Question: When would you use HorizontalPodAutoscaler?

Answer: HorizontalPodAutoscalerconfiguration of a horizontal pod autoscaler.apiVersion: autoscaling/v1import "k8s.io/api/autoscaling/v1"HorizontalPodAutoscalerconfiguration of a horizontal pod autoscaler.apiVersion: autoscaling/v1kind: HorizontalPodAutoscalermetadata (ObjectMeta)Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (HorizontalPodAutoscalerSpec)spec defines the behaviour of autoscaler. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.status (HorizontalPodAutoscalerStatus)status is the current information about the autoscaler.HorizontalPodAutoscalerSpecspecification of a horizontal pod autoscaler.maxReplicas (int32), requiredmaxReplicas is the upper limit for the number of pods that can be set by the autoscaler; cannot be smaller than MinReplicas.scaleTargetRef (CrossVersionObjectReference), requiredreference to scaled resource; horizontal pod autoscaler will learn the current resource consumption and will set the desired number of pods by using its Scale subresource.CrossVersionObjectReference contains enough information to let you identify the referred resource.scaleTargetRef.kind (string), requiredkind is the kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsscaleTargetRef.name (string), requiredname is the name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#namesscaleTargetRef.apiVersion (string)apiVersion is the API version of the referentminReplicas (int32)minReplicas is the lower limit for the number of replicas to which the autoscaler can scale down. It defaults to 1 pod. minReplicas is allowed to be 0 if the alpha feature gate HPAScaleToZero is enabled and at least one Object or External metric is configured. Scaling is active as long as at least one metric value is available.targetCPUUtilizationPercentage (int32)targetCPUUtilizationPercentage is the target average CPU utilization (represented as a percentage of requested CPU) over all the pods; if not specified the default autoscaling policy will be used.HorizontalPodAutoscalerStatuscurrent status of a horizontal pod autoscalercurrentReplicas (int32), requiredcurrentReplicas is the current number of replicas of pods managed by this autoscaler.desiredReplicas (int32), requireddesiredReplicas is the desired number of replicas of pods managed by this autoscaler.currentCPUUtilizationPercentage (int32)currentCPUUtilizationPercentage is the current average CPU utilization over all pods, represented as a percentage of requested CPU, e.g. 70 means that an average pod is using now 70% of its requested CPU.lastScaleTime (Time)lastScaleTime is the last time the HorizontalPodAutoscaler scaled the number of pods; used by the autoscaler to control how often the number of pods is changed.Time is a wrapper around time.Time whi


Question: What are the benefits of HorizontalPodAutoscaler?

Answer: HorizontalPodAutoscalerconfiguration of a horizontal pod autoscaler.apiVersion: autoscaling/v1import "k8s.io/api/autoscaling/v1"HorizontalPodAutoscalerconfiguration of a horizontal pod autoscaler.apiVersion: autoscaling/v1kind: HorizontalPodAutoscalermetadata (ObjectMeta)Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (HorizontalPodAutoscalerSpec)spec defines the behaviour of autoscaler. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.status (HorizontalPodAutoscalerStatus)status is the current information about the autoscaler.HorizontalPodAutoscalerSpecspecification of a horizontal pod autoscaler.maxReplicas (int32), requiredmaxReplicas is the upper limit for the number of pods that can be set by the autoscaler; cannot be smaller than MinReplicas.scaleTargetRef (CrossVersionObjectReference), requiredreference to scaled resource; horizontal pod autoscaler will learn the current resource consumption and will set the desired number of pods by using its Scale subresource.CrossVersionObjectReference contains enough information to let you identify the referred resource.scaleTargetRef.kind (string), requiredkind is the kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsscaleTargetRef.name (string), requiredname is the name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#namesscaleTargetRef.apiVersion (string)apiVersion is the API version of the referentminReplicas (int32)minReplicas is the lower limit for the number of replicas to which the autoscaler can scale down. It defaults to 1 pod. minReplicas is allowed to be 0 if the alpha feature gate HPAScaleToZero is enabled and at least one Object or External metric is configured. Scaling is active as long as at least one metric value is available.targetCPUUtilizationPercentage (int32)targetCPUUtilizationPercentage is the target average CPU utilization (represented as a percentage of requested CPU) over all the pods; if not specified the default autoscaling policy will be used.HorizontalPodAutoscalerStatuscurrent status of a horizontal pod autoscalercurrentReplicas (int32), requiredcurrentReplicas is the current number of replicas of pods managed by this autoscaler.desiredReplicas (int32), requireddesiredReplicas is the desired number of replicas of pods managed by this autoscaler.currentCPUUtilizationPercentage (int32)currentCPUUtilizationPercentage is the current average CPU utilization over all pods, represented as a percentage of requested CPU, e.g. 70 means that an average pod is using now 70% of its requested CPU.lastScaleTime (Time)lastScaleTime is the last time the HorizontalPodAutoscaler scaled the number of pods; used by the autoscaler to control how often the number of pods is changed.Time is a wrapper around time.Time whi


Question: What is HorizontalPodAutoscaler?

Answer: a p i V e r s i o n :   a u t o s c a l i n g / v 1   i m p o r t   " k 8 s . i o / a p i / a u t o s c a l i n g / v 1 "


Question: What is HorizontalPodAutoscaler?

Answer: c o n f i g u r a t i o n   o f   a   h o r i z o n t a l   p o d   a u t o s c a l e r .   a p i V e r s i o n :   a u t o s c a l i n g / v 1 k i n d :   H o r i z o n t a l P o d A u t o s c a l e r m e t a d a t a   ( O b j e c t M e t a ) S t a n d a r d   o b j e c t   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a s p e c   ( H o r i z o n t a l P o d A u t o s c a l e r S p e c ) s p e c   d e f i n e s   t h e   b e h a v i o u r   o f   a u t o s c a l e r .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # s p e c - a n d - s t a t u s . s t a t u s   ( H o r i z o n t a l P o d A u t o s c a l e r S t a t u s ) s t a t u s   i s   t h e   c u r r e n t   i n f o r m a t i o n   a b o u t   t h e   a u t o s c a l e r .   a p i V e r s i o n :   a u t o s c a l i n g / v 1   k i n d :   H o r i z o n t a l P o d A u t o s c a l e r   m e t a d a t a   ( O b j e c t M e t a )   S t a n d a r d   o b j e c t   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a   s p e c   ( H o r i z o n t a l P o d A u t o s c a l e r S p e c )   s p e c   d e f i n e s   t h e   b e h a v i o u r   o f   a u t o s c a l e r .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # s p e c - a n d - s t a t u s .   s t a t u s   ( H o r i z o n t a l P o d A u t o s c a l e r S t a t u s )   s t a t u s   i s   t h e   c u r r e n t   i n f o r m a t i


Question: What is HorizontalPodAutoscalerSpec?

Answer: s p e c i f i c a t i o n   o f   a   h o r i z o n t a l   p o d   a u t o s c a l e r .   m a x R e p l i c a s   ( i n t 3 2 ) ,   r e q u i r e d m a x R e p l i c a s   i s   t h e   u p p e r   l i m i t   f o r   t h e   n u m b e r   o f   p o d s   t h a t   c a n   b e   s e t   b y   t h e   a u t o s c a l e r ;   c a n n o t   b e   s m a l l e r   t h a n   M i n R e p l i c a s . s c a l e T a r g e t R e f   ( C r o s s V e r s i o n O b j e c t R e f e r e n c e ) ,   r e q u i r e d r e f e r e n c e   t o   s c a l e d   r e s o u r c e ;   h o r i z o n t a l   p o d   a u t o s c a l e r   w i l l   l e a r n   t h e   c u r r e n t   r e s o u r c e   c o n s u m p t i o n   a n d   w i l l   s e t   t h e   d e s i r e d   n u m b e r   o f   p o d s   b y   u s i n g   i t s   S c a l e   s u b r e s o u r c e . C r o s s V e r s i o n O b j e c t R e f e r e n c e   c o n t a i n s   e n o u g h   i n f o r m a t i o n   t o   l e t   y o u   i d e n t i f y   t h e   r e f e r r e d   r e s o u r c e . s c a l e T a r g e t R e f . k i n d   ( s t r i n g ) ,   r e q u i r e d k i n d   i s   t h e   k i n d   o f   t h e   r e f e r e n t ;   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # t y p e s - k i n d s s c a l e T a r g e t R e f . n a m e   ( s t r i n g ) ,   r e q u i r e d n a m e   i s   t h e   n a m e   o f   t h e   r e f e r e n t ;   M o r e   i n f o :   h t t p s : / / k u b e r n e t e s . i o / d o c s / c o n c e p t s / o v e r v i e w / w o r k i n g - w i t h - o b j e c t s / n a m e s / # n a m e s s c a l e T a r g e t R e f . a p i V e r s i o n   ( s t r i n g ) a p i V e r s i o n   i s   t h e   A P I   v e r s i o n   o f   t h e   r e f e r e n t m i n R e p l i c a s   ( i n t 3 2 ) m i n R e p l i c a s   i s   t h e   l o w e r   l i m i t   f o r   t h e   n u


Question: What is HorizontalPodAutoscalerStatus?

