Merge branch 'main' into updatetools
This commit is contained in:
RA489
@@ -26,7 +26,7 @@ This section of the Kubernetes documentation contains references.
|
||||
* [One-page API Reference for Kubernetes {{< param "version" >}}](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/)
|
||||
* [Using The Kubernetes API](/docs/reference/using-api/) - overview of the API for Kubernetes.
|
||||
* [API access control](/docs/reference/access-authn-authz/) - details on how Kubernetes controls API access
|
||||
* [Well-Known Labels, Annotations and Taints](/docs/reference/kubernetes-api/labels-annotations-taints/)
|
||||
* [Well-Known Labels, Annotations and Taints](/docs/reference/labels-annotations-taints/)
|
||||
|
||||
## Officially supported client libraries
|
||||
|
||||
@@ -38,8 +38,8 @@ client libraries:
|
||||
- [Kubernetes Python client library](https://github.com/kubernetes-client/python)
|
||||
- [Kubernetes Java client library](https://github.com/kubernetes-client/java)
|
||||
- [Kubernetes JavaScript client library](https://github.com/kubernetes-client/javascript)
|
||||
- [Kubernetes Dotnet client library](https://github.com/kubernetes-client/csharp)
|
||||
- [Kubernetes Haskell Client library](https://github.com/kubernetes-client/haskell)
|
||||
- [Kubernetes C# client library](https://github.com/kubernetes-client/csharp)
|
||||
- [Kubernetes Haskell client library](https://github.com/kubernetes-client/haskell)
|
||||
|
||||
## CLI
|
||||
|
||||
@@ -64,6 +64,8 @@ client libraries:
|
||||
* [Scheduler Policies](/docs/reference/scheduling/policies)
|
||||
* [Scheduler Profiles](/docs/reference/scheduling/config#profiles)
|
||||
|
||||
* List of [ports and protocols](/docs/reference/ports-and-protocols/) that
|
||||
should be open on control plane and worker nodes
|
||||
## Config APIs
|
||||
|
||||
This section hosts the documentation for "unpublished" APIs which are used to
|
||||
@@ -71,18 +73,20 @@ configure kubernetes components or tools. Most of these APIs are not exposed
|
||||
by the API server in a RESTful way though they are essential for a user or an
|
||||
operator to use or manage a cluster.
|
||||
|
||||
* [kube-apiserver configuration (v1alpha1)](/docs/reference/config-api/apiserver-config.v1alpha1/)
|
||||
* [kubelet configuration (v1beta1)](/docs/reference/config-api/kubelet-config.v1beta1/)
|
||||
* [kube-scheduler configuration (v1beta1)](/docs/reference/config-api/kube-scheduler-config.v1beta1/)
|
||||
* [kube-scheduler configuration (v1beta2)](/docs/reference/config-api/kube-scheduler-config.v1beta2/)
|
||||
* [kube-scheduler policy reference (v1)](/docs/reference/config-api/kube-scheduler-policy-config.v1/)
|
||||
* [kube-proxy configuration (v1alpha1)](/docs/reference/config-api/kube-proxy-config.v1alpha1/)
|
||||
* [`audit.k8s.io/v1` API](/docs/reference/config-api/apiserver-audit.v1/)
|
||||
|
||||
## Config APIs
|
||||
|
||||
* [Client authentication API (v1beta1)](/docs/reference/config-api/client-authentication.v1beta1/)
|
||||
* [WebhookAdmission configuration (v1)](/docs/reference/config-api/apiserver-webhookadmission.v1/)
|
||||
|
||||
## Config APIs
|
||||
## Config API for kubeadm
|
||||
|
||||
* [kube-scheduler policy reference (v1)](/docs/reference/config-api/kube-scheduler-policy-config.v1/)
|
||||
* [v1beta2](/docs/reference/config-api/kubeadm-config.v1beta2/)
|
||||
* [v1beta3](/docs/reference/config-api/kubeadm-config.v1beta3/)
|
||||
|
||||
## Design Docs
|
||||
|
||||
|
||||
@@ -127,7 +127,7 @@ up the verbosity:
|
||||
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group": "system:unauthenticated", "readonly": true, "nonResourcePath": "*"}}
|
||||
```
|
||||
|
||||
[Complete file example](https://releases.k8s.io/{{< param "githubbranch" >}}/pkg/auth/authorizer/abac/example_policy_file.jsonl)
|
||||
[Complete file example](https://releases.k8s.io/{{< param "fullversion" >}}/pkg/auth/authorizer/abac/example_policy_file.jsonl)
|
||||
|
||||
## A quick note on service accounts
|
||||
|
||||
|
||||
@@ -94,7 +94,7 @@ kube-apiserver -h | grep enable-admission-plugins
|
||||
In the current version, the default ones are:
|
||||
|
||||
```shell
|
||||
NamespaceLifecycle, LimitRanger, ServiceAccount, TaintNodesByCondition, Priority, DefaultTolerationSeconds, DefaultStorageClass, StorageObjectInUseProtection, PersistentVolumeClaimResize, RuntimeClass, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, DefaultIngressClass, MutatingAdmissionWebhook, ValidatingAdmissionWebhook, ResourceQuota
|
||||
CertificateApproval, CertificateSigning, CertificateSubjectRestriction, DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, LimitRanger, MutatingAdmissionWebhook, NamespaceLifecycle, PersistentVolumeClaimResize, Priority, ResourceQuota, RuntimeClass, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionWebhook
|
||||
```
|
||||
|
||||
## What does each admission controller do?
|
||||
@@ -105,6 +105,12 @@ NamespaceLifecycle, LimitRanger, ServiceAccount, TaintNodesByCondition, Priority
|
||||
|
||||
This admission controller allows all pods into the cluster. It is deprecated because its behavior is the same as if there were no admission controller at all.
|
||||
|
||||
### AlwaysDeny {#alwaysdeny}
|
||||
|
||||
{{< feature-state for_k8s_version="v1.13" state="deprecated" >}}
|
||||
|
||||
Rejects all requests. AlwaysDeny is DEPRECATED as it has no real meaning.
|
||||
|
||||
### AlwaysPullImages {#alwayspullimages}
|
||||
|
||||
This admission controller modifies every new Pod to force the image pull policy to Always. This is useful in a
|
||||
@@ -115,12 +121,6 @@ scheduled onto the right node), without any authorization check against the imag
|
||||
is enabled, images are always pulled prior to starting containers, which means valid credentials are
|
||||
required.
|
||||
|
||||
### AlwaysDeny {#alwaysdeny}
|
||||
|
||||
{{< feature-state for_k8s_version="v1.13" state="deprecated" >}}
|
||||
|
||||
Rejects all requests. AlwaysDeny is DEPRECATED as no real meaning.
|
||||
|
||||
### CertificateApproval {#certificateapproval}
|
||||
|
||||
This admission controller observes requests to 'approve' CertificateSigningRequest resources and performs additional
|
||||
@@ -145,6 +145,22 @@ This admission controller observes creation of CertificateSigningRequest resourc
|
||||
of `kubernetes.io/kube-apiserver-client`. It rejects any request that specifies a 'group' (or 'organization attribute')
|
||||
of `system:masters`.
|
||||
|
||||
### DefaultIngressClass {#defaultingressclass}
|
||||
|
||||
This admission controller observes creation of `Ingress` objects that do not request any specific
|
||||
ingress class and automatically adds a default ingress class to them. This way, users that do not
|
||||
request any special ingress class do not need to care about them at all and they will get the
|
||||
default one.
|
||||
|
||||
This admission controller does not do anything when no default ingress class is configured. When more than one ingress
|
||||
class is marked as default, it rejects any creation of `Ingress` with an error and an administrator
|
||||
must revisit their `IngressClass` objects and mark only one as default (with the annotation
|
||||
"ingressclass.kubernetes.io/is-default-class"). This admission controller ignores any `Ingress`
|
||||
updates; it acts only on creation.
|
||||
|
||||
See the [ingress](/docs/concepts/services-networking/ingress/) documentation for more about ingress
|
||||
classes and how to mark one as default.
|
||||
|
||||
### DefaultStorageClass {#defaultstorageclass}
|
||||
|
||||
This admission controller observes creation of `PersistentVolumeClaim` objects that do not request any specific storage class
|
||||
@@ -169,19 +185,6 @@ have toleration for taints `node.kubernetes.io/not-ready:NoExecute` or
|
||||
`node.kubernetes.io/unreachable:NoExecute`.
|
||||
The default value for `default-not-ready-toleration-seconds` and `default-unreachable-toleration-seconds` is 5 minutes.
|
||||
|
||||
### DenyExecOnPrivileged {#denyexeconprivileged}
|
||||
|
||||
{{< feature-state for_k8s_version="v1.13" state="deprecated" >}}
|
||||
|
||||
This admission controller will intercept all requests to exec a command in a pod if that pod has a privileged container.
|
||||
|
||||
This functionality has been merged into [DenyEscalatingExec](#denyescalatingexec).
|
||||
The DenyExecOnPrivileged admission plugin is deprecated.
|
||||
|
||||
Use of a policy-based admission plugin (like [PodSecurityPolicy](#podsecuritypolicy) or a custom admission plugin)
|
||||
which can be targeted at specific users or Namespaces and also protects against creation of overly privileged Pods
|
||||
is recommended instead.
|
||||
|
||||
### DenyEscalatingExec {#denyescalatingexec}
|
||||
|
||||
{{< feature-state for_k8s_version="v1.13" state="deprecated" >}}
|
||||
@@ -196,6 +199,32 @@ Use of a policy-based admission plugin (like [PodSecurityPolicy](#podsecuritypol
|
||||
which can be targeted at specific users or Namespaces and also protects against creation of overly privileged Pods
|
||||
is recommended instead.
|
||||
|
||||
### DenyExecOnPrivileged {#denyexeconprivileged}
|
||||
|
||||
{{< feature-state for_k8s_version="v1.13" state="deprecated" >}}
|
||||
|
||||
This admission controller will intercept all requests to exec a command in a pod if that pod has a privileged container.
|
||||
|
||||
This functionality has been merged into [DenyEscalatingExec](#denyescalatingexec).
|
||||
The DenyExecOnPrivileged admission plugin is deprecated.
|
||||
|
||||
Use of a policy-based admission plugin (like [PodSecurityPolicy](#podsecuritypolicy) or a custom admission plugin)
|
||||
which can be targeted at specific users or Namespaces and also protects against creation of overly privileged Pods
|
||||
is recommended instead.
|
||||
|
||||
### DenyServiceExternalIPs
|
||||
|
||||
This admission controller rejects all net-new usage of the `Service` field `externalIPs`. This
|
||||
feature is very powerful (allows network traffic interception) and not well
|
||||
controlled by policy. When enabled, users of the cluster may not create new
|
||||
Services which use `externalIPs` and may not add new values to `externalIPs` on
|
||||
existing `Service` objects. Existing uses of `externalIPs` are not affected,
|
||||
and users may remove values from `externalIPs` on existing `Service` objects.
|
||||
|
||||
Most users do not need this feature at all, and cluster admins should consider disabling it.
|
||||
Clusters that do need to use this feature should consider using some custom policy to manage usage
|
||||
of it.
|
||||
|
||||
### EventRateLimit {#eventratelimit}
|
||||
|
||||
{{< feature-state for_k8s_version="v1.13" state="alpha" >}}
|
||||
@@ -549,6 +578,37 @@ This admission controller also protects the access to `metadata.ownerReferences[
|
||||
of an object, so that only users with "update" permission to the `finalizers`
|
||||
subresource of the referenced *owner* can change it.
|
||||
|
||||
### PersistentVolumeClaimResize {#persistentvolumeclaimresize}
|
||||
|
||||
This admission controller implements additional validations for checking incoming `PersistentVolumeClaim` resize requests.
|
||||
|
||||
{{< note >}}
|
||||
Support for volume resizing is available as an alpha feature. Admins must set the feature gate `ExpandPersistentVolumes`
|
||||
to `true` to enable resizing.
|
||||
{{< /note >}}
|
||||
|
||||
After enabling the `ExpandPersistentVolumes` feature gate, enabling the `PersistentVolumeClaimResize` admission
|
||||
controller is recommended, too. This admission controller prevents resizing of all claims by default unless a claim's `StorageClass`
|
||||
explicitly enables resizing by setting `allowVolumeExpansion` to `true`.
|
||||
|
||||
For example: all `PersistentVolumeClaim`s created from the following `StorageClass` support volume expansion:
|
||||
|
||||
```yaml
|
||||
apiVersion: storage.k8s.io/v1
|
||||
kind: StorageClass
|
||||
metadata:
|
||||
name: gluster-vol-default
|
||||
provisioner: kubernetes.io/glusterfs
|
||||
parameters:
|
||||
resturl: "http://192.168.10.100:8080"
|
||||
restuser: ""
|
||||
secretNamespace: ""
|
||||
secretName: ""
|
||||
allowVolumeExpansion: true
|
||||
```
|
||||
|
||||
For more information about persistent volume claims, see [PersistentVolumeClaims](/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims).
|
||||
|
||||
### PersistentVolumeLabel {#persistentvolumelabel}
|
||||
|
||||
{{< feature-state for_k8s_version="v1.13" state="deprecated" >}}
|
||||
@@ -636,39 +696,22 @@ PodNodeSelector allows forcing pods to run on specifically labeled nodes. Also s
|
||||
admission plugin, which allows preventing pods from running on specifically tainted nodes.
|
||||
{{< /note >}}
|
||||
|
||||
### PersistentVolumeClaimResize {#persistentvolumeclaimresize}
|
||||
### PodSecurity {#podsecurity}
|
||||
|
||||
This admission controller implements additional validations for checking incoming `PersistentVolumeClaim` resize requests.
|
||||
{{< feature-state for_k8s_version="v1.22" state="alpha" >}}
|
||||
|
||||
{{< note >}}
|
||||
Support for volume resizing is available as an alpha feature. Admins must set the feature gate `ExpandPersistentVolumes`
|
||||
to `true` to enable resizing.
|
||||
{{< /note >}}
|
||||
This is the replacement for the deprecated [PodSecurityPolicy](#podsecuritypolicy) admission controller
|
||||
defined in the next section. This admission controller acts on creation and modification of the pod and
|
||||
determines if it should be admitted based on the requested security context and the
|
||||
[Pod Security Standards](/docs/concepts/security/pod-security-standards/).
|
||||
|
||||
After enabling the `ExpandPersistentVolumes` feature gate, enabling the `PersistentVolumeClaimResize` admission
|
||||
controller is recommended, too. This admission controller prevents resizing of all claims by default unless a claim's `StorageClass`
|
||||
explicitly enables resizing by setting `allowVolumeExpansion` to `true`.
|
||||
|
||||
For example: all `PersistentVolumeClaim`s created from the following `StorageClass` support volume expansion:
|
||||
|
||||
```yaml
|
||||
apiVersion: storage.k8s.io/v1
|
||||
kind: StorageClass
|
||||
metadata:
|
||||
name: gluster-vol-default
|
||||
provisioner: kubernetes.io/glusterfs
|
||||
parameters:
|
||||
resturl: "http://192.168.10.100:8080"
|
||||
restuser: ""
|
||||
secretNamespace: ""
|
||||
secretName: ""
|
||||
allowVolumeExpansion: true
|
||||
```
|
||||
|
||||
For more information about persistent volume claims, see [PersistentVolumeClaims](/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims).
|
||||
See the [Pod Security Admission documentation](/docs/concepts/security/pod-security-admission/)
|
||||
for more information.
|
||||
|
||||
### PodSecurityPolicy {#podsecuritypolicy}
|
||||
|
||||
{{< feature-state for_k8s_version="v1.21" state="deprecated" >}}
|
||||
|
||||
This admission controller acts on creation and modification of the pod and determines if it should be admitted
|
||||
based on the requested security context and the available Pod Security Policies.
|
||||
|
||||
@@ -760,7 +803,7 @@ for more detailed information.
|
||||
|
||||
### TaintNodesByCondition {#taintnodesbycondition}
|
||||
|
||||
{{< feature-state for_k8s_version="v1.12" state="beta" >}}
|
||||
{{< feature-state for_k8s_version="v1.17" state="stable" >}}
|
||||
|
||||
This admission controller {{< glossary_tooltip text="taints" term_id="taint" >}} newly created Nodes as `NotReady` and `NoSchedule`. That tainting avoids a race condition that could cause Pods to be scheduled on new Nodes before their taints were updated to accurately reflect their reported conditions.
|
||||
|
||||
|
||||
@@ -205,12 +205,10 @@ spec:
|
||||
```
|
||||
|
||||
Service account bearer tokens are perfectly valid to use outside the cluster and
|
||||
|
||||
can be used to create identities for long standing jobs that wish to talk to the
|
||||
Kubernetes API. To manually create a service account, simply use the `kubectl`
|
||||
|
||||
create serviceaccount (NAME)` command. This creates a service account in the
|
||||
current namespace and an associated secret.
|
||||
Kubernetes API. To manually create a service account, use the `kubectl create
|
||||
serviceaccount (NAME)` command. This creates a service account in the current
|
||||
namespace and an associated secret.
|
||||
|
||||
```bash
|
||||
kubectl create serviceaccount jenkins
|
||||
@@ -736,21 +734,32 @@ The following HTTP headers can be used to performing an impersonation request:
|
||||
* `Impersonate-User`: The username to act as.
|
||||
* `Impersonate-Group`: A group name to act as. Can be provided multiple times to set multiple groups. Optional. Requires "Impersonate-User".
|
||||
* `Impersonate-Extra-( extra name )`: A dynamic header used to associate extra fields with the user. Optional. Requires "Impersonate-User". In order to be preserved consistently, `( extra name )` should be lower-case, and any characters which aren't [legal in HTTP header labels](https://tools.ietf.org/html/rfc7230#section-3.2.6) MUST be utf8 and [percent-encoded](https://tools.ietf.org/html/rfc3986#section-2.1).
|
||||
* `Impersonate-Uid`: A unique identifier that represents the user being impersonated. Optional. Requires "Impersonate-User". Kubernetes does not impose any format requirements on this string.
|
||||
|
||||
{{< note >}}
|
||||
Prior to 1.11.3 (and 1.10.7, 1.9.11), `( extra name )` could only contain characters which were [legal in HTTP header labels](https://tools.ietf.org/html/rfc7230#section-3.2.6).
|
||||
{{< /note >}}
|
||||
|
||||
An example set of headers:
|
||||
{{< note >}}
|
||||
`Impersonate-Uid` is only available in versions 1.22.0 and higher.
|
||||
{{< /note >}}
|
||||
|
||||
An example of the impersonation headers used when impersonating a user with groups:
|
||||
```http
|
||||
Impersonate-User: jane.doe@example.com
|
||||
Impersonate-Group: developers
|
||||
Impersonate-Group: admins
|
||||
```
|
||||
|
||||
An example of the impersonation headers used when impersonating a user with a UID and
|
||||
extra fields:
|
||||
```http
|
||||
Impersonate-User: jane.doe@example.com
|
||||
Impersonate-Extra-dn: cn=jane,ou=engineers,dc=example,dc=com
|
||||
Impersonate-Extra-acme.com%2Fproject: some-project
|
||||
Impersonate-Extra-scopes: view
|
||||
Impersonate-Extra-scopes: development
|
||||
Impersonate-Uid: 06f6ce97-e2c5-4ab8-7ba5-7654dd08d52b
|
||||
```
|
||||
|
||||
When using `kubectl` set the `--as` flag to configure the `Impersonate-User`
|
||||
@@ -775,9 +784,13 @@ node/mynode cordoned
|
||||
node/mynode drained
|
||||
```
|
||||
|
||||
To impersonate a user, group, or set extra fields, the impersonating user must
|
||||
{{< note >}}
|
||||
`kubectl` cannot impersonate extra fields or UIDs.
|
||||
{{< /note >}}
|
||||
|
||||
To impersonate a user, group, user identifier (UID) or extra fields, the impersonating user must
|
||||
have the ability to perform the "impersonate" verb on the kind of attribute
|
||||
being impersonated ("user", "group", etc.). For clusters that enable the RBAC
|
||||
being impersonated ("user", "group", "uid", etc.). For clusters that enable the RBAC
|
||||
authorization plugin, the following ClusterRole encompasses the rules needed to
|
||||
set user and group impersonation headers:
|
||||
|
||||
@@ -792,19 +805,20 @@ rules:
|
||||
verbs: ["impersonate"]
|
||||
```
|
||||
|
||||
For impersonation, extra fields and impersonated UIDs are both under the "authentication.k8s.io" `apiGroup`.
|
||||
Extra fields are evaluated as sub-resources of the resource "userextras". To
|
||||
allow a user to use impersonation headers for the extra field "scopes", a user
|
||||
should be granted the following role:
|
||||
allow a user to use impersonation headers for the extra field "scopes" and
|
||||
for UIDs, a user should be granted the following role:
|
||||
|
||||
```yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: scopes-impersonator
|
||||
name: scopes-and-uid-impersonator
|
||||
rules:
|
||||
# Can set "Impersonate-Extra-scopes" header.
|
||||
# Can set "Impersonate-Extra-scopes" header and the "Impersonate-Uid" header.
|
||||
- apiGroups: ["authentication.k8s.io"]
|
||||
resources: ["userextras/scopes"]
|
||||
resources: ["userextras/scopes", "uids"]
|
||||
verbs: ["impersonate"]
|
||||
```
|
||||
|
||||
@@ -834,11 +848,17 @@ rules:
|
||||
resources: ["userextras/scopes"]
|
||||
verbs: ["impersonate"]
|
||||
resourceNames: ["view", "development"]
|
||||
|
||||
# Can impersonate the uid "06f6ce97-e2c5-4ab8-7ba5-7654dd08d52b"
|
||||
- apiGroups: ["authentication.k8s.io"]
|
||||
resources: ["uids"]
|
||||
verbs: ["impersonate"]
|
||||
resourceNames: ["06f6ce97-e2c5-4ab8-7ba5-7654dd08d52b"]
|
||||
```
|
||||
|
||||
## client-go credential plugins
|
||||
|
||||
{{< feature-state for_k8s_version="v1.11" state="beta" >}}
|
||||
{{< feature-state for_k8s_version="v1.22" state="stable" >}}
|
||||
|
||||
`k8s.io/client-go` and tools using it such as `kubectl` and `kubelet` are able to execute an
|
||||
external command to receive user credentials.
|
||||
@@ -869,6 +889,8 @@ To authenticate against the API:
|
||||
Credential plugins are configured through [kubectl config files](/docs/tasks/access-application-cluster/configure-access-multiple-clusters/)
|
||||
as part of the user fields.
