Question: What is Default deny all egress traffic?

Answer: Y o u   c a n   c r e a t e   a   " d e f a u l t "   e g r e s s   i s o l a t i o n   p o l i c y   f o r   a   n a m e s p a c e   b y   c r e a t i n g   a   N e t w o r k P o l i c y   t h a t   s e l e c t s   a l l   p o d s   b u t   d o e s   n o t   a l l o w   a n y   e g r e s s   t r a f f i c   f r o m   t h o s e   p o d s .   - - -   a p i V e r s i o n :   n e t w o r k i n g . k 8 s . i o / v 1   k i n d :   N e t w o r k P o l i c y   m e t a d a t a :   n a m e :   d e f a u l t - d e n y - e g r e s s   s p e c :   p o d S e l e c t o r :   { }   p o l i c y T y p e s :   -   E g r e s s   T h i s   e n s u r e s   t h a t   e v e n   p o d s   t h a t   a r e n ' t   s e l e c t e d   b y   a n y   o t h e r   N e t w o r k P o l i c y   w i l l   n o t   b e   a l l o w e d   e g r e s s   t r a f f i c .   T h i s   p o l i c y   d o e s   n o t   c h a n g e   t h e   i n g r e s s   i s o l a t i o n   b e h a v i o r   o f   a n y   p o d .


Question: What is Allow all egress traffic?

Answer: I f   y o u   w a n t   t o   a l l o w   a l l   c o n n e c t i o n s   f r o m   a l l   p o d s   i n   a   n a m e s p a c e ,   y o u   c a n   c r e a t e   a   p o l i c y   t h a t   e x p l i c i t l y   a l l o w s   a l l   o u t g o i n g   c o n n e c t i o n s   f r o m   p o d s   i n   t h a t   n a m e s p a c e .   - - -   a p i V e r s i o n :   n e t w o r k i n g . k 8 s . i o / v 1   k i n d :   N e t w o r k P o l i c y   m e t a d a t a :   n a m e :   a l l o w - a l l - e g r e s s   s p e c :   p o d S e l e c t o r :   { }   e g r e s s :   -   { }   p o l i c y T y p e s :   -   E g r e s s   W i t h   t h i s   p o l i c y   i n   p l a c e ,   n o   a d d i t i o n a l   p o l i c y   o r   p o l i c i e s   c a n   c a u s e   a n y   o u t g o i n g   c o n n e c t i o n   f r o m   t h o s e   p o d s   t o   b e   d e n i e d .   T h i s   p o l i c y   h a s   n o   e f f e c t   o n   i s o l a t i o n   f o r   i n g r e s s   t o   a n y   p o d .


Question: What is Default deny all ingress and all egress traffic?

Answer: Y o u   c a n   c r e a t e   a   " d e f a u l t "   p o l i c y   f o r   a   n a m e s p a c e   w h i c h   p r e v e n t s   a l l   i n g r e s s   A N D   e g r e s s   t r a f f i c   b y   c r e a t i n g   t h e   f o l l o w i n g   N e t w o r k P o l i c y   i n   t h a t   n a m e s p a c e .   - - -   a p i V e r s i o n :   n e t w o r k i n g . k 8 s . i o / v 1   k i n d :   N e t w o r k P o l i c y   m e t a d a t a :   n a m e :   d e f a u l t - d e n y - a l l   s p e c :   p o d S e l e c t o r :   { }   p o l i c y T y p e s :   -   I n g r e s s   -   E g r e s s   T h i s   e n s u r e s   t h a t   e v e n   p o d s   t h a t   a r e n ' t   s e l e c t e d   b y   a n y   o t h e r   N e t w o r k P o l i c y   w i l l   n o t   b e   a l l o w e d   i n g r e s s   o r   e g r e s s   t r a f f i c .


Question: What is Network traffic filtering?

Answer: N e t w o r k P o l i c y   i s   d e f i n e d   f o r   l a y e r   4   c o n n e c t i o n s   ( T C P ,   U D P ,   a n d   o p t i o n a l l y   S C T P ) .   F o r   a l l   t h e   o t h e r   p r o t o c o l s ,   t h e   b e h a v i o u r   m a y   v a r y   a c r o s s   n e t w o r k   p l u g i n s .


Question: What is Note:?

Answer: W h e n   a   d e n y   a l l   n e t w o r k   p o l i c y   i s   d e f i n e d ,   i t   i s   o n l y   g u a r a n t e e d   t o   d e n y   T C P ,   U D P   a n d   S C T P   c o n n e c t i o n s .   F o r   o t h e r   p r o t o c o l s ,   s u c h   a s   A R P   o r   I C M P ,   t h e   b e h a v i o u r   i s   u n d e f i n e d .   T h e   s a m e   a p p l i e s   t o   a l l o w   r u l e s :   w h e n   a   s p e c i f i c   p o d   i s   a l l o w e d   a s   i n g r e s s   s o u r c e   o r   e g r e s s   d e s t i n a t i o n ,   i t   i s   u n d e f i n e d   w h a t   h a p p e n s   w i t h   ( f o r   e x a m p l e )   I C M P   p a c k e t s .   P r o t o c o l s   s u c h   a s   I C M P   m a y   b e   a l l o w e d   b y   s o m e   n e t w o r k   p l u g i n s   a n d   d e n i e d   b y   o t h e r s .


Question: What is Targeting a range of ports?

Answer: W h e n   w r i t i n g   a   N e t w o r k P o l i c y ,   y o u   c a n   t a r g e t   a   r a n g e   o f   p o r t s   i n s t e a d   o f   a   s i n g l e   p o r t .   T h i s   i s   a c h i e v a b l e   w i t h   t h e   u s a g e   o f   t h e   e n d P o r t   f i e l d ,   a s   t h e   f o l l o w i n g   e x a m p l e :   a p i V e r s i o n :   n e t w o r k i n g . k 8 s . i o / v 1   k i n d :   N e t w o r k P o l i c y   m e t a d a t a :   n a m e :   m u l t i - p o r t - e g r e s s   n a m e s p a c e :   d e f a u l t   s p e c :   p o d S e l e c t o r :   m a t c h L a b e l s :   r o l e :   d b   p o l i c y T y p e s :   -   E g r e s s   e g r e s s :   -   t o :   -   i p B l o c k :   c i d r :   1 0 . 0 . 0 . 0 / 2 4   p o r t s :   -   p r o t o c o l :   T C P   p o r t :   3 2 0 0 0   e n d P o r t :   3 2 7 6 8   T h e   a b o v e   r u l e   a l l o w s   a n y   P o d   w i t h   l a b e l   r o l e = d b   o n   t h e   n a m e s p a c e   d e f a u l t   t o   c o m m u n i c a t e   w i t h   a n y   I P   w i t h i n   t h e   r a n g e   1 0 . 0 . 0 . 0 / 2 4   o v e r   T C P ,   p r o v i d e d   t h a t   t h e   t a r g e t   p o r t   i s   b e t w e e n   t h e   r a n g e   3 2 0 0 0   a n d   3 2 7 6 8 .   T h e   f o l l o w i n g   r e s t r i c t i o n s   a p p l y   w h e n   u s i n g   t h i s   f i e l d :   T h e   e n d P o r t   f i e l d   m u s t   b e   e q u a l   t o   o r   g r e a t e r   t h a n   t h e   p o r t   f i e l d . e n d P o r t   c a n   o n l y   b e   d e f i n e d   i f   p o r t   i s   a l s o   d e f i n e d . B o t h   p o r t s   m u s t   b e   n u m e r i c .


Question: What is Targeting multiple namespaces by label?

Answer: I n   t h i s   s c e n a r i o ,   y o u r   E g r e s s   N e t w o r k P o l i c y   t a r g e t s   m o r e   t h a n   o n e   n a m e s p a c e   u s i n g   t h e i r   l a b e l   n a m e s .   F o r   t h i s   t o   w o r k ,   y o u   n e e d   t o   l a b e l   t h e   t a r g e t   n a m e s p a c e s .   F o r   e x a m p l e :   k u b e c t l   l a b e l   n a m e s p a c e   f r o n t e n d   n a m e s p a c e = f r o n t e n d   k u b e c t l   l a b e l   n a m e s p a c e   b a c k e n d   n a m e s p a c e = b a c k e n d   A d d   t h e   l a b e l s   u n d e r   n a m e s p a c e S e l e c t o r   i n   y o u r   N e t w o r k P o l i c y   d o c u m e n t .   F o r   e x a m p l e :   a p i V e r s i o n :   n e t w o r k i n g . k 8 s . i o / v 1   k i n d :   N e t w o r k P o l i c y   m e t a d a t a :   n a m e :   e g r e s s - n a m e s p a c e s   s p e c :   p o d S e l e c t o r :   m a t c h L a b e l s :   a p p :   m y a p p   p o l i c y T y p e s :   -   E g r e s s   e g r e s s :   -   t o :   -   n a m e s p a c e S e l e c t o r :   m a t c h E x p r e s s i o n s :   -   k e y :   n a m e s p a c e   o p e r a t o r :   I n   v a l u e s :   [ " f r o n t e n d " ,   " b a c k e n d " ]


Question: What is Targeting a Namespace by its name?

Answer: T h e   K u b e r n e t e s   c o n t r o l   p l a n e   s e t s   a n   i m m u t a b l e   l a b e l   k u b e r n e t e s . i o / m e t a d a t a . n a m e   o n   a l l   n a m e s p a c e s ,   t h e   v a l u e   o f   t h e   l a b e l   i s   t h e   n a m e s p a c e   n a m e .   W h i l e   N e t w o r k P o l i c y   c a n n o t   t a r g e t   a   n a m e s p a c e   b y   i t s   n a m e   w i t h   s o m e   o b j e c t   f i e l d ,   y o u   c a n   u s e   t h e   s t a n d a r d i z e d   l a b e l   t o   t a r g e t   a   s p e c i f i c   n a m e s p a c e .


Question: What is Note:?

Answer: W h e n   a   n e w   N e t w o r k P o l i c y   o b j e c t   i s   c r e a t e d ,   i t   m a y   t a k e   s o m e   t i m e   f o r   a   n e t w o r k   p l u g i n   t o   h a n d l e   t h e   n e w   o b j e c t .   I f   a   p o d   t h a t   i s   a f f e c t e d   b y   a   N e t w o r k P o l i c y   i s   c r e a t e d   b e f o r e   t h e   n e t w o r k   p l u g i n   h a s   c o m p l e t e d   N e t w o r k P o l i c y   h a n d l i n g ,   t h a t   p o d   m a y   b e   s t a r t e d   u n p r o t e c t e d ,   a n d   i s o l a t i o n   r u l e s   w i l l   b e   a p p l i e d   w h e n   t h e   N e t w o r k P o l i c y   h a n d l i n g   i s   c o m p l e t e d .   O n c e   t h e   N e t w o r k P o l i c y   i s   h a n d l e d   b y   a   n e t w o r k   p l u g i n ,   A l l   n e w l y   c r e a t e d   p o d s   a f f e c t e d   b y   a   g i v e n   N e t w o r k P o l i c y   w i l l   b e   i s o l a t e d   b e f o r e   t h e y   a r e   s t a r t e d .   I m p l e m e n t a t i o n s   o f   N e t w o r k P o l i c y   m u s t   e n s u r e   t h a t   f i l t e r i n g   i s   e f f e c t i v e   t h r o u g h o u t   t h e   P o d   l i f e c y c l e ,   e v e n   f r o m   t h e   v e r y   f i r s t   i n s t a n t   t h a t   a n y   c o n t a i n e r   i n   t h a t   P o d   i s   s t a r t e d .   B e c a u s e   t h e y   a r e   a p p l i e d   a t   P o d   l e v e l ,   N e t w o r k P o l i c i e s   a p p l y   e q u a l l y   t o   i n i t   c o n t a i n e r s ,   s i d e c a r   c o n t a i n e r s ,   a n d   r e g u l a r   c o n t a i n e r s . A l l o w   r u l e s   w i l l   b e   a p p l i e d   e v e n t u a l l y   a f t e r   t h e   i s o l a t i o n   r u l e s   ( o r   m a y   b e   a p p l i e d   a t   t h e   s a m e   t i m e ) .   I n   t h e   w o r s t   c a s e ,   a   n e w l y   c r e a t e d   p o d   m a y   h a v e   n o   n e t w o r k   c o n n e c t i v i t y   a t   a l l   w


Question: What is NetworkPolicy and hostNetwork pods?