Answer: c u r r e n t   s t a t u s   o f   a   h o r i z o n t a l   p o d   a u t o s c a l e r   c u r r e n t R e p l i c a s   ( i n t 3 2 ) ,   r e q u i r e d c u r r e n t R e p l i c a s   i s   t h e   c u r r e n t   n u m b e r   o f   r e p l i c a s   o f   p o d s   m a n a g e d   b y   t h i s   a u t o s c a l e r . d e s i r e d R e p l i c a s   ( i n t 3 2 ) ,   r e q u i r e d d e s i r e d R e p l i c a s   i s   t h e   d e s i r e d   n u m b e r   o f   r e p l i c a s   o f   p o d s   m a n a g e d   b y   t h i s   a u t o s c a l e r . c u r r e n t C P U U t i l i z a t i o n P e r c e n t a g e   ( i n t 3 2 ) c u r r e n t C P U U t i l i z a t i o n P e r c e n t a g e   i s   t h e   c u r r e n t   a v e r a g e   C P U   u t i l i z a t i o n   o v e r   a l l   p o d s ,   r e p r e s e n t e d   a s   a   p e r c e n t a g e   o f   r e q u e s t e d   C P U ,   e . g .   7 0   m e a n s   t h a t   a n   a v e r a g e   p o d   i s   u s i n g   n o w   7 0 %   o f   i t s   r e q u e s t e d   C P U . l a s t S c a l e T i m e   ( T i m e ) l a s t S c a l e T i m e   i s   t h e   l a s t   t i m e   t h e   H o r i z o n t a l P o d A u t o s c a l e r   s c a l e d   t h e   n u m b e r   o f   p o d s ;   u s e d   b y   t h e   a u t o s c a l e r   t o   c o n t r o l   h o w   o f t e n   t h e   n u m b e r   o f   p o d s   i s   c h a n g e d . T i m e   i s   a   w r a p p e r   a r o u n d   t i m e . T i m e   w h i c h   s u p p o r t s   c o r r e c t   m a r s h a l i n g   t o   Y A M L   a n d   J S O N .   W r a p p e r s   a r e   p r o v i d e d   f o r   m a n y   o f   t h e   f a c t o r y   m e t h o d s   t h a t   t h e   t i m e   p a c k a g e   o f f e r s . o b s e r v e d G e n e r a t i o n   ( i n t 6 4 ) o b s e r v e d G e n e r a t i o n   i s   t h e   m o s t   r e c e n t   g e n e r a t i o n   o b s e r v e d   b y   t h i s   a u t o s c a l e r .   c u r r e n t R e p l i c a s   ( i n t 3


Question: What is HorizontalPodAutoscalerList?

Answer: l i s t   o f   h o r i z o n t a l   p o d   a u t o s c a l e r   o b j e c t s .   a p i V e r s i o n :   a u t o s c a l i n g / v 1 k i n d :   H o r i z o n t a l P o d A u t o s c a l e r L i s t m e t a d a t a   ( L i s t M e t a ) S t a n d a r d   l i s t   m e t a d a t a . i t e m s   ( [ ] H o r i z o n t a l P o d A u t o s c a l e r ) ,   r e q u i r e d i t e m s   i s   t h e   l i s t   o f   h o r i z o n t a l   p o d   a u t o s c a l e r   o b j e c t s .   a p i V e r s i o n :   a u t o s c a l i n g / v 1   k i n d :   H o r i z o n t a l P o d A u t o s c a l e r L i s t   m e t a d a t a   ( L i s t M e t a )   S t a n d a r d   l i s t   m e t a d a t a .   i t e m s   ( [ ] H o r i z o n t a l P o d A u t o s c a l e r ) ,   r e q u i r e d   i t e m s   i s   t h e   l i s t   o f   h o r i z o n t a l   p o d   a u t o s c a l e r   o b j e c t s .


Question: What is HTTP Request?

Answer: G E T   / a p i s / a u t o s c a l i n g / v 1 / n a m e s p a c e s / { n a m e s p a c e } / h o r i z o n t a l p o d a u t o s c a l e r s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   H o r i z o n t a l P o d A u t o s c a l e r n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   H o r i z o n t a l P o d A u t o s c a l e r   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( H o r i z o n t a l P o d A u t o s c a l e r ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i s / a u t o s c a l i n g / v 1 / n a m e s p a c e s / { n a m e s p a c e } / h o r i z o n t a l p o d a u t o s c a l e r s / { n a m e } / s t a t u s


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   H o r i z o n t a l P o d A u t o s c a l e r n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   H o r i z o n t a l P o d A u t o s c a l e r   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( H o r i z o n t a l P o d A u t o s c a l e r ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i s / a u t o s c a l i n g / v 1 / n a m e s p a c e s / { n a m e s p a c e } / h o r i z o n t a l p o d a u t o s c a l e r s


Question: What is Parameters?

Answer: n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n a l l o w W a t c h B o o k m a r k s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s w a t c h   ( i n   q u e r y ) :   b o o l e a n w a t c h   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n   a l l o w W a t c h B o o k m a r k s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   l a b e l S e l e c t o r   l i m i t   ( i n   q u e r y ) :   i n t e g e r   l i m i t   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n   r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n M a t c h   s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n   s e n d I n i t i a l E v e n


Question: What is Response?

Answer: 2 0 0   ( H o r i z o n t a l P o d A u t o s c a l e r L i s t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i s / a u t o s c a l i n g / v 1 / h o r i z o n t a l p o d a u t o s c a l e r s


Question: What is Parameters?

Answer: a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n a l l o w W a t c h B o o k m a r k s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s w a t c h   ( i n   q u e r y ) :   b o o l e a n w a t c h   a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n   a l l o w W a t c h B o o k m a r k s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   l a b e l S e l e c t o r   l i m i t   ( i n   q u e r y ) :   i n t e g e r   l i m i t   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n   r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n M a t c h   s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n   s e n d I n i t i a l E v e n t s   t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   t i m e o u t S e c o n d s   w a t c h   ( i n   q u e r y ) :   b o o l e a n   w a t c h


Question: What is Response?

Answer: 2 0 0   ( H o r i z o n t a l P o d A u t o s c a l e r L i s t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P O S T   / a p i s / a u t o s c a l i n g / v 1 / n a m e s p a c e s / { n a m e s p a c e } / h o r i z o n t a l p o d a u t o s c a l e r s


Question: What is Parameters?

Answer: n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   H o r i z o n t a l P o d A u t o s c a l e r ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   H o r i z o n t a l P o d A u t o s c a l e r ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( H o r i z o n t a l P o d A u t o s c a l e r ) :   O K   2 0 1   ( H o r i z o n t a l P o d A u t o s c a l e r ) :   C r e a t e d   2 0 2   ( H o r i z o n t a l P o d A u t o s c a l e r ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P U T   / a p i s / a u t o s c a l i n g / v 1 / n a m e s p a c e s / { n a m e s p a c e } / h o r i z o n t a l p o d a u t o s c a l e r s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   H o r i z o n t a l P o d A u t o s c a l e r n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   H o r i z o n t a l P o d A u t o s c a l e r ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   H o r i z o n t a l P o d A u t o s c a l e r   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   H o r i z o n t a l P o d A u t o s c a l e r ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( H o r i z o n t a l P o d A u t o s c a l e r ) :   O K   2 0 1   ( H o r i z o n t a l P o d A u t o s c a l e r ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P U T   / a p i s / a u t o s c a l i n g / v 1 / n a m e s p a c e s / { n a m e s p a c e } / h o r i z o n t a l p o d a u t o s c a l e r s / { n a m e } / s t a t u s


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   H o r i z o n t a l P o d A u t o s c a l e r n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   H o r i z o n t a l P o d A u t o s c a l e r ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   H o r i z o n t a l P o d A u t o s c a l e r   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   H o r i z o n t a l P o d A u t o s c a l e r ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( H o r i z o n t a l P o d A u t o s c a l e r ) :   O K   2 0 1   ( H o r i z o n t a l P o d A u t o s c a l e r ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P A T C H   / a p i s / a u t o s c a l i n g / v 1 / n a m e s p a c e s / { n a m e s p a c e } / h o r i z o n t a l p o d a u t o s c a l e r s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   H o r i z o n t a l P o d A u t o s c a l e r n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   P a t c h ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n f o r c e   ( i n   q u e r y ) :   b o o l e a n f o r c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   H o r i z o n t a l P o d A u t o s c a l e r   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   P a t c h ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   f o r c e   ( i n   q u e r y ) :   b o o l e a n   f o r c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( H o r i z o n t a l P o d A u t o s c a l e r ) :   O K   2 0 1   ( H o r i z o n t a l P o d A u t o s c a l e r ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P A T C H   / a p i s / a u t o s c a l i n g / v 1 / n a m e s p a c e s / { n a m e s p a c e } / h o r i z o n t a l p o d a u t o s c a l e r s / { n a m e } / s t a t u s


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   H o r i z o n t a l P o d A u t o s c a l e r n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   P a t c h ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n f o r c e   ( i n   q u e r y ) :   b o o l e a n f o r c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   H o r i z o n t a l P o d A u t o s c a l e r   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   P a t c h ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   f o r c e   ( i n   q u e r y ) :   b o o l e a n   f o r c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( H o r i z o n t a l P o d A u t o s c a l e r ) :   O K   2 0 1   ( H o r i z o n t a l P o d A u t o s c a l e r ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: D E L E T E   / a p i s / a u t o s c a l i n g / v 1 / n a m e s p a c e s / { n a m e s p a c e } / h o r i z o n t a l p o d a u t o s c a l e r s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   H o r i z o n t a l P o d A u t o s c a l e r n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   D e l e t e O p t i o n s d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r g r a c e P e r i o d S e c o n d s i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g p r o p a g a t i o n P o l i c y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   H o r i z o n t a l P o d A u t o s c a l e r   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   D e l e t e O p t i o n s   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   g r a c e P e r i o d S e c o n d s   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g   p r o p a g a t i o n P o l i c y


Question: What is Response?

Answer: 2 0 0   ( S t a t u s ) :   O K   2 0 2   ( S t a t u s ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: D E L E T E   / a p i s / a u t o s c a l i n g / v 1 / n a m e s p a c e s / { n a m e s p a c e } / h o r i z o n t a l p o d a u t o s c a l e r s


Question: What is Parameters?

Answer: n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   D e l e t e O p t i o n s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r g r a c e P e r i o d S e c o n d s i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g p r o p a g a t i o n P o l i c y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   D e l e t e O p t i o n s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   g r a c e P e r i o d S e c o n d s   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g


Question: What is Response?

Answer: 2 0 0   ( S t a t u s ) :   O K   4 0 1 :   U n a u t h o r i z e d   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Accessing the Kubernetes API from a Pod?

