Question: How does Dynamic Admission Control work?

Answer: Dynamic Admission ControlIn addition to compiled-in admission plugins, admission plugins can be developed as extensions and run as webhooks configured at runtime. This page describes how to build, configure, use, and monitor admission webhooks.What are admission webhooks?Admission webhooks are HTTP callbacks that receive admission requests and do something with them. You can define two types of admission webhooks, validating admission webhook and mutating admission webhook. Mutating admission webhooks are invoked first, and can modify objects sent to the API server to enforce custom defaults. After all object modifications are complete, and after the incoming object is validated by the API server, validating admission webhooks are invoked and can reject requests to enforce custom policies.Note:Admission webhooks that need to guarantee they see the final state of the object in order to enforce policy should use a validating admission webhook, since objects can be modified after being seen by mutating webhooks.Experimenting with admission webhooksAdmission webhooks are essentially part of the cluster control-plane. You should write and deploy them with great caution. Please read the user guides for instructions if you intend to write/deploy production-grade admission webhooks. In the following, we describe how to quickly experiment with admission webhooks.PrerequisitesEnsure that MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controllers are enabled. Here is a recommended set of admission controllers to enable in general.Ensure that the admissionregistration.k8s.io/v1 API is enabled.Write an admission webhook serverPlease refer to the implementation of the admission webhook server that is validated in a Kubernetes e2e test. The webhook handles the AdmissionReview request sent by the API servers, and sends back its decision as an AdmissionReview object in the same version it received.See the webhook request section for details on the data sent to webhooks.See the webhook response section for the data expected from webhooks.The example admission webhook server leaves the ClientAuth field empty, which defaults to NoClientCert. This means that the webhook server does not authenticate the identity of the clients, supposedly API servers. If you need mutual TLS or other ways to authenticate the clients, see how to authenticate API servers.Deploy the admission webhook serviceThe webhook server in the e2e test is deployed in the Kubernetes cluster, via the deployment API. The test also creates a service as the front-end of the webhook server. See code.You may also deploy your webhooks outside of the cluster. You will need to update your webhook configurations accordingly.Configure admission webhooks on the flyYou can dynamically configure what resources are subject to what admission webhooks via ValidatingWebhookConfiguration or MutatingWebhookConfiguration.The following is an example ValidatingWebhookConfiguration, a mutating webhook con


Question: When would you use Dynamic Admission Control?

Answer: Dynamic Admission ControlIn addition to compiled-in admission plugins, admission plugins can be developed as extensions and run as webhooks configured at runtime. This page describes how to build, configure, use, and monitor admission webhooks.What are admission webhooks?Admission webhooks are HTTP callbacks that receive admission requests and do something with them. You can define two types of admission webhooks, validating admission webhook and mutating admission webhook. Mutating admission webhooks are invoked first, and can modify objects sent to the API server to enforce custom defaults. After all object modifications are complete, and after the incoming object is validated by the API server, validating admission webhooks are invoked and can reject requests to enforce custom policies.Note:Admission webhooks that need to guarantee they see the final state of the object in order to enforce policy should use a validating admission webhook, since objects can be modified after being seen by mutating webhooks.Experimenting with admission webhooksAdmission webhooks are essentially part of the cluster control-plane. You should write and deploy them with great caution. Please read the user guides for instructions if you intend to write/deploy production-grade admission webhooks. In the following, we describe how to quickly experiment with admission webhooks.PrerequisitesEnsure that MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controllers are enabled. Here is a recommended set of admission controllers to enable in general.Ensure that the admissionregistration.k8s.io/v1 API is enabled.Write an admission webhook serverPlease refer to the implementation of the admission webhook server that is validated in a Kubernetes e2e test. The webhook handles the AdmissionReview request sent by the API servers, and sends back its decision as an AdmissionReview object in the same version it received.See the webhook request section for details on the data sent to webhooks.See the webhook response section for the data expected from webhooks.The example admission webhook server leaves the ClientAuth field empty, which defaults to NoClientCert. This means that the webhook server does not authenticate the identity of the clients, supposedly API servers. If you need mutual TLS or other ways to authenticate the clients, see how to authenticate API servers.Deploy the admission webhook serviceThe webhook server in the e2e test is deployed in the Kubernetes cluster, via the deployment API. The test also creates a service as the front-end of the webhook server. See code.You may also deploy your webhooks outside of the cluster. You will need to update your webhook configurations accordingly.Configure admission webhooks on the flyYou can dynamically configure what resources are subject to what admission webhooks via ValidatingWebhookConfiguration or MutatingWebhookConfiguration.The following is an example ValidatingWebhookConfiguration, a mutating webhook con


Question: What are the benefits of Dynamic Admission Control?

Answer: Dynamic Admission ControlIn addition to compiled-in admission plugins, admission plugins can be developed as extensions and run as webhooks configured at runtime. This page describes how to build, configure, use, and monitor admission webhooks.What are admission webhooks?Admission webhooks are HTTP callbacks that receive admission requests and do something with them. You can define two types of admission webhooks, validating admission webhook and mutating admission webhook. Mutating admission webhooks are invoked first, and can modify objects sent to the API server to enforce custom defaults. After all object modifications are complete, and after the incoming object is validated by the API server, validating admission webhooks are invoked and can reject requests to enforce custom policies.Note:Admission webhooks that need to guarantee they see the final state of the object in order to enforce policy should use a validating admission webhook, since objects can be modified after being seen by mutating webhooks.Experimenting with admission webhooksAdmission webhooks are essentially part of the cluster control-plane. You should write and deploy them with great caution. Please read the user guides for instructions if you intend to write/deploy production-grade admission webhooks. In the following, we describe how to quickly experiment with admission webhooks.PrerequisitesEnsure that MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controllers are enabled. Here is a recommended set of admission controllers to enable in general.Ensure that the admissionregistration.k8s.io/v1 API is enabled.Write an admission webhook serverPlease refer to the implementation of the admission webhook server that is validated in a Kubernetes e2e test. The webhook handles the AdmissionReview request sent by the API servers, and sends back its decision as an AdmissionReview object in the same version it received.See the webhook request section for details on the data sent to webhooks.See the webhook response section for the data expected from webhooks.The example admission webhook server leaves the ClientAuth field empty, which defaults to NoClientCert. This means that the webhook server does not authenticate the identity of the clients, supposedly API servers. If you need mutual TLS or other ways to authenticate the clients, see how to authenticate API servers.Deploy the admission webhook serviceThe webhook server in the e2e test is deployed in the Kubernetes cluster, via the deployment API. The test also creates a service as the front-end of the webhook server. See code.You may also deploy your webhooks outside of the cluster. You will need to update your webhook configurations accordingly.Configure admission webhooks on the flyYou can dynamically configure what resources are subject to what admission webhooks via ValidatingWebhookConfiguration or MutatingWebhookConfiguration.The following is an example ValidatingWebhookConfiguration, a mutating webhook con


Question: What is Dynamic Admission Control?

Answer: I n   a d d i t i o n   t o   c o m p i l e d - i n   a d m i s s i o n   p l u g i n s ,   a d m i s s i o n   p l u g i n s   c a n   b e   d e v e l o p e d   a s   e x t e n s i o n s   a n d   r u n   a s   w e b h o o k s   c o n f i g u r e d   a t   r u n t i m e .   T h i s   p a g e   d e s c r i b e s   h o w   t o   b u i l d ,   c o n f i g u r e ,   u s e ,   a n d   m o n i t o r   a d m i s s i o n   w e b h o o k s .


Question: What is What are admission webhooks??

Answer: A d m i s s i o n   w e b h o o k s   a r e   H T T P   c a l l b a c k s   t h a t   r e c e i v e   a d m i s s i o n   r e q u e s t s   a n d   d o   s o m e t h i n g   w i t h   t h e m .   Y o u   c a n   d e f i n e   t w o   t y p e s   o f   a d m i s s i o n   w e b h o o k s ,   v a l i d a t i n g   a d m i s s i o n   w e b h o o k   a n d   m u t a t i n g   a d m i s s i o n   w e b h o o k .   M u t a t i n g   a d m i s s i o n   w e b h o o k s   a r e   i n v o k e d   f i r s t ,   a n d   c a n   m o d i f y   o b j e c t s   s e n t   t o   t h e   A P I   s e r v e r   t o   e n f o r c e   c u s t o m   d e f a u l t s .   A f t e r   a l l   o b j e c t   m o d i f i c a t i o n s   a r e   c o m p l e t e ,   a n d   a f t e r   t h e   i n c o m i n g   o b j e c t   i s   v a l i d a t e d   b y   t h e   A P I   s e r v e r ,   v a l i d a t i n g   a d m i s s i o n   w e b h o o k s   a r e   i n v o k e d   a n d   c a n   r e j e c t   r e q u e s t s   t o   e n f o r c e   c u s t o m   p o l i c i e s .


Question: What is Experimenting with admission webhooks?

Answer: A d m i s s i o n   w e b h o o k s   a r e   e s s e n t i a l l y   p a r t   o f   t h e   c l u s t e r   c o n t r o l - p l a n e .   Y o u   s h o u l d   w r i t e   a n d   d e p l o y   t h e m   w i t h   g r e a t   c a u t i o n .   P l e a s e   r e a d   t h e   u s e r   g u i d e s   f o r   i n s t r u c t i o n s   i f   y o u   i n t e n d   t o   w r i t e / d e p l o y   p r o d u c t i o n - g r a d e   a d m i s s i o n   w e b h o o k s .   I n   t h e   f o l l o w i n g ,   w e   d e s c r i b e   h o w   t o   q u i c k l y   e x p e r i m e n t   w i t h   a d m i s s i o n   w e b h o o k s .


Question: What is Prerequisites?

Answer: E n s u r e   t h a t   M u t a t i n g A d m i s s i o n W e b h o o k   a n d   V a l i d a t i n g A d m i s s i o n W e b h o o k   a d m i s s i o n   c o n t r o l l e r s   a r e   e n a b l e d .   H e r e   i s   a   r e c o m m e n d e d   s e t   o f   a d m i s s i o n   c o n t r o l l e r s   t o   e n a b l e   i n   g e n e r a l . E n s u r e   t h a t   t h e   a d m i s s i o n r e g i s t r a t i o n . k 8 s . i o / v 1   A P I   i s   e n a b l e d .   E n s u r e   t h a t   M u t a t i n g A d m i s s i o n W e b h o o k   a n d   V a l i d a t i n g A d m i s s i o n W e b h o o k   a d m i s s i o n   c o n t r o l l e r s   a r e   e n a b l e d .   H e r e   i s   a   r e c o m m e n d e d   s e t   o f   a d m i s s i o n   c o n t r o l l e r s   t o   e n a b l e   i n   g e n e r a l .   E n s u r e   t h a t   t h e   a d m i s s i o n r e g i s t r a t i o n . k 8 s . i o / v 1   A P I   i s   e n a b l e d .


Question: What is Write an admission webhook server?

Answer: P l e a s e   r e f e r   t o   t h e   i m p l e m e n t a t i o n   o f   t h e   a d m i s s i o n   w e b h o o k   s e r v e r   t h a t   i s   v a l i d a t e d   i n   a   K u b e r n e t e s   e 2 e   t e s t .   T h e   w e b h o o k   h a n d l e s   t h e   A d m i s s i o n R e v i e w   r e q u e s t   s e n t   b y   t h e   A P I   s e r v e r s ,   a n d   s e n d s   b a c k   i t s   d e c i s i o n   a s   a n   A d m i s s i o n R e v i e w   o b j e c t   i n   t h e   s a m e   v e r s i o n   i t   r e c e i v e d .   S e e   t h e   w e b h o o k   r e q u e s t   s e c t i o n   f o r   d e t a i l s   o n   t h e   d a t a   s e n t   t o   w e b h o o k s .   S e e   t h e   w e b h o o k   r e s p o n s e   s e c t i o n   f o r   t h e   d a t a   e x p e c t e d   f r o m   w e b h o o k s .   T h e   e x a m p l e   a d m i s s i o n   w e b h o o k   s e r v e r   l e a v e s   t h e   C l i e n t A u t h   f i e l d   e m p t y ,   w h i c h   d e f a u l t s   t o   N o C l i e n t C e r t .   T h i s   m e a n s   t h a t   t h e   w e b h o o k   s e r v e r   d o e s   n o t   a u t h e n t i c a t e   t h e   i d e n t i t y   o f   t h e   c l i e n t s ,   s u p p o s e d l y   A P I   s e r v e r s .   I f   y o u   n e e d   m u t u a l   T L S   o r   o t h e r   w a y s   t o   a u t h e n t i c a t e   t h e   c l i e n t s ,   s e e   h o w   t o   a u t h e n t i c a t e   A P I   s e r v e r s .