Answer: N e t w o r k P o l i c y   b e h a v i o u r   f o r   h o s t N e t w o r k   p o d s   i s   u n d e f i n e d ,   b u t   i t   s h o u l d   b e   l i m i t e d   t o   2   p o s s i b i l i t i e s :   T h e   n e t w o r k   p l u g i n   c a n   d i s t i n g u i s h   h o s t N e t w o r k   p o d   t r a f f i c   f r o m   a l l   o t h e r   t r a f f i c   ( i n c l u d i n g   b e i n g   a b l e   t o   d i s t i n g u i s h   t r a f f i c   f r o m   d i f f e r e n t   h o s t N e t w o r k   p o d s   o n   t h e   s a m e   n o d e ) ,   a n d   w i l l   a p p l y   N e t w o r k P o l i c y   t o   h o s t N e t w o r k   p o d s   j u s t   l i k e   i t   d o e s   t o   p o d - n e t w o r k   p o d s . T h e   n e t w o r k   p l u g i n   c a n n o t   p r o p e r l y   d i s t i n g u i s h   h o s t N e t w o r k   p o d   t r a f f i c ,   a n d   s o   i t   i g n o r e s   h o s t N e t w o r k   p o d s   w h e n   m a t c h i n g   p o d S e l e c t o r   a n d   n a m e s p a c e S e l e c t o r .   T r a f f i c   t o / f r o m   h o s t N e t w o r k   p o d s   i s   t r e a t e d   t h e   s a m e   a s   a l l   o t h e r   t r a f f i c   t o / f r o m   t h e   n o d e   I P .   ( T h i s   i s   t h e   m o s t   c o m m o n   i m p l e m e n t a t i o n . )   T h i s   a p p l i e s   w h e n   a   h o s t N e t w o r k   p o d   i s   s e l e c t e d   b y   s p e c . p o d S e l e c t o r .   . . .   s p e c :   p o d S e l e c t o r :   m a t c h L a b e l s :   r o l e :   c l i e n t   . . .   a   h o s t N e t w o r k   p o d   i s   s e l e c t e d   b y   a   p o d S e l e c t o r   o r   n a m e s p a c e S e l e c t o r   i n   a n   i n g r e s s   o r   e g r e s s   r u l e .   . . .   i n g r e s s :   -   f r o m :   -   p o d S e l e c t o r :   m a t c h L a b e l s :   r o l e :   c l i e n t   . . .   a   h o s t N e t w o r k   p o d   i s   s e l e c t e d   b y   s p e c . p o d S e l e c t o r .   .


Question: What is What you can't do with network policies (at least, not yet)?

Answer: A s   o f   K u b e r n e t e s   1 . 3 4 ,   t h e   f o l l o w i n g   f u n c t i o n a l i t y   d o e s   n o t   e x i s t   i n   t h e   N e t w o r k P o l i c y   A P I ,   b u t   y o u   m i g h t   b e   a b l e   t o   i m p l e m e n t   w o r k a r o u n d s   u s i n g   O p e r a t i n g   S y s t e m   c o m p o n e n t s   ( s u c h   a s   S E L i n u x ,   O p e n V S w i t c h ,   I P T a b l e s ,   a n d   s o   o n )   o r   L a y e r   7   t e c h n o l o g i e s   ( I n g r e s s   c o n t r o l l e r s ,   S e r v i c e   M e s h   i m p l e m e n t a t i o n s )   o r   a d m i s s i o n   c o n t r o l l e r s .   I n   c a s e   y o u   a r e   n e w   t o   n e t w o r k   s e c u r i t y   i n   K u b e r n e t e s ,   i t s   w o r t h   n o t i n g   t h a t   t h e   f o l l o w i n g   U s e r   S t o r i e s   c a n n o t   ( y e t )   b e   i m p l e m e n t e d   u s i n g   t h e   N e t w o r k P o l i c y   A P I .   F o r c i n g   i n t e r n a l   c l u s t e r   t r a f f i c   t o   g o   t h r o u g h   a   c o m m o n   g a t e w a y   ( t h i s   m i g h t   b e   b e s t   s e r v e d   w i t h   a   s e r v i c e   m e s h   o r   o t h e r   p r o x y ) . A n y t h i n g   T L S   r e l a t e d   ( u s e   a   s e r v i c e   m e s h   o r   i n g r e s s   c o n t r o l l e r   f o r   t h i s ) . N o d e   s p e c i f i c   p o l i c i e s   ( y o u   c a n   u s e   C I D R   n o t a t i o n   f o r   t h e s e ,   b u t   y o u   c a n n o t   t a r g e t   n o d e s   b y   t h e i r   K u b e r n e t e s   i d e n t i t i e s   s p e c i f i c a l l y ) . T a r g e t i n g   o f   s e r v i c e s   b y   n a m e   ( y o u   c a n ,   h o w e v e r ,   t a r g e t   p o d s   o r   n a m e s p a c e s   b y   t h e i r   l a b e l s ,   w h i c h   i s   o f t e n   a   v i a b l e   w o r k a r o u n d ) . C r e a t i o n   o r   m a n a g e m e n t   o f   " P o l i c y   r e q u e s t s "   t h a t   a


Question: What is NetworkPolicy's impact on existing connections?

Answer: W h e n   t h e   s e t   o f   N e t w o r k P o l i c i e s   t h a t   a p p l i e s   t o   a n   e x i s t i n g   c o n n e c t i o n   c h a n g e s   -   t h i s   c o u l d   h a p p e n   e i t h e r   d u e   t o   a   c h a n g e   i n   N e t w o r k P o l i c i e s   o r   i f   t h e   r e l e v a n t   l a b e l s   o f   t h e   n a m e s p a c e s / p o d s   s e l e c t e d   b y   t h e   p o l i c y   ( b o t h   s u b j e c t   a n d   p e e r s )   a r e   c h a n g e d   i n   t h e   m i d d l e   o f   a n   e x i s t i n g   c o n n e c t i o n   -   i t   i s   i m p l e m e n t a t i o n   d e f i n e d   a s   t o   w h e t h e r   t h e   c h a n g e   w i l l   t a k e   e f f e c t   f o r   t h a t   e x i s t i n g   c o n n e c t i o n   o r   n o t .   E x a m p l e :   A   p o l i c y   i s   c r e a t e d   t h a t   l e a d s   t o   d e n y i n g   a   p r e v i o u s l y   a l l o w e d   c o n n e c t i o n ,   t h e   u n d e r l y i n g   n e t w o r k   p l u g i n   i m p l e m e n t a t i o n   i s   r e s p o n s i b l e   f o r   d e f i n i n g   i f   t h a t   n e w   p o l i c y   w i l l   c l o s e   t h e   e x i s t i n g   c o n n e c t i o n s   o r   n o t .   I t   i s   r e c o m m e n d e d   n o t   t o   m o d i f y   p o l i c i e s / p o d s / n a m e s p a c e s   i n   w a y s   t h a t   m i g h t   a f f e c t   e x i s t i n g   c o n n e c t i o n s .


Question: What is What's next?

Answer: S e e   t h e   D e c l a r e   N e t w o r k   P o l i c y   w a l k t h r o u g h   f o r   f u r t h e r   e x a m p l e s . S e e   m o r e   r e c i p e s   f o r   c o m m o n   s c e n a r i o s   e n a b l e d   b y   t h e   N e t w o r k P o l i c y   r e s o u r c e .


Question: What is Using Node Authorization?

Answer: Using Node AuthorizationNode authorization is a special-purpose authorization mode that specifically authorizes API requests made by kubelets.OverviewThe Node authorizer allows a kubelet to perform API operations. This includes:Read operations:servicesendpointsnodespodssecrets, configmaps, persistent volume claims and persistent volumes related to pods bound to the kubelet's nodeFEATURE STATE: Kubernetes v1.34 [stable] (enabled by default: true)Kubelets are limited to reading their own Node objects, and only reading pods bound to their node.Write operations:nodes and node status (enable the NodeRestriction admission plugin to limit a kubelet to modify its own node)pods and pod status (enable the NodeRestriction admission plugin to limit a kubelet to modify pods bound to itself)eventsAuth-related operations:read/write access to the CertificateSigningRequests API for TLS bootstrappingthe ability to create TokenReviews and SubjectAccessReviews for delegated authentication/authorization checksIn future releases, the node authorizer may add or remove permissions to ensure kubelets have the minimal set of permissions required to operate correctly.In order to be authorized by the Node authorizer, kubelets must use a credential that identifies them as being in the system:nodes group, with a username of system:node:<nodeName>. This group and user name format match the identity created for each kubelet as part of kubelet TLS bootstrapping.The value of <nodeName> must match precisely the name of the node as registered by the kubelet. By default, this is the host name as provided by hostname, or overridden via the kubelet option --hostname-override. However, when using the --cloud-provider kubelet option, the specific hostname may be determined by the cloud provider, ignoring the local hostname and the --hostname-override option. For specifics about how the kubelet determines the hostname, see the kubelet options reference.To enable the Node authorizer, start the API server with the --authorization-config flag set to a file that includes the Node authorizer; for example:apiVersion: apiserver.config.k8s.io/v1 kind: AuthorizationConfiguration authorizers: ... - type: Node ... Or, start the API server with the --authorization-mode flag set to a comma-separated list that includes Node; for example:kube-apiserver --authorization-mode=...,Node --other-options --more-options To limit the API objects kubelets are able to write, enable the NodeRestriction admission plugin by starting the apiserver with --enable-admission-plugins=...,NodeRestriction,...Migration considerationsKubelets outside the system:nodes groupKubelets outside the system:nodes group would not be authorized by the Node authorization mode, and would need to continue to be authorized via whatever mechanism currently authorizes them. The node admission plugin would not restrict requests from these kubelets.Kubelets with undifferentiated usernamesIn some deployments, kubelets have credentials that plac


Question: How does Using Node Authorization work?

Answer: Using Node AuthorizationNode authorization is a special-purpose authorization mode that specifically authorizes API requests made by kubelets.OverviewThe Node authorizer allows a kubelet to perform API operations. This includes:Read operations:servicesendpointsnodespodssecrets, configmaps, persistent volume claims and persistent volumes related to pods bound to the kubelet's nodeFEATURE STATE: Kubernetes v1.34 [stable] (enabled by default: true)Kubelets are limited to reading their own Node objects, and only reading pods bound to their node.Write operations:nodes and node status (enable the NodeRestriction admission plugin to limit a kubelet to modify its own node)pods and pod status (enable the NodeRestriction admission plugin to limit a kubelet to modify pods bound to itself)eventsAuth-related operations:read/write access to the CertificateSigningRequests API for TLS bootstrappingthe ability to create TokenReviews and SubjectAccessReviews for delegated authentication/authorization checksIn future releases, the node authorizer may add or remove permissions to ensure kubelets have the minimal set of permissions required to operate correctly.In order to be authorized by the Node authorizer, kubelets must use a credential that identifies them as being in the system:nodes group, with a username of system:node:<nodeName>. This group and user name format match the identity created for each kubelet as part of kubelet TLS bootstrapping.The value of <nodeName> must match precisely the name of the node as registered by the kubelet. By default, this is the host name as provided by hostname, or overridden via the kubelet option --hostname-override. However, when using the --cloud-provider kubelet option, the specific hostname may be determined by the cloud provider, ignoring the local hostname and the --hostname-override option. For specifics about how the kubelet determines the hostname, see the kubelet options reference.To enable the Node authorizer, start the API server with the --authorization-config flag set to a file that includes the Node authorizer; for example:apiVersion: apiserver.config.k8s.io/v1 kind: AuthorizationConfiguration authorizers: ... - type: Node ... Or, start the API server with the --authorization-mode flag set to a comma-separated list that includes Node; for example:kube-apiserver --authorization-mode=...,Node --other-options --more-options To limit the API objects kubelets are able to write, enable the NodeRestriction admission plugin by starting the apiserver with --enable-admission-plugins=...,NodeRestriction,...Migration considerationsKubelets outside the system:nodes groupKubelets outside the system:nodes group would not be authorized by the Node authorization mode, and would need to continue to be authorized via whatever mechanism currently authorizes them. The node admission plugin would not restrict requests from these kubelets.Kubelets with undifferentiated usernamesIn some deployments, kubelets have credentials that plac


Question: When would you use Using Node Authorization?