Answer: Accessing the Kubernetes API from a PodThis guide demonstrates how to access the Kubernetes API from within a pod.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesAccessing the API from within a PodWhen accessing the API from within a Pod, locating and authenticating to the API server are slightly different to the external client case.The easiest way to use the Kubernetes API from a Pod is to use one of the official client libraries. These libraries can automatically discover the API server and authenticate.Using Official Client LibrariesFrom within a Pod, the recommended ways to connect to the Kubernetes API are:For a Go client, use the official Go client library. The rest.InClusterConfig() function handles API host discovery and authentication automatically. See an example here.For a Python client, use the official Python client library. The config.load_incluster_config() function handles API host discovery and authentication automatically. See an example here.There are a number of other libraries available, please refer to the Client Libraries page.In each case, the service account credentials of the Pod are used to communicate securely with the API server.Directly accessing the REST APIWhile running in a Pod, your container can create an HTTPS URL for the Kubernetes API server by fetching the KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT_HTTPS environment variables. The API server's in-cluster address is also published to a Service named kubernetes in the default namespace so that pods may reference kubernetes.default.svc as a DNS name for the local API server.Note:Kubernetes does not guarantee that the API server has a valid certificate for the hostname kubernetes.default.svc; however, the control plane is expected to present a valid certificate for the hostname or IP address that $KUBERNETES_SERVICE_HOST represents.The recommended way to authenticate to the API server is with a service account credential. By default, a Pod is associated with a service account, and a credential (token) for that service account is placed into the filesystem tree of each container in that Pod, at /var/run/secrets/kubernetes.io/serviceaccount/token.If available, a certificate bundle is placed into the filesystem tree of each container at /var/run/secrets/kubernetes.io/serviceaccount/ca.crt, and should be used to verify the serving certificate of the API server.Finally, the default namespace to be used for namespaced API operations is placed in a file at /var/run/secrets/kubernetes.io/serviceaccount/namespace in each container.Using kubectl proxyIf you would like to query t


Question: How does Accessing the Kubernetes API from a Pod work?

Answer: Accessing the Kubernetes API from a PodThis guide demonstrates how to access the Kubernetes API from within a pod.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesAccessing the API from within a PodWhen accessing the API from within a Pod, locating and authenticating to the API server are slightly different to the external client case.The easiest way to use the Kubernetes API from a Pod is to use one of the official client libraries. These libraries can automatically discover the API server and authenticate.Using Official Client LibrariesFrom within a Pod, the recommended ways to connect to the Kubernetes API are:For a Go client, use the official Go client library. The rest.InClusterConfig() function handles API host discovery and authentication automatically. See an example here.For a Python client, use the official Python client library. The config.load_incluster_config() function handles API host discovery and authentication automatically. See an example here.There are a number of other libraries available, please refer to the Client Libraries page.In each case, the service account credentials of the Pod are used to communicate securely with the API server.Directly accessing the REST APIWhile running in a Pod, your container can create an HTTPS URL for the Kubernetes API server by fetching the KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT_HTTPS environment variables. The API server's in-cluster address is also published to a Service named kubernetes in the default namespace so that pods may reference kubernetes.default.svc as a DNS name for the local API server.Note:Kubernetes does not guarantee that the API server has a valid certificate for the hostname kubernetes.default.svc; however, the control plane is expected to present a valid certificate for the hostname or IP address that $KUBERNETES_SERVICE_HOST represents.The recommended way to authenticate to the API server is with a service account credential. By default, a Pod is associated with a service account, and a credential (token) for that service account is placed into the filesystem tree of each container in that Pod, at /var/run/secrets/kubernetes.io/serviceaccount/token.If available, a certificate bundle is placed into the filesystem tree of each container at /var/run/secrets/kubernetes.io/serviceaccount/ca.crt, and should be used to verify the serving certificate of the API server.Finally, the default namespace to be used for namespaced API operations is placed in a file at /var/run/secrets/kubernetes.io/serviceaccount/namespace in each container.Using kubectl proxyIf you would like to query t


Question: When would you use Accessing the Kubernetes API from a Pod?

Answer: Accessing the Kubernetes API from a PodThis guide demonstrates how to access the Kubernetes API from within a pod.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesAccessing the API from within a PodWhen accessing the API from within a Pod, locating and authenticating to the API server are slightly different to the external client case.The easiest way to use the Kubernetes API from a Pod is to use one of the official client libraries. These libraries can automatically discover the API server and authenticate.Using Official Client LibrariesFrom within a Pod, the recommended ways to connect to the Kubernetes API are:For a Go client, use the official Go client library. The rest.InClusterConfig() function handles API host discovery and authentication automatically. See an example here.For a Python client, use the official Python client library. The config.load_incluster_config() function handles API host discovery and authentication automatically. See an example here.There are a number of other libraries available, please refer to the Client Libraries page.In each case, the service account credentials of the Pod are used to communicate securely with the API server.Directly accessing the REST APIWhile running in a Pod, your container can create an HTTPS URL for the Kubernetes API server by fetching the KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT_HTTPS environment variables. The API server's in-cluster address is also published to a Service named kubernetes in the default namespace so that pods may reference kubernetes.default.svc as a DNS name for the local API server.Note:Kubernetes does not guarantee that the API server has a valid certificate for the hostname kubernetes.default.svc; however, the control plane is expected to present a valid certificate for the hostname or IP address that $KUBERNETES_SERVICE_HOST represents.The recommended way to authenticate to the API server is with a service account credential. By default, a Pod is associated with a service account, and a credential (token) for that service account is placed into the filesystem tree of each container in that Pod, at /var/run/secrets/kubernetes.io/serviceaccount/token.If available, a certificate bundle is placed into the filesystem tree of each container at /var/run/secrets/kubernetes.io/serviceaccount/ca.crt, and should be used to verify the serving certificate of the API server.Finally, the default namespace to be used for namespaced API operations is placed in a file at /var/run/secrets/kubernetes.io/serviceaccount/namespace in each container.Using kubectl proxyIf you would like to query t


Question: What are the benefits of Accessing the Kubernetes API from a Pod?

Answer: Accessing the Kubernetes API from a PodThis guide demonstrates how to access the Kubernetes API from within a pod.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesAccessing the API from within a PodWhen accessing the API from within a Pod, locating and authenticating to the API server are slightly different to the external client case.The easiest way to use the Kubernetes API from a Pod is to use one of the official client libraries. These libraries can automatically discover the API server and authenticate.Using Official Client LibrariesFrom within a Pod, the recommended ways to connect to the Kubernetes API are:For a Go client, use the official Go client library. The rest.InClusterConfig() function handles API host discovery and authentication automatically. See an example here.For a Python client, use the official Python client library. The config.load_incluster_config() function handles API host discovery and authentication automatically. See an example here.There are a number of other libraries available, please refer to the Client Libraries page.In each case, the service account credentials of the Pod are used to communicate securely with the API server.Directly accessing the REST APIWhile running in a Pod, your container can create an HTTPS URL for the Kubernetes API server by fetching the KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT_HTTPS environment variables. The API server's in-cluster address is also published to a Service named kubernetes in the default namespace so that pods may reference kubernetes.default.svc as a DNS name for the local API server.Note:Kubernetes does not guarantee that the API server has a valid certificate for the hostname kubernetes.default.svc; however, the control plane is expected to present a valid certificate for the hostname or IP address that $KUBERNETES_SERVICE_HOST represents.The recommended way to authenticate to the API server is with a service account credential. By default, a Pod is associated with a service account, and a credential (token) for that service account is placed into the filesystem tree of each container in that Pod, at /var/run/secrets/kubernetes.io/serviceaccount/token.If available, a certificate bundle is placed into the filesystem tree of each container at /var/run/secrets/kubernetes.io/serviceaccount/ca.crt, and should be used to verify the serving certificate of the API server.Finally, the default namespace to be used for namespaced API operations is placed in a file at /var/run/secrets/kubernetes.io/serviceaccount/namespace in each container.Using kubectl proxyIf you would like to query t


Question: What is Accessing the Kubernetes API from a Pod?

Answer: T h i s   g u i d e   d e m o n s t r a t e s   h o w   t o   a c c e s s   t h e   K u b e r n e t e s   A P I   f r o m   w i t h i n   a   p o d .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s


Question: What is Accessing the API from within a Pod?

Answer: W h e n   a c c e s s i n g   t h e   A P I   f r o m   w i t h i n   a   P o d ,   l o c a t i n g   a n d   a u t h e n t i c a t i n g   t o   t h e   A P I   s e r v e r   a r e   s l i g h t l y   d i f f e r e n t   t o   t h e   e x t e r n a l   c l i e n t   c a s e .   T h e   e a s i e s t   w a y   t o   u s e   t h e   K u b e r n e t e s   A P I   f r o m   a   P o d   i s   t o   u s e   o n e   o f   t h e   o f f i c i a l   c l i e n t   l i b r a r i e s .   T h e s e   l i b r a r i e s   c a n   a u t o m a t i c a l l y   d i s c o v e r   t h e   A P I   s e r v e r   a n d   a u t h e n t i c a t e .


Question: What is Using Official Client Libraries?

Answer: F r o m   w i t h i n   a   P o d ,   t h e   r e c o m m e n d e d   w a y s   t o   c o n n e c t   t o   t h e   K u b e r n e t e s   A P I   a r e :   F o r   a   G o   c l i e n t ,   u s e   t h e   o f f i c i a l   G o   c l i e n t   l i b r a r y .   T h e   r e s t . I n C l u s t e r C o n f i g ( )   f u n c t i o n   h a n d l e s   A P I   h o s t   d i s c o v e r y   a n d   a u t h e n t i c a t i o n   a u t o m a t i c a l l y .   S e e   a n   e x a m p l e   h e r e . F o r   a   P y t h o n   c l i e n t ,   u s e   t h e   o f f i c i a l   P y t h o n   c l i e n t   l i b r a r y .   T h e   c o n f i g . l o a d _ i n c l u s t e r _ c o n f i g ( )   f u n c t i o n   h a n d l e s   A P I   h o s t   d i s c o v e r y   a n d   a u t h e n t i c a t i o n   a u t o m a t i c a l l y .   S e e   a n   e x a m p l e   h e r e . T h e r e   a r e   a   n u m b e r   o f   o t h e r   l i b r a r i e s   a v a i l a b l e ,   p l e a s e   r e f e r   t o   t h e   C l i e n t   L i b r a r i e s   p a g e .   F o r   a   G o   c l i e n t ,   u s e   t h e   o f f i c i a l   G o   c l i e n t   l i b r a r y .   T h e   r e s t . I n C l u s t e r C o n f i g ( )   f u n c t i o n   h a n d l e s   A P I   h o s t   d i s c o v e r y   a n d   a u t h e n t i c a t i o n   a u t o m a t i c a l l y .   S e e   a n   e x a m p l e   h e r e .   F o r   a   P y t h o n   c l i e n t ,   u s e   t h e   o f f i c i a l   P y t h o n   c l i e n t   l i b r a r y .   T h e   c o n f i g . l o a d _ i n c l u s t e r _ c o n f i g ( )   f u n c t i o n   h a n d l e s   A P I   h o s t   d i s c o v e r y   a n d   a u t h e n t i c a t i o n   a u t o m a t i c a l l y .   S e e   a n   e x a m p l e   h e r e .   T h e r e   a r e   a   n u m b e r   o f   o t h e r   l i b r a r i e s   a v a i l a b l e ,   p l e a s e   r e f e r   t o   t h e   C l i e n t   L i b r a r i e s   p a g e .   I n   e a c h   c a s e ,   t h e   s e r v i c


Question: What is Directly accessing the REST API?