|
||||
|
||||
{{< tabs name="exec_plugin_kubeconfig_example_1" >}}
|
||||
{{% tab name="client.authentication.k8s.io/v1" %}}
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: Config
|
||||
@@ -884,7 +906,81 @@ users:
|
||||
# The API version returned by the plugin MUST match the version listed here.
|
||||
#
|
||||
# To integrate with tools that support multiple versions (such as client.authentication.k8s.io/v1alpha1),
|
||||
# set an environment variable or pass an argument to the tool that indicates which version the exec plugin expects.
|
||||
# set an environment variable, pass an argument to the tool that indicates which version the exec plugin expects,
|
||||
# or read the version from the ExecCredential object in the KUBERNETES_EXEC_INFO environment variable.
|
||||
apiVersion: "client.authentication.k8s.io/v1"
|
||||
|
||||
# Environment variables to set when executing the plugin. Optional.
|
||||
env:
|
||||
- name: "FOO"
|
||||
value: "bar"
|
||||
|
||||
# Arguments to pass when executing the plugin. Optional.
|
||||
args:
|
||||
- "arg1"
|
||||
- "arg2"
|
||||
|
||||
# Text shown to the user when the executable doesn't seem to be present. Optional.
|
||||
installHint: |
|
||||
example-client-go-exec-plugin is required to authenticate
|
||||
to the current cluster. It can be installed:
|
||||
|
||||
On macOS: brew install example-client-go-exec-plugin
|
||||
|
||||
On Ubuntu: apt-get install example-client-go-exec-plugin
|
||||
|
||||
On Fedora: dnf install example-client-go-exec-plugin
|
||||
|
||||
...
|
||||
|
||||
# Whether or not to provide cluster information, which could potentially contain
|
||||
# very large CA data, to this exec plugin as a part of the KUBERNETES_EXEC_INFO
|
||||
# environment variable.
|
||||
provideClusterInfo: true
|
||||
|
||||
# The contract between the exec plugin and the standard input I/O stream. If the
|
||||
# contract cannot be satisfied, this plugin will not be run and an error will be
|
||||
# returned. Valid values are "Never" (this exec plugin never uses standard input),
|
||||
# "IfAvailable" (this exec plugin wants to use standard input if it is available),
|
||||
# or "Always" (this exec plugin requires standard input to function). Required.
|
||||
interactiveMode: Never
|
||||
clusters:
|
||||
- name: my-cluster
|
||||
cluster:
|
||||
server: "https://172.17.4.100:6443"
|
||||
certificate-authority: "/etc/kubernetes/ca.pem"
|
||||
extensions:
|
||||
- name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config
|
||||
extension:
|
||||
arbitrary: config
|
||||
this: can be provided via the KUBERNETES_EXEC_INFO environment variable upon setting provideClusterInfo
|
||||
you: ["can", "put", "anything", "here"]
|
||||
contexts:
|
||||
- name: my-cluster
|
||||
context:
|
||||
cluster: my-cluster
|
||||
user: my-user
|
||||
current-context: my-cluster
|
||||
```
|
||||
{{% /tab %}}
|
||||
{{% tab name="client.authentication.k8s.io/v1beta1" %}}
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: Config
|
||||
users:
|
||||
- name: my-user
|
||||
user:
|
||||
exec:
|
||||
# Command to execute. Required.
|
||||
command: "example-client-go-exec-plugin"
|
||||
|
||||
# API version to use when decoding the ExecCredentials resource. Required.
|
||||
#
|
||||
# The API version returned by the plugin MUST match the version listed here.
|
||||
#
|
||||
# To integrate with tools that support multiple versions (such as client.authentication.k8s.io/v1alpha1),
|
||||
# set an environment variable, pass an argument to the tool that indicates which version the exec plugin expects,
|
||||
# or read the version from the ExecCredential object in the KUBERNETES_EXEC_INFO environment variable.
|
||||
apiVersion: "client.authentication.k8s.io/v1beta1"
|
||||
|
||||
# Environment variables to set when executing the plugin. Optional.
|
||||
@@ -914,6 +1010,14 @@ users:
|
||||
# very large CA data, to this exec plugin as a part of the KUBERNETES_EXEC_INFO
|
||||
# environment variable.
|
||||
provideClusterInfo: true
|
||||
|
||||
# The contract between the exec plugin and the standard input I/O stream. If the
|
||||
# contract cannot be satisfied, this plugin will not be run and an error will be
|
||||
# returned. Valid values are "Never" (this exec plugin never uses standard input),
|
||||
# "IfAvailable" (this exec plugin wants to use standard input if it is available),
|
||||
# or "Always" (this exec plugin requires standard input to function). Optional.
|
||||
# Defaults to "IfAvailable".
|
||||
interactiveMode: Never
|
||||
clusters:
|
||||
- name: my-cluster
|
||||
cluster:
|
||||
@@ -932,6 +1036,8 @@ contexts:
|
||||
user: my-user
|
||||
current-context: my-cluster
|
||||
```
|
||||
{{% /tab %}}
|
||||
{{< /tabs >}}
|
||||
|
||||
Relative command paths are interpreted as relative to the directory of the config file. If
|
||||
KUBECONFIG is set to `/home/jane/kubeconfig` and the exec command is `./bin/example-client-go-exec-plugin`,
|
||||
@@ -943,21 +1049,53 @@ the binary `/home/jane/bin/example-client-go-exec-plugin` is executed.
|
||||
exec:
|
||||
# Path relative to the directory of the kubeconfig
|
||||
command: "./bin/example-client-go-exec-plugin"
|
||||
apiVersion: "client.authentication.k8s.io/v1beta1"
|
||||
apiVersion: "client.authentication.k8s.io/v1"
|
||||
interactiveMode: Never
|
||||
```
|
||||
|
||||
### Input and output formats
|
||||
|
||||
The executed command prints an `ExecCredential` object to `stdout`. `k8s.io/client-go`
|
||||
authenticates against the Kubernetes API using the returned credentials in the `status`.
|
||||
The executed command is passed an `ExecCredential` object as input via the `KUBERNETES_EXEC_INFO`
|
||||
environment variable. This input contains helpful information like the expected API version
|
||||
of the returned `ExecCredential` object and whether or not the plugin can use `stdin` to interact
|
||||
with the user.
|
||||
|
||||
When run from an interactive session, `stdin` is exposed directly to the plugin. Plugins should use a
|
||||
[TTY check](https://godoc.org/golang.org/x/crypto/ssh/terminal#IsTerminal) to determine if it's
|
||||
appropriate to prompt a user interactively.
|
||||
When run from an interactive session (i.e., a terminal), `stdin` can be exposed directly
|
||||
to the plugin. Plugins should use the `spec.interactive` field of the input
|
||||
`ExecCredential` object from the `KUBERNETES_EXEC_INFO` environment variable in order to
|
||||
determine if `stdin` has been provided. A plugin's `stdin` requirements (i.e., whether
|
||||
`stdin` is optional, strictly required, or never used in order for the plugin
|
||||
to run successfully) is declared via the `user.exec.interactiveMode` field in the
|
||||
[kubeconfig](/docs/concepts/configuration/organize-cluster-access-kubeconfig/) (see table
|
||||
below for valid values). The `user.exec.interactiveMode` field is optional in `client.authentication.k8s.io/v1beta1`
|
||||
and required in `client.authentication.k8s.io/v1`.
|
||||
|
||||
{{< table caption="interactiveMode values" >}}
|
||||
| `interactiveMode` Value | Meaning |
|
||||
| ----------------------- | ------- |
|
||||
| `Never` | This exec plugin never needs to use standard input, and therefore the exec plugin will be run regardless of whether standard input is available for user input. |
|
||||
| `IfAvailable` | This exec plugin would like to use standard input if it is available, but can still operate if standard input is not available. Therefore, the exec plugin will be run regardless of whether stdin is available for user input. If standard input is available for user input, then it will be provided to this exec plugin. |
|
||||
| `Always` | This exec plugin requires standard input in order to run, and therefore the exec plugin will only be run if standard input is available for user input. If standard input is not available for user input, then the exec plugin will not be run and an error will be returned by the exec plugin runner. |
|
||||
{{< /table >}}
|
||||
|
||||
To use bearer token credentials, the plugin returns a token in the status of the
|
||||
[`ExecCredential`](/docs/reference/config-api/client-authentication.v1beta1/#client-authentication-k8s-io-v1beta1-ExecCredential)
|
||||
|
||||
{{< tabs name="exec_plugin_ExecCredential_example_1" >}}
|
||||
{{% tab name="client.authentication.k8s.io/v1" %}}
|
||||
```json
|
||||
{
|
||||
"apiVersion": "client.authentication.k8s.io/v1",
|
||||
"kind": "ExecCredential",
|
||||
"status": {
|
||||
"token": "my-bearer-token"
|
||||
}
|
||||
}
|
||||
```
|
||||
{{% /tab %}}
|
||||
{{% tab name="client.authentication.k8s.io/v1beta1" %}}
|
||||
```json
|
||||
{
|
||||
"apiVersion": "client.authentication.k8s.io/v1beta1",
|
||||
@@ -967,6 +1105,8 @@ To use bearer token credentials, the plugin returns a token in the status of the
|
||||
}
|
||||
}
|
||||
```
|
||||
{{% /tab %}}
|
||||
{{< /tabs >}}
|
||||
|
||||
Alternatively, a PEM-encoded client certificate and key can be returned to use TLS client auth.
|
||||
If the plugin returns a different certificate and key on a subsequent call, `k8s.io/client-go`
|
||||
@@ -976,6 +1116,20 @@ If specified, `clientKeyData` and `clientCertificateData` must both must be pres
|
||||
|
||||
`clientCertificateData` may contain additional intermediate certificates to send to the server.
|
||||
|
||||
{{< tabs name="exec_plugin_ExecCredential_example_2" >}}
|
||||
{{% tab name="client.authentication.k8s.io/v1" %}}
|
||||
```json
|
||||
{
|
||||
"apiVersion": "client.authentication.k8s.io/v1",
|
||||
"kind": "ExecCredential",
|
||||
"status": {
|
||||
"clientCertificateData": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
|
||||
"clientKeyData": "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"
|
||||
}
|
||||
}
|
||||
```
|
||||
{{% /tab %}}
|
||||
{{% tab name="client.authentication.k8s.io/v1beta1" %}}
|
||||
```json
|
||||
{
|
||||
"apiVersion": "client.authentication.k8s.io/v1beta1",
|
||||
@@ -986,6 +1140,8 @@ If specified, `clientKeyData` and `clientCertificateData` must both must be pres
|
||||
}
|
||||
}
|
||||
```
|
||||
{{% /tab %}}
|
||||
{{< /tabs >}}
|
||||
|
||||
Optionally, the response can include the expiry of the credential formatted as a
|
||||
RFC3339 timestamp. Presence or absence of an expiry has the following impact:
|
||||
@@ -996,6 +1152,20 @@ RFC3339 timestamp. Presence or absence of an expiry has the following impact:
|
||||
- If an expiry is omitted, the bearer token and TLS credentials are cached until
|
||||
the server responds with a 401 HTTP status code or until the process exits.
|
||||
|
||||
{{< tabs name="exec_plugin_ExecCredential_example_3" >}}
|
||||
{{% tab name="client.authentication.k8s.io/v1" %}}
|
||||
```json
|
||||
{
|
||||
"apiVersion": "client.authentication.k8s.io/v1",
|
||||
"kind": "ExecCredential",
|
||||
"status": {
|
||||
"token": "my-bearer-token",
|
||||
"expirationTimestamp": "2018-03-05T17:30:20-08:00"
|
||||
}
|
||||
}
|
||||
```
|
||||
{{% /tab %}}
|
||||
{{% tab name="client.authentication.k8s.io/v1beta1" %}}
|
||||
```json
|
||||
{
|
||||
"apiVersion": "client.authentication.k8s.io/v1beta1",
|
||||
@@ -1006,14 +1176,38 @@ RFC3339 timestamp. Presence or absence of an expiry has the following impact:
|
||||
}
|
||||
}
|
||||
```
|
||||
{{% /tab %}}
|
||||
{{< /tabs >}}
|
||||
|
||||
To enable the exec plugin to obtain cluster-specific information, set `provideClusterInfo` on the `user.exec`
|
||||
field in the [kubeconfig](/docs/concepts/configuration/organize-cluster-access-kubeconfig/).
|
||||
The plugin will then be supplied with an environment variable, `KUBERNETES_EXEC_INFO`.
|
||||
The plugin will then be supplied this cluster-specific information in the `KUBERNETES_EXEC_INFO` environment variable.
|
||||
Information from this environment variable can be used to perform cluster-specific
|
||||
credential acquisition logic.
|
||||
The following `ExecCredential` manifest describes a cluster information sample.
|
||||
|
||||
{{< tabs name="exec_plugin_ExecCredential_example_4" >}}
|
||||
{{% tab name="client.authentication.k8s.io/v1" %}}
|
||||
```json
|
||||
{
|
||||
"apiVersion": "client.authentication.k8s.io/v1",
|
||||
"kind": "ExecCredential",
|
||||
"spec": {
|
||||
"cluster": {
|
||||
"server": "https://172.17.4.100:6443",
|
||||
"certificate-authority-data": "LS0t...",
|
||||
"config": {
|
||||
"arbitrary": "config",
|
||||
"this": "can be provided via the KUBERNETES_EXEC_INFO environment variable upon setting provideClusterInfo",
|
||||
"you": ["can", "put", "anything", "here"]
|
||||
}
|
||||
},
|
||||
"interactive": true
|
||||
}
|
||||
}
|
||||
```
|
||||
{{% /tab %}}
|
||||
{{% tab name="client.authentication.k8s.io/v1beta1" %}}
|
||||
```json
|
||||
{
|
||||
"apiVersion": "client.authentication.k8s.io/v1beta1",
|
||||
@@ -1027,12 +1221,14 @@ The following `ExecCredential` manifest describes a cluster information sample.
|
||||
"this": "can be provided via the KUBERNETES_EXEC_INFO environment variable upon setting provideClusterInfo",
|
||||
"you": ["can", "put", "anything", "here"]
|
||||
}
|
||||
}
|
||||
},
|
||||
"interactive": true
|
||||
}
|
||||
}
|
||||
```
|
||||
{{% /tab %}}
|
||||
{{< /tabs >}}
|
||||
|
||||
## {{% heading "whatsnext" %}}
|
||||
|
||||
* Read the [client authentication reference (v1beta1)](/docs/reference/config-api/client-authentication.v1beta1/)
|
||||
|
||||
|
||||
@@ -192,22 +192,33 @@ The following flags can be used:
|
||||
You can choose more than one authorization module. Modules are checked in order
|
||||
so an earlier module has higher priority to allow or deny a request.
|
||||
|
||||
## Privilege escalation via pod creation
|
||||
## Privilege escalation via workload creation or edits {#privilege-escalation-via-pod-creation}
|
||||
|
||||
Users who have the ability to create pods in a namespace can potentially
|
||||
escalate their privileges within that namespace. They can create pods that
|
||||
access their privileges within that namespace. They can create pods that access
|
||||
secrets the user cannot themselves read, or that run under a service account
|
||||
with different/greater permissions.
|
||||
Users who can create/edit pods in a namespace, either directly or through a [controller](/docs/concepts/architecture/controller/)
|
||||
such as an operator, could escalate their privileges in that namespace.
|
||||
|
||||
{{< caution >}}
|
||||
System administrators, use care when granting access to pod creation. A user
|
||||
granted permission to create pods (or controllers that create pods) in the
|
||||
namespace can: read all secrets in the namespace; read all config maps in the
|
||||
namespace; and impersonate any service account in the namespace and take any
|
||||
action the account could take. This applies regardless of authorization mode.
|
||||
System administrators, use care when granting access to create or edit workloads.
|
||||
Details of how these can be misused are documented in [escalation paths](/docs/reference/access-authn-authz/authorization/#escalation-paths)
|
||||
{{< /caution >}}
|
||||
|
||||
### Escalation paths {#escalation-paths}
|
||||
- Mounting arbitrary secrets in that namespace
|
||||
- Can be used to access secrets meant for other workloads
|
||||
- Can be used to obtain a more privileged service account's service account token
|
||||
- Using arbitrary Service Accounts in that namespace
|
||||
- Can perform Kubernetes API actions as another workload (impersonation)
|
||||
- Can perform any privileged actions that Service Account has
|
||||
- Mounting configmaps meant for other workloads in that namespace
|
||||
- Can be used to obtain information meant for other workloads, such as DB host names.
|
||||
- Mounting volumes meant for other workloads in that namespace
|
||||
- Can be used to obtain information meant for other workloads, and change it.
|
||||
|
||||
{{< caution >}}
|
||||
System administrators should be cautious when deploying CRDs that
|
||||
change the above areas. These may open privilege escalations paths.
|
||||
This should be considered when deciding on your RBAC controls.
|
||||
{{< /caution >}}
|
||||
|
||||
## {{% heading "whatsnext" %}}
|
||||
|
||||
|
||||
@@ -70,7 +70,7 @@ controller on the controller manager.
|
||||
|
||||
Each valid token is backed by a secret in the `kube-system` namespace. You can
|
||||
find the full design doc
|
||||
[here](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/design-proposals/cluster-lifecycle/bootstrap-discovery.md).
|
||||
[here](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/cluster-lifecycle/bootstrap-discovery.md).
|
||||
|
||||
Here is what the secret looks like.
|
||||
|
||||
|
||||
@@ -3,6 +3,7 @@ reviewers:
|
||||
- liggitt
|
||||
- mikedanese
|
||||
- munnerz
|
||||
- enj
|
||||
title: Certificate Signing Requests
|
||||
content_type: concept
|
||||
weight: 20
|
||||
@@ -31,6 +32,9 @@ The CertificateSigningRequest object includes a PEM-encoded PKCS#10 signing requ
|
||||
the `spec.request` field. The CertificateSigningRequest denotes the signer (the
|
||||
recipient that the request is being made to) using the `spec.signerName` field.
|
||||
Note that `spec.signerName` is a required key after API version `certificates.k8s.io/v1`.
|
||||
In Kubernetes v1.22 and later, clients may optionally set the `spec.expirationSeconds`
|
||||
field to request a particular lifetime for the issued certificate. The minimum valid
|
||||
value for this field is `600`, i.e. ten minutes.
|
||||
|
||||
Once created, a CertificateSigningRequest must be approved before it can be signed.
|
||||
Depending on the signer selected, a CertificateSigningRequest may be automatically approved
|
||||
@@ -56,19 +60,21 @@ state for some duration:
|
||||
|
||||
* Approved requests: automatically deleted after 1 hour
|
||||
* Denied requests: automatically deleted after 1 hour
|
||||
* Pending requests: automatically deleted after 1 hour
|
||||
* Failed requests: automatically deleted after 1 hour
|
||||
* Pending requests: automatically deleted after 24 hours
|
||||
* All requests: automatically deleted after the issued certificate has expired
|
||||
|
||||
## Signers
|
||||
|
||||
All signers should provide information about how they work so that clients can predict what will happen to their CSRs.
|
||||
Custom signerNames can also be specified. All signers should provide information about how they work so that clients can predict what will happen to their CSRs.
|
||||
This includes:
|
||||
|
||||
1. **Trust distribution**: how trust (CA bundles) are distributed.
|
||||
1. **Permitted subjects**: any restrictions on and behavior when a disallowed subject is requested.
|
||||
1. **Permitted x509 extensions**: including IP subjectAltNames, DNS subjectAltNames, Email subjectAltNames, URI subjectAltNames etc, and behavior when a disallowed extension is requested.
|
||||
1. **Permitted key usages / extended key usages**: any restrictions on and behavior when usages different than the signer-determined usages are specified in the CSR.
|
||||
1. **Expiration/certificate lifetime**: whether it is fixed by the signer, configurable by the admin, determined by the CSR object etc
|
||||
and the behavior when an expiration is different than the signer-determined expiration that is specified in the CSR.
|
||||
1. **Expiration/certificate lifetime**: whether it is fixed by the signer, configurable by the admin, determined by the CSR `spec.expirationSeconds` field, etc
|
||||
and the behavior when the signer-determined expiration is different from the CSR `spec.expirationSeconds` field.
|
||||
1. **CA bit allowed/disallowed**: and behavior if a CSR contains a request a for a CA certificate when the signer does not permit it.
|
||||
|
||||
Commonly, the `status.certificate` field contains a single PEM-encoded X.509
|
||||
@@ -78,15 +84,19 @@ that case, the documentation for the signer should specify the meaning of
|
||||
additional certificates; for example, this might be the certificate plus
|
||||
intermediates to be presented during TLS handshakes.
|
||||
|
||||
The PKCS#10 signing request format doesn't allow to specify a certificate
|
||||
expiration or lifetime. The expiration or lifetime therefore has to be set
|
||||
through e.g. an annotation on the CSR object. While it's theoretically
|
||||
possible for a signer to use that expiration date, there is currently no
|
||||
known implementation that does. (The built-in signers all use the same
|
||||
`ClusterSigningDuration` configuration option, which defaults to 1 year,
|
||||
and can be changed with the `--cluster-signing-duration` command-line
|
||||
flag of the kube-controller-manager.)
|
||||
The PKCS#10 signing request format does not have a standard mechanism to specify a
|
||||
certificate expiration or lifetime. The expiration or lifetime therefore has to be set
|
||||
through the `spec.expirationSeconds` field of the CSR object. The built-in signers
|
||||
use the `ClusterSigningDuration` configuration option, which defaults to 1 year,
|
||||
(the `--cluster-signing-duration` command-line flag of the kube-controller-manager)
|
||||
as the default when no `spec.expirationSeconds` is specified. When `spec.expirationSeconds`
|
||||
is specified, the minimum of `spec.expirationSeconds` and `ClusterSigningDuration` is
|
||||
used.
|
||||
|
||||
{{< note >}}
|
||||
The `spec.expirationSeconds` field was added in Kubernetes v1.22. Earlier versions of Kubernetes do not honor this field.
|
||||
Kubernetes API servers prior to v1.22 will silently drop this field when the object is created.
|
||||
{{< /note >}}
|
||||
|
||||
### Kubernetes signers
|
||||
|
||||
@@ -102,8 +112,8 @@ Kubernetes provides built-in signers that each have a well-known `signerName`:
|
||||
but it is often not the only cluster-admin subject in a cluster.
|
||||
1. Permitted x509 extensions - honors subjectAltName and key usage extensions and discards other extensions.
|
||||
1. Permitted key usages - must include `["client auth"]`. Must not include key usages beyond `["digital signature", "key encipherment", "client auth"]`.