Answer: Using Node AuthorizationNode authorization is a special-purpose authorization mode that specifically authorizes API requests made by kubelets.OverviewThe Node authorizer allows a kubelet to perform API operations. This includes:Read operations:servicesendpointsnodespodssecrets, configmaps, persistent volume claims and persistent volumes related to pods bound to the kubelet's nodeFEATURE STATE: Kubernetes v1.34 [stable] (enabled by default: true)Kubelets are limited to reading their own Node objects, and only reading pods bound to their node.Write operations:nodes and node status (enable the NodeRestriction admission plugin to limit a kubelet to modify its own node)pods and pod status (enable the NodeRestriction admission plugin to limit a kubelet to modify pods bound to itself)eventsAuth-related operations:read/write access to the CertificateSigningRequests API for TLS bootstrappingthe ability to create TokenReviews and SubjectAccessReviews for delegated authentication/authorization checksIn future releases, the node authorizer may add or remove permissions to ensure kubelets have the minimal set of permissions required to operate correctly.In order to be authorized by the Node authorizer, kubelets must use a credential that identifies them as being in the system:nodes group, with a username of system:node:<nodeName>. This group and user name format match the identity created for each kubelet as part of kubelet TLS bootstrapping.The value of <nodeName> must match precisely the name of the node as registered by the kubelet. By default, this is the host name as provided by hostname, or overridden via the kubelet option --hostname-override. However, when using the --cloud-provider kubelet option, the specific hostname may be determined by the cloud provider, ignoring the local hostname and the --hostname-override option. For specifics about how the kubelet determines the hostname, see the kubelet options reference.To enable the Node authorizer, start the API server with the --authorization-config flag set to a file that includes the Node authorizer; for example:apiVersion: apiserver.config.k8s.io/v1 kind: AuthorizationConfiguration authorizers: ... - type: Node ... Or, start the API server with the --authorization-mode flag set to a comma-separated list that includes Node; for example:kube-apiserver --authorization-mode=...,Node --other-options --more-options To limit the API objects kubelets are able to write, enable the NodeRestriction admission plugin by starting the apiserver with --enable-admission-plugins=...,NodeRestriction,...Migration considerationsKubelets outside the system:nodes groupKubelets outside the system:nodes group would not be authorized by the Node authorization mode, and would need to continue to be authorized via whatever mechanism currently authorizes them. The node admission plugin would not restrict requests from these kubelets.Kubelets with undifferentiated usernamesIn some deployments, kubelets have credentials that plac


Question: What are the benefits of Using Node Authorization?

Answer: Using Node AuthorizationNode authorization is a special-purpose authorization mode that specifically authorizes API requests made by kubelets.OverviewThe Node authorizer allows a kubelet to perform API operations. This includes:Read operations:servicesendpointsnodespodssecrets, configmaps, persistent volume claims and persistent volumes related to pods bound to the kubelet's nodeFEATURE STATE: Kubernetes v1.34 [stable] (enabled by default: true)Kubelets are limited to reading their own Node objects, and only reading pods bound to their node.Write operations:nodes and node status (enable the NodeRestriction admission plugin to limit a kubelet to modify its own node)pods and pod status (enable the NodeRestriction admission plugin to limit a kubelet to modify pods bound to itself)eventsAuth-related operations:read/write access to the CertificateSigningRequests API for TLS bootstrappingthe ability to create TokenReviews and SubjectAccessReviews for delegated authentication/authorization checksIn future releases, the node authorizer may add or remove permissions to ensure kubelets have the minimal set of permissions required to operate correctly.In order to be authorized by the Node authorizer, kubelets must use a credential that identifies them as being in the system:nodes group, with a username of system:node:<nodeName>. This group and user name format match the identity created for each kubelet as part of kubelet TLS bootstrapping.The value of <nodeName> must match precisely the name of the node as registered by the kubelet. By default, this is the host name as provided by hostname, or overridden via the kubelet option --hostname-override. However, when using the --cloud-provider kubelet option, the specific hostname may be determined by the cloud provider, ignoring the local hostname and the --hostname-override option. For specifics about how the kubelet determines the hostname, see the kubelet options reference.To enable the Node authorizer, start the API server with the --authorization-config flag set to a file that includes the Node authorizer; for example:apiVersion: apiserver.config.k8s.io/v1 kind: AuthorizationConfiguration authorizers: ... - type: Node ... Or, start the API server with the --authorization-mode flag set to a comma-separated list that includes Node; for example:kube-apiserver --authorization-mode=...,Node --other-options --more-options To limit the API objects kubelets are able to write, enable the NodeRestriction admission plugin by starting the apiserver with --enable-admission-plugins=...,NodeRestriction,...Migration considerationsKubelets outside the system:nodes groupKubelets outside the system:nodes group would not be authorized by the Node authorization mode, and would need to continue to be authorized via whatever mechanism currently authorizes them. The node admission plugin would not restrict requests from these kubelets.Kubelets with undifferentiated usernamesIn some deployments, kubelets have credentials that plac


Question: What is Using Node Authorization?

Answer: N o d e   a u t h o r i z a t i o n   i s   a   s p e c i a l - p u r p o s e   a u t h o r i z a t i o n   m o d e   t h a t   s p e c i f i c a l l y   a u t h o r i z e s   A P I   r e q u e s t s   m a d e   b y   k u b e l e t s .


Question: What is Overview?

Answer: T h e   N o d e   a u t h o r i z e r   a l l o w s   a   k u b e l e t   t o   p e r f o r m   A P I   o p e r a t i o n s .   T h i s   i n c l u d e s :   R e a d   o p e r a t i o n s :   s e r v i c e s e n d p o i n t s n o d e s p o d s s e c r e t s ,   c o n f i g m a p s ,   p e r s i s t e n t   v o l u m e   c l a i m s   a n d   p e r s i s t e n t   v o l u m e s   r e l a t e d   t o   p o d s   b o u n d   t o   t h e   k u b e l e t ' s   n o d e   K u b e l e t s   a r e   l i m i t e d   t o   r e a d i n g   t h e i r   o w n   N o d e   o b j e c t s ,   a n d   o n l y   r e a d i n g   p o d s   b o u n d   t o   t h e i r   n o d e .   W r i t e   o p e r a t i o n s :   n o d e s   a n d   n o d e   s t a t u s   ( e n a b l e   t h e   N o d e R e s t r i c t i o n   a d m i s s i o n   p l u g i n   t o   l i m i t   a   k u b e l e t   t o   m o d i f y   i t s   o w n   n o d e ) p o d s   a n d   p o d   s t a t u s   ( e n a b l e   t h e   N o d e R e s t r i c t i o n   a d m i s s i o n   p l u g i n   t o   l i m i t   a   k u b e l e t   t o   m o d i f y   p o d s   b o u n d   t o   i t s e l f ) e v e n t s   A u t h - r e l a t e d   o p e r a t i o n s :   r e a d / w r i t e   a c c e s s   t o   t h e   C e r t i f i c a t e S i g n i n g R e q u e s t s   A P I   f o r   T L S   b o o t s t r a p p i n g t h e   a b i l i t y   t o   c r e a t e   T o k e n R e v i e w s   a n d   S u b j e c t A c c e s s R e v i e w s   f o r   d e l e g a t e d   a u t h e n t i c a t i o n / a u t h o r i z a t i o n   c h e c k s   I n   f u t u r e   r e l e a s e s ,   t h e   n o d e   a u t h o r i z e r   m a y   a d d   o r   r e m o v e   p e r m i s s i o n s   t o   e n s u r e   k u b e l e t s   h a v e   t h e   m i n i m a l   s e t   o f   p e r m i s s i o n s   r e q u i r e d   t o   o p e r a t e   c o r r e c t l y .   I n   o r d e r   t o   b e   a u t h o r i z e d   b y   t h e   N o d e   a u t h o r i z e r ,


Question: What is Kubelets outside the system:nodes group?

Answer: K u b e l e t s   o u t s i d e   t h e   s y s t e m : n o d e s   g r o u p   w o u l d   n o t   b e   a u t h o r i z e d   b y   t h e   N o d e   a u t h o r i z a t i o n   m o d e ,   a n d   w o u l d   n e e d   t o   c o n t i n u e   t o   b e   a u t h o r i z e d   v i a   w h a t e v e r   m e c h a n i s m   c u r r e n t l y   a u t h o r i z e s   t h e m .   T h e   n o d e   a d m i s s i o n   p l u g i n   w o u l d   n o t   r e s t r i c t   r e q u e s t s   f r o m   t h e s e   k u b e l e t s .


Question: What is Kubelets with undifferentiated usernames?

Answer: I n   s o m e   d e p l o y m e n t s ,   k u b e l e t s   h a v e   c r e d e n t i a l s   t h a t   p l a c e   t h e m   i n   t h e   s y s t e m : n o d e s   g r o u p ,   b u t   d o   n o t   i d e n t i f y   t h e   p a r t i c u l a r   n o d e   t h e y   a r e   a s s o c i a t e d   w i t h ,   b e c a u s e   t h e y   d o   n o t   h a v e   a   u s e r n a m e   i n   t h e   s y s t e m : n o d e : . . .   f o r m a t .   T h e s e   k u b e l e t s   w o u l d   n o t   b e   a u t h o r i z e d   b y   t h e   N o d e   a u t h o r i z a t i o n   m o d e ,   a n d   w o u l d   n e e d   t o   c o n t i n u e   t o   b e   a u t h o r i z e d   v i a   w h a t e v e r   m e c h a n i s m   c u r r e n t l y   a u t h o r i z e s   t h e m .   T h e   N o d e R e s t r i c t i o n   a d m i s s i o n   p l u g i n   w o u l d   i g n o r e   r e q u e s t s   f r o m   t h e s e   k u b e l e t s ,   s i n c e   t h e   d e f a u l t   n o d e   i d e n t i f i e r   i m p l e m e n t a t i o n   w o u l d   n o t   c o n s i d e r   t h a t   a   n o d e   i d e n t i t y .


Question: What is Generating Reference Documentation for the Kubernetes API?

Answer: Generating Reference Documentation for the Kubernetes APIThis page shows how to update the Kubernetes API reference documentation.The Kubernetes API reference documentation is built from the Kubernetes OpenAPI spec using the kubernetes-sigs/reference-docs generation code.If you find bugs in the generated documentation, you need to fix them upstream.If you need only to regenerate the reference documentation from the OpenAPI spec, continue reading this page.Before you beginRequirements:You need a machine that is running Linux or macOS.You need to have these tools installed:Python v3.7.x+GitGolang version 1.13+Pip used to install PyYAMLPyYAML v5.1.2makegcc compiler/linkerDocker (Required only for kubectl command reference)Your PATH environment variable must include the required build tools, such as the Go binary and python.You need to know how to create a pull request to a GitHub repository. This involves creating your own fork of the repository. For more information, see Work from a local clone.Set up the local repositoriesCreate a local workspace and set your GOPATH:mkdir -p $HOME/<workspace> export GOPATH=$HOME/<workspace> Get a local clone of the following repositories:go get -u github.com/kubernetes-sigs/reference-docs go get -u github.com/go-openapi/loads go get -u github.com/go-openapi/spec If you don't already have the kubernetes/website repository, get it now:git clone https://github.com/<your-username>/website $GOPATH/src/github.com/<your-username>/website Get a clone of the kubernetes/kubernetes repository as k8s.io/kubernetes:git clone https://github.com/kubernetes/kubernetes $GOPATH/src/k8s.io/kubernetes The base directory of your clone of the kubernetes/kubernetes repository is $GOPATH/src/k8s.io/kubernetes. The remaining steps refer to your base directory as <k8s-base>.The base directory of your clone of the kubernetes/website repository is $GOPATH/src/github.com/<your username>/website. The remaining steps refer to your base directory as <web-base>.The base directory of your clone of the kubernetes-sigs/reference-docs repository is $GOPATH/src/github.com/kubernetes-sigs/reference-docs. The remaining steps refer to your base directory as <rdocs-base>.Generate the API reference docsThis section shows how to generate the published Kubernetes API reference documentation.Set build variablesSet K8S_ROOT to <k8s-base>.Set K8S_WEBROOT to <web-base>.Set K8S_RELEASE to the version of the docs you want to build. For example, if you want to build docs for Kubernetes 1.17.0, set K8S_RELEASE to 1.17.0.For example:export K8S_WEBROOT=${GOPATH}/src/github.com/<your-username>/website export K8S_ROOT=${GOPATH}/src/k8s.io/kubernetes export K8S_RELEASE=1.17.0 Create versioned directory and fetch Open API specThe updateapispec build target creates the versioned build directory. After the directory is created, the Open API spec is fetched from the <k8s-base> repository. These steps ensure that the version of the configuration files and Kubernetes Open API


Question: How does Generating Reference Documentation for the Kubernetes API work?