Answer: W h i l e   r u n n i n g   i n   a   P o d ,   y o u r   c o n t a i n e r   c a n   c r e a t e   a n   H T T P S   U R L   f o r   t h e   K u b e r n e t e s   A P I   s e r v e r   b y   f e t c h i n g   t h e   K U B E R N E T E S _ S E R V I C E _ H O S T   a n d   K U B E R N E T E S _ S E R V I C E _ P O R T _ H T T P S   e n v i r o n m e n t   v a r i a b l e s .   T h e   A P I   s e r v e r ' s   i n - c l u s t e r   a d d r e s s   i s   a l s o   p u b l i s h e d   t o   a   S e r v i c e   n a m e d   k u b e r n e t e s   i n   t h e   d e f a u l t   n a m e s p a c e   s o   t h a t   p o d s   m a y   r e f e r e n c e   k u b e r n e t e s . d e f a u l t . s v c   a s   a   D N S   n a m e   f o r   t h e   l o c a l   A P I   s e r v e r .


Question: What is Note:?

Answer: T h e   r e c o m m e n d e d   w a y   t o   a u t h e n t i c a t e   t o   t h e   A P I   s e r v e r   i s   w i t h   a   s e r v i c e   a c c o u n t   c r e d e n t i a l .   B y   d e f a u l t ,   a   P o d   i s   a s s o c i a t e d   w i t h   a   s e r v i c e   a c c o u n t ,   a n d   a   c r e d e n t i a l   ( t o k e n )   f o r   t h a t   s e r v i c e   a c c o u n t   i s   p l a c e d   i n t o   t h e   f i l e s y s t e m   t r e e   o f   e a c h   c o n t a i n e r   i n   t h a t   P o d ,   a t   / v a r / r u n / s e c r e t s / k u b e r n e t e s . i o / s e r v i c e a c c o u n t / t o k e n .   I f   a v a i l a b l e ,   a   c e r t i f i c a t e   b u n d l e   i s   p l a c e d   i n t o   t h e   f i l e s y s t e m   t r e e   o f   e a c h   c o n t a i n e r   a t   / v a r / r u n / s e c r e t s / k u b e r n e t e s . i o / s e r v i c e a c c o u n t / c a . c r t ,   a n d   s h o u l d   b e   u s e d   t o   v e r i f y   t h e   s e r v i n g   c e r t i f i c a t e   o f   t h e   A P I   s e r v e r .   F i n a l l y ,   t h e   d e f a u l t   n a m e s p a c e   t o   b e   u s e d   f o r   n a m e s p a c e d   A P I   o p e r a t i o n s   i s   p l a c e d   i n   a   f i l e   a t   / v a r / r u n / s e c r e t s / k u b e r n e t e s . i o / s e r v i c e a c c o u n t / n a m e s p a c e   i n   e a c h   c o n t a i n e r .


Question: What is Using kubectl proxy?

Answer: I f   y o u   w o u l d   l i k e   t o   q u e r y   t h e   A P I   w i t h o u t   a n   o f f i c i a l   c l i e n t   l i b r a r y ,   y o u   c a n   r u n   k u b e c t l   p r o x y   a s   t h e   c o m m a n d   o f   a   n e w   s i d e c a r   c o n t a i n e r   i n   t h e   P o d .   T h i s   w a y ,   k u b e c t l   p r o x y   w i l l   a u t h e n t i c a t e   t o   t h e   A P I   a n d   e x p o s e   i t   o n   t h e   l o c a l h o s t   i n t e r f a c e   o f   t h e   P o d ,   s o   t h a t   o t h e r   c o n t a i n e r s   i n   t h e   P o d   c a n   u s e   i t   d i r e c t l y .


Question: What is Without using a proxy?

Answer: I t   i s   p o s s i b l e   t o   a v o i d   u s i n g   t h e   k u b e c t l   p r o x y   b y   p a s s i n g   t h e   a u t h e n t i c a t i o n   t o k e n   d i r e c t l y   t o   t h e   A P I   s e r v e r .   T h e   i n t e r n a l   c e r t i f i c a t e   s e c u r e s   t h e   c o n n e c t i o n .   #   P o i n t   t o   t h e   i n t e r n a l   A P I   s e r v e r   h o s t n a m e   A P I S E R V E R = h t t p s : / / k u b e r n e t e s . d e f a u l t . s v c   #   P a t h   t o   S e r v i c e A c c o u n t   t o k e n   S E R V I C E A C C O U N T = / v a r / r u n / s e c r e t s / k u b e r n e t e s . i o / s e r v i c e a c c o u n t   #   R e a d   t h i s   P o d ' s   n a m e s p a c e   N A M E S P A C E = $ ( c a t   $ { S E R V I C E A C C O U N T } / n a m e s p a c e )   #   R e a d   t h e   S e r v i c e A c c o u n t   b e a r e r   t o k e n   T O K E N = $ ( c a t   $ { S E R V I C E A C C O U N T } / t o k e n )   #   R e f e r e n c e   t h e   i n t e r n a l   c e r t i f i c a t e   a u t h o r i t y   ( C A )   C A C E R T = $ { S E R V I C E A C C O U N T } / c a . c r t   #   E x p l o r e   t h e   A P I   w i t h   T O K E N   c u r l   - - c a c e r t   $ { C A C E R T }   - - h e a d e r   " A u t h o r i z a t i o n :   B e a r e r   $ { T O K E N } "   - X   G E T   $ { A P I S E R V E R } / a p i   T h e   o u t p u t   w i l l   b e   s i m i l a r   t o   t h i s :   {   " k i n d " :   " A P I V e r s i o n s " ,   " v e r s i o n s " :   [ " v 1 " ] ,   " s e r v e r A d d r e s s B y C l i e n t C I D R s " :   [   {   " c l i e n t C I D R " :   " 0 . 0 . 0 . 0 / 0 " ,   " s e r v e r A d d r e s s " :   " 1 0 . 0 . 1 . 1 4 9 : 4 4 3 "   }   ]   }


Question: What is Linux kernel security constraints for Pods and containers?

Answer: Linux kernel security constraints for Pods and containersOverview of Linux kernel security modules and constraints that you can use to harden your Pods and containers.This page describes some of the security features that are built into the Linux kernel that you can use in your Kubernetes workloads. To learn how to apply these features to your Pods and containers, refer to Configure a SecurityContext for a Pod or Container. You should already be familiar with Linux and with the basics of Kubernetes workloads.Run workloads without root privilegesWhen you deploy a workload in Kubernetes, use the Pod specification to restrict that workload from running as the root user on the node. You can use the Pod securityContext to define the specific Linux user and group for the processes in the Pod, and explicitly restrict containers from running as root users. Setting these values in the Pod manifest takes precedence over similar values in the container image, which is especially useful if you're running images that you don't own.Caution:Ensure that the user or group that you assign to the workload has the permissions required for the application to function correctly. Changing the user or group to one that doesn't have the correct permissions could lead to file access issues or failed operations.Configuring the kernel security features on this page provides fine-grained control over the actions that processes in your cluster can take, but managing these configurations can be challenging at scale. Running containers as non-root, or in user namespaces if you need root privileges, helps to reduce the chance that you'll need to enforce your configured kernel security capabilities.Security features in the Linux kernelKubernetes lets you configure and use Linux kernel features to improve isolation and harden your containerized workloads. Common features include the following:Secure computing mode (seccomp): Filter which system calls a process can makeAppArmor: Restrict the access privileges of individual programsSecurity Enhanced Linux (SELinux): Assign security labels to objects for more manageable security policy enforcementTo configure settings for one of these features, the operating system that you choose for your nodes must enable the feature in the kernel. For example, Ubuntu 7.10 and later enable AppArmor by default. To learn whether your OS enables a specific feature, consult the OS documentation.You use the securityContext field in your Pod specification to define the constraints that apply to those processes. The securityContext field also supports other security settings, such as specific Linux capabilities or file access permissions using UIDs and GIDs. To learn more, refer to Configure a SecurityContext for a Pod or Container.seccompSome of your workloads might need privileges to perform specific actions as the root user on your node's host machine. Linux uses capabilities to divide the available privileges into categories, so that processes can get


Question: How does Linux kernel security constraints for Pods and containers work?