|
||||
1. Expiration/certificate lifetime - set by the `--cluster-signing-duration` option for the
|
||||
kube-controller-manager implementation of this signer.
|
||||
1. Expiration/certificate lifetime - for the kube-controller-manager implementation of this signer, set to the minimum
|
||||
of the `--cluster-signing-duration` option or, if specified, the `spec.expirationSeconds` field of the CSR object.
|
||||
1. CA bit allowed/disallowed - not allowed.
|
||||
|
||||
1. `kubernetes.io/kube-apiserver-client-kubelet`: signs client certificates that will be honored as client certificates by the
|
||||
@@ -114,8 +124,8 @@ Kubernetes provides built-in signers that each have a well-known `signerName`:
|
||||
1. Permitted subjects - organizations are exactly `["system:nodes"]`, common name starts with "`system:node:`".
|
||||
1. Permitted x509 extensions - honors key usage extensions, forbids subjectAltName extensions and drops other extensions.
|
||||
1. Permitted key usages - exactly `["key encipherment", "digital signature", "client auth"]`.
|
||||
1. Expiration/certificate lifetime - set by the `--cluster-signing-duration` option for the
|
||||
kube-controller-manager implementation of this signer.
|
||||
1. Expiration/certificate lifetime - for the kube-controller-manager implementation of this signer, set to the minimum
|
||||
of the `--cluster-signing-duration` option or, if specified, the `spec.expirationSeconds` field of the CSR object.
|
||||
1. CA bit allowed/disallowed - not allowed.
|
||||
|
||||
1. `kubernetes.io/kubelet-serving`: signs serving certificates that are honored as a valid kubelet serving certificate
|
||||
@@ -127,8 +137,8 @@ Kubernetes provides built-in signers that each have a well-known `signerName`:
|
||||
1. Permitted x509 extensions - honors key usage and DNSName/IPAddress subjectAltName extensions, forbids EmailAddress and
|
||||
URI subjectAltName extensions, drops other extensions. At least one DNS or IP subjectAltName must be present.
|
||||
1. Permitted key usages - exactly `["key encipherment", "digital signature", "server auth"]`.
|
||||
1. Expiration/certificate lifetime - set by the `--cluster-signing-duration` option for the
|
||||
kube-controller-manager implementation of this signer.
|
||||
1. Expiration/certificate lifetime - for the kube-controller-manager implementation of this signer, set to the minimum
|
||||
of the `--cluster-signing-duration` option or, if specified, the `spec.expirationSeconds` field of the CSR object.
|
||||
1. CA bit allowed/disallowed - not allowed.
|
||||
|
||||
1. `kubernetes.io/legacy-unknown`: has no guarantees for trust at all. Some third-party distributions of Kubernetes
|
||||
@@ -139,14 +149,19 @@ Kubernetes provides built-in signers that each have a well-known `signerName`:
|
||||
1. Permitted subjects - any
|
||||
1. Permitted x509 extensions - honors subjectAltName and key usage extensions and discards other extensions.
|
||||
1. Permitted key usages - any
|
||||
1. Expiration/certificate lifetime - set by the `--cluster-signing-duration` option for the
|
||||
kube-controller-manager implementation of this signer.
|
||||
1. Expiration/certificate lifetime - for the kube-controller-manager implementation of this signer, set to the minimum
|
||||
of the `--cluster-signing-duration` option or, if specified, the `spec.expirationSeconds` field of the CSR object.
|
||||
1. CA bit allowed/disallowed - not allowed.
|
||||
|
||||
{{< note >}}
|
||||
Failures for all of these are only reported in kube-controller-manager logs.
|
||||
{{< /note >}}
|
||||
|
||||
{{< note >}}
|
||||
The `spec.expirationSeconds` field was added in Kubernetes v1.22. Earlier versions of Kubernetes do not honor this field.
|
||||
Kubernetes API servers prior to v1.22 will silently drop this field when the object is created.
|
||||
{{< /note >}}
|
||||
|
||||
Distribution of trust happens out of band for these signers. Any trust outside of those described above are strictly
|
||||
coincidental. For instance, some distributions may honor `kubernetes.io/legacy-unknown` as client certificates for the
|
||||
kube-apiserver, but this is not a standard.
|
||||
@@ -185,8 +200,7 @@ To allow signing a CertificateSigningRequest:
|
||||
|
||||
A few steps are required in order to get a normal user to be able to
|
||||
authenticate and invoke an API. First, this user must have certificate issued
|
||||
by the Kubernetes cluster, and then present that Certificate to the API call
|
||||
as the Certificate Header or through the kubectl.
|
||||
by the Kubernetes cluster, and then present that certificate to the Kubernetes API.
|
||||
|
||||
### Create private key
|
||||
|
||||
@@ -211,10 +225,9 @@ kind: CertificateSigningRequest
|
||||
metadata:
|
||||
name: myuser
|
||||
spec:
|
||||
groups:
|
||||
- system:authenticated
|
||||
request: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ1ZqQ0NBVDRDQVFBd0VURVBNQTBHQTFVRUF3d0dZVzVuWld4aE1JSUJJakFOQmdrcWhraUc5dzBCQVFFRgpBQU9DQVE4QU1JSUJDZ0tDQVFFQTByczhJTHRHdTYxakx2dHhWTTJSVlRWMDNHWlJTWWw0dWluVWo4RElaWjBOCnR2MUZtRVFSd3VoaUZsOFEzcWl0Qm0wMUFSMkNJVXBGd2ZzSjZ4MXF3ckJzVkhZbGlBNVhwRVpZM3ExcGswSDQKM3Z3aGJlK1o2MVNrVHF5SVBYUUwrTWM5T1Nsbm0xb0R2N0NtSkZNMUlMRVI3QTVGZnZKOEdFRjJ6dHBoaUlFMwpub1dtdHNZb3JuT2wzc2lHQ2ZGZzR4Zmd4eW8ybmlneFNVekl1bXNnVm9PM2ttT0x1RVF6cXpkakJ3TFJXbWlECklmMXBMWnoyalVnald4UkhCM1gyWnVVV1d1T09PZnpXM01LaE8ybHEvZi9DdS8wYk83c0x0MCt3U2ZMSU91TFcKcW90blZtRmxMMytqTy82WDNDKzBERHk5aUtwbXJjVDBnWGZLemE1dHJRSURBUUFCb0FBd0RRWUpLb1pJaHZjTgpBUUVMQlFBRGdnRUJBR05WdmVIOGR4ZzNvK21VeVRkbmFjVmQ1N24zSkExdnZEU1JWREkyQTZ1eXN3ZFp1L1BVCkkwZXpZWFV0RVNnSk1IRmQycVVNMjNuNVJsSXJ3R0xuUXFISUh5VStWWHhsdnZsRnpNOVpEWllSTmU3QlJvYXgKQVlEdUI5STZXT3FYbkFvczFqRmxNUG5NbFpqdU5kSGxpT1BjTU1oNndLaTZzZFhpVStHYTJ2RUVLY01jSVUyRgpvU2djUWdMYTk0aEpacGk3ZnNMdm1OQUxoT045UHdNMGM1dVJVejV4T0dGMUtCbWRSeEgvbUNOS2JKYjFRQm1HCkkwYitEUEdaTktXTU0xMzhIQXdoV0tkNjVoVHdYOWl4V3ZHMkh4TG1WQzg0L1BHT0tWQW9FNkpsYWFHdTlQVmkKdjlOSjVaZlZrcXdCd0hKbzZXdk9xVlA3SVFjZmg3d0drWm89Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=
|
||||
signerName: kubernetes.io/kube-apiserver-client
|
||||
expirationSeconds: 86400 # one day
|
||||
usages:
|
||||
- client auth
|
||||
EOF
|
||||
@@ -223,6 +236,7 @@ EOF
|
||||
Some points to note:
|
||||
|
||||
- `usages` has to be '`client auth`'
|
||||
- `expirationSeconds` could be made longer (i.e. `864000` for ten days) or shorter (i.e. `3600` for one hour)
|
||||
- `request` is the base64 encoded value of the CSR file content.
|
||||
You can get the content using this command: ```cat myuser.csr | base64 | tr -d "\n"```
|
||||
|
||||
@@ -384,6 +398,11 @@ Prior to Kubernetes v1.18, the kube-controller-manager would sign any CSRs that
|
||||
were marked as approved.
|
||||
{{< /note >}}
|
||||
|
||||
{{< note >}}
|
||||
The `spec.expirationSeconds` field was added in Kubernetes v1.22. Earlier versions of Kubernetes do not honor this field.
|
||||
Kubernetes API servers prior to v1.22 will silently drop this field when the object is created.
|
||||
{{< /note >}}
|
||||
|
||||
### API-based signers {#signer-api}
|
||||
|
||||
Users of the REST API can sign CSRs by submitting an UPDATE request to the `status`
|
||||
|
||||
@@ -57,7 +57,7 @@ In the following, we describe how to quickly experiment with admission webhooks.
|
||||
### Write an admission webhook server
|
||||
|
||||
Please refer to the implementation of the [admission webhook
|
||||
server](https://github.com/kubernetes/kubernetes/blob/v1.13.0/test/images/webhook/main.go)
|
||||
server](https://github.com/kubernetes/kubernetes/blob/release-1.21/test/images/agnhost/webhook/main.go)
|
||||
that is validated in a Kubernetes e2e test. The webhook handles the
|
||||
`AdmissionReview` request sent by the apiservers, and sends back its decision
|
||||
as an `AdmissionReview` object in the same version it received.
|
||||
@@ -147,7 +147,7 @@ webhooks:
|
||||
{{< /tabs >}}
|
||||
|
||||
The scope field specifies if only cluster-scoped resources ("Cluster") or namespace-scoped
|
||||
resources ("Namespaced") will match this rule. "*" means that there are no scope restrictions.
|
||||
resources ("Namespaced") will match this rule. "∗" means that there are no scope restrictions.
|
||||
|
||||
{{< note >}}
|
||||
When using `clientConfig.service`, the server cert must be valid for
|
||||
@@ -225,7 +225,7 @@ plugins:
|
||||
{{< /tabs >}}
|
||||
|
||||
For more information about `AdmissionConfiguration`, see the
|
||||
[AdmissionConfiguration schema](https://github.com/kubernetes/kubernetes/blob/v1.17.0/staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1/types.go#L27).
|
||||
[AdmissionConfiguration (v1) reference](/docs/reference/config-api/apiserver-webhookadmission.v1/).
|
||||
See the [webhook configuration](#webhook-configuration) section for details about each config field.
|
||||
|
||||
* In the kubeConfig file, provide the credentials:
|
||||
@@ -282,7 +282,7 @@ Of course you need to set up the webhook server to handle these authentications.
|
||||
|
||||
### Request
|
||||
|
||||
Webhooks are sent a POST request, with `Content-Type: application/json`,
|
||||
Webhooks are sent as POST requests, with `Content-Type: application/json`,
|
||||
with an `AdmissionReview` API object in the `admission.k8s.io` API group
|
||||
serialized to JSON as the body.
|
||||
|
||||
|
||||
@@ -86,7 +86,7 @@ Because ClusterRoles are cluster-scoped, you can also use them to grant access t
|
||||
* cluster-scoped resources (like {{< glossary_tooltip text="nodes" term_id="node" >}})
|
||||
* non-resource endpoints (like `/healthz`)
|
||||
* namespaced resources (like Pods), across all namespaces
|
||||
|
||||
|
||||
For example: you can use a ClusterRole to allow a particular user to run
|
||||
`kubectl get pods --all-namespaces`
|
||||
|
||||
@@ -279,8 +279,10 @@ rules:
|
||||
```
|
||||
|
||||
{{< note >}}
|
||||
You cannot restrict `create` or `deletecollection` requests by resourceName. For `create`, this
|
||||
limitation is because the object name is not known at authorization time.
|
||||
You cannot restrict `create` or `deletecollection` requests by their resource name.
|
||||
For `create`, this limitation is because the name of the new object may not be known at authorization time.
|
||||
If you restrict `list` or `watch` by resourceName, clients must include a `metadata.name` field selector in their `list` or `watch` request that matches the specified resourceName in order to be authorized.
|
||||
For example, `kubectl get configmaps --field-selector=metadata.name=my-configmap`
|
||||
{{< /note >}}
|
||||
|
||||
|
||||
@@ -683,9 +685,13 @@ When used in a <b>RoleBinding</b>, it gives full control over every resource in
|
||||
<td><b>admin</b></td>
|
||||
<td>None</td>
|
||||
<td>Allows admin access, intended to be granted within a namespace using a <b>RoleBinding</b>.
|
||||
|
||||
If used in a <b>RoleBinding</b>, allows read/write access to most resources in a namespace,
|
||||
including the ability to create roles and role bindings within the namespace.
|
||||
This role does not allow write access to resource quota or to the namespace itself.</td>
|
||||
This role does not allow write access to resource quota or to the namespace itself.
|
||||
This role also does not allow write access to Endpoints in clusters created
|
||||
using Kubernetes v1.22+. More information is available in the
|
||||
["Write Access for Endpoints" section](#write-access-for-endpoints).</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>edit</b></td>
|
||||
@@ -695,7 +701,9 @@ This role does not allow write access to resource quota or to the namespace itse
|
||||
This role does not allow viewing or modifying roles or role bindings.
|
||||
However, this role allows accessing Secrets and running Pods as any ServiceAccount in
|
||||
the namespace, so it can be used to gain the API access levels of any ServiceAccount in
|
||||
the namespace.</td>
|
||||
the namespace. This role also does not allow write access to Endpoints in
|
||||
clusters created using Kubernetes v1.22+. More information is available in the
|
||||
["Write Access for Endpoints" section](#write-access-for-endpoints).</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><b>view</b></td>
|
||||
@@ -1185,6 +1193,24 @@ In order from most secure to least secure, the approaches are:
|
||||
--group=system:serviceaccounts
|
||||
```
|
||||
|
||||
## Write access for Endpoints
|
||||
|
||||
Kubernetes clusters created before Kubernetes v1.22 include write access to
|
||||
Endpoints in the aggregated "edit" and "admin" roles. As a mitigation for
|
||||
[CVE-2021-25740](https://github.com/kubernetes/kubernetes/issues/103675), this
|
||||
access is not part of the aggregated roles in clusters that you create using
|
||||
Kubernetes v1.22 or later.
|
||||
|
||||
Existing clusters that have been upgraded to Kubernetes v1.22 will not be
|
||||
subject to this change. The [CVE
|
||||
announcement](https://github.com/kubernetes/kubernetes/issues/103675) includes
|
||||
guidance for restricting this access in existing clusters.
|
||||
|
||||
If you want new clusters to retain this level of access in the aggregated roles,
|
||||
you can create the following ClusterRole:
|
||||
|
||||
{{< codenew file="access/endpoints-aggregated.yaml" >}}
|
||||
|
||||
## Upgrading from ABAC
|
||||
|
||||
Clusters that originally ran older Kubernetes versions often used
|
||||
|
||||
@@ -1,23 +1,24 @@
|
||||
---
|
||||
reviewers:
|
||||
- bprashanth
|
||||
- davidopp
|
||||
- lavalamp
|
||||
- liggitt
|
||||
- bprashanth
|
||||
- davidopp
|
||||
- lavalamp
|
||||
- liggitt
|
||||
title: Managing Service Accounts
|
||||
content_type: concept
|
||||
weight: 50
|
||||
---
|
||||
|
||||
<!-- overview -->
|
||||
|
||||
This is a Cluster Administrator guide to service accounts. You should be familiar with
|
||||
[configuring Kubernetes service accounts](/docs/tasks/configure-pod-container/configure-service-account/).
|
||||
|
||||
Support for authorization and user accounts is planned but incomplete. Sometimes
|
||||
Support for authorization and user accounts is planned but incomplete. Sometimes
|
||||
incomplete features are referred to in order to better describe service accounts.
|
||||
|
||||
|
||||
<!-- body -->
|
||||
|
||||
## User accounts versus service accounts
|
||||
|
||||
Kubernetes distinguishes between the concept of a user account and a service account
|
||||
@@ -53,37 +54,46 @@ It is part of the API server.
|
||||
It acts synchronously to modify pods as they are created or updated. When this plugin is active
|
||||
(and it is by default on most distributions), then it does the following when a pod is created or modified:
|
||||
|
||||
1. If the pod does not have a `ServiceAccount` set, it sets the `ServiceAccount` to `default`.
|
||||
1. It ensures that the `ServiceAccount` referenced by the pod exists, and otherwise rejects it.
|
||||
1. If the pod does not contain any `ImagePullSecrets`, then `ImagePullSecrets` of the `ServiceAccount` are added to the pod.
|
||||
1. It adds a `volume` to the pod which contains a token for API access.
|
||||
1. It adds a `volumeSource` to each container of the pod mounted at `/var/run/secrets/kubernetes.io/serviceaccount`.
|
||||
1. If the pod does not have a `ServiceAccount` set, it sets the `ServiceAccount` to `default`.
|
||||
1. It ensures that the `ServiceAccount` referenced by the pod exists, and otherwise rejects it.
|
||||
1. It adds a `volume` to the pod which contains a token for API access if neither the ServiceAccount `automountServiceAccountToken` nor the Pod's `automountServiceAccountToken` is set to `false`.
|
||||
1. It adds a `volumeSource` to each container of the pod mounted at `/var/run/secrets/kubernetes.io/serviceaccount`, if the previous step has created a volume for ServiceAccount token.
|
||||
1. If the pod does not contain any `imagePullSecrets`, then `imagePullSecrets` of the `ServiceAccount` are added to the pod.
|
||||
|
||||
#### Bound Service Account Token Volume
|
||||
{{< feature-state for_k8s_version="v1.13" state="alpha" >}}
|
||||
|
||||
When the `BoundServiceAccountTokenVolume` feature gate is enabled, the service account admission controller will
|
||||
add a projected service account token volume instead of a secret volume. The service account token will expire after 1 hour by default or the pod is deleted. See more details about [projected volume](/docs/tasks/configure-pod-container/configure-projected-volume-storage/).
|
||||
{{< feature-state for_k8s_version="v1.22" state="stable" >}}
|
||||
|
||||
This feature depends on the `RootCAConfigMap` feature gate enabled which publish a "kube-root-ca.crt" ConfigMap to every namespace. This ConfigMap contains a CA bundle used for verifying connections to the kube-apiserver.
|
||||
1. If the pod does not have a `serviceAccountName` set, it sets the
|
||||
`serviceAccountName` to `default`.
|
||||
1. It ensures that the `serviceAccountName` referenced by the pod exists, and
|
||||
otherwise rejects it.
|
||||
1. If the pod does not contain any `imagePullSecrets`, then `imagePullSecrets`
|
||||
of the ServiceAccount referenced by `serviceAccountName` are added to the pod.
|
||||
1. It adds a `volume` to the pod which contains a token for API access
|
||||
if neither the ServiceAccount `automountServiceAccountToken` nor the Pod's
|
||||
`automountServiceAccountToken` is set to `false`.
|
||||
1. It adds a `volumeSource` to each container of the pod mounted at
|
||||
`/var/run/secrets/kubernetes.io/serviceaccount`, if the previous step has
|
||||
created a volume for ServiceAccount token.
|
||||
The ServiceAccount admission controller will add the following projected volume instead of a Secret-based volume for the non-expiring service account token created by Token Controller.
|
||||
|
||||
You can migrate a service account volume to a projected volume when
|
||||
the `BoundServiceAccountTokenVolume` feature gate is enabled.
|
||||
The service account token will expire after 1 hour or the pod is deleted. See
|
||||
more details about
|
||||
[projected volume](/docs/tasks/configure-pod-container/configure-projected-volume-storage/).
|
||||
```yaml
|
||||
- name: kube-api-access-<random-suffix>
|
||||
projected:
|
||||
defaultMode: 420 # 0644
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3607
|
||||
path: token
|
||||
- configMap:
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
name: kube-root-ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
```
|
||||
|
||||
This projected volume consists of three sources:
|
||||
|
||||
1. A ServiceAccountToken acquired from kube-apiserver via TokenRequest API. It will expire after 1 hour by default or when the pod is deleted. It is bound to the pod and has kube-apiserver as the audience.
|
||||
1. A ConfigMap containing a CA bundle used for verifying connections to the kube-apiserver. This feature depends on the `RootCAConfigMap` feature gate, which publishes a "kube-root-ca.crt" ConfigMap to every namespace. `RootCAConfigMap` feature gate is graduated to GA in 1.21 and default to true. (This flag will be removed from --feature-gate arg in 1.22)
|
||||
1. A DownwardAPI that references the namespace of the pod.
|
||||
|
||||
See more details about [projected volumes](/docs/tasks/configure-pod-container/configure-projected-volume-storage/).
|
||||
|
||||
### Token Controller
|
||||
|
||||
@@ -140,4 +150,3 @@ kubectl delete secret mysecretname
|
||||
|
||||
A ServiceAccount controller manages the ServiceAccounts inside namespaces, and
|
||||
ensures a ServiceAccount named "default" exists in every active namespace.
|
||||
|
||||
|
||||
@@ -172,5 +172,5 @@ Access to other non-resource paths can be disallowed without restricting access
|
||||
to the REST api.
|
||||
|
||||
For further documentation refer to the authorization.v1beta1 API objects and
|
||||
[webhook.go](https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/staging/src/k8s.io/apiserver/plugin/pkg/authorizer/webhook/webhook.go).
|
||||
[webhook.go](https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apiserver/plugin/pkg/authorizer/webhook/webhook.go).
|
||||
|
||||
|
||||
@@ -2,6 +2,9 @@
|
||||
title: Feature Gates
|
||||
weight: 10
|
||||
content_type: concept
|
||||
card:
|
||||
name: reference
|
||||
weight: 60
|
||||
---
|
||||
|
||||
<!-- overview -->
|
||||
@@ -25,7 +28,7 @@ Use `-h` flag to see a full set of feature gates for all components.
|
||||
To set feature gates for a component, such as kubelet, use the `--feature-gates` flag assigned to a list of feature pairs:
|
||||
|
||||
```shell
|
||||
--feature-gates="...,DynamicKubeletConfig=true"
|
||||
--feature-gates="...,GracefulNodeShutdown=true"
|
||||
```
|
||||
|
||||
The following tables are a summary of the feature gates that you can set on
|
||||
@@ -53,133 +56,150 @@ different Kubernetes components.