Answer: Generating Reference Documentation for the Kubernetes APIThis page shows how to update the Kubernetes API reference documentation.The Kubernetes API reference documentation is built from the Kubernetes OpenAPI spec using the kubernetes-sigs/reference-docs generation code.If you find bugs in the generated documentation, you need to fix them upstream.If you need only to regenerate the reference documentation from the OpenAPI spec, continue reading this page.Before you beginRequirements:You need a machine that is running Linux or macOS.You need to have these tools installed:Python v3.7.x+GitGolang version 1.13+Pip used to install PyYAMLPyYAML v5.1.2makegcc compiler/linkerDocker (Required only for kubectl command reference)Your PATH environment variable must include the required build tools, such as the Go binary and python.You need to know how to create a pull request to a GitHub repository. This involves creating your own fork of the repository. For more information, see Work from a local clone.Set up the local repositoriesCreate a local workspace and set your GOPATH:mkdir -p $HOME/<workspace> export GOPATH=$HOME/<workspace> Get a local clone of the following repositories:go get -u github.com/kubernetes-sigs/reference-docs go get -u github.com/go-openapi/loads go get -u github.com/go-openapi/spec If you don't already have the kubernetes/website repository, get it now:git clone https://github.com/<your-username>/website $GOPATH/src/github.com/<your-username>/website Get a clone of the kubernetes/kubernetes repository as k8s.io/kubernetes:git clone https://github.com/kubernetes/kubernetes $GOPATH/src/k8s.io/kubernetes The base directory of your clone of the kubernetes/kubernetes repository is $GOPATH/src/k8s.io/kubernetes. The remaining steps refer to your base directory as <k8s-base>.The base directory of your clone of the kubernetes/website repository is $GOPATH/src/github.com/<your username>/website. The remaining steps refer to your base directory as <web-base>.The base directory of your clone of the kubernetes-sigs/reference-docs repository is $GOPATH/src/github.com/kubernetes-sigs/reference-docs. The remaining steps refer to your base directory as <rdocs-base>.Generate the API reference docsThis section shows how to generate the published Kubernetes API reference documentation.Set build variablesSet K8S_ROOT to <k8s-base>.Set K8S_WEBROOT to <web-base>.Set K8S_RELEASE to the version of the docs you want to build. For example, if you want to build docs for Kubernetes 1.17.0, set K8S_RELEASE to 1.17.0.For example:export K8S_WEBROOT=${GOPATH}/src/github.com/<your-username>/website export K8S_ROOT=${GOPATH}/src/k8s.io/kubernetes export K8S_RELEASE=1.17.0 Create versioned directory and fetch Open API specThe updateapispec build target creates the versioned build directory. After the directory is created, the Open API spec is fetched from the <k8s-base> repository. These steps ensure that the version of the configuration files and Kubernetes Open API


Question: When would you use Generating Reference Documentation for the Kubernetes API?

Answer: Generating Reference Documentation for the Kubernetes APIThis page shows how to update the Kubernetes API reference documentation.The Kubernetes API reference documentation is built from the Kubernetes OpenAPI spec using the kubernetes-sigs/reference-docs generation code.If you find bugs in the generated documentation, you need to fix them upstream.If you need only to regenerate the reference documentation from the OpenAPI spec, continue reading this page.Before you beginRequirements:You need a machine that is running Linux or macOS.You need to have these tools installed:Python v3.7.x+GitGolang version 1.13+Pip used to install PyYAMLPyYAML v5.1.2makegcc compiler/linkerDocker (Required only for kubectl command reference)Your PATH environment variable must include the required build tools, such as the Go binary and python.You need to know how to create a pull request to a GitHub repository. This involves creating your own fork of the repository. For more information, see Work from a local clone.Set up the local repositoriesCreate a local workspace and set your GOPATH:mkdir -p $HOME/<workspace> export GOPATH=$HOME/<workspace> Get a local clone of the following repositories:go get -u github.com/kubernetes-sigs/reference-docs go get -u github.com/go-openapi/loads go get -u github.com/go-openapi/spec If you don't already have the kubernetes/website repository, get it now:git clone https://github.com/<your-username>/website $GOPATH/src/github.com/<your-username>/website Get a clone of the kubernetes/kubernetes repository as k8s.io/kubernetes:git clone https://github.com/kubernetes/kubernetes $GOPATH/src/k8s.io/kubernetes The base directory of your clone of the kubernetes/kubernetes repository is $GOPATH/src/k8s.io/kubernetes. The remaining steps refer to your base directory as <k8s-base>.The base directory of your clone of the kubernetes/website repository is $GOPATH/src/github.com/<your username>/website. The remaining steps refer to your base directory as <web-base>.The base directory of your clone of the kubernetes-sigs/reference-docs repository is $GOPATH/src/github.com/kubernetes-sigs/reference-docs. The remaining steps refer to your base directory as <rdocs-base>.Generate the API reference docsThis section shows how to generate the published Kubernetes API reference documentation.Set build variablesSet K8S_ROOT to <k8s-base>.Set K8S_WEBROOT to <web-base>.Set K8S_RELEASE to the version of the docs you want to build. For example, if you want to build docs for Kubernetes 1.17.0, set K8S_RELEASE to 1.17.0.For example:export K8S_WEBROOT=${GOPATH}/src/github.com/<your-username>/website export K8S_ROOT=${GOPATH}/src/k8s.io/kubernetes export K8S_RELEASE=1.17.0 Create versioned directory and fetch Open API specThe updateapispec build target creates the versioned build directory. After the directory is created, the Open API spec is fetched from the <k8s-base> repository. These steps ensure that the version of the configuration files and Kubernetes Open API


Question: What are the benefits of Generating Reference Documentation for the Kubernetes API?

Answer: Generating Reference Documentation for the Kubernetes APIThis page shows how to update the Kubernetes API reference documentation.The Kubernetes API reference documentation is built from the Kubernetes OpenAPI spec using the kubernetes-sigs/reference-docs generation code.If you find bugs in the generated documentation, you need to fix them upstream.If you need only to regenerate the reference documentation from the OpenAPI spec, continue reading this page.Before you beginRequirements:You need a machine that is running Linux or macOS.You need to have these tools installed:Python v3.7.x+GitGolang version 1.13+Pip used to install PyYAMLPyYAML v5.1.2makegcc compiler/linkerDocker (Required only for kubectl command reference)Your PATH environment variable must include the required build tools, such as the Go binary and python.You need to know how to create a pull request to a GitHub repository. This involves creating your own fork of the repository. For more information, see Work from a local clone.Set up the local repositoriesCreate a local workspace and set your GOPATH:mkdir -p $HOME/<workspace> export GOPATH=$HOME/<workspace> Get a local clone of the following repositories:go get -u github.com/kubernetes-sigs/reference-docs go get -u github.com/go-openapi/loads go get -u github.com/go-openapi/spec If you don't already have the kubernetes/website repository, get it now:git clone https://github.com/<your-username>/website $GOPATH/src/github.com/<your-username>/website Get a clone of the kubernetes/kubernetes repository as k8s.io/kubernetes:git clone https://github.com/kubernetes/kubernetes $GOPATH/src/k8s.io/kubernetes The base directory of your clone of the kubernetes/kubernetes repository is $GOPATH/src/k8s.io/kubernetes. The remaining steps refer to your base directory as <k8s-base>.The base directory of your clone of the kubernetes/website repository is $GOPATH/src/github.com/<your username>/website. The remaining steps refer to your base directory as <web-base>.The base directory of your clone of the kubernetes-sigs/reference-docs repository is $GOPATH/src/github.com/kubernetes-sigs/reference-docs. The remaining steps refer to your base directory as <rdocs-base>.Generate the API reference docsThis section shows how to generate the published Kubernetes API reference documentation.Set build variablesSet K8S_ROOT to <k8s-base>.Set K8S_WEBROOT to <web-base>.Set K8S_RELEASE to the version of the docs you want to build. For example, if you want to build docs for Kubernetes 1.17.0, set K8S_RELEASE to 1.17.0.For example:export K8S_WEBROOT=${GOPATH}/src/github.com/<your-username>/website export K8S_ROOT=${GOPATH}/src/k8s.io/kubernetes export K8S_RELEASE=1.17.0 Create versioned directory and fetch Open API specThe updateapispec build target creates the versioned build directory. After the directory is created, the Open API spec is fetched from the <k8s-base> repository. These steps ensure that the version of the configuration files and Kubernetes Open API


Question: What is Generating Reference Documentation for the Kubernetes API?

Answer: T h i s   p a g e   s h o w s   h o w   t o   u p d a t e   t h e   K u b e r n e t e s   A P I   r e f e r e n c e   d o c u m e n t a t i o n .   T h e   K u b e r n e t e s   A P I   r e f e r e n c e   d o c u m e n t a t i o n   i s   b u i l t   f r o m   t h e   K u b e r n e t e s   O p e n A P I   s p e c   u s i n g   t h e   k u b e r n e t e s - s i g s / r e f e r e n c e - d o c s   g e n e r a t i o n   c o d e .   I f   y o u   f i n d   b u g s   i n   t h e   g e n e r a t e d   d o c u m e n t a t i o n ,   y o u   n e e d   t o   f i x   t h e m   u p s t r e a m .   I f   y o u   n e e d   o n l y   t o   r e g e n e r a t e   t h e   r e f e r e n c e   d o c u m e n t a t i o n   f r o m   t h e   O p e n A P I   s p e c ,   c o n t i n u e   r e a d i n g   t h i s   p a g e .


Question: What is Requirements:?

Answer: Y o u   n e e d   a   m a c h i n e   t h a t   i s   r u n n i n g   L i n u x   o r   m a c O S . Y o u   n e e d   t o   h a v e   t h e s e   t o o l s   i n s t a l l e d : P y t h o n   v 3 . 7 . x + G i t G o l a n g   v e r s i o n   1 . 1 3 + P i p   u s e d   t o   i n s t a l l   P y Y A M L P y Y A M L   v 5 . 1 . 2 m a k e g c c   c o m p i l e r / l i n k e r D o c k e r   ( R e q u i r e d   o n l y   f o r   k u b e c t l   c o m m a n d   r e f e r e n c e ) Y o u r   P A T H   e n v i r o n m e n t   v a r i a b l e   m u s t   i n c l u d e   t h e   r e q u i r e d   b u i l d   t o o l s ,   s u c h   a s   t h e   G o   b i n a r y   a n d   p y t h o n . Y o u   n e e d   t o   k n o w   h o w   t o   c r e a t e   a   p u l l   r e q u e s t   t o   a   G i t H u b   r e p o s i t o r y .   T h i s   i n v o l v e s   c r e a t i n g   y o u r   o w n   f o r k   o f   t h e   r e p o s i t o r y .   F o r   m o r e   i n f o r m a t i o n ,   s e e   W o r k   f r o m   a   l o c a l   c l o n e .   Y o u   n e e d   a   m a c h i n e   t h a t   i s   r u n n i n g   L i n u x   o r   m a c O S .   Y o u   n e e d   t o   h a v e   t h e s e   t o o l s   i n s t a l l e d :   P y t h o n   v 3 . 7 . x + G i t G o l a n g   v e r s i o n   1 . 1 3 + P i p   u s e d   t o   i n s t a l l   P y Y A M L P y Y A M L   v 5 . 1 . 2 m a k e g c c   c o m p i l e r / l i n k e r D o c k e r   ( R e q u i r e d   o n l y   f o r   k u b e c t l   c o m m a n d   r e f e r e n c e )   Y o u r   P A T H   e n v i r o n m e n t   v a r i a b l e   m u s t   i n c l u d e   t h e   r e q u i r e d   b u i l d   t o o l s ,   s u c h   a s   t h e   G o   b i n a r y   a n d   p y t h o n .   Y o u   n e e d   t o   k n o w   h o w   t o   c r e a t e   a   p u l l   r e q u e s t   t o   a   G i t H u b   r e p o s i t o r y .   T h i s   i n v o l v e s   c r e a t i n g   y o u r   o w n   f o r k   o f   t h e   r e p o s i t o r y .   F o r   m o r


Question: What is Set up the local repositories?

Answer: C r e a t e   a   l o c a l   w o r k s p a c e   a n d   s e t   y o u r   G O P A T H :   m k d i r   - p   $ H O M E / < w o r k s p a c e >   e x p o r t   G O P A T H = $ H O M E / < w o r k s p a c e >   G e t   a   l o c a l   c l o n e   o f   t h e   f o l l o w i n g   r e p o s i t o r i e s :   g o   g e t   - u   g i t h u b . c o m / k u b e r n e t e s - s i g s / r e f e r e n c e - d o c s   g o   g e t   - u   g i t h u b . c o m / g o - o p e n a p i / l o a d s   g o   g e t   - u   g i t h u b . c o m / g o - o p e n a p i / s p e c   I f   y o u   d o n ' t   a l r e a d y   h a v e   t h e   k u b e r n e t e s / w e b s i t e   r e p o s i t o r y ,   g e t   i t   n o w :   g i t   c l o n e   h t t p s : / / g i t h u b . c o m / < y o u r - u s e r n a m e > / w e b s i t e   $ G O P A T H / s r c / g i t h u b . c o m / < y o u r - u s e r n a m e > / w e b s i t e   G e t   a   c l o n e   o f   t h e   k u b e r n e t e s / k u b e r n e t e s   r e p o s i t o r y   a s   k 8 s . i o / k u b e r n e t e s :   g i t   c l o n e   h t t p s : / / g i t h u b . c o m / k u b e r n e t e s / k u b e r n e t e s   $ G O P A T H / s r c / k 8 s . i o / k u b e r n e t e s   T h e   b a s e   d i r e c t o r y   o f   y o u r   c l o n e   o f   t h e   k u b e r n e t e s / k u b e r n e t e s   r e p o s i t o r y   i s   $ G O P A T H / s r c / k 8 s . i o / k u b e r n e t e s .   T h e   r e m a i n i n g   s t e p s   r e f e r   t o   y o u r   b a s e   d i r e c t o r y   a s   < k 8 s - b a s e > . T h e   b a s e   d i r e c t o r y   o f   y o u r   c l o n e   o f   t h e   k u b e r n e t e s / w e b s i t e   r e p o s i t o r y   i s   $ G O P A T H / s r c / g i t h u b . c o m / < y o u r   u s e r n a m e > / w e b s i t e .   T h e   r e m a i n i n g   s t e p s   r e f e r   t o   y o u r   b a s e   d i r e c t o r y   a s   < w e b - b a s e > . T h e   b a s e   d i r e c t o r y   o f   y o u r   c l o n e   o f   t


Question: What is Generate the API reference docs?