Answer: Linux kernel security constraints for Pods and containersOverview of Linux kernel security modules and constraints that you can use to harden your Pods and containers.This page describes some of the security features that are built into the Linux kernel that you can use in your Kubernetes workloads. To learn how to apply these features to your Pods and containers, refer to Configure a SecurityContext for a Pod or Container. You should already be familiar with Linux and with the basics of Kubernetes workloads.Run workloads without root privilegesWhen you deploy a workload in Kubernetes, use the Pod specification to restrict that workload from running as the root user on the node. You can use the Pod securityContext to define the specific Linux user and group for the processes in the Pod, and explicitly restrict containers from running as root users. Setting these values in the Pod manifest takes precedence over similar values in the container image, which is especially useful if you're running images that you don't own.Caution:Ensure that the user or group that you assign to the workload has the permissions required for the application to function correctly. Changing the user or group to one that doesn't have the correct permissions could lead to file access issues or failed operations.Configuring the kernel security features on this page provides fine-grained control over the actions that processes in your cluster can take, but managing these configurations can be challenging at scale. Running containers as non-root, or in user namespaces if you need root privileges, helps to reduce the chance that you'll need to enforce your configured kernel security capabilities.Security features in the Linux kernelKubernetes lets you configure and use Linux kernel features to improve isolation and harden your containerized workloads. Common features include the following:Secure computing mode (seccomp): Filter which system calls a process can makeAppArmor: Restrict the access privileges of individual programsSecurity Enhanced Linux (SELinux): Assign security labels to objects for more manageable security policy enforcementTo configure settings for one of these features, the operating system that you choose for your nodes must enable the feature in the kernel. For example, Ubuntu 7.10 and later enable AppArmor by default. To learn whether your OS enables a specific feature, consult the OS documentation.You use the securityContext field in your Pod specification to define the constraints that apply to those processes. The securityContext field also supports other security settings, such as specific Linux capabilities or file access permissions using UIDs and GIDs. To learn more, refer to Configure a SecurityContext for a Pod or Container.seccompSome of your workloads might need privileges to perform specific actions as the root user on your node's host machine. Linux uses capabilities to divide the available privileges into categories, so that processes can get


Question: When would you use Linux kernel security constraints for Pods and containers?

Answer: Linux kernel security constraints for Pods and containersOverview of Linux kernel security modules and constraints that you can use to harden your Pods and containers.This page describes some of the security features that are built into the Linux kernel that you can use in your Kubernetes workloads. To learn how to apply these features to your Pods and containers, refer to Configure a SecurityContext for a Pod or Container. You should already be familiar with Linux and with the basics of Kubernetes workloads.Run workloads without root privilegesWhen you deploy a workload in Kubernetes, use the Pod specification to restrict that workload from running as the root user on the node. You can use the Pod securityContext to define the specific Linux user and group for the processes in the Pod, and explicitly restrict containers from running as root users. Setting these values in the Pod manifest takes precedence over similar values in the container image, which is especially useful if you're running images that you don't own.Caution:Ensure that the user or group that you assign to the workload has the permissions required for the application to function correctly. Changing the user or group to one that doesn't have the correct permissions could lead to file access issues or failed operations.Configuring the kernel security features on this page provides fine-grained control over the actions that processes in your cluster can take, but managing these configurations can be challenging at scale. Running containers as non-root, or in user namespaces if you need root privileges, helps to reduce the chance that you'll need to enforce your configured kernel security capabilities.Security features in the Linux kernelKubernetes lets you configure and use Linux kernel features to improve isolation and harden your containerized workloads. Common features include the following:Secure computing mode (seccomp): Filter which system calls a process can makeAppArmor: Restrict the access privileges of individual programsSecurity Enhanced Linux (SELinux): Assign security labels to objects for more manageable security policy enforcementTo configure settings for one of these features, the operating system that you choose for your nodes must enable the feature in the kernel. For example, Ubuntu 7.10 and later enable AppArmor by default. To learn whether your OS enables a specific feature, consult the OS documentation.You use the securityContext field in your Pod specification to define the constraints that apply to those processes. The securityContext field also supports other security settings, such as specific Linux capabilities or file access permissions using UIDs and GIDs. To learn more, refer to Configure a SecurityContext for a Pod or Container.seccompSome of your workloads might need privileges to perform specific actions as the root user on your node's host machine. Linux uses capabilities to divide the available privileges into categories, so that processes can get


Question: What are the benefits of Linux kernel security constraints for Pods and containers?

Answer: Linux kernel security constraints for Pods and containersOverview of Linux kernel security modules and constraints that you can use to harden your Pods and containers.This page describes some of the security features that are built into the Linux kernel that you can use in your Kubernetes workloads. To learn how to apply these features to your Pods and containers, refer to Configure a SecurityContext for a Pod or Container. You should already be familiar with Linux and with the basics of Kubernetes workloads.Run workloads without root privilegesWhen you deploy a workload in Kubernetes, use the Pod specification to restrict that workload from running as the root user on the node. You can use the Pod securityContext to define the specific Linux user and group for the processes in the Pod, and explicitly restrict containers from running as root users. Setting these values in the Pod manifest takes precedence over similar values in the container image, which is especially useful if you're running images that you don't own.Caution:Ensure that the user or group that you assign to the workload has the permissions required for the application to function correctly. Changing the user or group to one that doesn't have the correct permissions could lead to file access issues or failed operations.Configuring the kernel security features on this page provides fine-grained control over the actions that processes in your cluster can take, but managing these configurations can be challenging at scale. Running containers as non-root, or in user namespaces if you need root privileges, helps to reduce the chance that you'll need to enforce your configured kernel security capabilities.Security features in the Linux kernelKubernetes lets you configure and use Linux kernel features to improve isolation and harden your containerized workloads. Common features include the following:Secure computing mode (seccomp): Filter which system calls a process can makeAppArmor: Restrict the access privileges of individual programsSecurity Enhanced Linux (SELinux): Assign security labels to objects for more manageable security policy enforcementTo configure settings for one of these features, the operating system that you choose for your nodes must enable the feature in the kernel. For example, Ubuntu 7.10 and later enable AppArmor by default. To learn whether your OS enables a specific feature, consult the OS documentation.You use the securityContext field in your Pod specification to define the constraints that apply to those processes. The securityContext field also supports other security settings, such as specific Linux capabilities or file access permissions using UIDs and GIDs. To learn more, refer to Configure a SecurityContext for a Pod or Container.seccompSome of your workloads might need privileges to perform specific actions as the root user on your node's host machine. Linux uses capabilities to divide the available privileges into categories, so that processes can get


Question: What is Linux kernel security constraints for Pods and containers?

Answer: T h i s   p a g e   d e s c r i b e s   s o m e   o f   t h e   s e c u r i t y   f e a t u r e s   t h a t   a r e   b u i l t   i n t o   t h e   L i n u x   k e r n e l   t h a t   y o u   c a n   u s e   i n   y o u r   K u b e r n e t e s   w o r k l o a d s .   T o   l e a r n   h o w   t o   a p p l y   t h e s e   f e a t u r e s   t o   y o u r   P o d s   a n d   c o n t a i n e r s ,   r e f e r   t o   C o n f i g u r e   a   S e c u r i t y C o n t e x t   f o r   a   P o d   o r   C o n t a i n e r .   Y o u   s h o u l d   a l r e a d y   b e   f a m i l i a r   w i t h   L i n u x   a n d   w i t h   t h e   b a s i c s   o f   K u b e r n e t e s   w o r k l o a d s .


Question: What is Run workloads without root privileges?

Answer: W h e n   y o u   d e p l o y   a   w o r k l o a d   i n   K u b e r n e t e s ,   u s e   t h e   P o d   s p e c i f i c a t i o n   t o   r e s t r i c t   t h a t   w o r k l o a d   f r o m   r u n n i n g   a s   t h e   r o o t   u s e r   o n   t h e   n o d e .   Y o u   c a n   u s e   t h e   P o d   s e c u r i t y C o n t e x t   t o   d e f i n e   t h e   s p e c i f i c   L i n u x   u s e r   a n d   g r o u p   f o r   t h e   p r o c e s s e s   i n   t h e   P o d ,   a n d   e x p l i c i t l y   r e s t r i c t   c o n t a i n e r s   f r o m   r u n n i n g   a s   r o o t   u s e r s .   S e t t i n g   t h e s e   v a l u e s   i n   t h e   P o d   m a n i f e s t   t a k e s   p r e c e d e n c e   o v e r   s i m i l a r   v a l u e s   i n   t h e   c o n t a i n e r   i m a g e ,   w h i c h   i s   e s p e c i a l l y   u s e f u l   i f   y o u ' r e   r u n n i n g   i m a g e s   t h a t   y o u   d o n ' t   o w n .


Question: What is Caution:?

Answer: C o n f i g u r i n g   t h e   k e r n e l   s e c u r i t y   f e a t u r e s   o n   t h i s   p a g e   p r o v i d e s   f i n e - g r a i n e d   c o n t r o l   o v e r   t h e   a c t i o n s   t h a t   p r o c e s s e s   i n   y o u r   c l u s t e r   c a n   t a k e ,   b u t   m a n a g i n g   t h e s e   c o n f i g u r a t i o n s   c a n   b e   c h a l l e n g i n g   a t   s c a l e .   R u n n i n g   c o n t a i n e r s   a s   n o n - r o o t ,   o r   i n   u s e r   n a m e s p a c e s   i f   y o u   n e e d   r o o t   p r i v i l e g e s ,   h e l p s   t o   r e d u c e   t h e   c h a n c e   t h a t   y o u ' l l   n e e d   t o   e n f o r c e   y o u r   c o n f i g u r e d   k e r n e l   s e c u r i t y   c a p a b i l i t i e s .


Question: What is Security features in the Linux kernel?