Question: What is Deploy the admission webhook service?

Answer: T h e   w e b h o o k   s e r v e r   i n   t h e   e 2 e   t e s t   i s   d e p l o y e d   i n   t h e   K u b e r n e t e s   c l u s t e r ,   v i a   t h e   d e p l o y m e n t   A P I .   T h e   t e s t   a l s o   c r e a t e s   a   s e r v i c e   a s   t h e   f r o n t - e n d   o f   t h e   w e b h o o k   s e r v e r .   S e e   c o d e .   Y o u   m a y   a l s o   d e p l o y   y o u r   w e b h o o k s   o u t s i d e   o f   t h e   c l u s t e r .   Y o u   w i l l   n e e d   t o   u p d a t e   y o u r   w e b h o o k   c o n f i g u r a t i o n s   a c c o r d i n g l y .


Question: What is Configure admission webhooks on the fly?

Answer: Y o u   c a n   d y n a m i c a l l y   c o n f i g u r e   w h a t   r e s o u r c e s   a r e   s u b j e c t   t o   w h a t   a d m i s s i o n   w e b h o o k s   v i a   V a l i d a t i n g W e b h o o k C o n f i g u r a t i o n   o r   M u t a t i n g W e b h o o k C o n f i g u r a t i o n .   T h e   f o l l o w i n g   i s   a n   e x a m p l e   V a l i d a t i n g W e b h o o k C o n f i g u r a t i o n ,   a   m u t a t i n g   w e b h o o k   c o n f i g u r a t i o n   i s   s i m i l a r .   S e e   t h e   w e b h o o k   c o n f i g u r a t i o n   s e c t i o n   f o r   d e t a i l s   a b o u t   e a c h   c o n f i g   f i e l d .   a p i V e r s i o n :   a d m i s s i o n r e g i s t r a t i o n . k 8 s . i o / v 1   k i n d :   V a l i d a t i n g W e b h o o k C o n f i g u r a t i o n   m e t a d a t a :   n a m e :   " p o d - p o l i c y . e x a m p l e . c o m "   w e b h o o k s :   -   n a m e :   " p o d - p o l i c y . e x a m p l e . c o m "   r u l e s :   -   a p i G r o u p s :   [ " " ]   a p i V e r s i o n s :   [ " v 1 " ]   o p e r a t i o n s :   [ " C R E A T E " ]   r e s o u r c e s :   [ " p o d s " ]   s c o p e :   " N a m e s p a c e d "   c l i e n t C o n f i g :   s e r v i c e :   n a m e s p a c e :   " e x a m p l e - n a m e s p a c e "   n a m e :   " e x a m p l e - s e r v i c e "   c a B u n d l e :   < C A _ B U N D L E >   a d m i s s i o n R e v i e w V e r s i o n s :   [ " v 1 " ]   s i d e E f f e c t s :   N o n e   t i m e o u t S e c o n d s :   5


Question: What is Note:?

Answer: T h e   s c o p e   f i e l d   s p e c i f i e s   i f   o n l y   c l u s t e r - s c o p e d   r e s o u r c e s   ( " C l u s t e r " )   o r   n a m e s p a c e - s c o p e d   r e s o u r c e s   ( " N a m e s p a c e d " )   w i l l   m a t c h   t h i s   r u l e .   " ∗ "   m e a n s   t h a t   t h e r e   a r e   n o   s c o p e   r e s t r i c t i o n s .


Question: What is Note:?

Answer: W h e n   a n   A P I   s e r v e r   r e c e i v e s   a   r e q u e s t   t h a t   m a t c h e s   o n e   o f   t h e   r u l e s ,   t h e   A P I   s e r v e r   s e n d s   a n   a d m i s s i o n R e v i e w   r e q u e s t   t o   w e b h o o k   a s   s p e c i f i e d   i n   t h e   c l i e n t C o n f i g .   A f t e r   y o u   c r e a t e   t h e   w e b h o o k   c o n f i g u r a t i o n ,   t h e   s y s t e m   w i l l   t a k e   a   f e w   s e c o n d s   t o   h o n o r   t h e   n e w   c o n f i g u r a t i o n .


Question: What is Authenticate API servers?

Answer: I f   y o u r   a d m i s s i o n   w e b h o o k s   r e q u i r e   a u t h e n t i c a t i o n ,   y o u   c a n   c o n f i g u r e   t h e   A P I   s e r v e r s   t o   u s e   b a s i c   a u t h ,   b e a r e r   t o k e n ,   o r   a   c e r t   t o   a u t h e n t i c a t e   i t s e l f   t o   t h e   w e b h o o k s .   T h e r e   a r e   t h r e e   s t e p s   t o   c o m p l e t e   t h e   c o n f i g u r a t i o n .   W h e n   s t a r t i n g   t h e   A P I   s e r v e r ,   s p e c i f y   t h e   l o c a t i o n   o f   t h e   a d m i s s i o n   c o n t r o l   c o n f i g u r a t i o n   f i l e   v i a   t h e   - - a d m i s s i o n - c o n t r o l - c o n f i g - f i l e   f l a g . I n   t h e   a d m i s s i o n   c o n t r o l   c o n f i g u r a t i o n   f i l e ,   s p e c i f y   w h e r e   t h e   M u t a t i n g A d m i s s i o n W e b h o o k   c o n t r o l l e r   a n d   V a l i d a t i n g A d m i s s i o n W e b h o o k   c o n t r o l l e r   s h o u l d   r e a d   t h e   c r e d e n t i a l s .   T h e   c r e d e n t i a l s   a r e   s t o r e d   i n   k u b e C o n f i g   f i l e s   ( y e s ,   t h e   s a m e   s c h e m a   t h a t ' s   u s e d   b y   k u b e c t l ) ,   s o   t h e   f i e l d   n a m e   i s   k u b e C o n f i g F i l e .   H e r e   i s   a n   e x a m p l e   a d m i s s i o n   c o n t r o l   c o n f i g u r a t i o n   f i l e :   W h e n   s t a r t i n g   t h e   A P I   s e r v e r ,   s p e c i f y   t h e   l o c a t i o n   o f   t h e   a d m i s s i o n   c o n t r o l   c o n f i g u r a t i o n   f i l e   v i a   t h e   - - a d m i s s i o n - c o n t r o l - c o n f i g - f i l e   f l a g .   I n   t h e   a d m i s s i o n   c o n t r o l   c o n f i g u r a t i o n   f i l e ,   s p e c i f y   w h e r e   t h e   M u t a t i n g A d m i s s i o n W e b h o o k   c o n t r o l l e r   a n d   V a l i d a t i n g A d m i s s i o n W e b h o o k   c o n t r o l l e r


Question: What is Request?

Answer: W e b h o o k s   a r e   s e n t   a s   P O S T   r e q u e s t s ,   w i t h   C o n t e n t - T y p e :   a p p l i c a t i o n / j s o n ,   w i t h   a n   A d m i s s i o n R e v i e w   A P I   o b j e c t   i n   t h e   a d m i s s i o n . k 8 s . i o   A P I   g r o u p   s e r i a l i z e d   t o   J S O N   a s   t h e   b o d y .   W e b h o o k s   c a n   s p e c i f y   w h a t   v e r s i o n s   o f   A d m i s s i o n R e v i e w   o b j e c t s   t h e y   a c c e p t   w i t h   t h e   a d m i s s i o n R e v i e w V e r s i o n s   f i e l d   i n   t h e i r   c o n f i g u r a t i o n :   a p i V e r s i o n :   a d m i s s i o n r e g i s t r a t i o n . k 8 s . i o / v 1   k i n d :   V a l i d a t i n g W e b h o o k C o n f i g u r a t i o n   w e b h o o k s :   -   n a m e :   m y - w e b h o o k . e x a m p l e . c o m   a d m i s s i o n R e v i e w V e r s i o n s :   [ " v 1 " ,   " v 1 b e t a 1 " ]   a d m i s s i o n R e v i e w V e r s i o n s   i s   a   r e q u i r e d   f i e l d   w h e n   c r e a t i n g   w e b h o o k   c o n f i g u r a t i o n s .   W e b h o o k s   a r e   r e q u i r e d   t o   s u p p o r t   a t   l e a s t   o n e   A d m i s s i o n R e v i e w   v e r s i o n   u n d e r s t o o d   b y   t h e   c u r r e n t   a n d   p r e v i o u s   A P I   s e r v e r .   A P I   s e r v e r s   s e n d   t h e   f i r s t   A d m i s s i o n R e v i e w   v e r s i o n   i n   t h e   a d m i s s i o n R e v i e w V e r s i o n s   l i s t   t h e y   s u p p o r t .   I f   n o n e   o f   t h e   v e r s i o n s   i n   t h e   l i s t   a r e   s u p p o r t e d   b y   t h e   A P I   s e r v e r ,   t h e   c o n f i g u r a t i o n   w i l l   n o t   b e   a l l o w e d   t o   b e   c r e a t e d .   I f   a n   A P I   s e r v e r   e n c o u n t e r s   a   w e b h o o k   c o n f i g u r a t i o n   t h a t   w a s   p r e v i o u s l y   c r e a t e d   a n d   d o e s   n o t   s u p p o


Question: What is Response?

Answer: W e b h o o k s   r e s p o n d   w i t h   a   2 0 0   H T T P   s t a t u s   c o d e ,   C o n t e n t - T y p e :   a p p l i c a t i o n / j s o n ,   a n d   a   b o d y   c o n t a i n i n g   a n   A d m i s s i o n R e v i e w   o b j e c t   ( i n   t h e   s a m e   v e r s i o n   t h e y   w e r e   s e n t ) ,   w i t h   t h e   r e s p o n s e   s t a n z a   p o p u l a t e d ,   s e r i a l i z e d   t o   J S O N .   A t   a   m i n i m u m ,   t h e   r e s p o n s e   s t a n z a   m u s t   c o n t a i n   t h e   f o l l o w i n g   f i e l d s :   u i d ,   c o p i e d   f r o m   t h e   r e q u e s t . u i d   s e n t   t o   t h e   w e b h o o k a l l o w e d ,   e i t h e r   s e t   t o   t r u e   o r   f a l s e   E x a m p l e   o f   a   m i n i m a l   r e s p o n s e   f r o m   a   w e b h o o k   t o   a l l o w   a   r e q u e s t :   {   " a p i V e r s i o n " :   " a d m i s s i o n . k 8 s . i o / v 1 " ,   " k i n d " :   " A d m i s s i o n R e v i e w " ,   " r e s p o n s e " :   {   " u i d " :   " < v a l u e   f r o m   r e q u e s t . u i d > " ,   " a l l o w e d " :   t r u e   }   }   E x a m p l e   o f   a   m i n i m a l   r e s p o n s e   f r o m   a   w e b h o o k   t o   f o r b i d   a   r e q u e s t :   {   " a p i V e r s i o n " :   " a d m i s s i o n . k 8 s . i o / v 1 " ,   " k i n d " :   " A d m i s s i o n R e v i e w " ,   " r e s p o n s e " :   {   " u i d " :   " < v a l u e   f r o m   r e q u e s t . u i d > " ,   " a l l o w e d " :   f a l s e   }   }   W h e n   r e j e c t i n g   a   r e q u e s t ,   t h e   w e b h o o k   c a n   c u s t o m i z e   t h e   h t t p   c o d e   a n d   m e s s a g e   r e t u r n e d   t o   t h e   u s e r   u s i n g   t h e   s t a t u s   f i e l d .   T h e   s p e c i f i e d   s t a t u s   o b j e c t   i s   r e t u r n e d   t o   t h e   u s e r .   S e e   t h e   A P I   d o c u m e n t a t i o n   f o r   d e t a i l s   a b o u t


Question: What is Caution:?

Answer: {   " a p i V e r s i o n " :   " a d m i s s i o n . k 8 s . i o / v 1 " ,   " k i n d " :   " A d m i s s i o n R e v i e w " ,   " r e s p o n s e " :   {   " u i d " :   " < v a l u e   f r o m   r e q u e s t . u i d > " ,   " a l l o w e d " :   t r u e ,   " w a r n i n g s " :   [   " d u p l i c a t e   e n v v a r   e n t r i e s   s p e c i f i e d   w i t h   n a m e   M Y _ E N V " ,   " m e m o r y   r e q u e s t   l e s s   t h a n   4 M B   s p e c i f i e d   f o r   c o n t a i n e r   m y c o n t a i n e r ,   w h i c h   w i l l   n o t   s t a r t   s u c c e s s f u l l y "   ]   }   }


Question: What is Webhook configuration?