Answer: T h i s   s e c t i o n   s h o w s   h o w   t o   g e n e r a t e   t h e   p u b l i s h e d   K u b e r n e t e s   A P I   r e f e r e n c e   d o c u m e n t a t i o n .


Question: What is Set build variables?

Answer: S e t   K 8 S _ R O O T   t o   < k 8 s - b a s e > . S e t   K 8 S _ W E B R O O T   t o   < w e b - b a s e > . S e t   K 8 S _ R E L E A S E   t o   t h e   v e r s i o n   o f   t h e   d o c s   y o u   w a n t   t o   b u i l d .   F o r   e x a m p l e ,   i f   y o u   w a n t   t o   b u i l d   d o c s   f o r   K u b e r n e t e s   1 . 1 7 . 0 ,   s e t   K 8 S _ R E L E A S E   t o   1 . 1 7 . 0 .   F o r   e x a m p l e :   e x p o r t   K 8 S _ W E B R O O T = $ { G O P A T H } / s r c / g i t h u b . c o m / < y o u r - u s e r n a m e > / w e b s i t e   e x p o r t   K 8 S _ R O O T = $ { G O P A T H } / s r c / k 8 s . i o / k u b e r n e t e s   e x p o r t   K 8 S _ R E L E A S E = 1 . 1 7 . 0


Question: What is Create versioned directory and fetch Open API spec?

Answer: T h e   u p d a t e a p i s p e c   b u i l d   t a r g e t   c r e a t e s   t h e   v e r s i o n e d   b u i l d   d i r e c t o r y .   A f t e r   t h e   d i r e c t o r y   i s   c r e a t e d ,   t h e   O p e n   A P I   s p e c   i s   f e t c h e d   f r o m   t h e   < k 8 s - b a s e >   r e p o s i t o r y .   T h e s e   s t e p s   e n s u r e   t h a t   t h e   v e r s i o n   o f   t h e   c o n f i g u r a t i o n   f i l e s   a n d   K u b e r n e t e s   O p e n   A P I   s p e c   m a t c h   t h e   r e l e a s e   v e r s i o n .   T h e   v e r s i o n e d   d i r e c t o r y   n a m e   f o l l o w s   t h e   p a t t e r n   o f   v < m a j o r > _ < m i n o r > .   I n   t h e   < r d o c s - b a s e >   d i r e c t o r y ,   r u n   t h e   f o l l o w i n g   b u i l d   t a r g e t :   c d   < r d o c s - b a s e >   m a k e   u p d a t e a p i s p e c


Question: What is Build the API reference docs?

Answer: T h e   c o p y a p i   t a r g e t   b u i l d s   t h e   A P I   r e f e r e n c e   a n d   c o p i e s   t h e   g e n e r a t e d   f i l e s   t o   d i r e c t o r i e s   i n   < w e b - b a s e > .   R u n   t h e   f o l l o w i n g   c o m m a n d   i n   < r d o c s - b a s e > :   c d   < r d o c s - b a s e >   m a k e   c o p y a p i   V e r i f y   t h a t   t h e s e   t w o   f i l e s   h a v e   b e e n   g e n e r a t e d :   [   - e   " < r d o c s - b a s e > / g e n - a p i d o c s / b u i l d / i n d e x . h t m l "   ]   & &   e c h o   " i n d e x . h t m l   b u i l t "   | |   e c h o   " n o   i n d e x . h t m l "   [   - e   " < r d o c s - b a s e > / g e n - a p i d o c s / b u i l d / n a v D a t a . j s "   ]   & &   e c h o   " n a v D a t a . j s   b u i l t "   | |   e c h o   " n o   n a v D a t a . j s "   G o   t o   t h e   b a s e   o f   y o u r   l o c a l   < w e b - b a s e > ,   a n d   v i e w   w h i c h   f i l e s   h a v e   b e e n   m o d i f i e d :   c d   < w e b - b a s e >   g i t   s t a t u s   T h e   o u t p u t   i s   s i m i l a r   t o :   s t a t i c / d o c s / r e f e r e n c e / g e n e r a t e d / k u b e r n e t e s - a p i / v 1 . 3 4 / c s s / b o o t s t r a p . m i n . c s s   s t a t i c / d o c s / r e f e r e n c e / g e n e r a t e d / k u b e r n e t e s - a p i / v 1 . 3 4 / c s s / f o n t - a w e s o m e . m i n . c s s   s t a t i c / d o c s / r e f e r e n c e / g e n e r a t e d / k u b e r n e t e s - a p i / v 1 . 3 4 / c s s / s t y l e s h e e t . c s s   s t a t i c / d o c s / r e f e r e n c e / g e n e r a t e d / k u b e r n e t e s - a p i / v 1 . 3 4 / f o n t s / F o n t A w e s o m e . o t f   s t a t i c / d o c s / r e f e r e n c e / g e n e r a t e d / k u b e r n e t e s - a p i / v 1 . 3 4 / f o n t s / f o n t a w e s o m e - w e b f o n t . e o t   s t a t i c / d o c s / r e f e r e n c e / g e n e r a t e d / k u b e r n e t e s - a p i / v 1 . 3 4 / f


Question: What is Update the API reference index pages?

Answer: W h e n   g e n e r a t i n g   r e f e r e n c e   d o c u m e n t a t i o n   f o r   a   n e w   r e l e a s e ,   u p d a t e   t h e   f i l e ,   < w e b - b a s e > / c o n t e n t / e n / d o c s / r e f e r e n c e / k u b e r n e t e s - a p i / a p i - i n d e x . m d   w i t h   t h e   n e w   v e r s i o n   n u m b e r .   O p e n   < w e b - b a s e > / c o n t e n t / e n / d o c s / r e f e r e n c e / k u b e r n e t e s - a p i / a p i - i n d e x . m d   f o r   e d i t i n g ,   a n d   u p d a t e   t h e   A P I   r e f e r e n c e   v e r s i o n   n u m b e r .   F o r   e x a m p l e : - - -   t i t l e :   v 1 . 1 7   - - -   [ K u b e r n e t e s   A P I   v 1 . 1 7 ] ( / d o c s / r e f e r e n c e / g e n e r a t e d / k u b e r n e t e s - a p i / v 1 . 1 7 / )   O p e n   < w e b - b a s e > / c o n t e n t / e n / d o c s / r e f e r e n c e / _ i n d e x . m d   f o r   e d i t i n g ,   a n d   a d d   a   n e w   l i n k   f o r   t h e   l a t e s t   A P I   r e f e r e n c e .   R e m o v e   t h e   o l d e s t   A P I   r e f e r e n c e   v e r s i o n .   T h e r e   s h o u l d   b e   f i v e   l i n k s   t o   t h e   m o s t   r e c e n t   A P I   r e f e r e n c e s .   O p e n   < w e b - b a s e > / c o n t e n t / e n / d o c s / r e f e r e n c e / k u b e r n e t e s - a p i / a p i - i n d e x . m d   f o r   e d i t i n g ,   a n d   u p d a t e   t h e   A P I   r e f e r e n c e   v e r s i o n   n u m b e r .   F o r   e x a m p l e :   - - -   t i t l e :   v 1 . 1 7   - - -   [ K u b e r n e t e s   A P I   v 1 . 1 7 ] ( / d o c s / r e f e r e n c e / g e n e r a t e d / k u b e r n e t e s - a p i / v 1 . 1 7 / )   O p e n   < w e b - b a s e > / c o n t e n t / e n / d o c s / r e f e r e n c e / _ i n d e x . m d   f o r   e d i t i n g ,   a n d   a d d   a   n e w   l i n k   f o r   t h e   l a t e s t   A P I   r e f e r e n c e .   R e m o v e   t h e   o l d e s t   A P I   r e f e r e n c e


Question: What is Locally test the API reference?

Answer: P u b l i s h   a   l o c a l   v e r s i o n   o f   t h e   A P I   r e f e r e n c e .   V e r i f y   t h e   l o c a l   p r e v i e w .   c d   < w e b - b a s e >   g i t   s u b m o d u l e   u p d a t e   - - i n i t   - - r e c u r s i v e   - - d e p t h   1   #   i f   n o t   a l r e a d y   d o n e   m a k e   c o n t a i n e r - s e r v e


Question: What is Commit the changes?

Answer: I n   < w e b - b a s e > ,   r u n   g i t   a d d   a n d   g i t   c o m m i t   t o   c o m m i t   t h e   c h a n g e .   S u b m i t   y o u r   c h a n g e s   a s   a   p u l l   r e q u e s t   t o   t h e   k u b e r n e t e s / w e b s i t e   r e p o s i t o r y .   M o n i t o r   y o u r   p u l l   r e q u e s t ,   a n d   r e s p o n d   t o   r e v i e w e r   c o m m e n t s   a s   n e e d e d .   C o n t i n u e   t o   m o n i t o r   y o u r   p u l l   r e q u e s t   u n t i l   i t   h a s   b e e n   m e r g e d .


Question: What is What's next?

Answer: G e n e r a t i n g   R e f e r e n c e   D o c u m e n t a t i o n   Q u i c k s t a r t G e n e r a t i n g   R e f e r e n c e   D o c s   f o r   K u b e r n e t e s   C o m p o n e n t s   a n d   T o o l s G e n e r a t i n g   R e f e r e n c e   D o c u m e n t a t i o n   f o r   k u b e c t l   C o m m a n d s


Question: What is Protocols for Services?

Answer: Protocols for ServicesIf you configure a Service, you can select from any network protocol that Kubernetes supports.Kubernetes supports the following protocols with Services:SCTPTCP (the default)UDPWhen you define a Service, you can also specify the application protocol that it uses.This document details some special cases, all of them typically using TCP as a transport protocol:HTTP and HTTPSPROXY protocolTLS termination at the load balancerSupported protocolsThere are 3 valid values for the protocol of a port for a Service:SCTPFEATURE STATE: Kubernetes v1.20 [stable]When using a network plugin that supports SCTP traffic, you can use SCTP for most Services. For type: LoadBalancer Services, SCTP support depends on the cloud provider offering this facility. (Most do not).SCTP is not supported on nodes that run Windows.Support for multihomed SCTP associationsThe support of multihomed SCTP associations requires that the CNI plugin can support the assignment of multiple interfaces and IP addresses to a Pod.NAT for multihomed SCTP associations requires special logic in the corresponding kernel modules.TCPYou can use TCP for any kind of Service, and it's the default network protocol.UDPYou can use UDP for most Services. For type: LoadBalancer Services, UDP support depends on the cloud provider offering this facility.Special casesHTTPIf your cloud provider supports it, you can use a Service in LoadBalancer mode to configure a load balancer outside of your Kubernetes cluster, in a special mode where your cloud provider's load balancer implements HTTP / HTTPS reverse proxying, with traffic forwarded to the backend endpoints for that Service.Typically, you set the protocol for the Service to TCP and add an annotation (usually specific to your cloud provider) that configures the load balancer to handle traffic at the HTTP level. This configuration might also include serving HTTPS (HTTP over TLS) and reverse-proxying plain HTTP to your workload.Note:You can also use an Ingress to expose HTTP/HTTPS Services.You might additionally want to specify that the application protocol of the connection is http or https. Use http if the session from the load balancer to your workload is HTTP without TLS, and use https if the session from the load balancer to your workload uses TLS encryption.PROXY protocolIf your cloud provider supports it, you can use a Service set to type: LoadBalancer to configure a load balancer outside of Kubernetes itself, that will forward connections wrapped with the PROXY protocol.The load balancer then sends an initial series of octets describing the incoming connection, similar to this example (PROXY protocol v1):PROXY TCP4 192.0.2.202 10.0.42.7 12345 7\r\n The data after the proxy protocol preamble are the original data from the client. When either side closes the connection, the load balancer also triggers a connection close and sends any remaining data where feasible.Typically, you define a Service with the protocol to TCP. You also set an


Question: How does Protocols for Services work?