|
||||
| `APIPriorityAndFairness` | `false` | Alpha | 1.17 | 1.19 |
|
||||
| `APIPriorityAndFairness` | `true` | Beta | 1.20 | |
|
||||
| `APIResponseCompression` | `false` | Alpha | 1.7 | 1.15 |
|
||||
| `APIResponseCompression` | `false` | Beta | 1.16 | |
|
||||
| `APIResponseCompression` | `true` | Beta | 1.16 | |
|
||||
| `APIServerIdentity` | `false` | Alpha | 1.20 | |
|
||||
| `APIServerTracing` | `false` | Alpha | 1.22 | |
|
||||
| `AllowInsecureBackendProxy` | `true` | Beta | 1.17 | |
|
||||
| `AnyVolumeDataSource` | `false` | Alpha | 1.18 | |
|
||||
| `AppArmor` | `true` | Beta | 1.4 | |
|
||||
| `BalanceAttachedNodeVolumes` | `false` | Alpha | 1.11 | |
|
||||
| `BoundServiceAccountTokenVolume` | `false` | Alpha | 1.13 | |
|
||||
| `ControllerManagerLeaderMigration` | `false` | Alpha | 1.21 | |
|
||||
| `CPUManager` | `false` | Alpha | 1.8 | 1.9 |
|
||||
| `CPUManager` | `true` | Beta | 1.10 | |
|
||||
| `CRIContainerLogRotation` | `false` | Alpha | 1.10 | 1.10 |
|
||||
| `CRIContainerLogRotation` | `true` | Beta| 1.11 | |
|
||||
| `CPUManagerPolicyOptions` | `false` | Alpha | 1.22 | |
|
||||
| `CSIInlineVolume` | `false` | Alpha | 1.15 | 1.15 |
|
||||
| `CSIInlineVolume` | `true` | Beta | 1.16 | - |
|
||||
| `CSIMigration` | `false` | Alpha | 1.14 | 1.16 |
|
||||
| `CSIMigration` | `true` | Beta | 1.17 | |
|
||||
| `CSIMigrationAWS` | `false` | Alpha | 1.14 | |
|
||||
| `CSIMigrationAWS` | `false` | Beta | 1.17 | |
|
||||
| `CSIMigrationAWSComplete` | `false` | Alpha | 1.17 | |
|
||||
| `CSIMigrationAzureDisk` | `false` | Alpha | 1.15 | 1.18 |
|
||||
| `CSIMigrationAzureDisk` | `false` | Beta | 1.19 | |
|
||||
| `CSIMigrationAzureDiskComplete` | `false` | Alpha | 1.17 | |
|
||||
| `CSIMigrationAzureFile` | `false` | Alpha | 1.15 | |
|
||||
| `CSIMigrationAzureFileComplete` | `false` | Alpha | 1.17 | |
|
||||
| `CSIMigrationAzureFile` | `false` | Alpha | 1.15 | 1.19 |
|
||||
| `CSIMigrationAzureFile` | `false` | Beta | 1.21 | |
|
||||
| `CSIMigrationGCE` | `false` | Alpha | 1.14 | 1.16 |
|
||||
| `CSIMigrationGCE` | `false` | Beta | 1.17 | |
|
||||
| `CSIMigrationGCEComplete` | `false` | Alpha | 1.17 | |
|
||||
| `CSIMigrationOpenStack` | `false` | Alpha | 1.14 | 1.17 |
|
||||
| `CSIMigrationOpenStack` | `true` | Beta | 1.18 | |
|
||||
| `CSIMigrationOpenStackComplete` | `false` | Alpha | 1.17 | |
|
||||
| `CSIMigrationvSphere` | `false` | Beta | 1.19 | |
|
||||
| `CSIMigrationvSphereComplete` | `false` | Beta | 1.19 | |
|
||||
| `CSIServiceAccountToken` | `false` | Alpha | 1.20 | |
|
||||
| `CSIStorageCapacity` | `false` | Alpha | 1.19 | |
|
||||
| `CSIStorageCapacity` | `false` | Alpha | 1.19 | 1.20 |
|
||||
| `CSIStorageCapacity` | `true` | Beta | 1.21 | |
|
||||
| `CSIVolumeFSGroupPolicy` | `false` | Alpha | 1.19 | 1.19 |
|
||||
| `CSIVolumeFSGroupPolicy` | `true` | Beta | 1.20 | |
|
||||
| `CSIVolumeHealth` | `false` | Alpha | 1.21 | |
|
||||
| `CSRDuration` | `true` | Beta | 1.22 | |
|
||||
| `ConfigurableFSGroupPolicy` | `false` | Alpha | 1.18 | 1.19 |
|
||||
| `ConfigurableFSGroupPolicy` | `true` | Beta | 1.20 | |
|
||||
| `CronJobControllerV2` | `false` | Alpha | 1.20 | |
|
||||
| `ControllerManagerLeaderMigration` | `false` | Alpha | 1.21 | 1.21 |
|
||||
| `ControllerManagerLeaderMigration` | `true` | Beta | 1.22 | |
|
||||
| `CustomCPUCFSQuotaPeriod` | `false` | Alpha | 1.12 | |
|
||||
| `DaemonSetUpdateSurge` | `false` | Alpha | 1.21 | 1.21 |
|
||||
| `DaemonSetUpdateSurge` | `true` | Beta | 1.22 | |
|
||||
| `DefaultPodTopologySpread` | `false` | Alpha | 1.19 | 1.19 |
|
||||
| `DefaultPodTopologySpread` | `true` | Beta | 1.20 | |
|
||||
| `DelegateFSGroupToCSIDriver` | `false` | Alpha | 1.22 | |
|
||||
| `DevicePlugins` | `false` | Alpha | 1.8 | 1.9 |
|
||||
| `DevicePlugins` | `true` | Beta | 1.10 | |
|
||||
| `DisableAcceleratorUsageMetrics` | `false` | Alpha | 1.19 | 1.19 |
|
||||
| `DisableAcceleratorUsageMetrics` | `true` | Beta | 1.20 | |
|
||||
| `DownwardAPIHugePages` | `false` | Alpha | 1.20 | |
|
||||
| `DynamicKubeletConfig` | `false` | Alpha | 1.4 | 1.10 |
|
||||
| `DynamicKubeletConfig` | `true` | Beta | 1.11 | |
|
||||
| `EfficientWatchResumption` | `false` | Alpha | 1.20 | |
|
||||
| `EndpointSlice` | `false` | Alpha | 1.16 | 1.16 |
|
||||
| `EndpointSlice` | `false` | Beta | 1.17 | |
|
||||
| `EndpointSlice` | `true` | Beta | 1.18 | |
|
||||
| `EndpointSliceNodeName` | `false` | Alpha | 1.20 | |
|
||||
| `EndpointSliceProxying` | `false` | Alpha | 1.18 | 1.18 |
|
||||
| `EndpointSliceProxying` | `true` | Beta | 1.19 | |
|
||||
| `EndpointSliceTerminatingCondition` | `false` | Alpha | 1.20 | |
|
||||
| `DisableCloudProviders` | `false` | Alpha | 1.22 | |
|
||||
| `DownwardAPIHugePages` | `false` | Alpha | 1.20 | 1.20 |
|
||||
| `DownwardAPIHugePages` | `false` | Beta | 1.21 | |
|
||||
| `EfficientWatchResumption` | `false` | Alpha | 1.20 | 1.20 |
|
||||
| `EfficientWatchResumption` | `true` | Beta | 1.21 | |
|
||||
| `EndpointSliceTerminatingCondition` | `false` | Alpha | 1.20 | 1.21 |
|
||||
| `EndpointSliceTerminatingCondition` | `true` | Beta | 1.22 | |
|
||||
| `EphemeralContainers` | `false` | Alpha | 1.16 | |
|
||||
| `ExpandCSIVolumes` | `false` | Alpha | 1.14 | 1.15 |
|
||||
| `ExpandCSIVolumes` | `true` | Beta | 1.16 | |
|
||||
| `ExpandedDNSConfig` | `false` | Alpha | 1.22 | |
|
||||
| `ExpandInUsePersistentVolumes` | `false` | Alpha | 1.11 | 1.14 |
|
||||
| `ExpandInUsePersistentVolumes` | `true` | Beta | 1.15 | |
|
||||
| `ExpandPersistentVolumes` | `false` | Alpha | 1.8 | 1.10 |
|
||||
| `ExpandPersistentVolumes` | `true` | Beta | 1.11 | |
|
||||
| `ExperimentalHostUserNamespaceDefaulting` | `false` | Beta | 1.5 | |
|
||||
| `GenericEphemeralVolume` | `false` | Alpha | 1.19 | |
|
||||
| `GracefulNodeShutdown` | `false` | Alpha | 1.20 | |
|
||||
| `GenericEphemeralVolume` | `false` | Alpha | 1.19 | 1.20 |
|
||||
| `GenericEphemeralVolume` | `true` | Beta | 1.21 | |
|
||||
| `GracefulNodeShutdown` | `false` | Alpha | 1.20 | 1.20 |
|
||||
| `GracefulNodeShutdown` | `true` | Beta | 1.21 | |
|
||||
| `HPAContainerMetrics` | `false` | Alpha | 1.20 | |
|
||||
| `HPAScaleToZero` | `false` | Alpha | 1.16 | |
|
||||
| `HugePageStorageMediumSize` | `false` | Alpha | 1.18 | 1.18 |
|
||||
| `HugePageStorageMediumSize` | `true` | Beta | 1.19 | |
|
||||
| `IPv6DualStack` | `false` | Alpha | 1.15 | |
|
||||
| `ImmutableEphemeralVolumes` | `false` | Alpha | 1.18 | 1.18 |
|
||||
| `ImmutableEphemeralVolumes` | `true` | Beta | 1.19 | |
|
||||
| `IndexedJob` | `false` | Alpha | 1.21 | 1.21 |
|
||||
| `IndexedJob` | `true` | Beta | 1.22 | |
|
||||
| `JobTrackingWithFinalizers` | `false` | Alpha | 1.22 | |
|
||||
| `IngressClassNamespacedParams` | `false` | Alpha | 1.21 | 1.21 |
|
||||
| `IngressClassNamespacedParams` | `true` | Beta | 1.22 | |
|
||||
| `InTreePluginAWSUnregister` | `false` | Alpha | 1.21 | |
|
||||
| `InTreePluginAzureDiskUnregister` | `false` | Alpha | 1.21 | |
|
||||
| `InTreePluginAzureFileUnregister` | `false` | Alpha | 1.21 | |
|
||||
| `InTreePluginGCEUnregister` | `false` | Alpha | 1.21 | |
|
||||
| `InTreePluginOpenStackUnregister` | `false` | Alpha | 1.21 | |
|
||||
| `InTreePluginvSphereUnregister` | `false` | Alpha | 1.21 | |
|
||||
| `IPv6DualStack` | `false` | Alpha | 1.15 | 1.20 |
|
||||
| `IPv6DualStack` | `true` | Beta | 1.21 | |
|
||||
| `JobTrackingWithFinalizers` | `false` | Alpha | 1.22 | |
|
||||
| `KubeletCredentialProviders` | `false` | Alpha | 1.20 | |
|
||||
| `KubeletPodResources` | `true` | Alpha | 1.13 | 1.14 |
|
||||
| `KubeletPodResources` | `true` | Beta | 1.15 | |
|
||||
| `LegacyNodeRoleBehavior` | `false` | Alpha | 1.16 | 1.18 |
|
||||
| `LegacyNodeRoleBehavior` | `true` | True | 1.19 | |
|
||||
| `LocalStorageCapacityIsolation` | `false` | Alpha | 1.7 | 1.9 |
|
||||
| `LocalStorageCapacityIsolation` | `true` | Beta | 1.10 | |
|
||||
| `LocalStorageCapacityIsolationFSQuotaMonitoring` | `false` | Alpha | 1.15 | |
|
||||
| `LogarithmicScaleDown` | `false` | Alpha | 1.21 | 1.21 |
|
||||
| `LogarithmicScaleDown` | `true` | Beta | 1.22 | |
|
||||
| `KubeletInUserNamespace` | `false` | Alpha | 1.22 | |
|
||||
| `KubeletPodResourcesGetAllocatable` | `false` | Alpha | 1.21 | |
|
||||
| `MemoryManager` | `false` | Alpha | 1.21 | 1.21 |
|
||||
| `MemoryManager` | `true` | Beta | 1.22 | |
|
||||
| `MemoryQoS` | `false` | Alpha | 1.22 | |
|
||||
| `MixedProtocolLBService` | `false` | Alpha | 1.20 | |
|
||||
| `NodeDisruptionExclusion` | `false` | Alpha | 1.16 | 1.18 |
|
||||
| `NodeDisruptionExclusion` | `true` | Beta | 1.19 | |
|
||||
| `NetworkPolicyEndPort` | `false` | Alpha | 1.21 | 1.21 |
|
||||
| `NetworkPolicyEndPort` | `true` | Beta | 1.22 | |
|
||||
| `NodeSwap` | `false` | Alpha | 1.22 | |
|
||||
| `NonPreemptingPriority` | `false` | Alpha | 1.15 | 1.18 |
|
||||
| `NonPreemptingPriority` | `true` | Beta | 1.19 | |
|
||||
| `PodDisruptionBudget` | `false` | Alpha | 1.3 | 1.4 |
|
||||
| `PodDisruptionBudget` | `true` | Beta | 1.5 | |
|
||||
| `PodDeletionCost` | `false` | Alpha | 1.21 | 1.21 |
|
||||
| `PodDeletionCost` | `true` | Beta | 1.22 | |
|
||||
| `PodAffinityNamespaceSelector` | `false` | Alpha | 1.21 | 1.21 |
|
||||
| `PodAffinityNamespaceSelector` | `true` | Beta | 1.22 | |
|
||||
| `PodOverhead` | `false` | Alpha | 1.16 | 1.17 |
|
||||
| `PodOverhead` | `true` | Beta | 1.18 | |
|
||||
| `PodOverhead` | `true` | Beta | 1.18 | |
|
||||
| `PodSecurity` | `false` | Alpha | 1.22 | |
|
||||
| `PreferNominatedNode` | `false` | Alpha | 1.21 | 1.21 |
|
||||
| `PreferNominatedNode` | `true` | Beta | 1.22 | |
|
||||
| `ProbeTerminationGracePeriod` | `false` | Alpha | 1.21 | 1.21 |
|
||||
| `ProbeTerminationGracePeriod` | `false` | Beta | 1.22 | |
|
||||
| `ProcMountType` | `false` | Alpha | 1.12 | |
|
||||
| `ProxyTerminatingEndpoints` | `false` | Alpha | 1.22 | |
|
||||
| `QOSReserved` | `false` | Alpha | 1.11 | |
|
||||
| `RemainingItemCount` | `false` | Alpha | 1.15 | |
|
||||
| `ReadWriteOncePod` | `false` | Alpha | 1.22 | |
|
||||
| `RemainingItemCount` | `false` | Alpha | 1.15 | 1.15 |
|
||||
| `RemainingItemCount` | `true` | Beta | 1.16 | |
|
||||
| `RemoveSelfLink` | `false` | Alpha | 1.16 | 1.19 |
|
||||
| `RemoveSelfLink` | `true` | Beta | 1.20 | |
|
||||
| `RootCAConfigMap` | `false` | Alpha | 1.13 | 1.19 |
|
||||
| `RootCAConfigMap` | `true` | Beta | 1.20 | |
|
||||
| `RotateKubeletServerCertificate` | `false` | Alpha | 1.7 | 1.11 |
|
||||
| `RotateKubeletServerCertificate` | `true` | Beta | 1.12 | |
|
||||
| `RunAsGroup` | `true` | Beta | 1.14 | |
|
||||
| `SCTPSupport` | `false` | Alpha | 1.12 | 1.18 |
|
||||
| `SCTPSupport` | `true` | Beta | 1.19 | |
|
||||
| `ServerSideApply` | `false` | Alpha | 1.14 | 1.15 |
|
||||
| `ServerSideApply` | `true` | Beta | 1.16 | |
|
||||
| `ServiceAccountIssuerDiscovery` | `false` | Alpha | 1.18 | 1.19 |
|
||||
| `ServiceAccountIssuerDiscovery` | `true` | Beta | 1.20 | |
|
||||
| `ServiceLBNodePortControl` | `false` | Alpha | 1.20 | |
|
||||
| `ServiceNodeExclusion` | `false` | Alpha | 1.8 | 1.18 |
|
||||
| `ServiceNodeExclusion` | `true` | Beta | 1.19 | |
|
||||
| `ServiceTopology` | `false` | Alpha | 1.17 | |
|
||||
| `SetHostnameAsFQDN` | `false` | Alpha | 1.19 | 1.19 |
|
||||
| `SetHostnameAsFQDN` | `true` | Beta | 1.20 | |
|
||||
| `SizeMemoryBackedVolumes` | `false` | Alpha | 1.20 | |
|
||||
| `SeccompDefault` | `false` | Alpha | 1.22 | |
|
||||
| `ServiceInternalTrafficPolicy` | `false` | Alpha | 1.21 | 1.21 |
|
||||
| `ServiceInternalTrafficPolicy` | `true` | Beta | 1.22 | |
|
||||
| `ServiceLBNodePortControl` | `false` | Alpha | 1.20 | 1.21 |
|
||||
| `ServiceLBNodePortControl` | `true` | Beta | 1.22 | |
|
||||
| `ServiceLoadBalancerClass` | `false` | Alpha | 1.21 | 1.21 |
|
||||
| `ServiceLoadBalancerClass` | `true` | Beta | 1.22 | |
|
||||
| `SizeMemoryBackedVolumes` | `false` | Alpha | 1.20 | 1.21 |
|
||||
| `SizeMemoryBackedVolumes` | `true` | Beta | 1.22 | |
|
||||
| `StatefulSetMinReadySeconds` | `false` | Alpha | 1.22 | |
|
||||
| `StorageVersionAPI` | `false` | Alpha | 1.20 | |
|
||||
| `StorageVersionHash` | `false` | Alpha | 1.14 | 1.14 |
|
||||
| `StorageVersionHash` | `true` | Beta | 1.15 | |
|
||||
| `Sysctls` | `true` | Beta | 1.11 | |
|
||||
| `TTLAfterFinished` | `false` | Alpha | 1.12 | |
|
||||
| `SuspendJob` | `false` | Alpha | 1.21 | 1.21 |
|
||||
| `SuspendJob` | `true` | Beta | 1.22 | |
|
||||
| `TTLAfterFinished` | `false` | Alpha | 1.12 | 1.20 |
|
||||
| `TTLAfterFinished` | `true` | Beta | 1.21 | |
|
||||
| `TopologyAwareHints` | `false` | Alpha | 1.21 | |
|
||||
| `TopologyManager` | `false` | Alpha | 1.16 | 1.17 |
|
||||
| `TopologyManager` | `true` | Beta | 1.18 | |
|
||||
| `ValidateProxyRedirects` | `false` | Alpha | 1.12 | 1.13 |
|
||||
| `ValidateProxyRedirects` | `true` | Beta | 1.14 | |
|
||||
| `WarningHeaders` | `true` | Beta | 1.19 | |
|
||||
| `VolumeCapacityPriority` | `false` | Alpha | 1.21 | - |
|
||||
| `WinDSR` | `false` | Alpha | 1.14 | |
|
||||
| `WinOverlay` | `false` | Alpha | 1.14 | 1.19 |
|
||||
| `WinOverlay` | `true` | Beta | 1.20 | |
|
||||
| `WindowsEndpointSliceProxying` | `false` | Alpha | 1.19 | |
|
||||
| `WindowsHostProcessContainers` | `false` | Alpha | 1.22 | |
|
||||
{{< /table >}}
|
||||
|
||||
### Feature gates for graduated or deprecated features
|
||||
@@ -197,24 +217,50 @@ different Kubernetes components.
|
||||
| `AffinityInAnnotations` | - | Deprecated | 1.8 | - |
|
||||
| `AllowExtTrafficLocalEndpoints` | `false` | Beta | 1.4 | 1.6 |
|
||||
| `AllowExtTrafficLocalEndpoints` | `true` | GA | 1.7 | - |
|
||||
| `AttachVolumeLimit` | `false` | Alpha | 1.11 | 1.11 |
|
||||
| `AttachVolumeLimit` | `true` | Beta | 1.12 | 1.16 |
|
||||
| `AttachVolumeLimit` | `true` | GA | 1.17 | - |
|
||||
| `BalanceAttachedNodeVolumes` | `false` | Alpha | 1.11 | 1.21 |
|
||||
| `BalanceAttachedNodeVolumes` | `false` | Deprecated | 1.22 | |
|
||||
| `BlockVolume` | `false` | Alpha | 1.9 | 1.12 |
|
||||
| `BlockVolume` | `true` | Beta | 1.13 | 1.17 |
|
||||
| `BlockVolume` | `true` | GA | 1.18 | - |
|
||||
| `BoundServiceAccountTokenVolume` | `false` | Alpha | 1.13 | 1.20 |
|
||||
| `BoundServiceAccountTokenVolume` | `true` | Beta | 1.21 | 1.21 |
|
||||
| `BoundServiceAccountTokenVolume` | `true` | GA | 1.22 | - |
|
||||
| `CRIContainerLogRotation` | `false` | Alpha | 1.10 | 1.10 |
|
||||
| `CRIContainerLogRotation` | `true` | Beta | 1.11 | 1.20 |
|
||||
| `CRIContainerLogRotation` | `true` | GA | 1.21 | - |
|
||||
| `CSIBlockVolume` | `false` | Alpha | 1.11 | 1.13 |
|
||||
| `CSIBlockVolume` | `true` | Beta | 1.14 | 1.17 |
|
||||
| `CSIBlockVolume` | `true` | GA | 1.18 | - |
|
||||
| `CSIDriverRegistry` | `false` | Alpha | 1.12 | 1.13 |
|
||||
| `CSIDriverRegistry` | `true` | Beta | 1.14 | 1.17 |
|
||||
| `CSIDriverRegistry` | `true` | GA | 1.18 | |
|
||||
| `CSIMigrationAWSComplete` | `false` | Alpha | 1.17 | 1.20 |
|
||||
| `CSIMigrationAWSComplete` | - | Deprecated | 1.21 | - |
|
||||
| `CSIMigrationAzureDiskComplete` | `false` | Alpha | 1.17 | 1.20 |
|
||||
| `CSIMigrationAzureDiskComplete` | - | Deprecated | 1.21 | - |
|
||||
| `CSIMigrationAzureFileComplete` | `false` | Alpha | 1.17 | 1.20 |
|
||||
| `CSIMigrationAzureFileComplete` | - | Deprecated | 1.21 | - |
|
||||
| `CSIMigrationGCEComplete` | `false` | Alpha | 1.17 | 1.20 |
|
||||
| `CSIMigrationGCEComplete` | - | Deprecated | 1.21 | - |
|
||||
| `CSIMigrationOpenStackComplete` | `false` | Alpha | 1.17 | 1.20 |
|
||||
| `CSIMigrationOpenStackComplete` | - | Deprecated | 1.21 | - |
|
||||
| `CSIMigrationvSphereComplete` | `false` | Beta | 1.19 | 1.21 |
|
||||
| `CSIMigrationvSphereComplete` | - | Deprecated | 1.22 | - |
|
||||
| `CSINodeInfo` | `false` | Alpha | 1.12 | 1.13 |
|
||||
| `CSINodeInfo` | `true` | Beta | 1.14 | 1.16 |
|
||||
| `CSINodeInfo` | `true` | GA | 1.17 | |
|
||||
| `AttachVolumeLimit` | `false` | Alpha | 1.11 | 1.11 |
|
||||
| `AttachVolumeLimit` | `true` | Beta | 1.12 | 1.16 |
|
||||
| `AttachVolumeLimit` | `true` | GA | 1.17 | - |
|
||||
| `CSIPersistentVolume` | `false` | Alpha | 1.9 | 1.9 |
|
||||
| `CSIPersistentVolume` | `true` | Beta | 1.10 | 1.12 |
|
||||
| `CSIPersistentVolume` | `true` | GA | 1.13 | - |
|
||||
| `CSIServiceAccountToken` | `false` | Alpha | 1.20 | 1.20 |
|
||||
| `CSIServiceAccountToken` | `true` | Beta | 1.21 | 1.21 |
|
||||
| `CSIServiceAccountToken` | `true` | GA | 1.22 | |
|
||||
| `CronJobControllerV2` | `false` | Alpha | 1.20 | 1.20 |
|
||||
| `CronJobControllerV2` | `true` | Beta | 1.21 | 1.21 |
|
||||
| `CronJobControllerV2` | `true` | GA | 1.22 | - |
|
||||
| `CustomPodDNS` | `false` | Alpha | 1.9 | 1.9 |
|
||||
| `CustomPodDNS` | `true` | Beta| 1.10 | 1.13 |
|
||||
| `CustomPodDNS` | `true` | GA | 1.14 | - |
|
||||
@@ -238,26 +284,51 @@ different Kubernetes components.