Answer: T o   r e g i s t e r   a d m i s s i o n   w e b h o o k s ,   c r e a t e   M u t a t i n g W e b h o o k C o n f i g u r a t i o n   o r   V a l i d a t i n g W e b h o o k C o n f i g u r a t i o n   A P I   o b j e c t s .   T h e   n a m e   o f   a   M u t a t i n g W e b h o o k C o n f i g u r a t i o n   o r   a   V a l i d a t i n g W e b h o o k C o n f i g u r a t i o n   o b j e c t   m u s t   b e   a   v a l i d   D N S   s u b d o m a i n   n a m e .   E a c h   c o n f i g u r a t i o n   c a n   c o n t a i n   o n e   o r   m o r e   w e b h o o k s .   I f   m u l t i p l e   w e b h o o k s   a r e   s p e c i f i e d   i n   a   s i n g l e   c o n f i g u r a t i o n ,   e a c h   m u s t   b e   g i v e n   a   u n i q u e   n a m e .   T h i s   i s   r e q u i r e d   i n   o r d e r   t o   m a k e   r e s u l t i n g   a u d i t   l o g s   a n d   m e t r i c s   e a s i e r   t o   m a t c h   u p   t o   a c t i v e   c o n f i g u r a t i o n s .   E a c h   w e b h o o k   d e f i n e s   t h e   f o l l o w i n g   t h i n g s .


Question: What is Matching requests: rules?

Answer: E a c h   w e b h o o k   m u s t   s p e c i f y   a   l i s t   o f   r u l e s   u s e d   t o   d e t e r m i n e   i f   a   r e q u e s t   t o   t h e   A P I   s e r v e r   s h o u l d   b e   s e n t   t o   t h e   w e b h o o k .   E a c h   r u l e   s p e c i f i e s   o n e   o r   m o r e   o p e r a t i o n s ,   a p i G r o u p s ,   a p i V e r s i o n s ,   a n d   r e s o u r c e s ,   a n d   a   r e s o u r c e   s c o p e :   o p e r a t i o n s   l i s t s   o n e   o r   m o r e   o p e r a t i o n s   t o   m a t c h .   C a n   b e   " C R E A T E " ,   " U P D A T E " ,   " D E L E T E " ,   " C O N N E C T " ,   o r   " * "   t o   m a t c h   a l l . a p i G r o u p s   l i s t s   o n e   o r   m o r e   A P I   g r o u p s   t o   m a t c h .   " "   i s   t h e   c o r e   A P I   g r o u p .   " * "   m a t c h e s   a l l   A P I   g r o u p s . a p i V e r s i o n s   l i s t s   o n e   o r   m o r e   A P I   v e r s i o n s   t o   m a t c h .   " * "   m a t c h e s   a l l   A P I   v e r s i o n s . r e s o u r c e s   l i s t s   o n e   o r   m o r e   r e s o u r c e s   t o   m a t c h . " * "   m a t c h e s   a l l   r e s o u r c e s ,   b u t   n o t   s u b r e s o u r c e s . " * / * "   m a t c h e s   a l l   r e s o u r c e s   a n d   s u b r e s o u r c e s . " p o d s / * "   m a t c h e s   a l l   s u b r e s o u r c e s   o f   p o d s . " * / s t a t u s "   m a t c h e s   a l l   s t a t u s   s u b r e s o u r c e s . s c o p e   s p e c i f i e s   a   s c o p e   t o   m a t c h .   V a l i d   v a l u e s   a r e   " C l u s t e r " ,   " N a m e s p a c e d " ,   a n d   " * " .   S u b r e s o u r c e s   m a t c h   t h e   s c o p e   o f   t h e i r   p a r e n t   r e s o u r c e .   D e f a u l t   i s   " * " . " C l u s t e r "   m e a n s   t h a t   o n l y   c l u s t e r - s c o p e d   r e s o u r c e s   w i l l   m a t c h   t h i s   r u l e   ( N a m e s p a c e   A P I   o b j e


Question: What is Matching requests: objectSelector?

Answer: W e b h o o k s   m a y   o p t i o n a l l y   l i m i t   w h i c h   r e q u e s t s   a r e   i n t e r c e p t e d   b a s e d   o n   t h e   l a b e l s   o f   t h e   o b j e c t s   t h e y   w o u l d   b e   s e n t ,   b y   s p e c i f y i n g   a n   o b j e c t S e l e c t o r .   I f   s p e c i f i e d ,   t h e   o b j e c t S e l e c t o r   i s   e v a l u a t e d   a g a i n s t   b o t h   t h e   o b j e c t   a n d   o l d O b j e c t   t h a t   w o u l d   b e   s e n t   t o   t h e   w e b h o o k ,   a n d   i s   c o n s i d e r e d   t o   m a t c h   i f   e i t h e r   o b j e c t   m a t c h e s   t h e   s e l e c t o r .   A   n u l l   o b j e c t   ( o l d O b j e c t   i n   t h e   c a s e   o f   c r e a t e ,   o r   n e w O b j e c t   i n   t h e   c a s e   o f   d e l e t e ) ,   o r   a n   o b j e c t   t h a t   c a n n o t   h a v e   l a b e l s   ( l i k e   a   D e p l o y m e n t R o l l b a c k   o r   a   P o d P r o x y O p t i o n s   o b j e c t )   i s   n o t   c o n s i d e r e d   t o   m a t c h .   U s e   t h e   o b j e c t   s e l e c t o r   o n l y   i f   t h e   w e b h o o k   i s   o p t - i n ,   b e c a u s e   e n d   u s e r s   m a y   s k i p   t h e   a d m i s s i o n   w e b h o o k   b y   s e t t i n g   t h e   l a b e l s .   T h i s   e x a m p l e   s h o w s   a   m u t a t i n g   w e b h o o k   t h a t   w o u l d   m a t c h   a   C R E A T E   o f   a n y   r e s o u r c e   ( b u t   n o t   s u b r e s o u r c e s )   w i t h   t h e   l a b e l   f o o :   b a r :   a p i V e r s i o n :   a d m i s s i o n r e g i s t r a t i o n . k 8 s . i o / v 1   k i n d :   M u t a t i n g W e b h o o k C o n f i g u r a t i o n   w e b h o o k s :   -   n a m e :   m y - w e b h o o k . e x a m p l e . c o m   o b j e c t S e l e c t o r :   m a t c h L a b e l s :   f o o :   b a r   r u l e s :   -   o p e r a t i o n s :   [ " C R E A T E " ]   a p i G r o u p s :   [ " * "


Question: What is Matching requests: namespaceSelector?

Answer: W e b h o o k s   m a y   o p t i o n a l l y   l i m i t   w h i c h   r e q u e s t s   f o r   n a m e s p a c e d   r e s o u r c e s   a r e   i n t e r c e p t e d ,   b a s e d   o n   t h e   l a b e l s   o f   t h e   c o n t a i n i n g   n a m e s p a c e ,   b y   s p e c i f y i n g   a   n a m e s p a c e S e l e c t o r .   T h e   n a m e s p a c e S e l e c t o r   d e c i d e s   w h e t h e r   t o   r u n   t h e   w e b h o o k   o n   a   r e q u e s t   f o r   a   n a m e s p a c e d   r e s o u r c e   ( o r   a   N a m e s p a c e   o b j e c t ) ,   b a s e d   o n   w h e t h e r   t h e   n a m e s p a c e ' s   l a b e l s   m a t c h   t h e   s e l e c t o r .   I f   t h e   o b j e c t   i t s e l f   i s   a   n a m e s p a c e ,   t h e   m a t c h i n g   i s   p e r f o r m e d   o n   o b j e c t . m e t a d a t a . l a b e l s .   I f   t h e   o b j e c t   i s   a   c l u s t e r   s c o p e d   r e s o u r c e   o t h e r   t h a n   a   N a m e s p a c e ,   n a m e s p a c e S e l e c t o r   h a s   n o   e f f e c t .   T h i s   e x a m p l e   s h o w s   a   m u t a t i n g   w e b h o o k   t h a t   m a t c h e s   a   C R E A T E   o f   a n y   n a m e s p a c e d   r e s o u r c e   i n s i d e   a   n a m e s p a c e   t h a t   d o e s   n o t   h a v e   a   " r u n l e v e l "   l a b e l   o f   " 0 "   o r   " 1 " :   a p i V e r s i o n :   a d m i s s i o n r e g i s t r a t i o n . k 8 s . i o / v 1   k i n d :   M u t a t i n g W e b h o o k C o n f i g u r a t i o n   w e b h o o k s :   -   n a m e :   m y - w e b h o o k . e x a m p l e . c o m   n a m e s p a c e S e l e c t o r :   m a t c h E x p r e s s i o n s :   -   k e y :   r u n l e v e l   o p e r a t o r :   N o t I n   v a l u e s :   [ " 0 " , " 1 " ]   r u l e s :   -   o p e r a t i o n s :   [ " C R E A T E " ]   a p i G r o u p s :   [ " * " ]   a p i V e r s i o n s :   [ " * " ]   r e s o u r c e s :   [ " * " ]   s c o p e :


Question: What is Matching requests: matchPolicy?

Answer: A P I   s e r v e r s   c a n   m a k e   o b j e c t s   a v a i l a b l e   v i a   m u l t i p l e   A P I   g r o u p s   o r   v e r s i o n s .   F o r   e x a m p l e ,   i f   a   w e b h o o k   o n l y   s p e c i f i e d   a   r u l e   f o r   s o m e   A P I   g r o u p s / v e r s i o n s   ( l i k e   a p i G r o u p s : [ " a p p s " ] ,   a p i V e r s i o n s : [ " v 1 " , " v 1 b e t a 1 " ] ) ,   a n d   a   r e q u e s t   w a s   m a d e   t o   m o d i f y   t h e   r e s o u r c e   v i a   a n o t h e r   A P I   g r o u p / v e r s i o n   ( l i k e   e x t e n s i o n s / v 1 b e t a 1 ) ,   t h e   r e q u e s t   w o u l d   n o t   b e   s e n t   t o   t h e   w e b h o o k .   T h e   m a t c h P o l i c y   l e t s   a   w e b h o o k   d e f i n e   h o w   i t s   r u l e s   a r e   u s e d   t o   m a t c h   i n c o m i n g   r e q u e s t s .   A l l o w e d   v a l u e s   a r e   E x a c t   o r   E q u i v a l e n t .   E x a c t   m e a n s   a   r e q u e s t   s h o u l d   b e   i n t e r c e p t e d   o n l y   i f   i t   e x a c t l y   m a t c h e s   a   s p e c i f i e d   r u l e . E q u i v a l e n t   m e a n s   a   r e q u e s t   s h o u l d   b e   i n t e r c e p t e d   i f   i t   m o d i f i e s   a   r e s o u r c e   l i s t e d   i n   r u l e s ,   e v e n   v i a   a n o t h e r   A P I   g r o u p   o r   v e r s i o n .   I n   t h e   e x a m p l e   g i v e n   a b o v e ,   t h e   w e b h o o k   t h a t   o n l y   r e g i s t e r e d   f o r   a p p s / v 1   c o u l d   u s e   m a t c h P o l i c y :   m a t c h P o l i c y :   E x a c t   w o u l d   m e a n   t h e   e x t e n s i o n s / v 1 b e t a 1   r e q u e s t   w o u l d   n o t   b e   s e n t   t o   t h e   w e b h o o k m a t c h P o l i c y :   E q u i v a l e n t   m e a n s   t h e   e x t e n s i o n s / v 1 b e t a 1   r e q u e s t   w o u l d   b e   s e n t   t o   t h e   w e b h o o k   ( w i t h   t h e   o b j e


Question: What is Matching requests: matchConditions?