Answer: K u b e r n e t e s   l e t s   y o u   c o n f i g u r e   a n d   u s e   L i n u x   k e r n e l   f e a t u r e s   t o   i m p r o v e   i s o l a t i o n   a n d   h a r d e n   y o u r   c o n t a i n e r i z e d   w o r k l o a d s .   C o m m o n   f e a t u r e s   i n c l u d e   t h e   f o l l o w i n g :   S e c u r e   c o m p u t i n g   m o d e   ( s e c c o m p ) :   F i l t e r   w h i c h   s y s t e m   c a l l s   a   p r o c e s s   c a n   m a k e A p p A r m o r :   R e s t r i c t   t h e   a c c e s s   p r i v i l e g e s   o f   i n d i v i d u a l   p r o g r a m s S e c u r i t y   E n h a n c e d   L i n u x   ( S E L i n u x ) :   A s s i g n   s e c u r i t y   l a b e l s   t o   o b j e c t s   f o r   m o r e   m a n a g e a b l e   s e c u r i t y   p o l i c y   e n f o r c e m e n t   T o   c o n f i g u r e   s e t t i n g s   f o r   o n e   o f   t h e s e   f e a t u r e s ,   t h e   o p e r a t i n g   s y s t e m   t h a t   y o u   c h o o s e   f o r   y o u r   n o d e s   m u s t   e n a b l e   t h e   f e a t u r e   i n   t h e   k e r n e l .   F o r   e x a m p l e ,   U b u n t u   7 . 1 0   a n d   l a t e r   e n a b l e   A p p A r m o r   b y   d e f a u l t .   T o   l e a r n   w h e t h e r   y o u r   O S   e n a b l e s   a   s p e c i f i c   f e a t u r e ,   c o n s u l t   t h e   O S   d o c u m e n t a t i o n .   Y o u   u s e   t h e   s e c u r i t y C o n t e x t   f i e l d   i n   y o u r   P o d   s p e c i f i c a t i o n   t o   d e f i n e   t h e   c o n s t r a i n t s   t h a t   a p p l y   t o   t h o s e   p r o c e s s e s .   T h e   s e c u r i t y C o n t e x t   f i e l d   a l s o   s u p p o r t s   o t h e r   s e c u r i t y   s e t t i n g s ,   s u c h   a s   s p e c i f i c   L i n u x   c a p a b i l i t i e s   o r   f i l e   a c c e s s   p e r m i s s i o n s   u s i n g   U I D s   a n d   G I D s .   T o   l e a r n   m o r e ,   r e f e r   t o   C o n f i g


Question: What is seccomp?

Answer: S o m e   o f   y o u r   w o r k l o a d s   m i g h t   n e e d   p r i v i l e g e s   t o   p e r f o r m   s p e c i f i c   a c t i o n s   a s   t h e   r o o t   u s e r   o n   y o u r   n o d e ' s   h o s t   m a c h i n e .   L i n u x   u s e s   c a p a b i l i t i e s   t o   d i v i d e   t h e   a v a i l a b l e   p r i v i l e g e s   i n t o   c a t e g o r i e s ,   s o   t h a t   p r o c e s s e s   c a n   g e t   t h e   p r i v i l e g e s   r e q u i r e d   t o   p e r f o r m   s p e c i f i c   a c t i o n s   w i t h o u t   b e i n g   g r a n t e d   a l l   p r i v i l e g e s .   E a c h   c a p a b i l i t y   h a s   a   s e t   o f   s y s t e m   c a l l s   ( s y s c a l l s )   t h a t   a   p r o c e s s   c a n   m a k e .   s e c c o m p   l e t s   y o u   r e s t r i c t   t h e s e   i n d i v i d u a l   s y s c a l l s .   I t   c a n   b e   u s e d   t o   s a n d b o x   t h e   p r i v i l e g e s   o f   a   p r o c e s s ,   r e s t r i c t i n g   t h e   c a l l s   i t   i s   a b l e   t o   m a k e   f r o m   u s e r s p a c e   i n t o   t h e   k e r n e l .   I n   K u b e r n e t e s ,   y o u   u s e   a   c o n t a i n e r   r u n t i m e   o n   e a c h   n o d e   t o   r u n   y o u r   c o n t a i n e r s .   E x a m p l e   r u n t i m e s   i n c l u d e   C R I - O ,   D o c k e r ,   o r   c o n t a i n e r d .   E a c h   r u n t i m e   a l l o w s   o n l y   a   s u b s e t   o f   L i n u x   c a p a b i l i t i e s   b y   d e f a u l t .   Y o u   c a n   f u r t h e r   l i m i t   t h e   a l l o w e d   s y s c a l l s   i n d i v i d u a l l y   b y   u s i n g   a   s e c c o m p   p r o f i l e .   C o n t a i n e r   r u n t i m e s   u s u a l l y   i n c l u d e   a   d e f a u l t   s e c c o m p   p r o f i l e .   K u b e r n e t e s   l e t s   y o u   a u t o m a t i c a l l y   a p p l y   s e c c o m p   p r o f i l e s   l o a d e d   o n t o   a   n o d e   t o   y o


Question: What is Note:?

Answer: T o   l e a r n   h o w   t o   i m p l e m e n t   s e c c o m p   i n   K u b e r n e t e s ,   r e f e r   t o   R e s t r i c t   a   C o n t a i n e r ' s   S y s c a l l s   w i t h   s e c c o m p   o r   t h e   S e c c o m p   n o d e   r e f e r e n c e   T o   l e a r n   m o r e   a b o u t   s e c c o m p ,   s e e   S e c c o m p   B P F   i n   t h e   L i n u x   k e r n e l   d o c u m e n t a t i o n .


Question: What is Considerations for seccomp?

Answer: s e c c o m p   i s   a   l o w - l e v e l   s e c u r i t y   c o n f i g u r a t i o n   t h a t   y o u   s h o u l d   o n l y   c o n f i g u r e   y o u r s e l f   i f   y o u   r e q u i r e   f i n e - g r a i n e d   c o n t r o l   o v e r   L i n u x   s y s c a l l s .   U s i n g   s e c c o m p ,   e s p e c i a l l y   a t   s c a l e ,   h a s   t h e   f o l l o w i n g   r i s k s :   C o n f i g u r a t i o n s   m i g h t   b r e a k   d u r i n g   a p p l i c a t i o n   u p d a t e s A t t a c k e r s   c a n   s t i l l   u s e   a l l o w e d   s y s c a l l s   t o   e x p l o i t   v u l n e r a b i l i t i e s P r o f i l e   m a n a g e m e n t   f o r   i n d i v i d u a l   a p p l i c a t i o n s   b e c o m e s   c h a l l e n g i n g   a t   s c a l e   R e c o m m e n d a t i o n :   U s e   t h e   d e f a u l t   s e c c o m p   p r o f i l e   t h a t ' s   b u n d l e d   w i t h   y o u r   c o n t a i n e r   r u n t i m e .   I f   y o u   n e e d   a   m o r e   i s o l a t e d   e n v i r o n m e n t ,   c o n s i d e r   u s i n g   a   s a n d b o x ,   s u c h   a s   g V i s o r .   S a n d b o x e s   s o l v e   t h e   p r e c e d i n g   r i s k s   w i t h   c u s t o m   s e c c o m p   p r o f i l e s ,   b u t   r e q u i r e   m o r e   c o m p u t e   r e s o u r c e s   o n   y o u r   n o d e s   a n d   m i g h t   h a v e   c o m p a t i b i l i t y   i s s u e s   w i t h   G P U s   a n d   o t h e r   s p e c i a l i z e d   h a r d w a r e .


Question: What is AppArmor and SELinux: policy-based mandatory access control?

Answer: Y o u   c a n   u s e   L i n u x   p o l i c y - b a s e d   m a n d a t o r y   a c c e s s   c o n t r o l   ( M A C )   m e c h a n i s m s ,   s u c h   a s   A p p A r m o r   a n d   S E L i n u x ,   t o   h a r d e n   y o u r   K u b e r n e t e s   w o r k l o a d s .


Question: What is AppArmor?

Answer: A p p A r m o r   i s   a   L i n u x   k e r n e l   s e c u r i t y   m o d u l e   t h a t   s u p p l e m e n t s   t h e   s t a n d a r d   L i n u x   u s e r   a n d   g r o u p   b a s e d   p e r m i s s i o n s   t o   c o n f i n e   p r o g r a m s   t o   a   l i m i t e d   s e t   o f   r e s o u r c e s .   A p p A r m o r   c a n   b e   c o n f i g u r e d   f o r   a n y   a p p l i c a t i o n   t o   r e d u c e   i t s   p o t e n t i a l   a t t a c k   s u r f a c e   a n d   p r o v i d e   g r e a t e r   i n - d e p t h   d e f e n s e .   I t   i s   c o n f i g u r e d   t h r o u g h   p r o f i l e s   t u n e d   t o   a l l o w   t h e   a c c e s s   n e e d e d   b y   a   s p e c i f i c   p r o g r a m   o r   c o n t a i n e r ,   s u c h   a s   L i n u x   c a p a b i l i t i e s ,   n e t w o r k   a c c e s s ,   a n d   f i l e   p e r m i s s i o n s .   E a c h   p r o f i l e   c a n   b e   r u n   i n   e i t h e r   e n f o r c i n g   m o d e ,   w h i c h   b l o c k s   a c c e s s   t o   d i s a l l o w e d   r e s o u r c e s ,   o r   c o m p l a i n   m o d e ,   w h i c h   o n l y   r e p o r t s   v i o l a t i o n s .   A p p A r m o r   c a n   h e l p   y o u   t o   r u n   a   m o r e   s e c u r e   d e p l o y m e n t   b y   r e s t r i c t i n g   w h a t   c o n t a i n e r s   a r e   a l l o w e d   t o   d o ,   a n d / o r   p r o v i d e   b e t t e r   a u d i t i n g   t h r o u g h   s y s t e m   l o g s .   T h e   c o n t a i n e r   r u n t i m e   t h a t   y o u   u s e   m i g h t   s h i p   w i t h   a   d e f a u l t   A p p A r m o r   p r o f i l e ,   o r   y o u   c a n   u s e   a   c u s t o m   p r o f i l e .   T o   l e a r n   h o w   t o   u s e   A p p A r m o r   i n   K u b e r n e t e s ,   r e f e r   t o   R e s t r i c t   a   C o n t a i n e r ' s   A c c e s s   t o   R e s o u r c e s   w i t h   A p p A r m o r .


Question: What is SELinux?