Answer: Protocols for ServicesIf you configure a Service, you can select from any network protocol that Kubernetes supports.Kubernetes supports the following protocols with Services:SCTPTCP (the default)UDPWhen you define a Service, you can also specify the application protocol that it uses.This document details some special cases, all of them typically using TCP as a transport protocol:HTTP and HTTPSPROXY protocolTLS termination at the load balancerSupported protocolsThere are 3 valid values for the protocol of a port for a Service:SCTPFEATURE STATE: Kubernetes v1.20 [stable]When using a network plugin that supports SCTP traffic, you can use SCTP for most Services. For type: LoadBalancer Services, SCTP support depends on the cloud provider offering this facility. (Most do not).SCTP is not supported on nodes that run Windows.Support for multihomed SCTP associationsThe support of multihomed SCTP associations requires that the CNI plugin can support the assignment of multiple interfaces and IP addresses to a Pod.NAT for multihomed SCTP associations requires special logic in the corresponding kernel modules.TCPYou can use TCP for any kind of Service, and it's the default network protocol.UDPYou can use UDP for most Services. For type: LoadBalancer Services, UDP support depends on the cloud provider offering this facility.Special casesHTTPIf your cloud provider supports it, you can use a Service in LoadBalancer mode to configure a load balancer outside of your Kubernetes cluster, in a special mode where your cloud provider's load balancer implements HTTP / HTTPS reverse proxying, with traffic forwarded to the backend endpoints for that Service.Typically, you set the protocol for the Service to TCP and add an annotation (usually specific to your cloud provider) that configures the load balancer to handle traffic at the HTTP level. This configuration might also include serving HTTPS (HTTP over TLS) and reverse-proxying plain HTTP to your workload.Note:You can also use an Ingress to expose HTTP/HTTPS Services.You might additionally want to specify that the application protocol of the connection is http or https. Use http if the session from the load balancer to your workload is HTTP without TLS, and use https if the session from the load balancer to your workload uses TLS encryption.PROXY protocolIf your cloud provider supports it, you can use a Service set to type: LoadBalancer to configure a load balancer outside of Kubernetes itself, that will forward connections wrapped with the PROXY protocol.The load balancer then sends an initial series of octets describing the incoming connection, similar to this example (PROXY protocol v1):PROXY TCP4 192.0.2.202 10.0.42.7 12345 7\r\n The data after the proxy protocol preamble are the original data from the client. When either side closes the connection, the load balancer also triggers a connection close and sends any remaining data where feasible.Typically, you define a Service with the protocol to TCP. You also set an


Question: When would you use Protocols for Services?

Answer: Protocols for ServicesIf you configure a Service, you can select from any network protocol that Kubernetes supports.Kubernetes supports the following protocols with Services:SCTPTCP (the default)UDPWhen you define a Service, you can also specify the application protocol that it uses.This document details some special cases, all of them typically using TCP as a transport protocol:HTTP and HTTPSPROXY protocolTLS termination at the load balancerSupported protocolsThere are 3 valid values for the protocol of a port for a Service:SCTPFEATURE STATE: Kubernetes v1.20 [stable]When using a network plugin that supports SCTP traffic, you can use SCTP for most Services. For type: LoadBalancer Services, SCTP support depends on the cloud provider offering this facility. (Most do not).SCTP is not supported on nodes that run Windows.Support for multihomed SCTP associationsThe support of multihomed SCTP associations requires that the CNI plugin can support the assignment of multiple interfaces and IP addresses to a Pod.NAT for multihomed SCTP associations requires special logic in the corresponding kernel modules.TCPYou can use TCP for any kind of Service, and it's the default network protocol.UDPYou can use UDP for most Services. For type: LoadBalancer Services, UDP support depends on the cloud provider offering this facility.Special casesHTTPIf your cloud provider supports it, you can use a Service in LoadBalancer mode to configure a load balancer outside of your Kubernetes cluster, in a special mode where your cloud provider's load balancer implements HTTP / HTTPS reverse proxying, with traffic forwarded to the backend endpoints for that Service.Typically, you set the protocol for the Service to TCP and add an annotation (usually specific to your cloud provider) that configures the load balancer to handle traffic at the HTTP level. This configuration might also include serving HTTPS (HTTP over TLS) and reverse-proxying plain HTTP to your workload.Note:You can also use an Ingress to expose HTTP/HTTPS Services.You might additionally want to specify that the application protocol of the connection is http or https. Use http if the session from the load balancer to your workload is HTTP without TLS, and use https if the session from the load balancer to your workload uses TLS encryption.PROXY protocolIf your cloud provider supports it, you can use a Service set to type: LoadBalancer to configure a load balancer outside of Kubernetes itself, that will forward connections wrapped with the PROXY protocol.The load balancer then sends an initial series of octets describing the incoming connection, similar to this example (PROXY protocol v1):PROXY TCP4 192.0.2.202 10.0.42.7 12345 7\r\n The data after the proxy protocol preamble are the original data from the client. When either side closes the connection, the load balancer also triggers a connection close and sends any remaining data where feasible.Typically, you define a Service with the protocol to TCP. You also set an


Question: What are the benefits of Protocols for Services?

Answer: Protocols for ServicesIf you configure a Service, you can select from any network protocol that Kubernetes supports.Kubernetes supports the following protocols with Services:SCTPTCP (the default)UDPWhen you define a Service, you can also specify the application protocol that it uses.This document details some special cases, all of them typically using TCP as a transport protocol:HTTP and HTTPSPROXY protocolTLS termination at the load balancerSupported protocolsThere are 3 valid values for the protocol of a port for a Service:SCTPFEATURE STATE: Kubernetes v1.20 [stable]When using a network plugin that supports SCTP traffic, you can use SCTP for most Services. For type: LoadBalancer Services, SCTP support depends on the cloud provider offering this facility. (Most do not).SCTP is not supported on nodes that run Windows.Support for multihomed SCTP associationsThe support of multihomed SCTP associations requires that the CNI plugin can support the assignment of multiple interfaces and IP addresses to a Pod.NAT for multihomed SCTP associations requires special logic in the corresponding kernel modules.TCPYou can use TCP for any kind of Service, and it's the default network protocol.UDPYou can use UDP for most Services. For type: LoadBalancer Services, UDP support depends on the cloud provider offering this facility.Special casesHTTPIf your cloud provider supports it, you can use a Service in LoadBalancer mode to configure a load balancer outside of your Kubernetes cluster, in a special mode where your cloud provider's load balancer implements HTTP / HTTPS reverse proxying, with traffic forwarded to the backend endpoints for that Service.Typically, you set the protocol for the Service to TCP and add an annotation (usually specific to your cloud provider) that configures the load balancer to handle traffic at the HTTP level. This configuration might also include serving HTTPS (HTTP over TLS) and reverse-proxying plain HTTP to your workload.Note:You can also use an Ingress to expose HTTP/HTTPS Services.You might additionally want to specify that the application protocol of the connection is http or https. Use http if the session from the load balancer to your workload is HTTP without TLS, and use https if the session from the load balancer to your workload uses TLS encryption.PROXY protocolIf your cloud provider supports it, you can use a Service set to type: LoadBalancer to configure a load balancer outside of Kubernetes itself, that will forward connections wrapped with the PROXY protocol.The load balancer then sends an initial series of octets describing the incoming connection, similar to this example (PROXY protocol v1):PROXY TCP4 192.0.2.202 10.0.42.7 12345 7\r\n The data after the proxy protocol preamble are the original data from the client. When either side closes the connection, the load balancer also triggers a connection close and sends any remaining data where feasible.Typically, you define a Service with the protocol to TCP. You also set an


Question: What is Protocols for Services?

Answer: I f   y o u   c o n f i g u r e   a   S e r v i c e ,   y o u   c a n   s e l e c t   f r o m   a n y   n e t w o r k   p r o t o c o l   t h a t   K u b e r n e t e s   s u p p o r t s .   K u b e r n e t e s   s u p p o r t s   t h e   f o l l o w i n g   p r o t o c o l s   w i t h   S e r v i c e s :   S C T P T C P   ( t h e   d e f a u l t ) U D P   W h e n   y o u   d e f i n e   a   S e r v i c e ,   y o u   c a n   a l s o   s p e c i f y   t h e   a p p l i c a t i o n   p r o t o c o l   t h a t   i t   u s e s .   T h i s   d o c u m e n t   d e t a i l s   s o m e   s p e c i a l   c a s e s ,   a l l   o f   t h e m   t y p i c a l l y   u s i n g   T C P   a s   a   t r a n s p o r t   p r o t o c o l :   H T T P   a n d   H T T P S P R O X Y   p r o t o c o l T L S   t e r m i n a t i o n   a t   t h e   l o a d   b a l a n c e r


Question: What is Supported protocols?

Answer: T h e r e   a r e   3   v a l i d   v a l u e s   f o r   t h e   p r o t o c o l   o f   a   p o r t   f o r   a   S e r v i c e :


Question: What is SCTP?

Answer: W h e n   u s i n g   a   n e t w o r k   p l u g i n   t h a t   s u p p o r t s   S C T P   t r a f f i c ,   y o u   c a n   u s e   S C T P   f o r   m o s t   S e r v i c e s .   F o r   t y p e :   L o a d B a l a n c e r   S e r v i c e s ,   S C T P   s u p p o r t   d e p e n d s   o n   t h e   c l o u d   p r o v i d e r   o f f e r i n g   t h i s   f a c i l i t y .   ( M o s t   d o   n o t ) .   S C T P   i s   n o t   s u p p o r t e d   o n   n o d e s   t h a t   r u n   W i n d o w s .


Question: What is Support for multihomed SCTP associations?

Answer: T h e   s u p p o r t   o f   m u l t i h o m e d   S C T P   a s s o c i a t i o n s   r e q u i r e s   t h a t   t h e   C N I   p l u g i n   c a n   s u p p o r t   t h e   a s s i g n m e n t   o f   m u l t i p l e   i n t e r f a c e s   a n d   I P   a d d r e s s e s   t o   a   P o d .   N A T   f o r   m u l t i h o m e d   S C T P   a s s o c i a t i o n s   r e q u i r e s   s p e c i a l   l o g i c   i n   t h e   c o r r e s p o n d i n g   k e r n e l   m o d u l e s .


Question: What is TCP?

Answer: Y o u   c a n   u s e   T C P   f o r   a n y   k i n d   o f   S e r v i c e ,   a n d   i t ' s   t h e   d e f a u l t   n e t w o r k   p r o t o c o l .


Question: What is UDP?

Answer: Y o u   c a n   u s e   U D P   f o r   m o s t   S e r v i c e s .   F o r   t y p e :   L o a d B a l a n c e r   S e r v i c e s ,   U D P   s u p p o r t   d e p e n d s   o n   t h e   c l o u d   p r o v i d e r   o f f e r i n g   t h i s   f a c i l i t y .


Question: What is HTTP?

Answer: I f   y o u r   c l o u d   p r o v i d e r   s u p p o r t s   i t ,   y o u   c a n   u s e   a   S e r v i c e   i n   L o a d B a l a n c e r   m o d e   t o   c o n f i g u r e   a   l o a d   b a l a n c e r   o u t s i d e   o f   y o u r   K u b e r n e t e s   c l u s t e r ,   i n   a   s p e c i a l   m o d e   w h e r e   y o u r   c l o u d   p r o v i d e r ' s   l o a d   b a l a n c e r   i m p l e m e n t s   H T T P   /   H T T P S   r e v e r s e   p r o x y i n g ,   w i t h   t r a f f i c   f o r w a r d e d   t o   t h e   b a c k e n d   e n d p o i n t s   f o r   t h a t   S e r v i c e .   T y p i c a l l y ,   y o u   s e t   t h e   p r o t o c o l   f o r   t h e   S e r v i c e   t o   T C P   a n d   a d d   a n   a n n o t a t i o n   ( u s u a l l y   s p e c i f i c   t o   y o u r   c l o u d   p r o v i d e r )   t h a t   c o n f i g u r e s   t h e   l o a d   b a l a n c e r   t o   h a n d l e   t r a f f i c   a t   t h e   H T T P   l e v e l .   T h i s   c o n f i g u r a t i o n   m i g h t   a l s o   i n c l u d e   s e r v i n g   H T T P S   ( H T T P   o v e r   T L S )   a n d   r e v e r s e - p r o x y i n g   p l a i n   H T T P   t o   y o u r   w o r k l o a d .


Question: What is Note:?