Answer: Y o u   c a n   d e f i n e   m a t c h   c o n d i t i o n s   f o r   w e b h o o k s   i f   y o u   n e e d   f i n e - g r a i n e d   r e q u e s t   f i l t e r i n g .   T h e s e   c o n d i t i o n s   a r e   u s e f u l   i f   y o u   f i n d   t h a t   m a t c h   r u l e s ,   o b j e c t S e l e c t o r s   a n d   n a m e s p a c e S e l e c t o r s   s t i l l   d o e s n ' t   p r o v i d e   t h e   f i l t e r i n g   y o u   w a n t   o v e r   w h e n   t o   c a l l   o u t   o v e r   H T T P .   M a t c h   c o n d i t i o n s   a r e   C E L   e x p r e s s i o n s .   A l l   m a t c h   c o n d i t i o n s   m u s t   e v a l u a t e   t o   t r u e   f o r   t h e   w e b h o o k   t o   b e   c a l l e d .   H e r e   i s   a n   e x a m p l e   i l l u s t r a t i n g   a   f e w   d i f f e r e n t   u s e s   f o r   m a t c h   c o n d i t i o n s :   a p i V e r s i o n :   a d m i s s i o n r e g i s t r a t i o n . k 8 s . i o / v 1   k i n d :   V a l i d a t i n g W e b h o o k C o n f i g u r a t i o n   w e b h o o k s :   -   n a m e :   m y - w e b h o o k . e x a m p l e . c o m   m a t c h P o l i c y :   E q u i v a l e n t   r u l e s :   -   o p e r a t i o n s :   [ ' C R E A T E ' , ' U P D A T E ' ]   a p i G r o u p s :   [ ' * ' ]   a p i V e r s i o n s :   [ ' * ' ]   r e s o u r c e s :   [ ' * ' ]   f a i l u r e P o l i c y :   ' I g n o r e '   #   F a i l - o p e n   ( o p t i o n a l )   s i d e E f f e c t s :   N o n e   c l i e n t C o n f i g :   s e r v i c e :   n a m e s p a c e :   m y - n a m e s p a c e   n a m e :   m y - w e b h o o k   c a B u n d l e :   ' < o m i t t e d > '   #   Y o u   c a n   h a v e   u p   t o   6 4   m a t c h C o n d i t i o n s   p e r   w e b h o o k   m a t c h C o n d i t i o n s :   -   n a m e :   ' e x c l u d e - l e a s e s '   #   E a c h   m a t c h   c o n d i t i o n   m u s t   h a v e   a   u n i q u e   n a m e   e x p r e s s i o n :   ' ! ( r e q


Question: What is Note:?

Answer: M a t c h   c o n d i t i o n s   h a v e   a c c e s s   t o   t h e   f o l l o w i n g   C E L   v a r i a b l e s :   o b j e c t   -   T h e   o b j e c t   f r o m   t h e   i n c o m i n g   r e q u e s t .   T h e   v a l u e   i s   n u l l   f o r   D E L E T E   r e q u e s t s .   T h e   o b j e c t   v e r s i o n   m a y   b e   c o n v e r t e d   b a s e d   o n   t h e   m a t c h P o l i c y . o l d O b j e c t   -   T h e   e x i s t i n g   o b j e c t .   T h e   v a l u e   i s   n u l l   f o r   C R E A T E   r e q u e s t s . r e q u e s t   -   T h e   r e q u e s t   p o r t i o n   o f   t h e   A d m i s s i o n R e v i e w ,   e x c l u d i n g   o b j e c t   a n d   o l d O b j e c t . a u t h o r i z e r   -   A   C E L   A u t h o r i z e r .   M a y   b e   u s e d   t o   p e r f o r m   a u t h o r i z a t i o n   c h e c k s   f o r   t h e   p r i n c i p a l   ( a u t h e n t i c a t e d   u s e r )   o f   t h e   r e q u e s t .   S e e   A u t h z   i n   t h e   K u b e r n e t e s   C E L   l i b r a r y   d o c u m e n t a t i o n   f o r   m o r e   d e t a i l s . a u t h o r i z e r . r e q u e s t R e s o u r c e   -   A   s h o r t c u t   f o r   a n   a u t h o r i z a t i o n   c h e c k   c o n f i g u r e d   w i t h   t h e   r e q u e s t   r e s o u r c e   ( g r o u p ,   r e s o u r c e ,   ( s u b r e s o u r c e ) ,   n a m e s p a c e ,   n a m e ) .   F o r   m o r e   i n f o r m a t i o n   o n   C E L   e x p r e s s i o n s ,   r e f e r   t o   t h e   C o m m o n   E x p r e s s i o n   L a n g u a g e   i n   K u b e r n e t e s   r e f e r e n c e .   I n   t h e   e v e n t   o f   a n   e r r o r   e v a l u a t i n g   a   m a t c h   c o n d i t i o n   t h e   w e b h o o k   i s   n e v e r   c a l l e d .   W h e t h e r   t o   r e j e c t   t h e   r e q u e s t   i s   d e t e r m i n e d   a s   f o l l o w s :   I f   a n y   m a t c h   c o n d i t i o n   e v a l u a t e d   t o


Question: What is Contacting the webhook?

Answer: O n c e   t h e   A P I   s e r v e r   h a s   d e t e r m i n e d   a   r e q u e s t   s h o u l d   b e   s e n t   t o   a   w e b h o o k ,   i t   n e e d s   t o   k n o w   h o w   t o   c o n t a c t   t h e   w e b h o o k .   T h i s   i s   s p e c i f i e d   i n   t h e   c l i e n t C o n f i g   s t a n z a   o f   t h e   w e b h o o k   c o n f i g u r a t i o n .   W e b h o o k s   c a n   e i t h e r   b e   c a l l e d   v i a   a   U R L   o r   a   s e r v i c e   r e f e r e n c e ,   a n d   c a n   o p t i o n a l l y   i n c l u d e   a   c u s t o m   C A   b u n d l e   t o   u s e   t o   v e r i f y   t h e   T L S   c o n n e c t i o n .


Question: What is URL?

Answer: u r l   g i v e s   t h e   l o c a t i o n   o f   t h e   w e b h o o k ,   i n   s t a n d a r d   U R L   f o r m   ( s c h e m e : / / h o s t : p o r t / p a t h ) .   T h e   h o s t   s h o u l d   n o t   r e f e r   t o   a   s e r v i c e   r u n n i n g   i n   t h e   c l u s t e r ;   u s e   a   s e r v i c e   r e f e r e n c e   b y   s p e c i f y i n g   t h e   s e r v i c e   f i e l d   i n s t e a d .   T h e   h o s t   m i g h t   b e   r e s o l v e d   v i a   e x t e r n a l   D N S   i n   s o m e   A P I   s e r v e r s   ( e . g . ,   k u b e - a p i s e r v e r   c a n n o t   r e s o l v e   i n - c l u s t e r   D N S   a s   t h a t   w o u l d   b e   a   l a y e r i n g   v i o l a t i o n ) .   h o s t   m a y   a l s o   b e   a n   I P   a d d r e s s .   P l e a s e   n o t e   t h a t   u s i n g   l o c a l h o s t   o r   1 2 7 . 0 . 0 . 1   a s   a   h o s t   i s   r i s k y   u n l e s s   y o u   t a k e   g r e a t   c a r e   t o   r u n   t h i s   w e b h o o k   o n   a l l   h o s t s   w h i c h   r u n   a n   A P I   s e r v e r   w h i c h   m i g h t   n e e d   t o   m a k e   c a l l s   t o   t h i s   w e b h o o k .   S u c h   i n s t a l l a t i o n s   a r e   l i k e l y   t o   b e   n o n - p o r t a b l e   o r   n o t   r e a d i l y   r u n   i n   a   n e w   c l u s t e r .   T h e   s c h e m e   m u s t   b e   " h t t p s " ;   t h e   U R L   m u s t   b e g i n   w i t h   " h t t p s : / / " .   A t t e m p t i n g   t o   u s e   a   u s e r   o r   b a s i c   a u t h   ( f o r   e x a m p l e   u s e r : p a s s w o r d @ )   i s   n o t   a l l o w e d .   F r a g m e n t s   ( # . . . )   a n d   q u e r y   p a r a m e t e r s   ( ? . . . )   a r e   a l s o   n o t   a l l o w e d .   H e r e   i s   a n   e x a m p l e   o f   a   m u t a t i n g   w e b h o o k   c o n f i g u r e d   t o   c a l l   a   U R L   ( a n d   e x p e c t s   t h e   T L S   c e r t i f i c a t e


Question: What is Service reference?

Answer: T h e   s e r v i c e   s t a n z a   i n s i d e   c l i e n t C o n f i g   i s   a   r e f e r e n c e   t o   t h e   s e r v i c e   f o r   t h i s   w e b h o o k .   I f   t h e   w e b h o o k   i s   r u n n i n g   w i t h i n   t h e   c l u s t e r ,   t h e n   y o u   s h o u l d   u s e   s e r v i c e   i n s t e a d   o f   u r l .   T h e   s e r v i c e   n a m e s p a c e   a n d   n a m e   a r e   r e q u i r e d .   T h e   p o r t   i s   o p t i o n a l   a n d   d e f a u l t s   t o   4 4 3 .   T h e   p a t h   i s   o p t i o n a l   a n d   d e f a u l t s   t o   " / " .   H e r e   i s   a n   e x a m p l e   o f   a   m u t a t i n g   w e b h o o k   c o n f i g u r e d   t o   c a l l   a   s e r v i c e   o n   p o r t   " 1 2 3 4 "   a t   t h e   s u b p a t h   " / m y - p a t h " ,   a n d   t o   v e r i f y   t h e   T L S   c o n n e c t i o n   a g a i n s t   t h e   S e r v e r N a m e   m y - s e r v i c e - n a m e . m y - s e r v i c e - n a m e s p a c e . s v c   u s i n g   a   c u s t o m   C A   b u n d l e :   a p i V e r s i o n :   a d m i s s i o n r e g i s t r a t i o n . k 8 s . i o / v 1   k i n d :   M u t a t i n g W e b h o o k C o n f i g u r a t i o n   w e b h o o k s :   -   n a m e :   m y - w e b h o o k . e x a m p l e . c o m   c l i e n t C o n f i g :   c a B u n d l e :   < C A _ B U N D L E >   s e r v i c e :   n a m e s p a c e :   m y - s e r v i c e - n a m e s p a c e   n a m e :   m y - s e r v i c e - n a m e   p a t h :   / m y - p a t h   p o r t :   1 2 3 4


Question: What is Side effects?

Answer: W e b h o o k s   t y p i c a l l y   o p e r a t e   o n l y   o n   t h e   c o n t e n t   o f   t h e   A d m i s s i o n R e v i e w   s e n t   t o   t h e m .   S o m e   w e b h o o k s ,   h o w e v e r ,   m a k e   o u t - o f - b a n d   c h a n g e s   a s   p a r t   o f   p r o c e s s i n g   a d m i s s i o n   r e q u e s t s .   W e b h o o k s   t h a t   m a k e   o u t - o f - b a n d   c h a n g e s   ( " s i d e   e f f e c t s " )   m u s t   a l s o   h a v e   a   r e c o n c i l i a t i o n   m e c h a n i s m   ( l i k e   a   c o n t r o l l e r )   t h a t   p e r i o d i c a l l y   d e t e r m i n e s   t h e   a c t u a l   s t a t e   o f   t h e   w o r l d ,   a n d   a d j u s t s   t h e   o u t - o f - b a n d   d a t a   m o d i f i e d   b y   t h e   a d m i s s i o n   w e b h o o k   t o   r e f l e c t   r e a l i t y .   T h i s   i s   b e c a u s e   a   c a l l   t o   a n   a d m i s s i o n   w e b h o o k   d o e s   n o t   g u a r a n t e e   t h e   a d m i t t e d   o b j e c t   w i l l   b e   p e r s i s t e d   a s   i s ,   o r   a t   a l l .   L a t e r   w e b h o o k s   c a n   m o d i f y   t h e   c o n t e n t   o f   t h e   o b j e c t ,   a   c o n f l i c t   c o u l d   b e   e n c o u n t e r e d   w h i l e   w r i t i n g   t o   s t o r a g e ,   o r   t h e   s e r v e r   c o u l d   p o w e r   o f f   b e f o r e   p e r s i s t i n g   t h e   o b j e c t .   A d d i t i o n a l l y ,   w e b h o o k s   w i t h   s i d e   e f f e c t s   m u s t   s k i p   t h o s e   s i d e - e f f e c t s   w h e n   d r y R u n :   t r u e   a d m i s s i o n   r e q u e s t s   a r e   h a n d l e d .   A   w e b h o o k   m u s t   e x p l i c i t l y   i n d i c a t e   t h a t   i t   w i l l   n o t   h a v e   s i d e - e f f e c t s   w h e n   r u n   w i t h   d r y R u n ,   o r   t h e   d r y - r u n   r e q u e s t   w i l l   n o t   b e   s e n t   t o   t h e   w e b h o o k


Question: What is Timeouts?