|
||||
| `DryRun` | `true` | GA | 1.19 | - |
|
||||
| `DynamicAuditing` | `false` | Alpha | 1.13 | 1.18 |
|
||||
| `DynamicAuditing` | - | Deprecated | 1.19 | - |
|
||||
| `DynamicKubeletConfig` | `false` | Alpha | 1.4 | 1.10 |
|
||||
| `DynamicKubeletConfig` | `true` | Beta | 1.11 | 1.21 |
|
||||
| `DynamicKubeletConfig` | `false` | Deprecated | 1.22 | - |
|
||||
| `DynamicProvisioningScheduling` | `false` | Alpha | 1.11 | 1.11 |
|
||||
| `DynamicProvisioningScheduling` | - | Deprecated| 1.12 | - |
|
||||
| `DynamicKubeletConfig` | `false` | Alpha | 1.4 | 1.10 |
|
||||
| `DynamicKubeletConfig` | `true` | Beta | 1.11 | 1.21 |
|
||||
| `DynamicKubeletConfig` | `false` | Deprecated | 1.22 | - |
|
||||
| `DynamicVolumeProvisioning` | `true` | Alpha | 1.3 | 1.7 |
|
||||
| `DynamicVolumeProvisioning` | `true` | GA | 1.8 | - |
|
||||
| `EnableAggregatedDiscoveryTimeout` | `true` | Deprecated | 1.16 | - |
|
||||
| `EnableEquivalenceClassCache` | `false` | Alpha | 1.8 | 1.14 |
|
||||
| `EnableEquivalenceClassCache` | - | Deprecated | 1.15 | - |
|
||||
| `EndpointSlice` | `false` | Alpha | 1.16 | 1.16 |
|
||||
| `EndpointSlice` | `false` | Beta | 1.17 | 1.17 |
|
||||
| `EndpointSlice` | `true` | Beta | 1.18 | 1.20 |
|
||||
| `EndpointSlice` | `true` | GA | 1.21 | - |
|
||||
| `EndpointSliceNodeName` | `false` | Alpha | 1.20 | 1.20 |
|
||||
| `EndpointSliceNodeName` | `true` | GA | 1.21 | - |
|
||||
| `EndpointSliceProxying` | `false` | Alpha | 1.18 | 1.18 |
|
||||
| `EndpointSliceProxying` | `true` | Beta | 1.19 | 1.21 |
|
||||
| `EndpointSliceProxying` | `true` | GA | 1.22 | - |
|
||||
| `ExperimentalCriticalPodAnnotation` | `false` | Alpha | 1.5 | 1.12 |
|
||||
| `ExperimentalCriticalPodAnnotation` | `false` | Deprecated | 1.13 | - |
|
||||
| `EvenPodsSpread` | `false` | Alpha | 1.16 | 1.17 |
|
||||
| `EvenPodsSpread` | `true` | Beta | 1.18 | 1.18 |
|
||||
| `EvenPodsSpread` | `true` | GA | 1.19 | - |
|
||||
| `ExecProbeTimeout` | `true` | GA | 1.20 | - |
|
||||
| `ExternalPolicyForExternalIP` | `true` | GA | 1.18 | - |
|
||||
| `GCERegionalPersistentDisk` | `true` | Beta | 1.10 | 1.12 |
|
||||
| `GCERegionalPersistentDisk` | `true` | GA | 1.13 | - |
|
||||
| `HugePageStorageMediumSize` | `false` | Alpha | 1.18 | 1.18 |
|
||||
| `HugePageStorageMediumSize` | `true` | Beta | 1.19 | 1.21 |
|
||||
| `HugePageStorageMediumSize` | `true` | GA | 1.22 | - |
|
||||
| `HugePages` | `false` | Alpha | 1.8 | 1.9 |
|
||||
| `HugePages` | `true` | Beta| 1.10 | 1.13 |
|
||||
| `HugePages` | `true` | GA | 1.14 | - |
|
||||
| `HugePageStorageMediumSize` | `false` | Alpha | 1.18 | 1.18 |
|
||||
| `HugePageStorageMediumSize` | `true` | Beta | 1.19 | 1.21 |
|
||||
| `HugePageStorageMediumSize` | `true` | GA | 1.22 | - |
|
||||
| `HyperVContainer` | `false` | Alpha | 1.10 | 1.19 |
|
||||
| `HyperVContainer` | `false` | Deprecated | 1.20 | - |
|
||||
| `ImmutableEphemeralVolumes` | `false` | Alpha | 1.18 | 1.18 |
|
||||
| `ImmutableEphemeralVolumes` | `true` | Beta | 1.19 | 1.20 |
|
||||
| `ImmutableEphemeralVolumes` | `true` | GA | 1.21 | |
|
||||
| `Initializers` | `false` | Alpha | 1.7 | 1.13 |
|
||||
| `Initializers` | - | Deprecated | 1.14 | - |
|
||||
| `KubeletConfigFile` | `false` | Alpha | 1.8 | 1.9 |
|
||||
@@ -268,19 +339,30 @@ different Kubernetes components.
|
||||
| `KubeletPodResources` | `false` | Alpha | 1.13 | 1.14 |
|
||||
| `KubeletPodResources` | `true` | Beta | 1.15 | |
|
||||
| `KubeletPodResources` | `true` | GA | 1.20 | |
|
||||
| `LegacyNodeRoleBehavior` | `false` | Alpha | 1.16 | 1.18 |
|
||||
| `LegacyNodeRoleBehavior` | `true` | Beta | 1.19 | 1.20 |
|
||||
| `LegacyNodeRoleBehavior` | `false` | GA | 1.21 | - |
|
||||
| `MountContainers` | `false` | Alpha | 1.9 | 1.16 |
|
||||
| `MountContainers` | `false` | Deprecated | 1.17 | - |
|
||||
| `MountPropagation` | `false` | Alpha | 1.8 | 1.9 |
|
||||
| `MountPropagation` | `true` | Beta | 1.10 | 1.11 |
|
||||
| `MountPropagation` | `true` | GA | 1.12 | - |
|
||||
| `NodeDisruptionExclusion` | `false` | Alpha | 1.16 | 1.18 |
|
||||
| `NodeDisruptionExclusion` | `true` | Beta | 1.19 | 1.20 |
|
||||
| `NodeDisruptionExclusion` | `true` | GA | 1.21 | - |
|
||||
| `NodeLease` | `false` | Alpha | 1.12 | 1.13 |
|
||||
| `NodeLease` | `true` | Beta | 1.14 | 1.16 |
|
||||
| `NodeLease` | `true` | GA | 1.17 | - |
|
||||
| `NamespaceDefaultLabelName` | `true` | Beta | 1.21 | 1.21 |
|
||||
| `NamespaceDefaultLabelName` | `true` | GA | 1.22 | - |
|
||||
| `PVCProtection` | `false` | Alpha | 1.9 | 1.9 |
|
||||
| `PVCProtection` | - | Deprecated | 1.10 | - |
|
||||
| `PersistentLocalVolumes` | `false` | Alpha | 1.7 | 1.9 |
|
||||
| `PersistentLocalVolumes` | `true` | Beta | 1.10 | 1.13 |
|
||||
| `PersistentLocalVolumes` | `true` | GA | 1.14 | - |
|
||||
| `PodDisruptionBudget` | `false` | Alpha | 1.3 | 1.4 |
|
||||
| `PodDisruptionBudget` | `true` | Beta | 1.5 | 1.20 |
|
||||
| `PodDisruptionBudget` | `true` | GA | 1.21 | - |
|
||||
| `PodPriority` | `false` | Alpha | 1.8 | 1.10 |
|
||||
| `PodPriority` | `true` | Beta | 1.11 | 1.13 |
|
||||
| `PodPriority` | `true` | GA | 1.14 | - |
|
||||
@@ -291,36 +373,60 @@ different Kubernetes components.
|
||||
| `PodShareProcessNamespace` | `true` | Beta | 1.12 | 1.16 |
|
||||
| `PodShareProcessNamespace` | `true` | GA | 1.17 | - |
|
||||
| `RequestManagement` | `false` | Alpha | 1.15 | 1.16 |
|
||||
| `RequestManagement` | - | Derecated | 1.17 | - |
|
||||
| `ResourceLimitsPriorityFunction` | `false` | Alpha | 1.9 | 1.18 |
|
||||
| `ResourceLimitsPriorityFunction` | - | Deprecated | 1.19 | - |
|
||||
| `ResourceQuotaScopeSelectors` | `false` | Alpha | 1.11 | 1.11 |
|
||||
| `ResourceQuotaScopeSelectors` | `true` | Beta | 1.12 | 1.16 |
|
||||
| `ResourceQuotaScopeSelectors` | `true` | GA | 1.17 | - |
|
||||
| `RootCAConfigMap` | `false` | Alpha | 1.13 | 1.19 |
|
||||
| `RootCAConfigMap` | `true` | Beta | 1.20 | 1.20 |
|
||||
| `RootCAConfigMap` | `true` | GA | 1.21 | - |
|
||||
| `RotateKubeletClientCertificate` | `true` | Beta | 1.8 | 1.18 |
|
||||
| `RotateKubeletClientCertificate` | `true` | GA | 1.19 | - |
|
||||
| `RunAsGroup` | `true` | Beta | 1.14 | 1.20 |
|
||||
| `RunAsGroup` | `true` | GA | 1.21 | - |
|
||||
| `RuntimeClass` | `false` | Alpha | 1.12 | 1.13 |
|
||||
| `RuntimeClass` | `true` | Beta | 1.14 | 1.19 |
|
||||
| `RuntimeClass` | `true` | GA | 1.20 | - |
|
||||
| `ScheduleDaemonSetPods` | `false` | Alpha | 1.11 | 1.11 |
|
||||
| `ScheduleDaemonSetPods` | `true` | Beta | 1.12 | 1.16 |
|
||||
| `ScheduleDaemonSetPods` | `true` | GA | 1.17 | - |
|
||||
| `SCTPSupport` | `false` | Alpha | 1.12 | 1.18 |
|
||||
| `SCTPSupport` | `true` | Beta | 1.19 | 1.19 |
|
||||
| `SCTPSupport` | `true` | GA | 1.20 | - |
|
||||
| `ScheduleDaemonSetPods` | `false` | Alpha | 1.11 | 1.11 |
|
||||
| `ScheduleDaemonSetPods` | `true` | Beta | 1.12 | 1.16 |
|
||||
| `ScheduleDaemonSetPods` | `true` | GA | 1.17 | - |
|
||||
| `SelectorIndex` | `false` | Alpha | 1.18 | 1.18 |
|
||||
| `SelectorIndex` | `true` | Beta | 1.19 | 1.19 |
|
||||
| `SelectorIndex` | `true` | GA | 1.20 | - |
|
||||
| `ServerSideApply` | `false` | Alpha | 1.14 | 1.15 |
|
||||
| `ServerSideApply` | `true` | Beta | 1.16 | 1.21 |
|
||||
| `ServerSideApply` | `true` | GA | 1.22 | - |
|
||||
| `ServiceAccountIssuerDiscovery` | `false` | Alpha | 1.18 | 1.19 |
|
||||
| `ServiceAccountIssuerDiscovery` | `true` | Beta | 1.20 | 1.20 |
|
||||
| `ServiceAccountIssuerDiscovery` | `true` | GA | 1.21 | - |
|
||||
| `ServiceAppProtocol` | `false` | Alpha | 1.18 | 1.18 |
|
||||
| `ServiceAppProtocol` | `true` | Beta | 1.19 | |
|
||||
| `ServiceAppProtocol` | `true` | Beta | 1.19 | 1.19 |
|
||||
| `ServiceAppProtocol` | `true` | GA | 1.20 | - |
|
||||
| `ServiceLoadBalancerFinalizer` | `false` | Alpha | 1.15 | 1.15 |
|
||||
| `ServiceLoadBalancerFinalizer` | `true` | Beta | 1.16 | 1.16 |
|
||||
| `ServiceLoadBalancerFinalizer` | `true` | GA | 1.17 | - |
|
||||
| `ServiceNodeExclusion` | `false` | Alpha | 1.8 | 1.18 |
|
||||
| `ServiceNodeExclusion` | `true` | Beta | 1.19 | 1.20 |
|
||||
| `ServiceNodeExclusion` | `true` | GA | 1.21 | - |
|
||||
| `ServiceTopology` | `false` | Alpha | 1.17 | 1.19 |
|
||||
| `ServiceTopology` | `false` | Deprecated | 1.20 | - |
|
||||
| `SetHostnameAsFQDN` | `false` | Alpha | 1.19 | 1.19 |
|
||||
| `SetHostnameAsFQDN` | `true` | Beta | 1.20 | 1.21 |
|
||||
| `SetHostnameAsFQDN` | `true` | GA | 1.22 | - |
|
||||
| `StartupProbe` | `false` | Alpha | 1.16 | 1.17 |
|
||||
| `StartupProbe` | `true` | Beta | 1.18 | 1.19 |
|
||||
| `StartupProbe` | `true` | GA | 1.20 | - |
|
||||
| `StorageObjectInUseProtection` | `true` | Beta | 1.10 | 1.10 |
|
||||
| `StorageObjectInUseProtection` | `true` | GA | 1.11 | - |
|
||||
| `StreamingProxyRedirects` | `false` | Beta | 1.5 | 1.5 |
|
||||
| `StreamingProxyRedirects` | `true` | Beta | 1.6 | 1.18 |
|
||||
| `StreamingProxyRedirects` | - | Deprecated| 1.19 | - |
|
||||
| `StreamingProxyRedirects` | `true` | Beta | 1.6 | 1.17 |
|
||||
| `StreamingProxyRedirects` | `true` | Deprecated | 1.18 | 1.21 |
|
||||
| `StreamingProxyRedirects` | `false` | Deprecated | 1.22 | - |
|
||||
| `SupportIPVSProxyMode` | `false` | Alpha | 1.8 | 1.8 |
|
||||
| `SupportIPVSProxyMode` | `false` | Beta | 1.9 | 1.9 |
|
||||
| `SupportIPVSProxyMode` | `true` | Beta | 1.10 | 1.10 |
|
||||
@@ -331,6 +437,8 @@ different Kubernetes components.
|
||||
| `SupportPodPidsLimit` | `false` | Alpha | 1.10 | 1.13 |
|
||||
| `SupportPodPidsLimit` | `true` | Beta | 1.14 | 1.19 |
|
||||
| `SupportPodPidsLimit` | `true` | GA | 1.20 | - |
|
||||
| `Sysctls` | `true` | Beta | 1.11 | 1.20 |
|
||||
| `Sysctls` | `true` | GA | 1.21 | |
|
||||
| `TaintBasedEvictions` | `false` | Alpha | 1.6 | 1.12 |
|
||||
| `TaintBasedEvictions` | `true` | Beta | 1.13 | 1.17 |
|
||||
| `TaintBasedEvictions` | `true` | GA | 1.18 | - |
|
||||
@@ -343,25 +451,34 @@ different Kubernetes components.
|
||||
| `TokenRequestProjection` | `false` | Alpha | 1.11 | 1.11 |
|
||||
| `TokenRequestProjection` | `true` | Beta | 1.12 | 1.19 |
|
||||
| `TokenRequestProjection` | `true` | GA | 1.20 | - |
|
||||
| `VolumeSnapshotDataSource` | `false` | Alpha | 1.12 | 1.16 |
|
||||
| `VolumeSnapshotDataSource` | `true` | Beta | 1.17 | 1.19 |
|
||||
| `VolumeSnapshotDataSource` | `true` | GA | 1.20 | - |
|
||||
| `ValidateProxyRedirects` | `false` | Alpha | 1.12 | 1.13 |
|
||||
| `ValidateProxyRedirects` | `true` | Beta | 1.14 | 1.21 |
|
||||
| `ValidateProxyRedirects` | `true` | Deprecated | 1.22 | - |
|
||||
| `VolumePVCDataSource` | `false` | Alpha | 1.15 | 1.15 |
|
||||
| `VolumePVCDataSource` | `true` | Beta | 1.16 | 1.17 |
|
||||
| `VolumePVCDataSource` | `true` | GA | 1.18 | - |
|
||||
| `VolumeScheduling` | `false` | Alpha | 1.9 | 1.9 |
|
||||
| `VolumeScheduling` | `true` | Beta | 1.10 | 1.12 |
|
||||
| `VolumeScheduling` | `true` | GA | 1.13 | - |
|
||||
| `VolumeSnapshotDataSource` | `false` | Alpha | 1.12 | 1.16 |
|
||||
| `VolumeSnapshotDataSource` | `true` | Beta | 1.17 | 1.19 |
|
||||
| `VolumeSnapshotDataSource` | `true` | GA | 1.20 | - |
|
||||
| `VolumeSubpath` | `true` | GA | 1.10 | - |
|
||||
| `VolumeSubpathEnvExpansion` | `false` | Alpha | 1.14 | 1.14 |
|
||||
| `VolumeSubpathEnvExpansion` | `true` | Beta | 1.15 | 1.16 |
|
||||
| `VolumeSubpathEnvExpansion` | `true` | GA | 1.17 | - |
|
||||
| `WarningHeaders` | `true` | Beta | 1.19 | 1.21 |
|
||||
| `WarningHeaders` | `true` | GA | 1.22 | - |
|
||||
| `WatchBookmark` | `false` | Alpha | 1.15 | 1.15 |
|
||||
| `WatchBookmark` | `true` | Beta | 1.16 | 1.16 |
|
||||
| `WatchBookmark` | `true` | GA | 1.17 | - |
|
||||
| `WindowsEndpointSliceProxying` | `false` | Alpha | 1.19 | 1.20 |
|
||||
| `WindowsEndpointSliceProxying` | `true` | Beta | 1.21 | 1.21 |
|
||||
| `WindowsEndpointSliceProxying` | `true` | GA | 1.22| - |
|
||||
| `WindowsGMSA` | `false` | Alpha | 1.14 | 1.15 |
|
||||
| `WindowsGMSA` | `true` | Beta | 1.16 | 1.17 |
|
||||
| `WindowsGMSA` | `true` | GA | 1.18 | - |
|
||||
| `WindowsHostProcessContainers` | `false` | Alpha | 1.22 |
|
||||
| `WindowsRunAsUserName` | `false` | Alpha | 1.16 | 1.16 |
|
||||
| `WindowsRunAsUserName` | `true` | Beta | 1.17 | 1.17 |
|
||||
| `WindowsRunAsUserName` | `true` | GA | 1.18 | - |
|
||||
@@ -416,9 +533,10 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
prioritization and fairness at each server. (Renamed from `RequestManagement`)
|
||||
- `APIResponseCompression`: Compress the API responses for `LIST` or `GET` requests.
|
||||
- `APIServerIdentity`: Assign each API server an ID in a cluster.
|
||||
- `APIServerTracing`: Add support for distributed tracing in the API server.
|
||||
- `Accelerators`: Enable Nvidia GPU support when using Docker
|
||||
- `AdvancedAuditing`: Enable [advanced auditing](/docs/tasks/debug-application-cluster/audit/#advanced-audit)
|
||||
- `AffinityInAnnotations`(*deprecated*): Enable setting
|
||||
- `AffinityInAnnotations`: Enable setting
|
||||
[Pod affinity or anti-affinity](/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity).
|
||||
- `AllowExtTrafficLocalEndpoints`: Enable a service to route external requests to node local endpoints.
|
||||
- `AllowInsecureBackendProxy`: Enable the users to skip TLS verification of
|
||||
@@ -442,9 +560,17 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
extended tokens by starting `kube-apiserver` with flag `--service-account-extend-token-expiration=false`.
|
||||
Check [Bound Service Account Tokens](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/1205-bound-service-account-tokens/README.md)
|
||||
for more details.
|
||||
- `ControllerManagerLeaderMigration`: Enables Leader Migration for
|
||||
[kube-controller-manager](/docs/tasks/administer-cluster/controller-manager-leader-migration/#initial-leader-migration-configuration) and
|
||||
[cloud-controller-manager](/docs/tasks/administer-cluster/controller-manager-leader-migration/#deploy-cloud-controller-manager) which allows a cluster operator to live migrate
|
||||
controllers from the kube-controller-manager into an external controller-manager
|
||||
(e.g. the cloud-controller-manager) in an HA cluster without downtime.
|
||||
- `CPUManager`: Enable container level CPU affinity support, see
|
||||
[CPU Management Policies](/docs/tasks/administer-cluster/cpu-management-policies/).