Answer: Y o u   m i g h t   a d d i t i o n a l l y   w a n t   t o   s p e c i f y   t h a t   t h e   a p p l i c a t i o n   p r o t o c o l   o f   t h e   c o n n e c t i o n   i s   h t t p   o r   h t t p s .   U s e   h t t p   i f   t h e   s e s s i o n   f r o m   t h e   l o a d   b a l a n c e r   t o   y o u r   w o r k l o a d   i s   H T T P   w i t h o u t   T L S ,   a n d   u s e   h t t p s   i f   t h e   s e s s i o n   f r o m   t h e   l o a d   b a l a n c e r   t o   y o u r   w o r k l o a d   u s e s   T L S   e n c r y p t i o n .


Question: What is PROXY protocol?

Answer: I f   y o u r   c l o u d   p r o v i d e r   s u p p o r t s   i t ,   y o u   c a n   u s e   a   S e r v i c e   s e t   t o   t y p e :   L o a d B a l a n c e r   t o   c o n f i g u r e   a   l o a d   b a l a n c e r   o u t s i d e   o f   K u b e r n e t e s   i t s e l f ,   t h a t   w i l l   f o r w a r d   c o n n e c t i o n s   w r a p p e d   w i t h   t h e   P R O X Y   p r o t o c o l .   T h e   l o a d   b a l a n c e r   t h e n   s e n d s   a n   i n i t i a l   s e r i e s   o f   o c t e t s   d e s c r i b i n g   t h e   i n c o m i n g   c o n n e c t i o n ,   s i m i l a r   t o   t h i s   e x a m p l e   ( P R O X Y   p r o t o c o l   v 1 ) :   P R O X Y   T C P 4   1 9 2 . 0 . 2 . 2 0 2   1 0 . 0 . 4 2 . 7   1 2 3 4 5   7 \ r \ n   T h e   d a t a   a f t e r   t h e   p r o x y   p r o t o c o l   p r e a m b l e   a r e   t h e   o r i g i n a l   d a t a   f r o m   t h e   c l i e n t .   W h e n   e i t h e r   s i d e   c l o s e s   t h e   c o n n e c t i o n ,   t h e   l o a d   b a l a n c e r   a l s o   t r i g g e r s   a   c o n n e c t i o n   c l o s e   a n d   s e n d s   a n y   r e m a i n i n g   d a t a   w h e r e   f e a s i b l e .   T y p i c a l l y ,   y o u   d e f i n e   a   S e r v i c e   w i t h   t h e   p r o t o c o l   t o   T C P .   Y o u   a l s o   s e t   a n   a n n o t a t i o n ,   s p e c i f i c   t o   y o u r   c l o u d   p r o v i d e r ,   t h a t   c o n f i g u r e s   t h e   l o a d   b a l a n c e r   t o   w r a p   e a c h   i n c o m i n g   c o n n e c t i o n   i n   t h e   P R O X Y   p r o t o c o l .


Question: What is TLS?

Answer: I f   y o u r   c l o u d   p r o v i d e r   s u p p o r t s   i t ,   y o u   c a n   u s e   a   S e r v i c e   s e t   t o   t y p e :   L o a d B a l a n c e r   a s   a   w a y   t o   s e t   u p   e x t e r n a l   r e v e r s e   p r o x y i n g ,   w h e r e   t h e   c o n n e c t i o n   f r o m   c l i e n t   t o   l o a d   b a l a n c e r   i s   T L S   e n c r y p t e d   a n d   t h e   l o a d   b a l a n c e r   i s   t h e   T L S   s e r v e r   p e e r .   T h e   c o n n e c t i o n   f r o m   t h e   l o a d   b a l a n c e r   t o   y o u r   w o r k l o a d   c a n   a l s o   b e   T L S ,   o r   m i g h t   b e   p l a i n   t e x t .   T h e   e x a c t   o p t i o n s   a v a i l a b l e   t o   y o u   d e p e n d   o n   y o u r   c l o u d   p r o v i d e r   o r   c u s t o m   S e r v i c e   i m p l e m e n t a t i o n .   T y p i c a l l y ,   y o u   s e t   t h e   p r o t o c o l   t o   T C P   a n d   s e t   a n   a n n o t a t i o n   ( u s u a l l y   s p e c i f i c   t o   y o u r   c l o u d   p r o v i d e r )   t h a t   c o n f i g u r e s   t h e   l o a d   b a l a n c e r   t o   a c t   a s   a   T L S   s e r v e r .   Y o u   w o u l d   c o n f i g u r e   t h e   T L S   i d e n t i t y   ( a s   s e r v e r ,   a n d   p o s s i b l y   a l s o   a s   a   c l i e n t   t h a t   c o n n e c t s   t o   y o u r   w o r k l o a d )   u s i n g   m e c h a n i s m s   t h a t   a r e   s p e c i f i c   t o   y o u r   c l o u d   p r o v i d e r .


Question: What is Cloud Native Security and Kubernetes?

Answer: Cloud Native Security and KubernetesConcepts for keeping your cloud-native workload secure.Kubernetes is based on a cloud-native architecture, and draws on advice from the CNCF about good practice for cloud native information security.Read on through this page for an overview of how Kubernetes is designed to help you deploy a secure cloud native platform.Cloud native information securityThe CNCF white paper on cloud native security defines security controls and practices that are appropriate to different lifecycle phases.Develop lifecycle phaseEnsure the integrity of development environments.Design applications following good practice for information security, appropriate for your context.Consider end user security as part of solution design.To achieve this, you can:Adopt an architecture, such as zero trust, that minimizes attack surfaces, even for internal threats.Define a code review process that considers security concerns.Build a threat model of your system or application that identifies trust boundaries. Use that to model to identify risks and to help find ways to treat those risks.Incorporate advanced security automation, such as fuzzing and security chaos engineering, where it's justified.Distribute lifecycle phaseEnsure the security of the supply chain for container images you execute.Ensure the security of the supply chain for the cluster and other components that execute your application. An example of another component might be an external database that your cloud-native application uses for persistence.To achieve this, you can:Scan container images and other artifacts for known vulnerabilities.Ensure that software distribution uses encryption in transit, with a chain of trust for the software source.Adopt and follow processes to update dependencies when updates are available, especially in response to security announcements.Use validation mechanisms such as digital certificates for supply chain assurance.Subscribe to feeds and other mechanisms to alert you to security risks.Restrict access to artifacts. Place container images in a private registry that only allows authorized clients to pull images.Deploy lifecycle phaseEnsure appropriate restrictions on what can be deployed, who can deploy it, and where it can be deployed to. You can enforce measures from the distribute phase, such as verifying the cryptographic identity of container image artifacts.You can deploy different applications and cluster components into different namespaces. Containers themselves, and namespaces, both provide isolation mechanisms that are relevant to information security.When you deploy Kubernetes, you also set the foundation for your applications' runtime environment: a Kubernetes cluster (or multiple clusters). That IT infrastructure must provide the security guarantees that higher layers expect.Runtime lifecycle phaseThe Runtime phase comprises three critical areas: access, compute, and storage.Runtime protection: accessThe Kubernetes API is what makes y


Question: How does Cloud Native Security and Kubernetes work?

Answer: Cloud Native Security and KubernetesConcepts for keeping your cloud-native workload secure.Kubernetes is based on a cloud-native architecture, and draws on advice from the CNCF about good practice for cloud native information security.Read on through this page for an overview of how Kubernetes is designed to help you deploy a secure cloud native platform.Cloud native information securityThe CNCF white paper on cloud native security defines security controls and practices that are appropriate to different lifecycle phases.Develop lifecycle phaseEnsure the integrity of development environments.Design applications following good practice for information security, appropriate for your context.Consider end user security as part of solution design.To achieve this, you can:Adopt an architecture, such as zero trust, that minimizes attack surfaces, even for internal threats.Define a code review process that considers security concerns.Build a threat model of your system or application that identifies trust boundaries. Use that to model to identify risks and to help find ways to treat those risks.Incorporate advanced security automation, such as fuzzing and security chaos engineering, where it's justified.Distribute lifecycle phaseEnsure the security of the supply chain for container images you execute.Ensure the security of the supply chain for the cluster and other components that execute your application. An example of another component might be an external database that your cloud-native application uses for persistence.To achieve this, you can:Scan container images and other artifacts for known vulnerabilities.Ensure that software distribution uses encryption in transit, with a chain of trust for the software source.Adopt and follow processes to update dependencies when updates are available, especially in response to security announcements.Use validation mechanisms such as digital certificates for supply chain assurance.Subscribe to feeds and other mechanisms to alert you to security risks.Restrict access to artifacts. Place container images in a private registry that only allows authorized clients to pull images.Deploy lifecycle phaseEnsure appropriate restrictions on what can be deployed, who can deploy it, and where it can be deployed to. You can enforce measures from the distribute phase, such as verifying the cryptographic identity of container image artifacts.You can deploy different applications and cluster components into different namespaces. Containers themselves, and namespaces, both provide isolation mechanisms that are relevant to information security.When you deploy Kubernetes, you also set the foundation for your applications' runtime environment: a Kubernetes cluster (or multiple clusters). That IT infrastructure must provide the security guarantees that higher layers expect.Runtime lifecycle phaseThe Runtime phase comprises three critical areas: access, compute, and storage.Runtime protection: accessThe Kubernetes API is what makes y


Question: When would you use Cloud Native Security and Kubernetes?

Answer: Cloud Native Security and KubernetesConcepts for keeping your cloud-native workload secure.Kubernetes is based on a cloud-native architecture, and draws on advice from the CNCF about good practice for cloud native information security.Read on through this page for an overview of how Kubernetes is designed to help you deploy a secure cloud native platform.Cloud native information securityThe CNCF white paper on cloud native security defines security controls and practices that are appropriate to different lifecycle phases.Develop lifecycle phaseEnsure the integrity of development environments.Design applications following good practice for information security, appropriate for your context.Consider end user security as part of solution design.To achieve this, you can:Adopt an architecture, such as zero trust, that minimizes attack surfaces, even for internal threats.Define a code review process that considers security concerns.Build a threat model of your system or application that identifies trust boundaries. Use that to model to identify risks and to help find ways to treat those risks.Incorporate advanced security automation, such as fuzzing and security chaos engineering, where it's justified.Distribute lifecycle phaseEnsure the security of the supply chain for container images you execute.Ensure the security of the supply chain for the cluster and other components that execute your application. An example of another component might be an external database that your cloud-native application uses for persistence.To achieve this, you can:Scan container images and other artifacts for known vulnerabilities.Ensure that software distribution uses encryption in transit, with a chain of trust for the software source.Adopt and follow processes to update dependencies when updates are available, especially in response to security announcements.Use validation mechanisms such as digital certificates for supply chain assurance.Subscribe to feeds and other mechanisms to alert you to security risks.Restrict access to artifacts. Place container images in a private registry that only allows authorized clients to pull images.Deploy lifecycle phaseEnsure appropriate restrictions on what can be deployed, who can deploy it, and where it can be deployed to. You can enforce measures from the distribute phase, such as verifying the cryptographic identity of container image artifacts.You can deploy different applications and cluster components into different namespaces. Containers themselves, and namespaces, both provide isolation mechanisms that are relevant to information security.When you deploy Kubernetes, you also set the foundation for your applications' runtime environment: a Kubernetes cluster (or multiple clusters). That IT infrastructure must provide the security guarantees that higher layers expect.Runtime lifecycle phaseThe Runtime phase comprises three critical areas: access, compute, and storage.Runtime protection: accessThe Kubernetes API is what makes y


Question: What are the benefits of Cloud Native Security and Kubernetes?

Answer: Cloud Native Security and KubernetesConcepts for keeping your cloud-native workload secure.Kubernetes is based on a cloud-native architecture, and draws on advice from the CNCF about good practice for cloud native information security.Read on through this page for an overview of how Kubernetes is designed to help you deploy a secure cloud native platform.Cloud native information securityThe CNCF white paper on cloud native security defines security controls and practices that are appropriate to different lifecycle phases.Develop lifecycle phaseEnsure the integrity of development environments.Design applications following good practice for information security, appropriate for your context.Consider end user security as part of solution design.To achieve this, you can:Adopt an architecture, such as zero trust, that minimizes attack surfaces, even for internal threats.Define a code review process that considers security concerns.Build a threat model of your system or application that identifies trust boundaries. Use that to model to identify risks and to help find ways to treat those risks.Incorporate advanced security automation, such as fuzzing and security chaos engineering, where it's justified.Distribute lifecycle phaseEnsure the security of the supply chain for container images you execute.Ensure the security of the supply chain for the cluster and other components that execute your application. An example of another component might be an external database that your cloud-native application uses for persistence.To achieve this, you can:Scan container images and other artifacts for known vulnerabilities.Ensure that software distribution uses encryption in transit, with a chain of trust for the software source.Adopt and follow processes to update dependencies when updates are available, especially in response to security announcements.Use validation mechanisms such as digital certificates for supply chain assurance.Subscribe to feeds and other mechanisms to alert you to security risks.Restrict access to artifacts. Place container images in a private registry that only allows authorized clients to pull images.Deploy lifecycle phaseEnsure appropriate restrictions on what can be deployed, who can deploy it, and where it can be deployed to. You can enforce measures from the distribute phase, such as verifying the cryptographic identity of container image artifacts.You can deploy different applications and cluster components into different namespaces. Containers themselves, and namespaces, both provide isolation mechanisms that are relevant to information security.When you deploy Kubernetes, you also set the foundation for your applications' runtime environment: a Kubernetes cluster (or multiple clusters). That IT infrastructure must provide the security guarantees that higher layers expect.Runtime lifecycle phaseThe Runtime phase comprises three critical areas: access, compute, and storage.Runtime protection: accessThe Kubernetes API is what makes y


Question: What is Cloud Native Security and Kubernetes?