Answer: B e c a u s e   w e b h o o k s   a d d   t o   A P I   r e q u e s t   l a t e n c y ,   t h e y   s h o u l d   e v a l u a t e   a s   q u i c k l y   a s   p o s s i b l e .   t i m e o u t S e c o n d s   a l l o w s   c o n f i g u r i n g   h o w   l o n g   t h e   A P I   s e r v e r   s h o u l d   w a i t   f o r   a   w e b h o o k   t o   r e s p o n d   b e f o r e   t r e a t i n g   t h e   c a l l   a s   a   f a i l u r e .   I f   t h e   t i m e o u t   e x p i r e s   b e f o r e   t h e   w e b h o o k   r e s p o n d s ,   t h e   w e b h o o k   c a l l   w i l l   b e   i g n o r e d   o r   t h e   A P I   c a l l   w i l l   b e   r e j e c t e d   b a s e d   o n   t h e   f a i l u r e   p o l i c y .   T h e   t i m e o u t   v a l u e   m u s t   b e   b e t w e e n   1   a n d   3 0   s e c o n d s .   H e r e   i s   a n   e x a m p l e   o f   a   v a l i d a t i n g   w e b h o o k   w i t h   a   c u s t o m   t i m e o u t   o f   2   s e c o n d s :   a p i V e r s i o n :   a d m i s s i o n r e g i s t r a t i o n . k 8 s . i o / v 1   k i n d :   V a l i d a t i n g W e b h o o k C o n f i g u r a t i o n   w e b h o o k s :   -   n a m e :   m y - w e b h o o k . e x a m p l e . c o m   t i m e o u t S e c o n d s :   2   T h e   t i m e o u t   f o r   a n   a d m i s s i o n   w e b h o o k   d e f a u l t s   t o   1 0   s e c o n d s .


Question: What is Reinvocation policy?

Answer: A   s i n g l e   o r d e r i n g   o f   m u t a t i n g   a d m i s s i o n s   p l u g i n s   ( i n c l u d i n g   w e b h o o k s )   d o e s   n o t   w o r k   f o r   a l l   c a s e s   ( s e e   h t t p s : / / i s s u e . k 8 s . i o / 6 4 3 3 3   a s   a n   e x a m p l e ) .   A   m u t a t i n g   w e b h o o k   c a n   a d d   a   n e w   s u b - s t r u c t u r e   t o   t h e   o b j e c t   ( l i k e   a d d i n g   a   c o n t a i n e r   t o   a   p o d ) ,   a n d   o t h e r   m u t a t i n g   p l u g i n s   w h i c h   h a v e   a l r e a d y   r u n   m a y   h a v e   o p i n i o n s   o n   t h o s e   n e w   s t r u c t u r e s   ( l i k e   s e t t i n g   a n   i m a g e P u l l P o l i c y   o n   a l l   c o n t a i n e r s ) .   T o   a l l o w   m u t a t i n g   a d m i s s i o n   p l u g i n s   t o   o b s e r v e   c h a n g e s   m a d e   b y   o t h e r   p l u g i n s ,   b u i l t - i n   m u t a t i n g   a d m i s s i o n   p l u g i n s   a r e   r e - r u n   i f   a   m u t a t i n g   w e b h o o k   m o d i f i e s   a n   o b j e c t ,   a n d   m u t a t i n g   w e b h o o k s   c a n   s p e c i f y   a   r e i n v o c a t i o n P o l i c y   t o   c o n t r o l   w h e t h e r   t h e y   a r e   r e i n v o k e d   a s   w e l l .   r e i n v o c a t i o n P o l i c y   m a y   b e   s e t   t o   N e v e r   o r   I f N e e d e d .   I t   d e f a u l t s   t o   N e v e r .   N e v e r :   t h e   w e b h o o k   m u s t   n o t   b e   c a l l e d   m o r e   t h a n   o n c e   i n   a   s i n g l e   a d m i s s i o n   e v a l u a t i o n . I f N e e d e d :   t h e   w e b h o o k   m a y   b e   c a l l e d   a g a i n   a s   p a r t   o f   t h e   a d m i s s i o n   e v a l u a t i o n   i f   t h e   o b j e c t   b e i n g   a d m i t t e d   i s   m o d i f i e d   b y   o t h e r   a d m i s s i o n   p l u g i n s   a f t e r   t h e   i n i t i a l   w e b h o o k   c a l l .   T h e   i


Question: What is Failure policy?

Answer: f a i l u r e P o l i c y   d e f i n e s   h o w   u n r e c o g n i z e d   e r r o r s   a n d   t i m e o u t   e r r o r s   f r o m   t h e   a d m i s s i o n   w e b h o o k   a r e   h a n d l e d .   A l l o w e d   v a l u e s   a r e   I g n o r e   o r   F a i l .   I g n o r e   m e a n s   t h a t   a n   e r r o r   c a l l i n g   t h e   w e b h o o k   i s   i g n o r e d   a n d   t h e   A P I   r e q u e s t   i s   a l l o w e d   t o   c o n t i n u e . F a i l   m e a n s   t h a t   a n   e r r o r   c a l l i n g   t h e   w e b h o o k   c a u s e s   t h e   a d m i s s i o n   t o   f a i l   a n d   t h e   A P I   r e q u e s t   t o   b e   r e j e c t e d .   H e r e   i s   a   m u t a t i n g   w e b h o o k   c o n f i g u r e d   t o   r e j e c t   a n   A P I   r e q u e s t   i f   e r r o r s   a r e   e n c o u n t e r e d   c a l l i n g   t h e   a d m i s s i o n   w e b h o o k :   a p i V e r s i o n :   a d m i s s i o n r e g i s t r a t i o n . k 8 s . i o / v 1   k i n d :   M u t a t i n g W e b h o o k C o n f i g u r a t i o n   w e b h o o k s :   -   n a m e :   m y - w e b h o o k . e x a m p l e . c o m   f a i l u r e P o l i c y :   F a i l   T h e   d e f a u l t   f a i l u r e P o l i c y   f o r   a n   a d m i s s i o n   w e b h o o k s   i s   F a i l .


Question: What is Monitoring admission webhooks?

Answer: T h e   A P I   s e r v e r   p r o v i d e s   w a y s   t o   m o n i t o r   a d m i s s i o n   w e b h o o k   b e h a v i o r s .   T h e s e   m o n i t o r i n g   m e c h a n i s m s   h e l p   c l u s t e r   a d m i n s   t o   a n s w e r   q u e s t i o n s   l i k e :   W h i c h   m u t a t i n g   w e b h o o k   m u t a t e d   t h e   o b j e c t   i n   a   A P I   r e q u e s t ? W h a t   c h a n g e   d i d   t h e   m u t a t i n g   w e b h o o k   a p p l i e d   t o   t h e   o b j e c t ? W h i c h   w e b h o o k s   a r e   f r e q u e n t l y   r e j e c t i n g   A P I   r e q u e s t s ?   W h a t ' s   t h e   r e a s o n   f o r   a   r e j e c t i o n ?   W h i c h   m u t a t i n g   w e b h o o k   m u t a t e d   t h e   o b j e c t   i n   a   A P I   r e q u e s t ?   W h a t   c h a n g e   d i d   t h e   m u t a t i n g   w e b h o o k   a p p l i e d   t o   t h e   o b j e c t ?   W h i c h   w e b h o o k s   a r e   f r e q u e n t l y   r e j e c t i n g   A P I   r e q u e s t s ?   W h a t ' s   t h e   r e a s o n   f o r   a   r e j e c t i o n ?


Question: What is Mutating webhook auditing annotations?

Answer: S o m e t i m e s   i t ' s   u s e f u l   t o   k n o w   w h i c h   m u t a t i n g   w e b h o o k   m u t a t e d   t h e   o b j e c t   i n   a   A P I   r e q u e s t ,   a n d   w h a t   c h a n g e   d i d   t h e   w e b h o o k   a p p l y .   T h e   K u b e r n e t e s   A P I   s e r v e r   p e r f o r m s   a u d i t i n g   o n   e a c h   m u t a t i n g   w e b h o o k   i n v o c a t i o n .   E a c h   i n v o c a t i o n   g e n e r a t e s   a n   a u d i t i n g   a n n o t a t i o n   c a p t u r i n g   i f   a   r e q u e s t   o b j e c t   i s   m u t a t e d   b y   t h e   i n v o c a t i o n ,   a n d   o p t i o n a l l y   g e n e r a t e s   a n   a n n o t a t i o n   c a p t u r i n g   t h e   a p p l i e d   p a t c h   f r o m   t h e   w e b h o o k   a d m i s s i o n   r e s p o n s e .   T h e   a n n o t a t i o n s   a r e   s e t   i n   t h e   a u d i t   e v e n t   f o r   g i v e n   r e q u e s t   o n   g i v e n   s t a g e   o f   i t s   e x e c u t i o n ,   w h i c h   i s   t h e n   p r e - p r o c e s s e d   a c c o r d i n g   t o   a   c e r t a i n   p o l i c y   a n d   w r i t t e n   t o   a   b a c k e n d .   T h e   a u d i t   l e v e l   o f   a   e v e n t   d e t e r m i n e s   w h i c h   a n n o t a t i o n s   g e t   r e c o r d e d :   A t   M e t a d a t a   a u d i t   l e v e l   o r   h i g h e r ,   a n   a n n o t a t i o n   w i t h   k e y   m u t a t i o n . w e b h o o k . a d m i s s i o n . k 8 s . i o / r o u n d _ { r o u n d   i d x } _ i n d e x _ { o r d e r   i d x }   g e t s   l o g g e d   w i t h   J S O N   p a y l o a d   i n d i c a t i n g   a   w e b h o o k   g e t s   i n v o k e d   f o r   g i v e n   r e q u e s t   a n d   w h e t h e r   i t   m u t a t e d   t h e   o b j e c t   o r   n o t . F o r   e x a m p l e ,   t h e   f o l l o w i n g   a n n o t a t i o n   g e t s   r e c o r d e d   f o r   a   w e b h o o k   b e i n g   r e i n v o


Question: What is Admission webhook metrics?

Answer: T h e   A P I   s e r v e r   e x p o s e s   P r o m e t h e u s   m e t r i c s   f r o m   t h e   / m e t r i c s   e n d p o i n t ,   w h i c h   c a n   b e   u s e d   f o r   m o n i t o r i n g   a n d   d i a g n o s i n g   A P I   s e r v e r   s t a t u s .   T h e   f o l l o w i n g   m e t r i c s   r e c o r d   s t a t u s   r e l a t e d   t o   a d m i s s i o n   w e b h o o k s .


Question: What is API server admission webhook rejection count?

Answer: S o m e t i m e s   i t ' s   u s e f u l   t o   k n o w   w h i c h   a d m i s s i o n   w e b h o o k s   a r e   f r e q u e n t l y   r e j e c t i n g   A P I   r e q u e s t s ,   a n d   t h e   r e a s o n   f o r   a   r e j e c t i o n .   T h e   A P I   s e r v e r   e x p o s e s   a   P r o m e t h e u s   c o u n t e r   m e t r i c   r e c o r d i n g   a d m i s s i o n   w e b h o o k   r e j e c t i o n s .   T h e   m e t r i c s   a r e   l a b e l l e d   t o   i d e n t i f y   t h e   c a u s e s   o f   w e b h o o k   r e j e c t i o n ( s ) :   n a m e :   t h e   n a m e   o f   t h e   w e b h o o k   t h a t   r e j e c t e d   a   r e q u e s t . o p e r a t i o n :   t h e   o p e r a t i o n   t y p e   o f   t h e   r e q u e s t ,   c a n   b e   o n e   o f   C R E A T E ,   U P D A T E ,   D E L E T E   a n d   C O N N E C T . t y p e :   t h e   a d m i s s i o n   w e b h o o k   t y p e ,   c a n   b e   o n e   o f   a d m i t   a n d   v a l i d a t i n g . e r r o r _ t y p e :   i d e n t i f i e s   i f   a n   e r r o r   o c c u r r e d   d u r i n g   t h e   w e b h o o k   i n v o c a t i o n   t h a t   c a u s e d   t h e   r e j e c t i o n .   I t s   v a l u e   c a n   b e   o n e   o f : c a l l i n g _ w e b h o o k _ e r r o r :   u n r e c o g n i z e d   e r r o r s   o r   t i m e o u t   e r r o r s   f r o m   t h e   a d m i s s i o n   w e b h o o k   h a p p e n e d   a n d   t h e   w e b h o o k ' s   F a i l u r e   p o l i c y   i s   s e t   t o   F a i l . n o _ e r r o r :   n o   e r r o r   o c c u r r e d .   T h e   w e b h o o k   r e j e c t e d   t h e   r e q u e s t   w i t h   a l l o w e d :   f a l s e   i n   t h e   a d m i s s i o n   r e s p o n s e .   T h e   m e t r i c s   l a b e l   r e j e c t i o n _ c o d e   r e c o r d s   t h e   . s t a t u s . c o d e   s e t   i n   t h e   a d m i s s i o n   r e s p o n s e . a p i s e r v e r _ i n t e r n a l _ e r r o r :


Question: What is Best practices and warnings?

Answer: F o r   r e c o m m e n d a t i o n s   a n d   c o n s i d e r a t i o n s   w h e n   w r i t i n g   m u t a t i n g   a d m i s s i o n   w e b h o o k s ,   s e e   A d m i s s i o n   W e b h o o k s   G o o d   P r a c t i c e s .