|
||||
- `CRIContainerLogRotation`: Enable container log rotation for cri container runtime.
|
||||
- `CPUManagerPolicyOptions`: Allow fine-tuning of CPUManager policies.
|
||||
- `CRIContainerLogRotation`: Enable container log rotation for CRI container runtime. The default max size of a log file is 10MB and the
|
||||
default max number of log files allowed for a container is 5. These values can be configured in the kubelet config.
|
||||
See the [logging at node level](/docs/concepts/cluster-administration/logging/#logging-at-the-node-level) documentation for more details.
|
||||
- `CSIBlockVolume`: Enable external CSI volume drivers to support block storage.
|
||||
See the [`csi` raw block volume support](/docs/concepts/storage/volumes/#csi-raw-block-volume-support)
|
||||
documentation for more details.
|
||||
@@ -461,7 +587,9 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
kubelet and volume controllers and enables shims and translation logic to
|
||||
route volume operations from the AWS-EBS in-tree plugin to EBS CSI plugin.
|
||||
Requires CSIMigration and CSIMigrationAWS feature flags enabled and EBS CSI
|
||||
plugin installed and configured on all nodes in the cluster.
|
||||
plugin installed and configured on all nodes in the cluster. This flag has
|
||||
been deprecated in favor of the `InTreePluginAWSUnregister` feature flag
|
||||
which prevents the registration of in-tree EBS plugin.
|
||||
- `CSIMigrationAzureDisk`: Enables shims and translation logic to route volume
|
||||
operations from the Azure-Disk in-tree plugin to AzureDisk CSI plugin.
|
||||
Supports falling back to in-tree AzureDisk plugin if a node does not have
|
||||
@@ -472,7 +600,8 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
logic to route volume operations from the Azure-Disk in-tree plugin to
|
||||
AzureDisk CSI plugin. Requires CSIMigration and CSIMigrationAzureDisk feature
|
||||
flags enabled and AzureDisk CSI plugin installed and configured on all nodes
|
||||
in the cluster.
|
||||
in the cluster. This flag has been deprecated in favor of the
|
||||
`InTreePluginAzureDiskUnregister` feature flag which prevents the registration of in-tree AzureDisk plugin.
|
||||
- `CSIMigrationAzureFile`: Enables shims and translation logic to route volume
|
||||
operations from the Azure-File in-tree plugin to AzureFile CSI plugin.
|
||||
Supports falling back to in-tree AzureFile plugin if a node does not have
|
||||
@@ -483,7 +612,9 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
logic to route volume operations from the Azure-File in-tree plugin to
|
||||
AzureFile CSI plugin. Requires CSIMigration and CSIMigrationAzureFile feature
|
||||
flags enabled and AzureFile CSI plugin installed and configured on all nodes
|
||||
in the cluster.
|
||||
in the cluster. This flag has been deprecated in favor of the
|
||||
`InTreePluginAzureFileUnregister` feature flag which prevents the registration
|
||||
of in-tree AzureFile plugin.
|
||||
- `CSIMigrationGCE`: Enables shims and translation logic to route volume
|
||||
operations from the GCE-PD in-tree plugin to PD CSI plugin. Supports falling
|
||||
back to in-tree GCE plugin if a node does not have PD CSI plugin installed and
|
||||
@@ -492,7 +623,8 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
kubelet and volume controllers and enables shims and translation logic to
|
||||
route volume operations from the GCE-PD in-tree plugin to PD CSI plugin.
|
||||
Requires CSIMigration and CSIMigrationGCE feature flags enabled and PD CSI
|
||||
plugin installed and configured on all nodes in the cluster.
|
||||
plugin installed and configured on all nodes in the cluster. This flag has
|
||||
been deprecated in favor of the `InTreePluginGCEUnregister` feature flag which prevents the registration of in-tree GCE PD plugin.
|
||||
- `CSIMigrationOpenStack`: Enables shims and translation logic to route volume
|
||||
operations from the Cinder in-tree plugin to Cinder CSI plugin. Supports
|
||||
falling back to in-tree Cinder plugin if a node does not have Cinder CSI
|
||||
@@ -501,7 +633,8 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
kubelet and volume controllers and enables shims and translation logic to route
|
||||
volume operations from the Cinder in-tree plugin to Cinder CSI plugin.
|
||||
Requires CSIMigration and CSIMigrationOpenStack feature flags enabled and Cinder
|
||||
CSI plugin installed and configured on all nodes in the cluster.
|
||||
CSI plugin installed and configured on all nodes in the cluster. This flag has
|
||||
been deprecated in favor of the `InTreePluginOpenStackUnregister` feature flag which prevents the registration of in-tree openstack cinder plugin.
|
||||
- `CSIMigrationvSphere`: Enables shims and translation logic to route volume operations
|
||||
from the vSphere in-tree plugin to vSphere CSI plugin.
|
||||
Supports falling back to in-tree vSphere plugin if a node does not have vSphere
|
||||
@@ -510,7 +643,8 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
and volume controllers and enables shims and translation logic to route volume operations
|
||||
from the vSphere in-tree plugin to vSphere CSI plugin. Requires CSIMigration and
|
||||
CSIMigrationvSphere feature flags enabled and vSphere CSI plugin installed and
|
||||
configured on all nodes in the cluster.
|
||||
configured on all nodes in the cluster. This flag has been deprecated in favor
|
||||
of the `InTreePluginvSphereUnregister` feature flag which prevents the registration of in-tree vsphere plugin.
|
||||
- `CSINodeInfo`: Enable all logic related to the CSINodeInfo API object in csi.storage.k8s.io.
|
||||
- `CSIPersistentVolume`: Enable discovering and mounting volumes provisioned through a
|
||||
[CSI (Container Storage Interface)](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/storage/container-storage-interface.md)
|
||||
@@ -525,14 +659,18 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
- `CSIVolumeFSGroupPolicy`: Allows CSIDrivers to use the `fsGroupPolicy` field.
|
||||
This field controls whether volumes created by a CSIDriver support volume ownership
|
||||
and permission modifications when these volumes are mounted.
|
||||
- `CSIVolumeHealth`: Enable support for CSI volume health monitoring on node.
|
||||
- `CSRDuration`: Allows clients to request a duration for certificates issued
|
||||
via the Kubernetes CSR API.
|
||||
- `ConfigurableFSGroupPolicy`: Allows user to configure volume permission change policy
|
||||
for fsGroups when mounting a volume in a Pod. See
|
||||
[Configure volume permission and ownership change policy for Pods](/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods)
|
||||
for more details.
|
||||
- `ControllerManagerLeaderMigration`: Enables leader migration for
|
||||
`kube-controller-manager` and `cloud-controller-manager`.
|
||||
- `CronJobControllerV2`: Use an alternative implementation of the
|
||||
{{< glossary_tooltip text="CronJob" term_id="cronjob" >}} controller. Otherwise,
|
||||
version 1 of the same controller is selected.
|
||||
The version 2 controller provides experimental performance improvements.
|
||||
- `CustomCPUCFSQuotaPeriod`: Enable nodes to change `cpuCFSQuotaPeriod` in
|
||||
[kubelet config](/docs/tasks/administer-cluster/kubelet-config-file/).
|
||||
- `CustomPodDNS`: Enable customizing the DNS settings for a Pod using its `dnsConfig` property.
|
||||
@@ -546,29 +684,36 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
[CustomResourceDefinition](/docs/concepts/extend-kubernetes/api-extension/custom-resources/).
|
||||
- `CustomResourceWebhookConversion`: Enable webhook-based conversion
|
||||
on resources created from [CustomResourceDefinition](/docs/concepts/extend-kubernetes/api-extension/custom-resources/).
|
||||
troubleshoot a running Pod.
|
||||
- `DaemonSetUpdateSurge`: Enables the DaemonSet workloads to maintain
|
||||
availability during update per node.
|
||||
- `DefaultPodTopologySpread`: Enables the use of `PodTopologySpread` scheduling plugin to do
|
||||
[default spreading](/docs/concepts/workloads/pods/pod-topology-spread-constraints/#internal-default-constraints).
|
||||
- `DevicePlugins`: Enable the [device-plugins](/docs/concepts/cluster-administration/device-plugins/)
|
||||
- `DelegateFSGroupToCSIDriver`: If supported by the CSI driver, delegates the
|
||||
role of applying `fsGroup` from a Pod's `securityContext` to the driver by
|
||||
passing `fsGroup` through the NodeStageVolume and NodePublishVolume CSI calls.
|
||||
- `DevicePlugins`: Enable the [device-plugins](/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/)
|
||||
based resource provisioning on nodes.
|
||||
- `DisableAcceleratorUsageMetrics`:
|
||||
[Disable accelerator metrics collected by the kubelet](/docs/concepts/cluster-administration/system-metrics/#disable-accelerator-metrics).
|
||||
- `DisableCloudProviders`: Disables any functionality in `kube-apiserver`,
|
||||
`kube-controller-manager` and `kubelet` related to the `--cloud-provider`
|
||||
component flag.
|
||||
- `DownwardAPIHugePages`: Enables usage of hugepages in
|
||||
[downward API](/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information).
|
||||
- `DryRun`: Enable server-side [dry run](/docs/reference/using-api/api-concepts/#dry-run) requests
|
||||
so that validation, merging, and mutation can be tested without committing.
|
||||
- `DynamicAuditing`(*deprecated*): Used to enable dynamic auditing before v1.19.
|
||||
- `DynamicAuditing`: Used to enable dynamic auditing before v1.19.
|
||||
- `DynamicKubeletConfig`: Enable the dynamic configuration of kubelet. See
|
||||
[Reconfigure kubelet](/docs/tasks/administer-cluster/reconfigure-kubelet/).
|
||||
- `DynamicProvisioningScheduling`: Extend the default scheduler to be aware of
|
||||
volume topology and handle PV provisioning.
|
||||
This feature is superseded by the `VolumeScheduling` feature completely in v1.12.
|
||||
- `DynamicVolumeProvisioning`(*deprecated*): Enable the
|
||||
- `DynamicVolumeProvisioning`: Enable the
|
||||
[dynamic provisioning](/docs/concepts/storage/dynamic-provisioning/) of persistent volumes to Pods.
|
||||
- `EfficientWatchResumption`: Allows for storage-originated bookmark (progress
|
||||
notify) events to be delivered to the users. This is only applied to watch
|
||||
operations.
|
||||
- `EnableAggregatedDiscoveryTimeout` (*deprecated*): Enable the five second
|
||||
- `EnableAggregatedDiscoveryTimeout`: Enable the five second
|
||||
timeout on aggregated discovery calls.
|
||||
- `EnableEquivalenceClassCache`: Enable the scheduler to cache equivalence of
|
||||
nodes when scheduling Pods.
|
||||
@@ -591,6 +736,9 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
now-corrected fault where Kubernetes ignored exec probe timeouts. See
|
||||
[readiness probes](/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes).
|
||||
- `ExpandCSIVolumes`: Enable the expanding of CSI volumes.
|
||||
- `ExpandedDNSConfig`: Enable kubelet and kube-apiserver to allow more DNS
|
||||
search paths and longer list of DNS search paths. See
|
||||
[Expanded DNS Configuration](/docs/concepts/services-networking/dns-pod-service/#expanded-dns-configuration).
|
||||
- `ExpandInUsePersistentVolumes`: Enable expanding in-use PVCs. See
|
||||
[Resizing an in-use PersistentVolumeClaim](/docs/concepts/storage/persistent-volumes/#resizing-an-in-use-persistentvolumeclaim).
|
||||
- `ExpandPersistentVolumes`: Enable the expanding of persistent volumes. See
|
||||
@@ -603,6 +751,7 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
host mounts, or containers that are privileged or using specific non-namespaced
|
||||
capabilities (e.g. `MKNODE`, `SYS_MODULE` etc.). This should only be enabled
|
||||
if user namespace remapping is enabled in the Docker daemon.
|
||||
- `ExternalPolicyForExternalIP`: Fix a bug where ExternalTrafficPolicy is not applied to Service ExternalIPs.
|
||||
- `GCERegionalPersistentDisk`: Enable the regional PD feature on GCE.
|
||||
- `GenericEphemeralVolume`: Enables ephemeral, inline volumes that support all features
|
||||
of normal volumes (can be provided by third-party storage vendors, storage capacity tracking,
|
||||
@@ -624,20 +773,48 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
- `HyperVContainer`: Enable
|
||||
[Hyper-V isolation](https://docs.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/hyperv-container)
|
||||
for Windows containers.
|
||||
- `IPv6DualStack`: Enable [dual stack](/docs/concepts/services-networking/dual-stack/)
|
||||
support for IPv6.
|
||||
- `ImmutableEphemeralVolumes`: Allows for marking individual Secrets and ConfigMaps as
|
||||
immutable for better safety and performance.
|
||||
- `KubeletConfigFile` (*deprecated*): Enable loading kubelet configuration from
|
||||
- `InTreePluginAWSUnregister`: Stops registering the aws-ebs in-tree plugin in kubelet
|
||||
and volume controllers.
|
||||
- `InTreePluginAzureDiskUnregister`: Stops registering the azuredisk in-tree plugin in kubelet
|
||||
and volume controllers.
|
||||
- `InTreePluginAzureFileUnregister`: Stops registering the azurefile in-tree plugin in kubelet
|
||||
and volume controllers.
|
||||
- `InTreePluginGCEUnregister`: Stops registering the gce-pd in-tree plugin in kubelet
|
||||
and volume controllers.
|
||||
- `InTreePluginOpenStackUnregister`: Stops registering the OpenStack cinder in-tree plugin in kubelet
|
||||
and volume controllers.
|
||||
- `InTreePluginvSphereUnregister`: Stops registering the vSphere in-tree plugin in kubelet
|
||||
and volume controllers.
|
||||
- `IndexedJob`: Allows the [Job](/docs/concepts/workloads/controllers/job/)
|
||||
controller to manage Pod completions per completion index.
|
||||
- `IngressClassNamespacedParams`: Allow namespace-scoped parameters reference in
|
||||
`IngressClass` resource. This feature adds two fields - `Scope` and `Namespace`
|
||||
to `IngressClass.spec.parameters`.
|
||||
- `Initializers`: Allow asynchronous coordination of object creation using the
|
||||
Initializers admission plugin.
|
||||
- `IPv6DualStack`: Enable [dual stack](/docs/concepts/services-networking/dual-stack/)
|
||||
support for IPv6.
|
||||
- `JobTrackingWithFinalizers`: Enables tracking [Job](/docs/concepts/workloads/controllers/job)
|
||||
completions without relying on Pods remaining in the cluster indefinitely.
|
||||
The Job controller uses Pod finalizers and a field in the Job status to keep
|
||||
track of the finished Pods to count towards completion.
|
||||
- `KubeletConfigFile`: Enable loading kubelet configuration from
|
||||
a file specified using a config file.
|
||||
See [setting kubelet parameters via a config file](/docs/tasks/administer-cluster/kubelet-config-file/)
|
||||
for more details.
|
||||
- `KubeletCredentialProviders`: Enable kubelet exec credential providers for image pull credentials.
|
||||
- `KubeletInUserNamespace`: Enables support for running kubelet in a {{<glossary_tooltip text="user namespace" term_id="userns">}}.
|
||||
See [Running Kubernetes Node Components as a Non-root User](/docs/tasks/administer-cluster/kubelet-in-userns/).
|
||||
- `KubeletPluginsWatcher`: Enable probe-based plugin watcher utility to enable kubelet
|
||||
to discover plugins such as [CSI volume drivers](/docs/concepts/storage/volumes/#csi).
|
||||
- `KubeletPodResources`: Enable the kubelet's pod resources gRPC endpoint. See
|
||||
[Support Device Monitoring](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/606-compute-device-assignment/README.md)
|
||||
for more details.
|
||||
- `KubeletPodResourcesGetAllocatable`: Enable the kubelet's pod resources `GetAllocatableResources` functionality.
|
||||
This API augments the [resource allocation reporting](/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/#monitoring-device-plugin-resources)
|
||||
with informations about the allocatable resources, enabling clients to properly track the free compute resources on a node.
|
||||
- `LegacyNodeRoleBehavior`: When disabled, legacy behavior in service load balancers and
|
||||
node disruption will ignore the `node-role.kubernetes.io/master` label in favor of the
|
||||
feature-specific labels provided by `NodeDisruptionExclusion` and `ServiceNodeExclusion`.
|
||||
@@ -652,42 +829,69 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
supports project quotas and they are enabled, use project quotas to monitor
|
||||
[emptyDir volume](/docs/concepts/storage/volumes/#emptydir) storage consumption rather than
|
||||
filesystem walk for better performance and accuracy.
|
||||
- `LogarithmicScaleDown`: Enable semi-random selection of pods to evict on controller scaledown
|
||||
based on logarithmic bucketing of pod timestamps.
|
||||
- `MemoryManager`: Allows setting memory affinity for a container based on
|
||||
NUMA topology.
|
||||
- `MemoryQoS`: Enable memory protection and usage throttle on pod / container using cgroup v2 memory controller.
|
||||
- `MixedProtocolLBService`: Enable using different protocols in the same `LoadBalancer` type
|
||||
Service instance.
|
||||
- `MountContainers` (*deprecated*): Enable using utility containers on host as
|
||||
the volume mounter.
|
||||
- `MountContainers`: Enable using utility containers on host as the volume mounter.
|
||||
- `MountPropagation`: Enable sharing volume mounted by one container to other containers or pods.
|
||||
For more details, please see [mount propagation](/docs/concepts/storage/volumes/#mount-propagation).
|
||||
- `NamespaceDefaultLabelName`: Configure the API Server to set an immutable {{< glossary_tooltip text="label" term_id="label" >}}
|
||||
`kubernetes.io/metadata.name` on all namespaces, containing the namespace name.
|
||||
- `NetworkPolicyEndPort`: Enable use of the field `endPort` in NetworkPolicy objects, allowing the selection of a port range instead of a single port.
|
||||
- `NodeDisruptionExclusion`: Enable use of the Node label `node.kubernetes.io/exclude-disruption`
|
||||
which prevents nodes from being evacuated during zone failures.
|
||||
- `NodeLease`: Enable the new Lease API to report node heartbeats, which could be used as a node health signal.
|
||||
- `NodeSwap`: Enable the kubelet to allocate swap memory for Kubernetes workloads on a node.
|
||||
Must be used with `KubeletConfiguration.failSwapOn` set to false.
|
||||
For more details, please see [swap memory](/docs/concepts/architecture/nodes/#swap-memory)
|
||||
- `NonPreemptingPriority`: Enable `preemptionPolicy` field for PriorityClass and Pod.
|
||||
- `PVCProtection`: Enable the prevention of a PersistentVolumeClaim (PVC) from
|
||||
being deleted when it is still used by any Pod.
|
||||
- `PodDeletionCost`: Enable the [Pod Deletion Cost](/docs/concepts/workloads/controllers/replicaset/#pod-deletion-cost)
|
||||
feature which allows users to influence ReplicaSet downscaling order.
|
||||
- `PersistentLocalVolumes`: Enable the usage of `local` volume type in Pods.
|
||||
Pod affinity has to be specified if requesting a `local` volume.
|
||||
- `PodDisruptionBudget`: Enable the [PodDisruptionBudget](/docs/tasks/run-application/configure-pdb/) feature.
|
||||
- `PodAffinityNamespaceSelector`: Enable the [Pod Affinity Namespace Selector](/docs/concepts/scheduling-eviction/assign-pod-node/#namespace-selector)
|
||||
and [CrossNamespacePodAffinity](/docs/concepts/policy/resource-quotas/#cross-namespace-pod-affinity-quota) quota scope features.
|
||||
- `PodOverhead`: Enable the [PodOverhead](/docs/concepts/scheduling-eviction/pod-overhead/)
|
||||
feature to account for pod overheads.
|
||||
- `PodPriority`: Enable the descheduling and preemption of Pods based on their
|
||||
[priorities](/docs/concepts/configuration/pod-priority-preemption/).
|
||||
[priorities](/docs/concepts/scheduling-eviction/pod-priority-preemption/).
|
||||
- `PodReadinessGates`: Enable the setting of `PodReadinessGate` field for extending
|
||||
Pod readiness evaluation. See [Pod readiness gate](/docs/concepts/workloads/pods/pod-lifecycle/#pod-readiness-gate)
|
||||
for more details.
|
||||
- `PodSecurity`: Enables the `PodSecurity` admission plugin.
|
||||
- `PodShareProcessNamespace`: Enable the setting of `shareProcessNamespace` in a Pod for sharing
|
||||
a single process namespace between containers running in a pod. More details can be found in
|
||||
[Share Process Namespace between Containers in a Pod](/docs/tasks/configure-pod-container/share-process-namespace/).
|
||||
- `PreferNominatedNode`: This flag tells the scheduler whether the nominated
|
||||
nodes will be checked first before looping through all the other nodes in
|
||||
the cluster.
|
||||
- `ProbeTerminationGracePeriod`: Enable [setting probe-level
|
||||
`terminationGracePeriodSeconds`](/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#probe-level-terminationgraceperiodseconds)
|
||||
on pods. See the [enhancement proposal](https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/2238-liveness-probe-grace-period) for more details.
|
||||
- `ProcMountType`: Enables control over the type proc mounts for containers
|
||||
by setting the `procMount` field of a SecurityContext.
|
||||
- `ProxyTerminatingEndpoints`: Enable the kube-proxy to handle terminating
|
||||
endpoints when `ExternalTrafficPolicy=Local`.
|
||||
- `QOSReserved`: Allows resource reservations at the QoS level preventing pods
|
||||
at lower QoS levels from bursting into resources requested at higher QoS levels
|
||||
(memory only for now).
|
||||
- `ReadWriteOncePod`: Enables the usage of `ReadWriteOncePod` PersistentVolume
|
||||
access mode.
|
||||
- `RemainingItemCount`: Allow the API servers to show a count of remaining
|
||||
items in the response to a
|
||||
[chunking list request](/docs/reference/using-api/api-concepts/#retrieving-large-results-sets-in-chunks).
|
||||
- `RemoveSelfLink`: Deprecates and removes `selfLink` from ObjectMeta and
|
||||
ListMeta.
|
||||
- `ResourceLimitsPriorityFunction` (*deprecated*): Enable a scheduler priority function that
|
||||
- `RequestManagement`: Enables managing request concurrency with prioritization and fairness
|
||||
at each API server. Deprecated by `APIPriorityAndFairness` since 1.17.
|
||||
- `ResourceLimitsPriorityFunction`: Enable a scheduler priority function that
|
||||
assigns a lowest possible score of 1 to a node that satisfies at least one of
|
||||
the input Pod's cpu and memory limits. The intent is to break ties between
|
||||
nodes with same scores.