Answer: K u b e r n e t e s   i s   b a s e d   o n   a   c l o u d - n a t i v e   a r c h i t e c t u r e ,   a n d   d r a w s   o n   a d v i c e   f r o m   t h e   C N C F   a b o u t   g o o d   p r a c t i c e   f o r   c l o u d   n a t i v e   i n f o r m a t i o n   s e c u r i t y .   R e a d   o n   t h r o u g h   t h i s   p a g e   f o r   a n   o v e r v i e w   o f   h o w   K u b e r n e t e s   i s   d e s i g n e d   t o   h e l p   y o u   d e p l o y   a   s e c u r e   c l o u d   n a t i v e   p l a t f o r m .


Question: What is Cloud native information security?

Answer: T h e   C N C F   w h i t e   p a p e r   o n   c l o u d   n a t i v e   s e c u r i t y   d e f i n e s   s e c u r i t y   c o n t r o l s   a n d   p r a c t i c e s   t h a t   a r e   a p p r o p r i a t e   t o   d i f f e r e n t   l i f e c y c l e   p h a s e s .


Question: What is Develop lifecycle phase?

Answer: E n s u r e   t h e   i n t e g r i t y   o f   d e v e l o p m e n t   e n v i r o n m e n t s . D e s i g n   a p p l i c a t i o n s   f o l l o w i n g   g o o d   p r a c t i c e   f o r   i n f o r m a t i o n   s e c u r i t y ,   a p p r o p r i a t e   f o r   y o u r   c o n t e x t . C o n s i d e r   e n d   u s e r   s e c u r i t y   a s   p a r t   o f   s o l u t i o n   d e s i g n .   T o   a c h i e v e   t h i s ,   y o u   c a n :   A d o p t   a n   a r c h i t e c t u r e ,   s u c h   a s   z e r o   t r u s t ,   t h a t   m i n i m i z e s   a t t a c k   s u r f a c e s ,   e v e n   f o r   i n t e r n a l   t h r e a t s . D e f i n e   a   c o d e   r e v i e w   p r o c e s s   t h a t   c o n s i d e r s   s e c u r i t y   c o n c e r n s . B u i l d   a   t h r e a t   m o d e l   o f   y o u r   s y s t e m   o r   a p p l i c a t i o n   t h a t   i d e n t i f i e s   t r u s t   b o u n d a r i e s .   U s e   t h a t   t o   m o d e l   t o   i d e n t i f y   r i s k s   a n d   t o   h e l p   f i n d   w a y s   t o   t r e a t   t h o s e   r i s k s . I n c o r p o r a t e   a d v a n c e d   s e c u r i t y   a u t o m a t i o n ,   s u c h   a s   f u z z i n g   a n d   s e c u r i t y   c h a o s   e n g i n e e r i n g ,   w h e r e   i t ' s   j u s t i f i e d .


Question: What is Distribute lifecycle phase?

Answer: E n s u r e   t h e   s e c u r i t y   o f   t h e   s u p p l y   c h a i n   f o r   c o n t a i n e r   i m a g e s   y o u   e x e c u t e . E n s u r e   t h e   s e c u r i t y   o f   t h e   s u p p l y   c h a i n   f o r   t h e   c l u s t e r   a n d   o t h e r   c o m p o n e n t s   t h a t   e x e c u t e   y o u r   a p p l i c a t i o n .   A n   e x a m p l e   o f   a n o t h e r   c o m p o n e n t   m i g h t   b e   a n   e x t e r n a l   d a t a b a s e   t h a t   y o u r   c l o u d - n a t i v e   a p p l i c a t i o n   u s e s   f o r   p e r s i s t e n c e .   T o   a c h i e v e   t h i s ,   y o u   c a n :   S c a n   c o n t a i n e r   i m a g e s   a n d   o t h e r   a r t i f a c t s   f o r   k n o w n   v u l n e r a b i l i t i e s . E n s u r e   t h a t   s o f t w a r e   d i s t r i b u t i o n   u s e s   e n c r y p t i o n   i n   t r a n s i t ,   w i t h   a   c h a i n   o f   t r u s t   f o r   t h e   s o f t w a r e   s o u r c e . A d o p t   a n d   f o l l o w   p r o c e s s e s   t o   u p d a t e   d e p e n d e n c i e s   w h e n   u p d a t e s   a r e   a v a i l a b l e ,   e s p e c i a l l y   i n   r e s p o n s e   t o   s e c u r i t y   a n n o u n c e m e n t s . U s e   v a l i d a t i o n   m e c h a n i s m s   s u c h   a s   d i g i t a l   c e r t i f i c a t e s   f o r   s u p p l y   c h a i n   a s s u r a n c e . S u b s c r i b e   t o   f e e d s   a n d   o t h e r   m e c h a n i s m s   t o   a l e r t   y o u   t o   s e c u r i t y   r i s k s . R e s t r i c t   a c c e s s   t o   a r t i f a c t s .   P l a c e   c o n t a i n e r   i m a g e s   i n   a   p r i v a t e   r e g i s t r y   t h a t   o n l y   a l l o w s   a u t h o r i z e d   c l i e n t s   t o   p u l l   i m a g e s .


Question: What is Deploy lifecycle phase?

Answer: E n s u r e   a p p r o p r i a t e   r e s t r i c t i o n s   o n   w h a t   c a n   b e   d e p l o y e d ,   w h o   c a n   d e p l o y   i t ,   a n d   w h e r e   i t   c a n   b e   d e p l o y e d   t o .   Y o u   c a n   e n f o r c e   m e a s u r e s   f r o m   t h e   d i s t r i b u t e   p h a s e ,   s u c h   a s   v e r i f y i n g   t h e   c r y p t o g r a p h i c   i d e n t i t y   o f   c o n t a i n e r   i m a g e   a r t i f a c t s .   Y o u   c a n   d e p l o y   d i f f e r e n t   a p p l i c a t i o n s   a n d   c l u s t e r   c o m p o n e n t s   i n t o   d i f f e r e n t   n a m e s p a c e s .   C o n t a i n e r s   t h e m s e l v e s ,   a n d   n a m e s p a c e s ,   b o t h   p r o v i d e   i s o l a t i o n   m e c h a n i s m s   t h a t   a r e   r e l e v a n t   t o   i n f o r m a t i o n   s e c u r i t y .   W h e n   y o u   d e p l o y   K u b e r n e t e s ,   y o u   a l s o   s e t   t h e   f o u n d a t i o n   f o r   y o u r   a p p l i c a t i o n s '   r u n t i m e   e n v i r o n m e n t :   a   K u b e r n e t e s   c l u s t e r   ( o r   m u l t i p l e   c l u s t e r s ) .   T h a t   I T   i n f r a s t r u c t u r e   m u s t   p r o v i d e   t h e   s e c u r i t y   g u a r a n t e e s   t h a t   h i g h e r   l a y e r s   e x p e c t .


Question: What is Runtime lifecycle phase?

Answer: T h e   R u n t i m e   p h a s e   c o m p r i s e s   t h r e e   c r i t i c a l   a r e a s :   a c c e s s ,   c o m p u t e ,   a n d   s t o r a g e .


Question: What is Runtime protection: access?

Answer: T h e   K u b e r n e t e s   A P I   i s   w h a t   m a k e s   y o u r   c l u s t e r   w o r k .   P r o t e c t i n g   t h i s   A P I   i s   k e y   t o   p r o v i d i n g   e f f e c t i v e   c l u s t e r   s e c u r i t y .   O t h e r   p a g e s   i n   t h e   K u b e r n e t e s   d o c u m e n t a t i o n   h a v e   m o r e   d e t a i l   a b o u t   h o w   t o   s e t   u p   s p e c i f i c   a s p e c t s   o f   a c c e s s   c o n t r o l .   T h e   s e c u r i t y   c h e c k l i s t   h a s   a   s e t   o f   s u g g e s t e d   b a s i c   c h e c k s   f o r   y o u r   c l u s t e r .   B e y o n d   t h a t ,   s e c u r i n g   y o u r   c l u s t e r   m e a n s   i m p l e m e n t i n g   e f f e c t i v e   a u t h e n t i c a t i o n   a n d   a u t h o r i z a t i o n   f o r   A P I   a c c e s s .   U s e   S e r v i c e A c c o u n t s   t o   p r o v i d e   a n d   m a n a g e   s e c u r i t y   i d e n t i t i e s   f o r   w o r k l o a d s   a n d   c l u s t e r   c o m p o n e n t s .   K u b e r n e t e s   u s e s   T L S   t o   p r o t e c t   A P I   t r a f f i c ;   m a k e   s u r e   t o   d e p l o y   t h e   c l u s t e r   u s i n g   T L S   ( i n c l u d i n g   f o r   t r a f f i c   b e t w e e n   n o d e s   a n d   t h e   c o n t r o l   p l a n e ) ,   a n d   p r o t e c t   t h e   e n c r y p t i o n   k e y s .   I f   y o u   u s e   K u b e r n e t e s '   o w n   A P I   f o r   C e r t i f i c a t e S i g n i n g R e q u e s t s ,   p a y   s p e c i a l   a t t e n t i o n   t o   r e s t r i c t i n g   m i s u s e   t h e r e .


Question: What is Runtime protection: compute?

Answer: C o n t a i n e r s   p r o v i d e   t w o   t h i n g s :   i s o l a t i o n   b e t w e e n   d i f f e r e n t   a p p l i c a t i o n s ,   a n d   a   m e c h a n i s m   t o   c o m b i n e   t h o s e   i s o l a t e d   a p p l i c a t i o n s   t o   r u n   o n   t h e   s a m e   h o s t   c o m p u t e r .   T h o s e   t w o   a s p e c t s ,   i s o l a t i o n   a n d   a g g r e g a t i o n ,   m e a n   t h a t   r u n t i m e   s e c u r i t y   i n v o l v e s   i d e n t i f y i n g   t r a d e - o f f s   a n d   f i n d i n g   a n   a p p r o p r i a t e   b a l a n c e .   K u b e r n e t e s   r e l i e s   o n   a   c o n t a i n e r   r u n t i m e   t o   a c t u a l l y   s e t   u p   a n d   r u n   c o n t a i n e r s .   T h e   K u b e r n e t e s   p r o j e c t   d o e s   n o t   r e c o m m e n d   a   s p e c i f i c   c o n t a i n e r   r u n t i m e   a n d   y o u   s h o u l d   m a k e   s u r e   t h a t   t h e   r u n t i m e ( s )   t h a t   y o u   c h o o s e   m e e t   y o u r   i n f o r m a t i o n   s e c u r i t y   n e e d s .   T o   p r o t e c t   y o u r   c o m p u t e   a t   r u n t i m e ,   y o u   c a n :   E n f o r c e   P o d   s e c u r i t y   s t a n d a r d s   f o r   a p p l i c a t i o n s ,   t o   h e l p   e n s u r e   t h e y   r u n   w i t h   o n l y   t h e   n e c e s s a r y   p r i v i l e g e s . R u n   a   s p e c i a l i z e d   o p e r a t i n g   s y s t e m   o n   y o u r   n o d e s   t h a t   i s   d e s i g n e d   s p e c i f i c a l l y   f o r   r u n n i n g   c o n t a i n e r i z e d   w o r k l o a d s .   T h i s   i s   t y p i c a l l y   b a s e d   o n   a   r e a d - o n l y   o p e r a t i n g   s y s t e m   ( i m m u t a b l e   i m a g e )   t h a t   p r o v i d e s   o n l y   t h e   s e r v i c e s   e s s e n t i a l   f o r   r u n n i n g   c o n t a i n e r s . C o n t a i n e r - s p e c i f i c   o p e r a t i n g   s y s t e m s   h e