Question: What is kube-scheduler?

Answer: kube-schedulerSynopsisThe Kubernetes scheduler is a control plane process which assigns Pods to Nodes. The scheduler determines which Nodes are valid placements for each Pod in the scheduling queue according to constraints and available resources. The scheduler then ranks each valid Node and binds the Pod to a suitable Node. Multiple different schedulers may be used within a cluster; kube-scheduler is the reference implementation. See scheduling for more information about scheduling and the kube-scheduler component.kube-scheduler [flags] Options--allow-metric-labels stringToString Default: []The map from metric-label to value allow-list of this label. The key's format is <MetricName>,<LabelName>. The value's format is <allowed_value>,<allowed_value>...e.g. metric1,label1='v1,v2,v3', metric1,label2='v1,v2,v3' metric2,label1='v1,v2,v3'.--allow-metric-labels-manifest stringThe path to the manifest file that contains the allow-list mapping. The format of the file is the same as the flag --allow-metric-labels. Note that the flag --allow-metric-labels will override the manifest file.--authentication-kubeconfig stringkubeconfig file pointing at the 'core' kubernetes server with enough rights to create tokenreviews.authentication.k8s.io. This is optional. If empty, all token requests are considered to be anonymous and no client CA is looked up in the cluster.--authentication-skip-lookupIf false, the authentication-kubeconfig will be used to lookup missing authentication configuration from the cluster.--authentication-token-webhook-cache-ttl duration Default: 10sThe duration to cache responses from the webhook token authenticator.--authentication-tolerate-lookup-failure Default: trueIf true, failures to look up missing authentication configuration from the cluster are not considered fatal. Note that this can result in authentication that treats all requests as anonymous.--authorization-always-allow-paths strings Default: "/healthz,/readyz,/livez"A list of HTTP paths to skip during authorization, i.e. these are authorized without contacting the 'core' kubernetes server.--authorization-kubeconfig stringkubeconfig file pointing at the 'core' kubernetes server with enough rights to create subjectaccessreviews.authorization.k8s.io. This is optional. If empty, all requests not skipped by authorization are forbidden.--authorization-webhook-cache-authorized-ttl duration Default: 10sThe duration to cache 'authorized' responses from the webhook authorizer.--authorization-webhook-cache-unauthorized-ttl duration Default: 10sThe duration to cache 'unauthorized' responses from the webhook authorizer.--bind-address string Default: 0.0.0.0The IP address on which to listen for the --secure-port port. The associated interface(s) must be reachable by the rest of the cluster, and by CLI/web clients. If blank or an unspecified address (0.0.0.0 or ::), all interfaces and IP address families will be used.--cert-dir stringThe directory where the TLS certs are located. If --tls-c


Question: How does kube-scheduler work?

Answer: kube-schedulerSynopsisThe Kubernetes scheduler is a control plane process which assigns Pods to Nodes. The scheduler determines which Nodes are valid placements for each Pod in the scheduling queue according to constraints and available resources. The scheduler then ranks each valid Node and binds the Pod to a suitable Node. Multiple different schedulers may be used within a cluster; kube-scheduler is the reference implementation. See scheduling for more information about scheduling and the kube-scheduler component.kube-scheduler [flags] Options--allow-metric-labels stringToString Default: []The map from metric-label to value allow-list of this label. The key's format is <MetricName>,<LabelName>. The value's format is <allowed_value>,<allowed_value>...e.g. metric1,label1='v1,v2,v3', metric1,label2='v1,v2,v3' metric2,label1='v1,v2,v3'.--allow-metric-labels-manifest stringThe path to the manifest file that contains the allow-list mapping. The format of the file is the same as the flag --allow-metric-labels. Note that the flag --allow-metric-labels will override the manifest file.--authentication-kubeconfig stringkubeconfig file pointing at the 'core' kubernetes server with enough rights to create tokenreviews.authentication.k8s.io. This is optional. If empty, all token requests are considered to be anonymous and no client CA is looked up in the cluster.--authentication-skip-lookupIf false, the authentication-kubeconfig will be used to lookup missing authentication configuration from the cluster.--authentication-token-webhook-cache-ttl duration Default: 10sThe duration to cache responses from the webhook token authenticator.--authentication-tolerate-lookup-failure Default: trueIf true, failures to look up missing authentication configuration from the cluster are not considered fatal. Note that this can result in authentication that treats all requests as anonymous.--authorization-always-allow-paths strings Default: "/healthz,/readyz,/livez"A list of HTTP paths to skip during authorization, i.e. these are authorized without contacting the 'core' kubernetes server.--authorization-kubeconfig stringkubeconfig file pointing at the 'core' kubernetes server with enough rights to create subjectaccessreviews.authorization.k8s.io. This is optional. If empty, all requests not skipped by authorization are forbidden.--authorization-webhook-cache-authorized-ttl duration Default: 10sThe duration to cache 'authorized' responses from the webhook authorizer.--authorization-webhook-cache-unauthorized-ttl duration Default: 10sThe duration to cache 'unauthorized' responses from the webhook authorizer.--bind-address string Default: 0.0.0.0The IP address on which to listen for the --secure-port port. The associated interface(s) must be reachable by the rest of the cluster, and by CLI/web clients. If blank or an unspecified address (0.0.0.0 or ::), all interfaces and IP address families will be used.--cert-dir stringThe directory where the TLS certs are located. If --tls-c


Question: When would you use kube-scheduler?

Answer: kube-schedulerSynopsisThe Kubernetes scheduler is a control plane process which assigns Pods to Nodes. The scheduler determines which Nodes are valid placements for each Pod in the scheduling queue according to constraints and available resources. The scheduler then ranks each valid Node and binds the Pod to a suitable Node. Multiple different schedulers may be used within a cluster; kube-scheduler is the reference implementation. See scheduling for more information about scheduling and the kube-scheduler component.kube-scheduler [flags] Options--allow-metric-labels stringToString Default: []The map from metric-label to value allow-list of this label. The key's format is <MetricName>,<LabelName>. The value's format is <allowed_value>,<allowed_value>...e.g. metric1,label1='v1,v2,v3', metric1,label2='v1,v2,v3' metric2,label1='v1,v2,v3'.--allow-metric-labels-manifest stringThe path to the manifest file that contains the allow-list mapping. The format of the file is the same as the flag --allow-metric-labels. Note that the flag --allow-metric-labels will override the manifest file.--authentication-kubeconfig stringkubeconfig file pointing at the 'core' kubernetes server with enough rights to create tokenreviews.authentication.k8s.io. This is optional. If empty, all token requests are considered to be anonymous and no client CA is looked up in the cluster.--authentication-skip-lookupIf false, the authentication-kubeconfig will be used to lookup missing authentication configuration from the cluster.--authentication-token-webhook-cache-ttl duration Default: 10sThe duration to cache responses from the webhook token authenticator.--authentication-tolerate-lookup-failure Default: trueIf true, failures to look up missing authentication configuration from the cluster are not considered fatal. Note that this can result in authentication that treats all requests as anonymous.--authorization-always-allow-paths strings Default: "/healthz,/readyz,/livez"A list of HTTP paths to skip during authorization, i.e. these are authorized without contacting the 'core' kubernetes server.--authorization-kubeconfig stringkubeconfig file pointing at the 'core' kubernetes server with enough rights to create subjectaccessreviews.authorization.k8s.io. This is optional. If empty, all requests not skipped by authorization are forbidden.--authorization-webhook-cache-authorized-ttl duration Default: 10sThe duration to cache 'authorized' responses from the webhook authorizer.--authorization-webhook-cache-unauthorized-ttl duration Default: 10sThe duration to cache 'unauthorized' responses from the webhook authorizer.--bind-address string Default: 0.0.0.0The IP address on which to listen for the --secure-port port. The associated interface(s) must be reachable by the rest of the cluster, and by CLI/web clients. If blank or an unspecified address (0.0.0.0 or ::), all interfaces and IP address families will be used.--cert-dir stringThe directory where the TLS certs are located. If --tls-c


Question: What are the benefits of kube-scheduler?

Answer: kube-schedulerSynopsisThe Kubernetes scheduler is a control plane process which assigns Pods to Nodes. The scheduler determines which Nodes are valid placements for each Pod in the scheduling queue according to constraints and available resources. The scheduler then ranks each valid Node and binds the Pod to a suitable Node. Multiple different schedulers may be used within a cluster; kube-scheduler is the reference implementation. See scheduling for more information about scheduling and the kube-scheduler component.kube-scheduler [flags] Options--allow-metric-labels stringToString Default: []The map from metric-label to value allow-list of this label. The key's format is <MetricName>,<LabelName>. The value's format is <allowed_value>,<allowed_value>...e.g. metric1,label1='v1,v2,v3', metric1,label2='v1,v2,v3' metric2,label1='v1,v2,v3'.--allow-metric-labels-manifest stringThe path to the manifest file that contains the allow-list mapping. The format of the file is the same as the flag --allow-metric-labels. Note that the flag --allow-metric-labels will override the manifest file.--authentication-kubeconfig stringkubeconfig file pointing at the 'core' kubernetes server with enough rights to create tokenreviews.authentication.k8s.io. This is optional. If empty, all token requests are considered to be anonymous and no client CA is looked up in the cluster.--authentication-skip-lookupIf false, the authentication-kubeconfig will be used to lookup missing authentication configuration from the cluster.--authentication-token-webhook-cache-ttl duration Default: 10sThe duration to cache responses from the webhook token authenticator.--authentication-tolerate-lookup-failure Default: trueIf true, failures to look up missing authentication configuration from the cluster are not considered fatal. Note that this can result in authentication that treats all requests as anonymous.--authorization-always-allow-paths strings Default: "/healthz,/readyz,/livez"A list of HTTP paths to skip during authorization, i.e. these are authorized without contacting the 'core' kubernetes server.--authorization-kubeconfig stringkubeconfig file pointing at the 'core' kubernetes server with enough rights to create subjectaccessreviews.authorization.k8s.io. This is optional. If empty, all requests not skipped by authorization are forbidden.--authorization-webhook-cache-authorized-ttl duration Default: 10sThe duration to cache 'authorized' responses from the webhook authorizer.--authorization-webhook-cache-unauthorized-ttl duration Default: 10sThe duration to cache 'unauthorized' responses from the webhook authorizer.--bind-address string Default: 0.0.0.0The IP address on which to listen for the --secure-port port. The associated interface(s) must be reachable by the rest of the cluster, and by CLI/web clients. If blank or an unspecified address (0.0.0.0 or ::), all interfaces and IP address families will be used.--cert-dir stringThe directory where the TLS certs are located. If --tls-c


Question: What is Synopsis?

Answer: T h e   K u b e r n e t e s   s c h e d u l e r   i s   a   c o n t r o l   p l a n e   p r o c e s s   w h i c h   a s s i g n s   P o d s   t o   N o d e s .   T h e   s c h e d u l e r   d e t e r m i n e s   w h i c h   N o d e s   a r e   v a l i d   p l a c e m e n t s   f o r   e a c h   P o d   i n   t h e   s c h e d u l i n g   q u e u e   a c c o r d i n g   t o   c o n s t r a i n t s   a n d   a v a i l a b l e   r e s o u r c e s .   T h e   s c h e d u l e r   t h e n   r a n k s   e a c h   v a l i d   N o d e   a n d   b i n d s   t h e   P o d   t o   a   s u i t a b l e   N o d e .   M u l t i p l e   d i f f e r e n t   s c h e d u l e r s   m a y   b e   u s e d   w i t h i n   a   c l u s t e r ;   k u b e - s c h e d u l e r   i s   t h e   r e f e r e n c e   i m p l e m e n t a t i o n .   S e e   s c h e d u l i n g   f o r   m o r e   i n f o r m a t i o n   a b o u t   s c h e d u l i n g   a n d   t h e   k u b e - s c h e d u l e r   c o m p o n e n t .   k u b e - s c h e d u l e r   [ f l a g s ]


Question: What is Options?