|
||||
@@ -711,15 +915,21 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
instead of the DaemonSet controller.
|
||||
- `SCTPSupport`: Enables the _SCTP_ `protocol` value in Pod, Service,
|
||||
Endpoints, EndpointSlice, and NetworkPolicy definitions.
|
||||
- `SeccompDefault`: Enables the use of `RuntimeDefault` as the default seccomp profile for all workloads.
|
||||
The seccomp profile is specified in the `securityContext` of a Pod and/or a Container.
|
||||
- `SelectorIndex`: Allows label and field based indexes in API server watch
|
||||
cache to accelerate list operations.
|
||||
- `ServerSideApply`: Enables the [Sever Side Apply (SSA)](/docs/reference/using-api/server-side-apply/)
|
||||
feature on the API Server.
|
||||
- `ServiceAccountIssuerDiscovery`: Enable OIDC discovery endpoints (issuer and
|
||||
JWKS URLs) for the service account issuer in the API server. See
|
||||
[Configure Service Accounts for Pods](/docs/tasks/configure-pod-container/configure-service-account/#service-account-issuer-discovery)
|
||||
for more details.
|
||||
- `ServiceAppProtocol`: Enables the `AppProtocol` field on Services and Endpoints.
|
||||
- `ServiceLBNodePortControl`: Enables the `spec.allocateLoadBalancerNodePorts`
|
||||
field on Services.
|
||||
- `ServiceAppProtocol`: Enables the `appProtocol` field on Services and Endpoints.
|
||||
- `ServiceInternalTrafficPolicy`: Enables the `internalTrafficPolicy` field on Services
|
||||
- `ServiceLBNodePortControl`: Enables the `allocateLoadBalancerNodePorts` field on Services.
|
||||
- `ServiceLoadBalancerClass`: Enables the `loadBalancerClass` field on Services. See
|
||||
[Specifying class of load balancer implementation](/docs/concepts/services-networking/service/#load-balancer-class) for more details.
|
||||
- `ServiceLoadBalancerFinalizer`: Enable finalizer protection for Service load balancers.
|
||||
- `ServiceNodeExclusion`: Enable the exclusion of nodes from load balancers
|
||||
created by a cloud provider. A node is eligible for exclusion if labelled with
|
||||
@@ -728,8 +938,6 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
topology of the cluster. See
|
||||
[ServiceTopology](/docs/concepts/services-networking/service-topology/)
|
||||
for more details.
|
||||
- `SizeMemoryBackedVolumes`: Enables kubelet support to size memory backed volumes.
|
||||
See [volumes](/docs/concepts/storage/volumes) for more details.
|
||||
- `SetHostnameAsFQDN`: Enable the ability of setting Fully Qualified Domain
|
||||
Name(FQDN) as the hostname of a pod. See
|
||||
[Pod's `setHostnameAsFQDN` field](/docs/concepts/services-networking/dns-pod-service/#pod-sethostnameasfqdn-field).
|
||||
@@ -738,6 +946,8 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
- `StartupProbe`: Enable the
|
||||
[startup](/docs/concepts/workloads/pods/pod-lifecycle/#when-should-you-use-a-startup-probe)
|
||||
probe in the kubelet.
|
||||
- `StatefulSetMinReadySeconds`: Allows `minReadySeconds` to be respected by
|
||||
the StatefulSet controller.
|
||||
- `StorageObjectInUseProtection`: Postpone the deletion of PersistentVolume or
|
||||
PersistentVolumeClaim objects if they are still being used.
|
||||
- `StorageVersionAPI`: Enable the
|
||||
@@ -749,12 +959,15 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
Examples of streaming requests include the `exec`, `attach` and `port-forward` requests.
|
||||
- `SupportIPVSProxyMode`: Enable providing in-cluster service load balancing using IPVS.
|
||||
See [service proxies](/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies) for more details.
|
||||
- `SupportPodPidsLimit`: Enable the support to limiting PIDs in Pods.
|
||||
- `SupportNodePidsLimit`: Enable the support to limiting PIDs on the Node.
|
||||
The parameter `pid=<number>` in the `--system-reserved` and `--kube-reserved`
|
||||
options can be specified to ensure that the specified number of process IDs
|
||||
will be reserved for the system as a whole and for Kubernetes system daemons
|
||||
respectively.
|
||||
- `SupportPodPidsLimit`: Enable the support to limiting PIDs in Pods.
|
||||
- `SuspendJob`: Enable support to suspend and resume Jobs. See
|
||||
[the Jobs docs](/docs/concepts/workloads/controllers/job/) for
|
||||
more details.
|
||||
- `Sysctls`: Enable support for namespaced kernel parameters (sysctls) that can be
|
||||
set for each pod. See
|
||||
[sysctls](/docs/tasks/administer-cluster/sysctl-cluster/) for more details.
|
||||
@@ -770,30 +983,41 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
- `TokenRequest`: Enable the `TokenRequest` endpoint on service account resources.
|
||||
- `TokenRequestProjection`: Enable the injection of service account tokens into a
|
||||
Pod through a [`projected` volume](/docs/concepts/storage/volumes/#projected).
|
||||
- `TopologyAwareHints`: Enables topology aware routing based on topology hints
|
||||
in EndpointSlices. See [Topology Aware
|
||||
Hints](/docs/concepts/services-networking/topology-aware-hints/) for more
|
||||
details.
|
||||
- `TopologyManager`: Enable a mechanism to coordinate fine-grained hardware resource
|
||||
assignments for different components in Kubernetes. See
|
||||
[Control Topology Management Policies on a node](/docs/tasks/administer-cluster/topology-manager/).
|
||||
- `ValidateProxyRedirects`: This flag controls whether the API server should
|
||||
validate that redirects are only followed to the same host. Only used if the
|
||||
`StreamingProxyRedirects` flag is enabled.
|
||||
- `VolumeCapacityPriority`: Enable support for prioritizing nodes in different
|
||||
topologies based on available PV capacity.
|
||||
- `VolumePVCDataSource`: Enable support for specifying an existing PVC as a DataSource.
|
||||
- `VolumeScheduling`: Enable volume topology aware scheduling and make the
|
||||
PersistentVolumeClaim (PVC) binding aware of scheduling decisions. It also
|
||||
enables the usage of [`local`](/docs/concepts/storage/volumes/#local) volume
|
||||
type when used together with the `PersistentLocalVolumes` feature gate.
|
||||
- `VolumeSnapshotDataSource`: Enable volume snapshot data source support.
|
||||
- `VolumeSubpath`: Allow mounting a subpath of a volume in a container.
|
||||
- `VolumeSubpathEnvExpansion`: Enable `subPathExpr` field for expanding environment
|
||||
variables into a `subPath`.
|
||||
- `WarningHeaders`: Allow sending warning headers in API responses.
|
||||
- `WatchBookmark`: Enable support for watch bookmark events.
|
||||
- `WinDSR`: Allows kube-proxy to create DSR loadbalancers for Windows.
|
||||
- `WinOverlay`: Allows kube-proxy to run in overlay mode for Windows.
|
||||
- `WindowsGMSA`: Enables passing of GMSA credential specs from pods to container runtimes.
|
||||
- `WindowsRunAsUserName` : Enable support for running applications in Windows containers
|
||||
with as a non-default user. See
|
||||
[Configuring RunAsUserName](/docs/tasks/configure-pod-container/configure-runasusername)
|
||||
for more details.
|
||||
- `WindowsEndpointSliceProxying`: When enabled, kube-proxy running on Windows
|
||||
will use EndpointSlices as the primary data source instead of Endpoints,
|
||||
enabling scalability and performance improvements. See
|
||||
[Enabling Endpoint Slices](/docs/tasks/administer-cluster/enabling-endpointslices/).
|
||||
- `WindowsGMSA`: Enables passing of GMSA credential specs from pods to container runtimes.
|
||||
- `WindowsHostProcessContainers`: Enables support for Windows HostProcess containers.
|
||||
- `WindowsRunAsUserName` : Enable support for running applications in Windows containers
|
||||
with as a non-default user. See
|
||||
[Configuring RunAsUserName](/docs/tasks/configure-pod-container/configure-runasusername)
|
||||
for more details.
|
||||
|
||||
|
||||
## {{% heading "whatsnext" %}}
|
||||
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large
Load Diff
@@ -10,7 +10,7 @@ content_type: concept
|
||||
|
||||
<!-- overview -->
|
||||
|
||||
In a Kubernetes cluster, the components on the worker nodes - kubelet and kube-proxy - need to communicate with Kubernetes master components, specifically kube-apiserver.
|
||||
In a Kubernetes cluster, the components on the worker nodes - kubelet and kube-proxy - need to communicate with Kubernetes control plane components, specifically kube-apiserver.
|
||||
In order to ensure that communication is kept private, not interfered with, and ensure that each component of the cluster is talking to another trusted component, we strongly
|
||||
recommend using client TLS certificates on nodes.
|
||||
|
||||
@@ -18,7 +18,7 @@ The normal process of bootstrapping these components, especially worker nodes th
|
||||
can be a challenging process as it is often outside of the scope of Kubernetes and requires significant additional work.
|
||||
This in turn, can make it challenging to initialize or scale a cluster.
|
||||
|
||||
In order to simplify the process, beginning in version 1.4, Kubernetes introduced a certificate request and signing API to simplify the process. The proposal can be
|
||||
In order to simplify the process, beginning in version 1.4, Kubernetes introduced a certificate request and signing API. The proposal can be
|
||||
found [here](https://github.com/kubernetes/kubernetes/pull/20439).
|
||||
|
||||
This document describes the process of node initialization, how to set up TLS client certificate bootstrapping for
|
||||
@@ -44,7 +44,7 @@ Note that the above process depends upon:
|
||||
All of the following are responsibilities of whoever sets up and manages the cluster:
|
||||
|
||||
1. Creating the CA key and certificate
|
||||
2. Distributing the CA certificate to the master nodes, where kube-apiserver is running
|
||||
2. Distributing the CA certificate to the control plane nodes, where kube-apiserver is running
|
||||
3. Creating a key and certificate for each kubelet; strongly recommended to have a unique one, with a unique CN, for each kubelet
|
||||
4. Signing the kubelet certificate using the CA key
|
||||
5. Distributing the kubelet key and signed certificate to the specific node on which the kubelet is running
|
||||
@@ -90,9 +90,9 @@ In addition, you need your Kubernetes Certificate Authority (CA).
|
||||
## Certificate Authority
|
||||
|
||||
As without bootstrapping, you will need a Certificate Authority (CA) key and certificate. As without bootstrapping, these will be used
|
||||
to sign the kubelet certificate. As before, it is your responsibility to distribute them to master nodes.
|
||||
to sign the kubelet certificate. As before, it is your responsibility to distribute them to control plane nodes.
|
||||
|
||||
For the purposes of this document, we will assume these have been distributed to master nodes at `/var/lib/kubernetes/ca.pem` (certificate) and `/var/lib/kubernetes/ca-key.pem` (key).
|
||||
For the purposes of this document, we will assume these have been distributed to control plane nodes at `/var/lib/kubernetes/ca.pem` (certificate) and `/var/lib/kubernetes/ca-key.pem` (key).
|
||||
We will refer to these as "Kubernetes CA certificate and key".
|
||||
|
||||
All Kubernetes components that use these certificates - kubelet, kube-apiserver, kube-controller-manager - assume the key and certificate to be PEM-encoded.
|
||||
@@ -167,7 +167,7 @@ If you want to use bootstrap tokens, you must enable it on kube-apiserver with t
|
||||
|
||||
#### Token authentication file
|
||||
|
||||
kube-apiserver has an ability to accept tokens as authentication.
|
||||
kube-apiserver has the ability to accept tokens as authentication.
|
||||
These tokens are arbitrary but should represent at least 128 bits of entropy derived
|
||||
from a secure random number generator (such as `/dev/urandom` on most modern Linux
|
||||
systems). There are multiple ways you can generate a token. For example:
|
||||
@@ -234,7 +234,7 @@ In order for the controller-manager to sign certificates, it needs the following
|
||||
|
||||
### Access to key and certificate
|
||||
|
||||
As described earlier, you need to create a Kubernetes CA key and certificate, and distribute it to the master nodes.
|
||||
As described earlier, you need to create a Kubernetes CA key and certificate, and distribute it to the control plane nodes.
|
||||
These will be used by the controller-manager to sign the kubelet certificates.
|
||||
|
||||
Since these signed certificates will, in turn, be used by the kubelet to authenticate as a regular kubelet to kube-apiserver, it is important that the CA
|
||||
@@ -319,7 +319,7 @@ collection.
|
||||
|
||||
## kubelet configuration
|
||||
|
||||
Finally, with the master nodes properly set up and all of the necessary authentication and authorization in place, we can configure the kubelet.
|
||||
Finally, with the control plane nodes properly set up and all of the necessary authentication and authorization in place, we can configure the kubelet.
|
||||
|
||||
The kubelet requires the following configuration to bootstrap:
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -81,7 +81,7 @@ For non-resource requests, this is the lower-cased HTTP method.</td>
|
||||
|
||||
|
||||
<tr><td><code>user</code> <B>[Required]</B><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#userinfo-v1-authentication"><code>authentication/v1.UserInfo</code></a>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#userinfo-v1-authentication"><code>authentication/v1.UserInfo</code></a>
|
||||
</td>
|
||||
<td>
|
||||
Authenticated user information.</td>
|
||||
@@ -89,7 +89,7 @@ For non-resource requests, this is the lower-cased HTTP method.</td>
|
||||
|
||||
|
||||
<tr><td><code>impersonatedUser</code><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#userinfo-v1-authentication"><code>authentication/v1.UserInfo</code></a>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#userinfo-v1-authentication"><code>authentication/v1.UserInfo</code></a>
|
||||
</td>
|
||||
<td>
|
||||
Impersonated user information.</td>
|
||||
@@ -123,7 +123,7 @@ Does not apply for List-type requests, or non-resource requests.</td>
|
||||
|
||||
|
||||
<tr><td><code>responseStatus</code><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#status-v1-meta"><code>meta/v1.Status</code></a>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#status-v1-meta"><code>meta/v1.Status</code></a>
|
||||
</td>
|
||||
<td>
|
||||
The response status, populated even when the ResponseObject is not a Status type.
|
||||
@@ -154,7 +154,7 @@ at Response Level.</td>
|
||||
|
||||
|
||||
<tr><td><code>requestReceivedTimestamp</code><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#microtime-v1-meta"><code>meta/v1.MicroTime</code></a>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#microtime-v1-meta"><code>meta/v1.MicroTime</code></a>
|
||||
</td>
|
||||
<td>
|
||||
Time the request reached the apiserver.</td>
|
||||
@@ -162,7 +162,7 @@ at Response Level.</td>
|
||||
|
||||
|
||||
<tr><td><code>stageTimestamp</code><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#microtime-v1-meta"><code>meta/v1.MicroTime</code></a>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#microtime-v1-meta"><code>meta/v1.MicroTime</code></a>
|
||||
</td>
|
||||
<td>
|
||||
Time the request reached current audit stage.</td>
|
||||
@@ -206,7 +206,7 @@ EventList is a list of audit Events.
|
||||
|
||||
|
||||
<tr><td><code>metadata</code><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#listmeta-v1-meta"><code>meta/v1.ListMeta</code></a>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#listmeta-v1-meta"><code>meta/v1.ListMeta</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<span class="text-muted">No description provided.</span>
|
||||
@@ -252,7 +252,7 @@ categories are logged.
|
||||
|
||||
|
||||
<tr><td><code>metadata</code><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#objectmeta-v1-meta"><code>meta/v1.ObjectMeta</code></a>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#objectmeta-v1-meta"><code>meta/v1.ObjectMeta</code></a>
|
||||
</td>
|
||||
<td>
|
||||
ObjectMeta is included for interoperability with API infrastructure.Refer to the Kubernetes API documentation for the fields of the <code>metadata</code> field.</td>
|
||||
@@ -303,7 +303,7 @@ PolicyList is a list of audit Policies.
|
||||
|
||||
|
||||
<tr><td><code>metadata</code><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#listmeta-v1-meta"><code>meta/v1.ListMeta</code></a>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#listmeta-v1-meta"><code>meta/v1.ListMeta</code></a>
|
||||
</td>
|
||||
<td>
|
||||
<span class="text-muted">No description provided.</span>
|
||||
|
||||
@@ -0,0 +1,438 @@
|
||||
---
|
||||
title: kube-apiserver Configuration (v1alpha1)
|
||||
content_type: tool-reference
|
||||
package: apiserver.k8s.io/v1alpha1
|
||||
auto_generated: true
|
||||
---
|
||||
Package v1alpha1 is the v1alpha1 version of the API.
|
||||
|
||||
## Resource Types
|
||||
|
||||
|
||||
- [AdmissionConfiguration](#apiserver-k8s-io-v1alpha1-AdmissionConfiguration)
|
||||
- [EgressSelectorConfiguration](#apiserver-k8s-io-v1alpha1-EgressSelectorConfiguration)
|
||||
- [TracingConfiguration](#apiserver-k8s-io-v1alpha1-TracingConfiguration)
|
||||
|
||||
|
||||
|
||||
|
||||
## `AdmissionConfiguration` {#apiserver-k8s-io-v1alpha1-AdmissionConfiguration}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
AdmissionConfiguration provides versioned configuration for admission controllers.
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>apiserver.k8s.io/v1alpha1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>AdmissionConfiguration</code></td></tr>
|
||||
|
||||
|
||||
|
||||
|
||||
<tr><td><code>plugins</code><br/>
|
||||
<a href="#apiserver-k8s-io-v1alpha1-AdmissionPluginConfiguration"><code>[]AdmissionPluginConfiguration</code></a>
|
||||
</td>
|
||||
<td>
|
||||
Plugins allows specifying a configuration per admission control plugin.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
## `EgressSelectorConfiguration` {#apiserver-k8s-io-v1alpha1-EgressSelectorConfiguration}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
EgressSelectorConfiguration provides versioned configuration for egress selector clients.
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>apiserver.k8s.io/v1alpha1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>EgressSelectorConfiguration</code></td></tr>
|
||||
|
||||
|
||||
|
||||
|
||||
<tr><td><code>egressSelections</code> <B>[Required]</B><br/>
|
||||
<a href="#apiserver-k8s-io-v1alpha1-EgressSelection"><code>[]EgressSelection</code></a>
|
||||
</td>
|
||||
<td>
|
||||
connectionServices contains a list of egress selection client configurations</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
## `TracingConfiguration` {#apiserver-k8s-io-v1alpha1-TracingConfiguration}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
TracingConfiguration provides versioned configuration for tracing clients.
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>apiserver.k8s.io/v1alpha1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>TracingConfiguration</code></td></tr>
|
||||
|
||||
|
||||
|
||||
|
||||
<tr><td><code>endpoint</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
Endpoint of the collector that's running on the control-plane node.
|
||||
The APIServer uses the egressType ControlPlane when sending data to the collector.
|
||||
The syntax is defined in https://github.com/grpc/grpc/blob/master/doc/naming.md.
|
||||
Defaults to the otlpgrpc default, localhost:4317
|
||||
The connection is insecure, and does not support TLS.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>samplingRatePerMillion</code><br/>
|
||||
<code>int32</code>
|
||||
</td>
|
||||
<td>
|
||||
SamplingRatePerMillion is the number of samples to collect per million spans.
|
||||
Defaults to 0.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
## `AdmissionPluginConfiguration` {#apiserver-k8s-io-v1alpha1-AdmissionPluginConfiguration}
|
||||
|
||||
|
||||
|
||||
|
||||
**Appears in:**
|
||||
|
||||
- [AdmissionConfiguration](#apiserver-k8s-io-v1alpha1-AdmissionConfiguration)
|
||||
|
||||
|
||||
AdmissionPluginConfiguration provides the configuration for a single plug-in.
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
|
||||
|
||||
<tr><td><code>name</code> <B>[Required]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
Name is the name of the admission controller.
|
||||
It must match the registered admission plugin name.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>path</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
Path is the path to a configuration file that contains the plugin's
|
||||
configuration</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>configuration</code><br/>
|
||||
<a href="https://godoc.org/k8s.io/apimachinery/pkg/runtime#Unknown"><code>k8s.io/apimachinery/pkg/runtime.Unknown</code></a>
|
||||
</td>
|
||||
<td>
|
||||
Configuration is an embedded configuration object to be used as the plugin's
|
||||
configuration. If present, it will be used instead of the path to the configuration file.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
## `Connection` {#apiserver-k8s-io-v1alpha1-Connection}
|
||||
|
||||
|
||||
|
||||
|
||||
**Appears in:**
|
||||
|
||||
- [EgressSelection](#apiserver-k8s-io-v1alpha1-EgressSelection)
|
||||
|
||||
|
||||
Connection provides the configuration for a single egress selection client.
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
|
||||
|
||||
<tr><td><code>proxyProtocol</code> <B>[Required]</B><br/>
|
||||
<a href="#apiserver-k8s-io-v1alpha1-ProtocolType"><code>ProtocolType</code></a>
|
||||
</td>
|
||||
<td>
|
||||
Protocol is the protocol used to connect from client to the konnectivity server.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>transport</code><br/>
|
||||
<a href="#apiserver-k8s-io-v1alpha1-Transport"><code>Transport</code></a>
|
||||
</td>
|
||||
<td>
|
||||
Transport defines the transport configurations we use to dial to the konnectivity server.
|
||||
This is required if ProxyProtocol is HTTPConnect or GRPC.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
## `EgressSelection` {#apiserver-k8s-io-v1alpha1-EgressSelection}
|
||||
|
||||
|
||||
|
||||
|
||||
**Appears in:**
|
||||
|
||||
- [EgressSelectorConfiguration](#apiserver-k8s-io-v1alpha1-EgressSelectorConfiguration)
|
||||
|
||||
|
||||
EgressSelection provides the configuration for a single egress selection client.