Answer: S E L i n u x   i s   a   L i n u x   k e r n e l   s e c u r i t y   m o d u l e   t h a t   l e t s   y o u   r e s t r i c t   t h e   a c c e s s   t h a t   a   s p e c i f i c   s u b j e c t ,   s u c h   a s   a   p r o c e s s ,   h a s   t o   t h e   f i l e s   o n   y o u r   s y s t e m .   Y o u   d e f i n e   s e c u r i t y   p o l i c i e s   t h a t   a p p l y   t o   s u b j e c t s   t h a t   h a v e   s p e c i f i c   S E L i n u x   l a b e l s .   W h e n   a   p r o c e s s   t h a t   h a s   a n   S E L i n u x   l a b e l   a t t e m p t s   t o   a c c e s s   a   f i l e ,   t h e   S E L i n u x   s e r v e r   c h e c k s   w h e t h e r   t h a t   p r o c e s s '   s e c u r i t y   p o l i c y   a l l o w s   t h e   a c c e s s   a n d   m a k e s   a n   a u t h o r i z a t i o n   d e c i s i o n .   I n   K u b e r n e t e s ,   y o u   c a n   s e t   a n   S E L i n u x   l a b e l   i n   t h e   s e c u r i t y C o n t e x t   f i e l d   o f   y o u r   m a n i f e s t .   T h e   s p e c i f i e d   l a b e l s   a r e   a s s i g n e d   t o   t h o s e   p r o c e s s e s .   I f   y o u   h a v e   c o n f i g u r e d   s e c u r i t y   p o l i c i e s   t h a t   a f f e c t   t h o s e   l a b e l s ,   t h e   h o s t   O S   k e r n e l   e n f o r c e s   t h e s e   p o l i c i e s .   T o   l e a r n   h o w   t o   u s e   S E L i n u x   i n   K u b e r n e t e s ,   r e f e r   t o   A s s i g n   S E L i n u x   l a b e l s   t o   a   c o n t a i n e r .


Question: What is Differences between AppArmor and SELinux?

Answer: T h e   o p e r a t i n g   s y s t e m   o n   y o u r   L i n u x   n o d e s   u s u a l l y   i n c l u d e s   o n e   o f   e i t h e r   A p p A r m o r   o r   S E L i n u x .   B o t h   m e c h a n i s m s   p r o v i d e   s i m i l a r   t y p e s   o f   p r o t e c t i o n ,   b u t   h a v e   d i f f e r e n c e s   s u c h   a s   t h e   f o l l o w i n g :   C o n f i g u r a t i o n :   A p p A r m o r   u s e s   p r o f i l e s   t o   d e f i n e   a c c e s s   t o   r e s o u r c e s .   S E L i n u x   u s e s   p o l i c i e s   t h a t   a p p l y   t o   s p e c i f i c   l a b e l s . P o l i c y   a p p l i c a t i o n :   I n   A p p A r m o r ,   y o u   d e f i n e   r e s o u r c e s   u s i n g   f i l e   p a t h s .   S E L i n u x   u s e s   t h e   i n d e x   n o d e   ( i n o d e )   o f   a   r e s o u r c e   t o   i d e n t i f y   t h e   r e s o u r c e .


Question: What is Summary of features?

Answer: T h e   f o l l o w i n g   t a b l e   d e s c r i b e s   t h e   u s e   c a s e s   a n d   s c o p e   o f   e a c h   s e c u r i t y   c o n t r o l .   Y o u   c a n   u s e   a l l   o f   t h e s e   c o n t r o l s   t o g e t h e r   t o   b u i l d   a   m o r e   h a r d e n e d   s y s t e m .


Question: What is Considerations for managing custom configurations?

Answer: s e c c o m p ,   A p p A r m o r ,   a n d   S E L i n u x   u s u a l l y   h a v e   a   d e f a u l t   c o n f i g u r a t i o n   t h a t   o f f e r s   b a s i c   p r o t e c t i o n s .   Y o u   c a n   a l s o   c r e a t e   c u s t o m   p r o f i l e s   a n d   p o l i c i e s   t h a t   m e e t   t h e   r e q u i r e m e n t s   o f   y o u r   w o r k l o a d s .   M a n a g i n g   a n d   d i s t r i b u t i n g   t h e s e   c u s t o m   c o n f i g u r a t i o n s   a t   s c a l e   m i g h t   b e   c h a l l e n g i n g ,   e s p e c i a l l y   i f   y o u   u s e   a l l   t h r e e   f e a t u r e s   t o g e t h e r .   T o   h e l p   y o u   t o   m a n a g e   t h e s e   c o n f i g u r a t i o n s   a t   s c a l e ,   u s e   a   t o o l   l i k e   t h e   K u b e r n e t e s   S e c u r i t y   P r o f i l e s   O p e r a t o r .


Question: What is Kernel-level security features and privileged containers?

Answer: K u b e r n e t e s   l e t s   y o u   s p e c i f y   t h a t   s o m e   t r u s t e d   c o n t a i n e r s   c a n   r u n   i n   p r i v i l e g e d   m o d e .   A n y   c o n t a i n e r   i n   a   P o d   c a n   r u n   i n   p r i v i l e g e d   m o d e   t o   u s e   o p e r a t i n g   s y s t e m   a d m i n i s t r a t i v e   c a p a b i l i t i e s   t h a t   w o u l d   o t h e r w i s e   b e   i n a c c e s s i b l e .   T h i s   i s   a v a i l a b l e   f o r   b o t h   W i n d o w s   a n d   L i n u x .   P r i v i l e g e d   c o n t a i n e r s   e x p l i c i t l y   o v e r r i d e   s o m e   o f   t h e   L i n u x   k e r n e l   c o n s t r a i n t s   t h a t   y o u   m i g h t   u s e   i n   y o u r   w o r k l o a d s ,   a s   f o l l o w s :   s e c c o m p :   P r i v i l e g e d   c o n t a i n e r s   r u n   a s   t h e   U n c o n f i n e d   s e c c o m p   p r o f i l e ,   o v e r r i d i n g   a n y   s e c c o m p   p r o f i l e   t h a t   y o u   s p e c i f i e d   i n   y o u r   m a n i f e s t . A p p A r m o r :   P r i v i l e g e d   c o n t a i n e r s   i g n o r e   a n y   a p p l i e d   A p p A r m o r   p r o f i l e s . S E L i n u x :   P r i v i l e g e d   c o n t a i n e r s   r u n   a s   t h e   u n c o n f i n e d _ t   d o m a i n .


Question: What is Privileged containers?

Answer: A n y   c o n t a i n e r   i n   a   P o d   c a n   e n a b l e   P r i v i l e g e d   m o d e   i f   y o u   s e t   t h e   p r i v i l e g e d :   t r u e   f i e l d   i n   t h e   s e c u r i t y C o n t e x t   f i e l d   f o r   t h e   c o n t a i n e r .   P r i v i l e g e d   c o n t a i n e r s   o v e r r i d e   o r   u n d o   m a n y   o t h e r   h a r d e n i n g   s e t t i n g s   s u c h   a s   t h e   a p p l i e d   s e c c o m p   p r o f i l e ,   A p p A r m o r   p r o f i l e ,   o r   S E L i n u x   c o n s t r a i n t s .   P r i v i l e g e d   c o n t a i n e r s   a r e   g i v e n   a l l   L i n u x   c a p a b i l i t i e s ,   i n c l u d i n g   c a p a b i l i t i e s   t h a t   t h e y   d o n ' t   r e q u i r e .   F o r   e x a m p l e ,   a   r o o t   u s e r   i n   a   p r i v i l e g e d   c o n t a i n e r   m i g h t   b e   a b l e   t o   u s e   t h e   C A P _ S Y S _ A D M I N   a n d   C A P _ N E T _ A D M I N   c a p a b i l i t i e s   o n   t h e   n o d e ,   b y p a s s i n g   t h e   r u n t i m e   s e c c o m p   c o n f i g u r a t i o n   a n d   o t h e r   r e s t r i c t i o n s .   I n   m o s t   c a s e s ,   y o u   s h o u l d   a v o i d   u s i n g   p r i v i l e g e d   c o n t a i n e r s ,   a n d   i n s t e a d   g r a n t   t h e   s p e c i f i c   c a p a b i l i t i e s   r e q u i r e d   b y   y o u r   c o n t a i n e r   u s i n g   t h e   c a p a b i l i t i e s   f i e l d   i n   t h e   s e c u r i t y C o n t e x t   f i e l d .   O n l y   u s e   p r i v i l e g e d   m o d e   i f   y o u   h a v e   a   c a p a b i l i t y   t h a t   y o u   c a n ' t   g r a n t   w i t h   t h e   s e c u r i t y C o n t e x t .   T h i s   i s   u s e f u l   f o r   c o n t a i n e r s   t h a t   w a n t   t o   u s e   o p e r a t i n g   s y s t e m   a d m i n i s t r a t i v e   c a p a b i l i t i e s   s u c h   a s   m a n i p u l a t i n g   t h e   n e t w o


Question: What is Recommendations and best practices?

Answer: B e f o r e   c o n f i g u r i n g   k e r n e l - l e v e l   s e c u r i t y   c a p a b i l i t i e s ,   y o u   s h o u l d   c o n s i d e r   i m p l e m e n t i n g   n e t w o r k - l e v e l   i s o l a t i o n .   F o r   m o r e   i n f o r m a t i o n ,   r e a d   t h e   S e c u r i t y   C h e c k l i s t . U n l e s s   n e c e s s a r y ,   r u n   L i n u x   w o r k l o a d s   a s   n o n - r o o t   b y   s e t t i n g   s p e c i f i c   u s e r   a n d   g r o u p   I D s   i n   y o u r   P o d   m a n i f e s t   a n d   b y   s p e c i f y i n g   r u n A s N o n R o o t :   t r u e .   A d d i t i o n a l l y ,   y o u   c a n   r u n   w o r k l o a d s   i n   u s e r   n a m e s p a c e s   b y   s e t t i n g   h o s t U s e r s :   f a l s e   i n   y o u r   P o d   m a n i f e s t .   T h i s   l e t s   y o u   r u n   c o n t a i n e r s   a s   r o o t   u s e r s   i n   t h e   u s e r   n a m e s p a c e ,   b u t   a s   n o n - r o o t   u s e r s   i n   t h e   h o s t   n a m e s p a c e   o n   t h e   n o d e .   T h i s   i s   s t i l l   i n   e a r l y   s t a g e s   o f   d e v e l o p m e n t   a n d   m i g h t   n o t   h a v e   t h e   l e v e l   o f   s u p p o r t   t h a t   y o u   n e e d .   F o r   i n s t r u c t i o n s ,   r e f e r   t o   U s e   a   U s e r   N a m e s p a c e   W i t h   a   P o d .


Question: What is What's next?

Answer: L e a r n   h o w   t o   u s e   A p p A r m o r L e a r n   h o w   t o   u s e   s e c c o m p L e a r n   h o w   t o   u s e   S E L i n u x S e c c o m p   N o d e   R e f e r e n c e


Question: What is Page content types?