Answer: T h e   m a p   f r o m   m e t r i c - l a b e l   t o   v a l u e   a l l o w - l i s t   o f   t h i s   l a b e l .   T h e   k e y ' s   f o r m a t   i s   < M e t r i c N a m e > , < L a b e l N a m e > .   T h e   v a l u e ' s   f o r m a t   i s   < a l l o w e d _ v a l u e > , < a l l o w e d _ v a l u e > . . . e . g .   m e t r i c 1 , l a b e l 1 = ' v 1 , v 2 , v 3 ' ,   m e t r i c 1 , l a b e l 2 = ' v 1 , v 2 , v 3 '   m e t r i c 2 , l a b e l 1 = ' v 1 , v 2 , v 3 ' .   T h e   p a t h   t o   t h e   m a n i f e s t   f i l e   t h a t   c o n t a i n s   t h e   a l l o w - l i s t   m a p p i n g .   T h e   f o r m a t   o f   t h e   f i l e   i s   t h e   s a m e   a s   t h e   f l a g   - - a l l o w - m e t r i c - l a b e l s .   N o t e   t h a t   t h e   f l a g   - - a l l o w - m e t r i c - l a b e l s   w i l l   o v e r r i d e   t h e   m a n i f e s t   f i l e .   k u b e c o n f i g   f i l e   p o i n t i n g   a t   t h e   ' c o r e '   k u b e r n e t e s   s e r v e r   w i t h   e n o u g h   r i g h t s   t o   c r e a t e   t o k e n r e v i e w s . a u t h e n t i c a t i o n . k 8 s . i o .   T h i s   i s   o p t i o n a l .   I f   e m p t y ,   a l l   t o k e n   r e q u e s t s   a r e   c o n s i d e r e d   t o   b e   a n o n y m o u s   a n d   n o   c l i e n t   C A   i s   l o o k e d   u p   i n   t h e   c l u s t e r .   I f   f a l s e ,   t h e   a u t h e n t i c a t i o n - k u b e c o n f i g   w i l l   b e   u s e d   t o   l o o k u p   m i s s i n g   a u t h e n t i c a t i o n   c o n f i g u r a t i o n   f r o m   t h e   c l u s t e r .   T h e   d u r a t i o n   t o   c a c h e   r e s p o n s e s   f r o m   t h e   w e b h o o k   t o k e n   a u t h e n t i c a t o r .   I f   t r u e ,   f a i l u r e s   t o   l o o k   u p   m i s s i n g   a u t h e n t i c a t i o n   c o n f i g u r a t i o n   f r o m   t h e   c l u s t e r   a r e   n o t   c o n s i d e r e d   f a t a


Question: What is Use Cascading Deletion in a Cluster?

Answer: Use Cascading Deletion in a ClusterThis page shows you how to specify the type of cascading deletion to use in your cluster during garbage collection.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYou also need to create a sample Deployment to experiment with the different types of cascading deletion. You will need to recreate the Deployment for each type.Check owner references on your podsCheck that the ownerReferences field is present on your pods:kubectl get pods -l app=nginx --output=yaml The output has an ownerReferences field similar to this:apiVersion: v1 ... ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: nginx-deployment-6b474476c4 uid: 4fdcd81c-bd5d-41f7-97af-3a3b759af9a7 ... Use foreground cascading deletionBy default, Kubernetes uses background cascading deletion to delete dependents of an object. You can switch to foreground cascading deletion using either kubectl or the Kubernetes API, depending on the Kubernetes version your cluster runs.To check the version, enter kubectl version.You can delete objects using foreground cascading deletion using kubectl or the Kubernetes API.Using kubectlRun the following command:kubectl delete deployment nginx-deployment --cascade=foreground Using the Kubernetes APIStart a local proxy session:kubectl proxy --port=8080 Use curl to trigger deletion:curl -X DELETE localhost:8080/apis/apps/v1/namespaces/default/deployments/nginx-deployment \ -d '{"kind":"DeleteOptions","apiVersion":"v1","propagationPolicy":"Foreground"}' \ -H "Content-Type: application/json" The output contains a foregroundDeletion finalizer like this:"kind": "Deployment", "apiVersion": "apps/v1", "metadata": { "name": "nginx-deployment", "namespace": "default", "uid": "d1ce1b02-cae8-4288-8a53-30e84d8fa505", "resourceVersion": "1363097", "creationTimestamp": "2021-07-08T20:24:37Z", "deletionTimestamp": "2021-07-08T20:27:39Z", "finalizers": [ "foregroundDeletion" ] ... Use background cascading deletionCreate a sample Deployment.Use either kubectl or the Kubernetes API to delete the Deployment, depending on the Kubernetes version your cluster runs.To check the version, enter kubectl version.You can delete objects using background cascading deletion using kubectl or the Kubernetes API.Kubernetes uses background cascading deletion by default, and does so even if you run the following commands without the --cascade flag or the propagationPolicy argument.Using kubectlRun the following command:kubectl delete deployment nginx-deployment --cascade=background Using the Kubernetes APIStart a local proxy ses


Question: How does Use Cascading Deletion in a Cluster work?

Answer: Use Cascading Deletion in a ClusterThis page shows you how to specify the type of cascading deletion to use in your cluster during garbage collection.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYou also need to create a sample Deployment to experiment with the different types of cascading deletion. You will need to recreate the Deployment for each type.Check owner references on your podsCheck that the ownerReferences field is present on your pods:kubectl get pods -l app=nginx --output=yaml The output has an ownerReferences field similar to this:apiVersion: v1 ... ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: nginx-deployment-6b474476c4 uid: 4fdcd81c-bd5d-41f7-97af-3a3b759af9a7 ... Use foreground cascading deletionBy default, Kubernetes uses background cascading deletion to delete dependents of an object. You can switch to foreground cascading deletion using either kubectl or the Kubernetes API, depending on the Kubernetes version your cluster runs.To check the version, enter kubectl version.You can delete objects using foreground cascading deletion using kubectl or the Kubernetes API.Using kubectlRun the following command:kubectl delete deployment nginx-deployment --cascade=foreground Using the Kubernetes APIStart a local proxy session:kubectl proxy --port=8080 Use curl to trigger deletion:curl -X DELETE localhost:8080/apis/apps/v1/namespaces/default/deployments/nginx-deployment \ -d '{"kind":"DeleteOptions","apiVersion":"v1","propagationPolicy":"Foreground"}' \ -H "Content-Type: application/json" The output contains a foregroundDeletion finalizer like this:"kind": "Deployment", "apiVersion": "apps/v1", "metadata": { "name": "nginx-deployment", "namespace": "default", "uid": "d1ce1b02-cae8-4288-8a53-30e84d8fa505", "resourceVersion": "1363097", "creationTimestamp": "2021-07-08T20:24:37Z", "deletionTimestamp": "2021-07-08T20:27:39Z", "finalizers": [ "foregroundDeletion" ] ... Use background cascading deletionCreate a sample Deployment.Use either kubectl or the Kubernetes API to delete the Deployment, depending on the Kubernetes version your cluster runs.To check the version, enter kubectl version.You can delete objects using background cascading deletion using kubectl or the Kubernetes API.Kubernetes uses background cascading deletion by default, and does so even if you run the following commands without the --cascade flag or the propagationPolicy argument.Using kubectlRun the following command:kubectl delete deployment nginx-deployment --cascade=background Using the Kubernetes APIStart a local proxy ses


Question: When would you use Use Cascading Deletion in a Cluster?

Answer: Use Cascading Deletion in a ClusterThis page shows you how to specify the type of cascading deletion to use in your cluster during garbage collection.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYou also need to create a sample Deployment to experiment with the different types of cascading deletion. You will need to recreate the Deployment for each type.Check owner references on your podsCheck that the ownerReferences field is present on your pods:kubectl get pods -l app=nginx --output=yaml The output has an ownerReferences field similar to this:apiVersion: v1 ... ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: nginx-deployment-6b474476c4 uid: 4fdcd81c-bd5d-41f7-97af-3a3b759af9a7 ... Use foreground cascading deletionBy default, Kubernetes uses background cascading deletion to delete dependents of an object. You can switch to foreground cascading deletion using either kubectl or the Kubernetes API, depending on the Kubernetes version your cluster runs.To check the version, enter kubectl version.You can delete objects using foreground cascading deletion using kubectl or the Kubernetes API.Using kubectlRun the following command:kubectl delete deployment nginx-deployment --cascade=foreground Using the Kubernetes APIStart a local proxy session:kubectl proxy --port=8080 Use curl to trigger deletion:curl -X DELETE localhost:8080/apis/apps/v1/namespaces/default/deployments/nginx-deployment \ -d '{"kind":"DeleteOptions","apiVersion":"v1","propagationPolicy":"Foreground"}' \ -H "Content-Type: application/json" The output contains a foregroundDeletion finalizer like this:"kind": "Deployment", "apiVersion": "apps/v1", "metadata": { "name": "nginx-deployment", "namespace": "default", "uid": "d1ce1b02-cae8-4288-8a53-30e84d8fa505", "resourceVersion": "1363097", "creationTimestamp": "2021-07-08T20:24:37Z", "deletionTimestamp": "2021-07-08T20:27:39Z", "finalizers": [ "foregroundDeletion" ] ... Use background cascading deletionCreate a sample Deployment.Use either kubectl or the Kubernetes API to delete the Deployment, depending on the Kubernetes version your cluster runs.To check the version, enter kubectl version.You can delete objects using background cascading deletion using kubectl or the Kubernetes API.Kubernetes uses background cascading deletion by default, and does so even if you run the following commands without the --cascade flag or the propagationPolicy argument.Using kubectlRun the following command:kubectl delete deployment nginx-deployment --cascade=background Using the Kubernetes APIStart a local proxy ses


Question: What are the benefits of Use Cascading Deletion in a Cluster?

Answer: Use Cascading Deletion in a ClusterThis page shows you how to specify the type of cascading deletion to use in your cluster during garbage collection.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYou also need to create a sample Deployment to experiment with the different types of cascading deletion. You will need to recreate the Deployment for each type.Check owner references on your podsCheck that the ownerReferences field is present on your pods:kubectl get pods -l app=nginx --output=yaml The output has an ownerReferences field similar to this:apiVersion: v1 ... ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: nginx-deployment-6b474476c4 uid: 4fdcd81c-bd5d-41f7-97af-3a3b759af9a7 ... Use foreground cascading deletionBy default, Kubernetes uses background cascading deletion to delete dependents of an object. You can switch to foreground cascading deletion using either kubectl or the Kubernetes API, depending on the Kubernetes version your cluster runs.To check the version, enter kubectl version.You can delete objects using foreground cascading deletion using kubectl or the Kubernetes API.Using kubectlRun the following command:kubectl delete deployment nginx-deployment --cascade=foreground Using the Kubernetes APIStart a local proxy session:kubectl proxy --port=8080 Use curl to trigger deletion:curl -X DELETE localhost:8080/apis/apps/v1/namespaces/default/deployments/nginx-deployment \ -d '{"kind":"DeleteOptions","apiVersion":"v1","propagationPolicy":"Foreground"}' \ -H "Content-Type: application/json" The output contains a foregroundDeletion finalizer like this:"kind": "Deployment", "apiVersion": "apps/v1", "metadata": { "name": "nginx-deployment", "namespace": "default", "uid": "d1ce1b02-cae8-4288-8a53-30e84d8fa505", "resourceVersion": "1363097", "creationTimestamp": "2021-07-08T20:24:37Z", "deletionTimestamp": "2021-07-08T20:27:39Z", "finalizers": [ "foregroundDeletion" ] ... Use background cascading deletionCreate a sample Deployment.Use either kubectl or the Kubernetes API to delete the Deployment, depending on the Kubernetes version your cluster runs.To check the version, enter kubectl version.You can delete objects using background cascading deletion using kubectl or the Kubernetes API.Kubernetes uses background cascading deletion by default, and does so even if you run the following commands without the --cascade flag or the propagationPolicy argument.Using kubectlRun the following command:kubectl delete deployment nginx-deployment --cascade=background Using the Kubernetes APIStart a local proxy ses


Question: What is Use Cascading Deletion in a Cluster?

Answer: T h i s   p a g e   s h o w s   y o u   h o w   t o   s p e c i f y   t h e   t y p e   o f   c a s c a d i n g   d e l e t i o n   t o   u s e   i n   y o u r   c l u s t e r   d u r i n g   g a r b a g e   c o l l e c t i o n .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s   Y o u   a l s o   n e e d   t o   c r e a t e   a   s a m p l e   D e p l o y m e n t   t o   e x p e r i m e n t   w i t h   t h e   d i f f e r e n t   t y p e s   o f   c a s c a d i n g   d e l e t i o n .   Y o u   w i l l   n e e d   t o   r e c r e a t e   t h e   D e p l o y m e n t   f o r   e a c h   t y p e .


Question: What is Check owner references on your pods?

Answer: C h e c k   t h a t   t h e   o w n e r R e f e r e n c e s   f i e l d   i s   p r e s e n t   o n   y o u r   p o d s :   k u b e c t l   g e t   p o d s   - l   a p p = n g i n x   - - o u t p u t = y a m l   T h e   o u t p u t   h a s   a n   o w n e r R e f e r e n c e s   f i e l d   s i m i l a r   t o   t h i s :   a p i V e r s i o n :   v 1   . . .   o w n e r R e f e r e n c e s :   -   a p i V e r s i o n :   a p p s / v 1   b l o c k O w n e r D e l e t i o n :   t r u e   c o n t r o l l e r :   t r u e   k i n d :   R e p l i c a S e t   n a m e :   n g i n x - d e p l o y m e n t - 6 b 4 7 4 4 7 6 c 4   u i d :   4 f d c d 8 1 c - b d 5 d - 4 1 f 7 - 9 7 a f - 3 a 3 b 7 5 9 a f 9 a 7   . . .


Question: What is Use foreground cascading deletion?

Answer: B y   d e f a u l t ,   K u b e r n e t e s   u s e s   b a c k g r o u n d   c a s c a d i n g   d e l e t i o n   t o   d e l e t e   d e p e n d e n t s   o f   a n   o b j e c t .   Y o u   c a n   s w i t c h   t o   f o r e g r o u n d   c a s c a d i n g   d e l e t i o n   u s i n g   e i t h e r   k u b e c t l   o r   t h e   K u b e r n e t e s   A P I ,   d e p e n d i n g   o n   t h e   K u b e r n e t e s   v e r s i o n   y o u r   c l u s t e r   r u n s . T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   Y o u   c a n   d e l e t e   o b j e c t s   u s i n g   f o r e g r o u n d   c a s c a d i n g   d e l e t i o n   u s i n g   k u b e c t l   o r   t h e   K u b e r n e t e s   A P I .   U s i n g   k u b e c t l   R u n   t h e   f o l l o w i n g   c o m m a n d :   k u b e c t l   d e l e t e   d e p l o y m e n t   n g i n x - d e p l o y m e n t   - - c a s c a d e = f o r e g r o u n d   U s i n g   t h e   K u b e r n e t e s   A P I   S t a r t   a   l o c a l   p r o x y   s e s s i o n : k u b e c t l   p r o x y   - - p o r t = 8 0 8 0   U s e   c u r l   t o   t r i g g e r   d e l e t i o n : c u r l   - X   D E L E T E   l o c a l h o s t : 8 0 8 0 / a p i s / a p p s / v 1 / n a m e s p a c e s / d e f a u l t / d e p l o y m e n t s / n g i n x - d e p l o y m e n t   \   - d   ' { " k i n d " : " D e l e t e O p t i o n s " , " a p i V e r s i o n " : " v 1 " , " p r o p a g a t i o n P o l i c y " : " F o r e g r o u n d " } '   \   - H   " C o n t e n t - T y p e :   a p p l i c a t i o n / j s o n "   T h e   o u t p u t   c o n t a i n s   a   f o r e g r o u n d D e l e t i o n   f i n a l i z e r   l i k e   t h i s : " k i n d " :   " D e p l o y m e n t " ,   " a p i V e r s i o n " :   " a p p s / v 1 " ,   " m e t a d a t a " :   {   " n a m e " :   " n g i n x - d e p l o y m e n t " ,


Question: What is Use background cascading deletion?

Answer: C r e a t e   a   s a m p l e   D e p l o y m e n t . U s e   e i t h e r   k u b e c t l   o r   t h e   K u b e r n e t e s   A P I   t o   d e l e t e   t h e   D e p l o y m e n t ,   d e p e n d i n g   o n   t h e   K u b e r n e t e s   v e r s i o n   y o u r   c l u s t e r   r u n s . T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   Y o u   c a n   d e l e t e   o b j e c t s   u s i n g   b a c k g r o u n d   c a s c a d i n g   d e l e t i o n   u s i n g   k u b e c t l   o r   t h e   K u b e r n e t e s   A P I .   K u b e r n e t e s   u s e s   b a c k g r o u n d   c a s c a d i n g   d e l e t i o n   b y   d e f a u l t ,   a n d   d o e s   s o   e v e n   i f   y o u   r u n   t h e   f o l l o w i n g   c o m m a n d s   w i t h o u t   t h e   - - c a s c a d e   f l a g   o r   t h e   p r o p a g a t i o n P o l i c y   a r g u m e n t .   U s i n g   k u b e c t l   R u n   t h e   f o l l o w i n g   c o m m a n d :   k u b e c t l   d e l e t e   d e p l o y m e n t   n g i n x - d e p l o y m e n t   - - c a s c a d e = b a c k g r o u n d   U s i n g   t h e   K u b e r n e t e s   A P I   S t a r t   a   l o c a l   p r o x y   s e s s i o n : k u b e c t l   p r o x y   - - p o r t = 8 0 8 0   U s e   c u r l   t o   t r i g g e r   d e l e t i o n : c u r l   - X   D E L E T E   l o c a l h o s t : 8 0 8 0 / a p i s / a p p s / v 1 / n a m e s p a c e s / d e f a u l t / d e p l o y m e n t s / n g i n x - d e p l o y m e n t   \   - d   ' { " k i n d " : " D e l e t e O p t i o n s " , " a p i V e r s i o n " : " v 1 " , " p r o p a g a t i o n P o l i c y " : " B a c k g r o u n d " } '   \   - H   " C o n t e n t - T y p e :   a p p l i c a t i o n / j s o n "   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s : " k i n d " :   " S t a t u s " ,   " a p i V e r s i o n " :   " v 1 " ,   . .


Question: What is Delete owner objects and orphan dependents?

Answer: B y   d e f a u l t ,   w h e n   y o u   t e l l   K u b e r n e t e s   t o   d e l e t e   a n   o b j e c t ,   t h e   c o n t r o l l e r   a l s o   d e l e t e s   d e p e n d e n t   o b j e c t s .   Y o u   c a n   m a k e   K u b e r n e t e s   o r p h a n   t h e s e   d e p e n d e n t s   u s i n g   k u b e c t l   o r   t h e   K u b e r n e t e s   A P I ,   d e p e n d i n g   o n   t h e   K u b e r n e t e s   v e r s i o n   y o u r   c l u s t e r   r u n s . T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   U s i n g   k u b e c t l   R u n   t h e   f o l l o w i n g   c o m m a n d :   k u b e c t l   d e l e t e   d e p l o y m e n t   n g i n x - d e p l o y m e n t   - - c a s c a d e = o r p h a n   U s i n g   t h e   K u b e r n e t e s   A P I   S t a r t   a   l o c a l   p r o x y   s e s s i o n : k u b e c t l   p r o x y   - - p o r t = 8 0 8 0   U s e   c u r l   t o   t r i g g e r   d e l e t i o n : c u r l   - X   D E L E T E   l o c a l h o s t : 8 0 8 0 / a p i s / a p p s / v 1 / n a m e s p a c e s / d e f a u l t / d e p l o y m e n t s / n g i n x - d e p l o y m e n t   \   - d   ' { " k i n d " : " D e l e t e O p t i o n s " , " a p i V e r s i o n " : " v 1 " , " p r o p a g a t i o n P o l i c y " : " O r p h a n " } '   \   - H   " C o n t e n t - T y p e :   a p p l i c a t i o n / j s o n "   T h e   o u t p u t   c o n t a i n s   o r p h a n   i n   t h e   f i n a l i z e r s   f i e l d ,   s i m i l a r   t o   t h i s : " k i n d " :   " D e p l o y m e n t " ,   " a p i V e r s i o n " :   " a p p s / v 1 " ,   " n a m e s p a c e " :   " d e f a u l t " ,   " u i d " :   " 6 f 5 7 7 0 3 4 - 4 2 a 0 - 4 7 9 d - b e 2 1 - 7 8 0 1 8 c 4 6 6 f 1 f " ,   " c r e a t i o n T i m e s t a m p " :   " 2 0 2 1 - 0 7 - 0 9 T 1 6 : 4 6 : 3 7 Z " ,   " d e l e t i o n T i m e s t a m p


Question: What is What's next?

Answer: L e a r n   a b o u t   o w n e r s   a n d   d e p e n d e n t s   i n   K u b e r n e t e s . L e a r n   a b o u t   K u b e r n e t e s   f i n a l i z e r s . L e a r n   a b o u t   g a r b a g e   c o l l e c t i o n .


Question: What is Migrate Replicated Control Plane To Use Cloud Controller Manager?

Answer: Migrate Replicated Control Plane To Use Cloud Controller ManagerThe cloud-controller-manager is a Kubernetes control plane component that embeds cloud-specific control logic. The cloud controller manager lets you link your cluster into your cloud provider's API, and separates out the components that interact with that cloud platform from components that only interact with your cluster.By decoupling the interoperability logic between Kubernetes and the underlying cloud infrastructure, the cloud-controller-manager component enables cloud providers to release features at a different pace compared to the main Kubernetes project.BackgroundAs part of the cloud provider extraction effort, all cloud specific controllers must be moved out of the kube-controller-manager. All existing clusters that run cloud controllers in the kube-controller-manager must migrate to instead run the controllers in a cloud provider specific cloud-controller-manager.Leader Migration provides a mechanism in which HA clusters can safely migrate "cloud specific" controllers between the kube-controller-manager and the cloud-controller-manager via a shared resource lock between the two components while upgrading the replicated control plane. For a single-node control plane, or if unavailability of controller managers can be tolerated during the upgrade, Leader Migration is not needed and this guide can be ignored.Leader Migration can be enabled by setting --enable-leader-migration on kube-controller-manager or cloud-controller-manager. Leader Migration only applies during the upgrade and can be safely disabled or left enabled after the upgrade is complete.This guide walks you through the manual process of upgrading the control plane from kube-controller-manager with built-in cloud provider to running both kube-controller-manager and cloud-controller-manager. If you use a tool to deploy and manage the cluster, please refer to the documentation of the tool and the cloud provider for specific instructions of the migration.Before you beginIt is assumed that the control plane is running Kubernetes version N and to be upgraded to version N + 1. Although it is possible to migrate within the same version, ideally the migration should be performed as part of an upgrade so that changes of configuration can be aligned to each release. The exact versions of N and N + 1 depend on each cloud provider. For example, if a cloud provider builds a cloud-controller-manager to work with Kubernetes 1.24, then N can be 1.23 and N + 1 can be 1.24.The control plane nodes should run kube-controller-manager with Leader Election enabled, which is the default. As of version N, an in-tree cloud provider must be set with --cloud-provider flag and cloud-controller-manager should not yet be deployed.The out-of-tree cloud provider must have built a cloud-controller-manager with Leader Migration implementation. If the cloud provider imports k8s.io/cloud-provider and k8s.io/controller-manager of version v0.21.0 or la


Question: How does Migrate Replicated Control Plane To Use Cloud Controller Manager work?

Answer: Migrate Replicated Control Plane To Use Cloud Controller ManagerThe cloud-controller-manager is a Kubernetes control plane component that embeds cloud-specific control logic. The cloud controller manager lets you link your cluster into your cloud provider's API, and separates out the components that interact with that cloud platform from components that only interact with your cluster.By decoupling the interoperability logic between Kubernetes and the underlying cloud infrastructure, the cloud-controller-manager component enables cloud providers to release features at a different pace compared to the main Kubernetes project.BackgroundAs part of the cloud provider extraction effort, all cloud specific controllers must be moved out of the kube-controller-manager. All existing clusters that run cloud controllers in the kube-controller-manager must migrate to instead run the controllers in a cloud provider specific cloud-controller-manager.Leader Migration provides a mechanism in which HA clusters can safely migrate "cloud specific" controllers between the kube-controller-manager and the cloud-controller-manager via a shared resource lock between the two components while upgrading the replicated control plane. For a single-node control plane, or if unavailability of controller managers can be tolerated during the upgrade, Leader Migration is not needed and this guide can be ignored.Leader Migration can be enabled by setting --enable-leader-migration on kube-controller-manager or cloud-controller-manager. Leader Migration only applies during the upgrade and can be safely disabled or left enabled after the upgrade is complete.This guide walks you through the manual process of upgrading the control plane from kube-controller-manager with built-in cloud provider to running both kube-controller-manager and cloud-controller-manager. If you use a tool to deploy and manage the cluster, please refer to the documentation of the tool and the cloud provider for specific instructions of the migration.Before you beginIt is assumed that the control plane is running Kubernetes version N and to be upgraded to version N + 1. Although it is possible to migrate within the same version, ideally the migration should be performed as part of an upgrade so that changes of configuration can be aligned to each release. The exact versions of N and N + 1 depend on each cloud provider. For example, if a cloud provider builds a cloud-controller-manager to work with Kubernetes 1.24, then N can be 1.23 and N + 1 can be 1.24.The control plane nodes should run kube-controller-manager with Leader Election enabled, which is the default. As of version N, an in-tree cloud provider must be set with --cloud-provider flag and cloud-controller-manager should not yet be deployed.The out-of-tree cloud provider must have built a cloud-controller-manager with Leader Migration implementation. If the cloud provider imports k8s.io/cloud-provider and k8s.io/controller-manager of version v0.21.0 or la