Answer: Page content typesThe Kubernetes documentation follows several types of page content:ConceptTaskTutorialReferenceContent sectionsEach page content type contains a number of sections defined by Markdown comments and HTML headings. You can add content headings to your page with the heading shortcode. The comments and headings help maintain the structure of the page content types.Examples of Markdown comments defining page content sections:<!-- overview --> <!-- body --> To create common headings in your content pages, use the heading shortcode with a heading string.Examples of heading strings:whatsnextprerequisitesobjectivescleanupsynopsisseealsooptionsFor example, to create a whatsnext heading, add the heading shortcode with the "whatsnext" string:## {{% heading "whatsnext" %}} You can declare a prerequisites heading as follows:## {{% heading "prerequisites" %}} The heading shortcode expects one string parameter. The heading string parameter matches the prefix of a variable in the i18n/<lang>/<lang>.toml files. For example:i18n/en/en.toml:[whatsnext_heading] other = "What's next" i18n/ko/ko.toml:[whatsnext_heading] other = "다음 내용" Content typesEach content type informally defines its expected page structure. Create page content with the suggested page sections.ConceptA concept page explains some aspect of Kubernetes. For example, a concept page might describe the Kubernetes Deployment object and explain the role it plays as an application once it is deployed, scaled, and updated. Typically, concept pages don't include sequences of steps, but instead provide links to tasks or tutorials.To write a new concept page, create a Markdown file in a subdirectory of the /content/en/docs/concepts directory, with the following characteristics:Concept pages are divided into three sections:Page sectionoverviewbodywhatsnextThe overview and body sections appear as comments in the concept page. You can add the whatsnext section to your page with the heading shortcode.Fill each section with content. Follow these guidelines:Organize content with H2 and H3 headings.For overview, set the topic's context with a single paragraph.For body, explain the concept.For whatsnext, provide a bulleted list of topics (5 maximum) to learn more about the concept.Annotations is a published example of a concept page.TaskA task page shows how to do a single thing, typically by giving a short sequence of steps. Task pages have minimal explanation, but often provide links to conceptual topics that provide related background and knowledge.To write a new task page, create a Markdown file in a subdirectory of the /content/en/docs/tasks directory, with the following characteristics:Page sectionoverviewprerequisitesstepsdiscussionwhatsnextThe overview, steps, and discussion sections appear as comments in the task page. You can add the prerequisites and whatsnext sections to your page with the heading shortcode.Within each section, write your content. Use the following guidelines:Use a minimum


Question: How does Page content types work?

Answer: Page content typesThe Kubernetes documentation follows several types of page content:ConceptTaskTutorialReferenceContent sectionsEach page content type contains a number of sections defined by Markdown comments and HTML headings. You can add content headings to your page with the heading shortcode. The comments and headings help maintain the structure of the page content types.Examples of Markdown comments defining page content sections:<!-- overview --> <!-- body --> To create common headings in your content pages, use the heading shortcode with a heading string.Examples of heading strings:whatsnextprerequisitesobjectivescleanupsynopsisseealsooptionsFor example, to create a whatsnext heading, add the heading shortcode with the "whatsnext" string:## {{% heading "whatsnext" %}} You can declare a prerequisites heading as follows:## {{% heading "prerequisites" %}} The heading shortcode expects one string parameter. The heading string parameter matches the prefix of a variable in the i18n/<lang>/<lang>.toml files. For example:i18n/en/en.toml:[whatsnext_heading] other = "What's next" i18n/ko/ko.toml:[whatsnext_heading] other = "다음 내용" Content typesEach content type informally defines its expected page structure. Create page content with the suggested page sections.ConceptA concept page explains some aspect of Kubernetes. For example, a concept page might describe the Kubernetes Deployment object and explain the role it plays as an application once it is deployed, scaled, and updated. Typically, concept pages don't include sequences of steps, but instead provide links to tasks or tutorials.To write a new concept page, create a Markdown file in a subdirectory of the /content/en/docs/concepts directory, with the following characteristics:Concept pages are divided into three sections:Page sectionoverviewbodywhatsnextThe overview and body sections appear as comments in the concept page. You can add the whatsnext section to your page with the heading shortcode.Fill each section with content. Follow these guidelines:Organize content with H2 and H3 headings.For overview, set the topic's context with a single paragraph.For body, explain the concept.For whatsnext, provide a bulleted list of topics (5 maximum) to learn more about the concept.Annotations is a published example of a concept page.TaskA task page shows how to do a single thing, typically by giving a short sequence of steps. Task pages have minimal explanation, but often provide links to conceptual topics that provide related background and knowledge.To write a new task page, create a Markdown file in a subdirectory of the /content/en/docs/tasks directory, with the following characteristics:Page sectionoverviewprerequisitesstepsdiscussionwhatsnextThe overview, steps, and discussion sections appear as comments in the task page. You can add the prerequisites and whatsnext sections to your page with the heading shortcode.Within each section, write your content. Use the following guidelines:Use a minimum


Question: When would you use Page content types?

Answer: Page content typesThe Kubernetes documentation follows several types of page content:ConceptTaskTutorialReferenceContent sectionsEach page content type contains a number of sections defined by Markdown comments and HTML headings. You can add content headings to your page with the heading shortcode. The comments and headings help maintain the structure of the page content types.Examples of Markdown comments defining page content sections:<!-- overview --> <!-- body --> To create common headings in your content pages, use the heading shortcode with a heading string.Examples of heading strings:whatsnextprerequisitesobjectivescleanupsynopsisseealsooptionsFor example, to create a whatsnext heading, add the heading shortcode with the "whatsnext" string:## {{% heading "whatsnext" %}} You can declare a prerequisites heading as follows:## {{% heading "prerequisites" %}} The heading shortcode expects one string parameter. The heading string parameter matches the prefix of a variable in the i18n/<lang>/<lang>.toml files. For example:i18n/en/en.toml:[whatsnext_heading] other = "What's next" i18n/ko/ko.toml:[whatsnext_heading] other = "다음 내용" Content typesEach content type informally defines its expected page structure. Create page content with the suggested page sections.ConceptA concept page explains some aspect of Kubernetes. For example, a concept page might describe the Kubernetes Deployment object and explain the role it plays as an application once it is deployed, scaled, and updated. Typically, concept pages don't include sequences of steps, but instead provide links to tasks or tutorials.To write a new concept page, create a Markdown file in a subdirectory of the /content/en/docs/concepts directory, with the following characteristics:Concept pages are divided into three sections:Page sectionoverviewbodywhatsnextThe overview and body sections appear as comments in the concept page. You can add the whatsnext section to your page with the heading shortcode.Fill each section with content. Follow these guidelines:Organize content with H2 and H3 headings.For overview, set the topic's context with a single paragraph.For body, explain the concept.For whatsnext, provide a bulleted list of topics (5 maximum) to learn more about the concept.Annotations is a published example of a concept page.TaskA task page shows how to do a single thing, typically by giving a short sequence of steps. Task pages have minimal explanation, but often provide links to conceptual topics that provide related background and knowledge.To write a new task page, create a Markdown file in a subdirectory of the /content/en/docs/tasks directory, with the following characteristics:Page sectionoverviewprerequisitesstepsdiscussionwhatsnextThe overview, steps, and discussion sections appear as comments in the task page. You can add the prerequisites and whatsnext sections to your page with the heading shortcode.Within each section, write your content. Use the following guidelines:Use a minimum


Question: What are the benefits of Page content types?

Answer: Page content typesThe Kubernetes documentation follows several types of page content:ConceptTaskTutorialReferenceContent sectionsEach page content type contains a number of sections defined by Markdown comments and HTML headings. You can add content headings to your page with the heading shortcode. The comments and headings help maintain the structure of the page content types.Examples of Markdown comments defining page content sections:<!-- overview --> <!-- body --> To create common headings in your content pages, use the heading shortcode with a heading string.Examples of heading strings:whatsnextprerequisitesobjectivescleanupsynopsisseealsooptionsFor example, to create a whatsnext heading, add the heading shortcode with the "whatsnext" string:## {{% heading "whatsnext" %}} You can declare a prerequisites heading as follows:## {{% heading "prerequisites" %}} The heading shortcode expects one string parameter. The heading string parameter matches the prefix of a variable in the i18n/<lang>/<lang>.toml files. For example:i18n/en/en.toml:[whatsnext_heading] other = "What's next" i18n/ko/ko.toml:[whatsnext_heading] other = "다음 내용" Content typesEach content type informally defines its expected page structure. Create page content with the suggested page sections.ConceptA concept page explains some aspect of Kubernetes. For example, a concept page might describe the Kubernetes Deployment object and explain the role it plays as an application once it is deployed, scaled, and updated. Typically, concept pages don't include sequences of steps, but instead provide links to tasks or tutorials.To write a new concept page, create a Markdown file in a subdirectory of the /content/en/docs/concepts directory, with the following characteristics:Concept pages are divided into three sections:Page sectionoverviewbodywhatsnextThe overview and body sections appear as comments in the concept page. You can add the whatsnext section to your page with the heading shortcode.Fill each section with content. Follow these guidelines:Organize content with H2 and H3 headings.For overview, set the topic's context with a single paragraph.For body, explain the concept.For whatsnext, provide a bulleted list of topics (5 maximum) to learn more about the concept.Annotations is a published example of a concept page.TaskA task page shows how to do a single thing, typically by giving a short sequence of steps. Task pages have minimal explanation, but often provide links to conceptual topics that provide related background and knowledge.To write a new task page, create a Markdown file in a subdirectory of the /content/en/docs/tasks directory, with the following characteristics:Page sectionoverviewprerequisitesstepsdiscussionwhatsnextThe overview, steps, and discussion sections appear as comments in the task page. You can add the prerequisites and whatsnext sections to your page with the heading shortcode.Within each section, write your content. Use the following guidelines:Use a minimum


Question: What is Page content types?

Answer: T h e   K u b e r n e t e s   d o c u m e n t a t i o n   f o l l o w s   s e v e r a l   t y p e s   o f   p a g e   c o n t e n t :   C o n c e p t T a s k T u t o r i a l R e f e r e n c e