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
|
||||
|
||||
<tr><td><code>name</code> <B>[Required]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
name is the name of the egress selection.
|
||||
Currently supported values are "controlplane", "master", "etcd" and "cluster"
|
||||
The "master" egress selector is deprecated in favor of "controlplane"</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>connection</code> <B>[Required]</B><br/>
|
||||
<a href="#apiserver-k8s-io-v1alpha1-Connection"><code>Connection</code></a>
|
||||
</td>
|
||||
<td>
|
||||
connection is the exact information used to configure the egress selection</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
## `ProtocolType` {#apiserver-k8s-io-v1alpha1-ProtocolType}
|
||||
|
||||
(Alias of `string`)
|
||||
|
||||
|
||||
**Appears in:**
|
||||
|
||||
- [Connection](#apiserver-k8s-io-v1alpha1-Connection)
|
||||
|
||||
|
||||
ProtocolType is a set of valid values for Connection.ProtocolType
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## `TCPTransport` {#apiserver-k8s-io-v1alpha1-TCPTransport}
|
||||
|
||||
|
||||
|
||||
|
||||
**Appears in:**
|
||||
|
||||
- [Transport](#apiserver-k8s-io-v1alpha1-Transport)
|
||||
|
||||
|
||||
TCPTransport provides the information to connect to konnectivity server via TCP
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
|
||||
|
||||
<tr><td><code>url</code> <B>[Required]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
URL is the location of the konnectivity server to connect to.
|
||||
As an example it might be "https://127.0.0.1:8131"</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>tlsConfig</code><br/>
|
||||
<a href="#apiserver-k8s-io-v1alpha1-TLSConfig"><code>TLSConfig</code></a>
|
||||
</td>
|
||||
<td>
|
||||
TLSConfig is the config needed to use TLS when connecting to konnectivity server</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
## `TLSConfig` {#apiserver-k8s-io-v1alpha1-TLSConfig}
|
||||
|
||||
|
||||
|
||||
|
||||
**Appears in:**
|
||||
|
||||
- [TCPTransport](#apiserver-k8s-io-v1alpha1-TCPTransport)
|
||||
|
||||
|
||||
TLSConfig provides the authentication information to connect to konnectivity server
|
||||
Only used with TCPTransport
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
|
||||
|
||||
<tr><td><code>caBundle</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
caBundle is the file location of the CA to be used to determine trust with the konnectivity server.
|
||||
Must be absent/empty if TCPTransport.URL is prefixed with http://
|
||||
If absent while TCPTransport.URL is prefixed with https://, default to system trust roots.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>clientKey</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
clientKey is the file location of the client key to be used in mtls handshakes with the konnectivity server.
|
||||
Must be absent/empty if TCPTransport.URL is prefixed with http://
|
||||
Must be configured if TCPTransport.URL is prefixed with https://</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>clientCert</code><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
clientCert is the file location of the client certificate to be used in mtls handshakes with the konnectivity server.
|
||||
Must be absent/empty if TCPTransport.URL is prefixed with http://
|
||||
Must be configured if TCPTransport.URL is prefixed with https://</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
## `Transport` {#apiserver-k8s-io-v1alpha1-Transport}
|
||||
|
||||
|
||||
|
||||
|
||||
**Appears in:**
|
||||
|
||||
- [Connection](#apiserver-k8s-io-v1alpha1-Connection)
|
||||
|
||||
|
||||
Transport defines the transport configurations we use to dial to the konnectivity server
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
|
||||
|
||||
<tr><td><code>tcp</code><br/>
|
||||
<a href="#apiserver-k8s-io-v1alpha1-TCPTransport"><code>TCPTransport</code></a>
|
||||
</td>
|
||||
<td>
|
||||
TCP is the TCP configuration for communicating with the konnectivity server via TCP
|
||||
ProxyProtocol of GRPC is not supported with TCP transport at the moment
|
||||
Requires at least one of TCP or UDS to be set</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>uds</code><br/>
|
||||
<a href="#apiserver-k8s-io-v1alpha1-UDSTransport"><code>UDSTransport</code></a>
|
||||
</td>
|
||||
<td>
|
||||
UDS is the UDS configuration for communicating with the konnectivity server via UDS
|
||||
Requires at least one of TCP or UDS to be set</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
## `UDSTransport` {#apiserver-k8s-io-v1alpha1-UDSTransport}
|
||||
|
||||
|
||||
|
||||
|
||||
**Appears in:**
|
||||
|
||||
- [Transport](#apiserver-k8s-io-v1alpha1-Transport)
|
||||
|
||||
|
||||
UDSTransport provides the information to connect to konnectivity server via UDS
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
|
||||
|
||||
<tr><td><code>udsName</code> <B>[Required]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
UDSName is the name of the unix domain socket to connect to konnectivity server
|
||||
This does not use a unix:// prefix. (Eg: /etc/srv/kubernetes/konnectivity-server/konnectivity-server.socket)</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
@@ -0,0 +1,46 @@
|
||||
---
|
||||
title: WebhookAdmission Configuration (v1)
|
||||
content_type: tool-reference
|
||||
package: apiserver.config.k8s.io/v1
|
||||
auto_generated: true
|
||||
---
|
||||
Package v1 is the v1 version of the API.
|
||||
|
||||
## Resource Types
|
||||
|
||||
|
||||
- [WebhookAdmission](#apiserver-config-k8s-io-v1-WebhookAdmission)
|
||||
|
||||
|
||||
|
||||
|
||||
## `WebhookAdmission` {#apiserver-config-k8s-io-v1-WebhookAdmission}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
WebhookAdmission provides configuration for the webhook admission controller.
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
<tr><td><code>apiVersion</code><br/>string</td><td><code>apiserver.config.k8s.io/v1</code></td></tr>
|
||||
<tr><td><code>kind</code><br/>string</td><td><code>WebhookAdmission</code></td></tr>
|
||||
|
||||
|
||||
|
||||
|
||||
<tr><td><code>kubeConfigFile</code> <B>[Required]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
KubeConfigFile is the path to the kubeconfig file.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
@@ -187,6 +187,14 @@ ExecConfig.ProvideClusterInfo).</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>interactive</code> <B>[Required]</B><br/>
|
||||
<code>bool</code>
|
||||
</td>
|
||||
<td>
|
||||
Interactive declares whether stdin has been passed to this exec plugin.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
@@ -215,7 +223,7 @@ itself should at least be protected via file permissions.
|
||||
|
||||
|
||||
<tr><td><code>expirationTimestamp</code><br/>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#time-v1-meta"><code>meta/v1.Time</code></a>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#time-v1-meta"><code>meta/v1.Time</code></a>
|
||||
</td>
|
||||
<td>
|
||||
ExpirationTimestamp indicates a time when the provided credentials expire.</td>
|
||||
|
||||
@@ -9,7 +9,6 @@ auto_generated: true
|
||||
## Resource Types
|
||||
|
||||
|
||||
|
||||
- [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration)
|
||||
|
||||
|
||||
@@ -535,3 +534,247 @@ this always falls back to the userspace proxy.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## `ClientConnectionConfiguration` {#ClientConnectionConfiguration}
|
||||
|
||||
|
||||
|
||||
|
||||
**Appears in:**
|
||||
|
||||
- [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration)
|
||||
|
||||
- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration)
|
||||
|
||||
- [GenericControllerManagerConfiguration](#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration)
|
||||
|
||||
|
||||
ClientConnectionConfiguration contains details for constructing a client.
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
|
||||
|
||||
<tr><td><code>kubeconfig</code> <B>[Required]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
kubeconfig is the path to a KubeConfig file.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>acceptContentTypes</code> <B>[Required]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the
|
||||
default value of 'application/json'. This field will control all connections to the server used by a particular
|
||||
client.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>contentType</code> <B>[Required]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
contentType is the content type used when sending data to the server from this client.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>qps</code> <B>[Required]</B><br/>
|
||||
<code>float32</code>
|
||||
</td>
|
||||
<td>
|
||||
qps controls the number of queries per second allowed for this connection.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>burst</code> <B>[Required]</B><br/>
|
||||
<code>int32</code>
|
||||
</td>
|
||||
<td>
|
||||
burst allows extra queries to accumulate when a client is exceeding its rate.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `DebuggingConfiguration` {#DebuggingConfiguration}
|
||||
|
||||
|
||||
|
||||
|
||||
**Appears in:**
|
||||
|
||||
- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration)
|
||||
|
||||
- [GenericControllerManagerConfiguration](#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration)
|
||||
|
||||
|
||||
DebuggingConfiguration holds configuration for Debugging related features.
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
|
||||
|
||||
<tr><td><code>enableProfiling</code> <B>[Required]</B><br/>
|
||||
<code>bool</code>
|
||||
</td>
|
||||
<td>
|
||||
enableProfiling enables profiling via web interface host:port/debug/pprof/</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>enableContentionProfiling</code> <B>[Required]</B><br/>
|
||||
<code>bool</code>
|
||||
</td>
|
||||
<td>
|
||||
enableContentionProfiling enables lock contention profiling, if
|
||||
enableProfiling is true.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `LeaderElectionConfiguration` {#LeaderElectionConfiguration}
|
||||
|
||||
|
||||
|
||||
|
||||
**Appears in:**
|
||||
|
||||
- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration)
|
||||
|
||||
- [GenericControllerManagerConfiguration](#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration)
|
||||
|
||||
|
||||
LeaderElectionConfiguration defines the configuration of leader election
|
||||
clients for components that can run with leader election enabled.
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
|
||||
|
||||
<tr><td><code>leaderElect</code> <B>[Required]</B><br/>
|
||||
<code>bool</code>
|
||||
</td>
|
||||
<td>
|
||||
leaderElect enables a leader election client to gain leadership
|
||||
before executing the main loop. Enable this when running replicated
|
||||
components for high availability.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>leaseDuration</code> <B>[Required]</B><br/>
|
||||
<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a>
|
||||
</td>
|
||||
<td>
|
||||
leaseDuration is the duration that non-leader candidates will wait
|
||||
after observing a leadership renewal until attempting to acquire
|
||||
leadership of a led but unrenewed leader slot. This is effectively the
|
||||
maximum duration that a leader can be stopped before it is replaced
|
||||
by another candidate. This is only applicable if leader election is
|
||||
enabled.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>renewDeadline</code> <B>[Required]</B><br/>
|
||||
<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a>
|
||||
</td>
|
||||
<td>
|
||||
renewDeadline is the interval between attempts by the acting master to
|
||||
renew a leadership slot before it stops leading. This must be less
|
||||
than or equal to the lease duration. This is only applicable if leader
|
||||
election is enabled.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>retryPeriod</code> <B>[Required]</B><br/>
|
||||
<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a>
|
||||
</td>
|
||||
<td>
|
||||
retryPeriod is the duration the clients should wait between attempting
|
||||
acquisition and renewal of a leadership. This is only applicable if
|
||||
leader election is enabled.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>resourceLock</code> <B>[Required]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
resourceLock indicates the resource object type that will be used to lock
|
||||
during leader election cycles.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>resourceName</code> <B>[Required]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
resourceName indicates the name of resource object that will be used to lock
|
||||
during leader election cycles.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>resourceNamespace</code> <B>[Required]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
resourceName indicates the namespace of resource object that will be used to lock
|
||||
during leader election cycles.</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
## `LoggingConfiguration` {#LoggingConfiguration}
|
||||
|
||||
|
||||
|
||||
|
||||
**Appears in:**
|
||||
|
||||
- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration)
|
||||
|
||||
|
||||
LoggingConfiguration contains logging options
|
||||
Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information.
|
||||
|
||||
<table class="table">
|
||||
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
|
||||
<tbody>
|
||||
|
||||
|
||||
|
||||
<tr><td><code>format</code> <B>[Required]</B><br/>
|
||||
<code>string</code>
|
||||
</td>
|
||||
<td>
|
||||
Format Flag specifies the structure of log messages.
|
||||
default value of format is `text`</td>
|
||||
</tr>
|
||||
|
||||
|
||||
<tr><td><code>sanitization</code> <B>[Required]</B><br/>
|
||||
<code>bool</code>
|
||||
</td>
|
||||
<td>
|
||||
[Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens).
|
||||
Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)</td>
|
||||
</tr>
|
||||
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -89,7 +89,7 @@ of the predicates after it finds one predicate that failed.</td>
|
||||
|
||||
**Appears in:**
|
||||
|
||||
- [Extender](#kubescheduler-config-k8s-io-v1beta1-Extender)
|
||||
- [Extender](#kubescheduler-config-k8s-io-v1beta2-Extender)
|
||||
|
||||
- [LegacyExtender](#kubescheduler-config-k8s-io-v1-LegacyExtender)
|
||||
|
||||
@@ -132,7 +132,7 @@ resource when applying predicates.</td>
|
||||
|
||||
**Appears in:**
|
||||
|
||||
- [Extender](#kubescheduler-config-k8s-io-v1beta1-Extender)
|
||||
- [Extender](#kubescheduler-config-k8s-io-v1beta2-Extender)
|
||||
|
||||
- [LegacyExtender](#kubescheduler-config-k8s-io-v1-LegacyExtender)
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,22 @@
|
||||
---
|
||||
title: Affinity
|
||||
id: affinity
|
||||
date: 2019-01-11
|
||||
full_link: /docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity
|
||||
short_description: >
|
||||
Rules used by the scheduler to determine where to place pods
|
||||
aka:
|
||||
tags:
|
||||
- fundamental
|
||||
---
|
||||
|
||||
In Kubernetes, _affinity_ is a set of rules that give hints to the scheduler about where to place pods.
|
||||
|
||||
<!--more-->
|
||||
There are two kinds of affinity:
|
||||
* [node affinity](/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity)
|
||||
* [pod-to-pod affinity](/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity)
|
||||
|
||||
The rules are defined using the Kubernetes {{< glossary_tooltip term_id="label" text="labels">}},
|
||||
and {{< glossary_tooltip term_id="selector" text="selectors">}} specified in {{< glossary_tooltip term_id="pod" text="pods" >}},
|
||||
and they can be either required or preferred, depending on how strictly you want the scheduler to enforce them.
|
||||
Executable → Regular
@@ -0,0 +1,22 @@
|
||||
---
|
||||
title: API-initiated eviction
|
||||
id: api-eviction
|
||||
date: 2021-04-27
|
||||
full_link: /docs/concepts/scheduling-eviction/api-eviction/
|
||||
short_description: >
|
||||
API-initiated eviction is the process by which you use the Eviction API to create an
|
||||
Eviction object that triggers graceful pod termination.
|
||||
aka:
|
||||
tags:
|
||||
- operation
|
||||
---
|
||||
API-initiated eviction is the process by which you use the [Eviction API](/docs/reference/generated/kubernetes-api/{{<param "version">}}/#create-eviction-pod-v1-core)
|
||||
to create an `Eviction` object that triggers graceful pod termination.
|
||||
|
||||
<!--more-->
|
||||
|
||||
You can request eviction either by directly calling the Eviction API
|
||||
using a client of the kube-apiserver, like the `kubectl drain` command.
|
||||
When an `Eviction` object is created, the API server terminates the Pod.
|
||||
|
||||
API-initiated eviction is not the same as [node-pressure eviction](/docs/concepts/scheduling-eviction/eviction/#kubelet-eviction).
|
||||
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
@@ -0,0 +1,18 @@
|
||||
---
|
||||
title: Eviction
|
||||
id: eviction
|
||||
date: 2021-05-08
|
||||
full_link: /docs/concepts/scheduling-eviction/
|
||||
short_description: >
|
||||
Process of terminating one or more Pods on Nodes
|
||||
aka:
|
||||
tags:
|
||||
- operation
|
||||
---
|
||||
|
||||
Eviction is the process of terminating one or more Pods on Nodes.
|
||||
|
||||
<!--more-->
|
||||
There are two kinds of eviction:
|
||||
* [Node-pressure eviction](/docs/concepts/scheduling-eviction/node-pressure-eviction/)
|
||||
* [API-initiated eviction](/docs/concepts/scheduling-eviction/api-eviction/)
|
||||
@@ -0,0 +1,31 @@
|
||||
---
|
||||
title: Finalizer
|
||||
id: finalizer
|
||||
date: 2021-07-07
|
||||
full_link: /docs/concepts/overview/working-with-objects/finalizers/
|
||||
short_description: >
|
||||
A namespaced key that tells Kubernetes to wait until specific conditions are met
|
||||
before it fully deletes an object marked for deletion.
|
||||
aka:
|
||||
tags:
|
||||
- fundamental
|
||||
- operation
|
||||
---
|
||||
Finalizers are namespaced keys that tell Kubernetes to wait until specific
|
||||
conditions are met before it fully deletes resources marked for deletion.
|
||||
Finalizers alert {{<glossary_tooltip text="controllers" term_id="controller">}}
|
||||
to clean up resources the deleted object owned.
|
||||
|
||||
<!--more-->
|
||||
|
||||
When you tell Kubernetes to delete an object that has finalizers specified for
|
||||
it, the Kubernetes API marks the object for deletion, putting it into a
|
||||
read-only state. The target object remains in a terminating state while the
|
||||
control plane, or other components, take the actions defined by the finalizers.
|
||||
After these actions are complete, the controller removes the relevant finalizers
|
||||
from the target object. When the `metadata.finalizers` field is empty,
|
||||
Kubernetes considers the deletion complete.
|
||||
|
||||
You can use finalizers to control {{<glossary_tooltip text="garbage collection" term_id="garbage-collection">}}
|
||||
of resources. For example, you can define a finalizer to clean up related resources or
|
||||
infrastructure before the controller deletes the target resource.
|
||||
@@ -0,0 +1,24 @@
|
||||
---
|
||||
title: Garbage Collection
|
||||
id: garbage-collection
|
||||
date: 2021-07-07
|
||||
full_link: /docs/concepts/workloads/controllers/garbage-collection/
|
||||
short_description: >
|
||||
A collective term for the various mechanisms Kubernetes uses to clean up cluster
|
||||
resources.
|
||||
|
||||
aka:
|
||||
tags:
|
||||
- fundamental
|
||||
- operation
|
||||
---
|
||||
Garbage collection is a collective term for the various mechanisms Kubernetes uses to clean up
|
||||
cluster resources.
|
||||
|
||||
<!--more-->
|
||||
|
||||
Kubernetes uses garbage collection to clean up resources like [unused containers and images](/docs/concepts/workloads/controllers/garbage-collection/#containers-images),
|
||||
[failed Pods](/docs/concepts/workloads/pods/pod-lifecycle/#pod-garbage-collection),
|
||||
[objects owned by the targeted resource](/docs/concepts/overview/working-with-objects/owners-dependents/),
|
||||
[completed Jobs](/docs/concepts/workloads/controllers/ttlafterfinished/), and resources
|
||||
that have expired or failed.
|
||||
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
+1
-1
@@ -11,7 +11,7 @@ tags:
|
||||
- architecture
|
||||
- fundamental
|
||||
---
|
||||
Control Plane component that runs {{< glossary_tooltip text="controller" term_id="controller" >}} processes.
|
||||
Control plane component that runs {{< glossary_tooltip text="controller" term_id="controller" >}} processes.
|
||||
|
||||
<!--more-->
|
||||
|
||||
|
||||
Executable → Regular
Executable → Regular
+1
-1
@@ -2,7 +2,7 @@
|
||||
title: kube-scheduler
|
||||
id: kube-scheduler
|
||||
date: 2018-04-12
|
||||
full_link: /docs/reference/generated/kube-scheduler/
|
||||
full_link: /docs/reference/command-line-tools-reference/kube-scheduler/
|
||||
short_description: >
|
||||
Control plane component that watches for newly created pods with no assigned node, and selects a node for them to run on.
|
||||
|
||||
|
||||
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
@@ -0,0 +1,24 @@
|
||||
---
|
||||
title: Node-pressure eviction
|
||||
id: node-pressure-eviction
|
||||
date: 2021-05-13
|
||||
full_link: /docs/concepts/scheduling-eviction/node-pressure-eviction/
|
||||
short_description: >
|
||||
Node-pressure eviction is the process by which the kubelet proactively fails
|
||||
pods to reclaim resources on nodes.
|
||||
aka:
|
||||
- kubelet eviction
|
||||
tags:
|
||||
- operation
|
||||
---
|
||||
Node-pressure eviction is the process by which the {{<glossary_tooltip term_id="kubelet" text="kubelet">}} proactively terminates
|
||||
pods to reclaim resources on nodes.
|
||||
|
||||
<!--more-->
|
||||
|
||||
The kubelet monitors resources like CPU, memory, disk space, and filesystem
|
||||
inodes on your cluster's nodes. When one or more of these resources reach
|
||||
specific consumption levels, the kubelet can proactively fail one or more pods
|
||||
on the node to reclaim resources and prevent starvation.
|
||||
|
||||
Node-pressure eviction is not the same as [API-initiated eviction](/docs/concepts/scheduling-eviction/api-eviction/).
|
||||
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
Executable → Regular
@@ -0,0 +1,19 @@
|
||||
---
|
||||
id: pod-disruption
|
||||
title: Pod Disruption
|
||||
full_link: /docs/concepts/workloads/pods/disruptions/
|
||||
date: 2021-05-12
|
||||
short_description: >
|
||||
The process by which Pods on Nodes are terminated either voluntarily or involuntarily.
|
||||
|
||||
aka:
|
||||
related:
|
||||
- pod
|
||||
- container
|
||||
tags:
|
||||
- operation
|
||||
---
|
||||
|
||||
[Pod disruption](/docs/concepts/workloads/pods/disruptions/) is the process by which Pods on Nodes are terminated either voluntarily or involuntarily.
|
||||
|
||||
Voluntary disruptions are started intentionally by application owners or cluster administrators. Involuntary disruptions are unintentional and can be triggered by unavoidable issues like Nodes running out of resources, or by accidental deletions.
|
||||
@@ -2,7 +2,7 @@
|
||||
title: Pod Priority
|
||||
id: pod-priority
|
||||
date: 2019-01-31
|
||||
full_link: /docs/concepts/configuration/pod-priority-preemption/#pod-priority
|
||||
full_link: /docs/concepts/scheduling-eviction/pod-priority-preemption/#pod-priority
|
||||
short_description: >
|
||||
Pod Priority indicates the importance of a Pod relative to other Pods.
|
||||
|
||||
@@ -14,4 +14,4 @@ tags:
|
||||
|
||||
<!--more-->
|
||||
|
||||
[Pod Priority](/docs/concepts/configuration/pod-priority-preemption/#pod-priority) gives the ability to set scheduling priority of a Pod to be higher and lower than other Pods — an important feature for production clusters workload.
|
||||
[Pod Priority](/docs/concepts/scheduling-eviction/pod-priority-preemption/#pod-priority) gives the ability to set scheduling priority of a Pod to be higher and lower than other Pods — an important feature for production clusters workload.
|
||||
|
||||
Executable → Regular
Executable → Regular
@@ -2,7 +2,7 @@
|
||||
title: Preemption
|
||||
id: preemption
|
||||
date: 2019-01-31
|
||||
full_link: /docs/concepts/configuration/pod-priority-preemption/#preemption
|
||||
full_link: /docs/concepts/scheduling-eviction/pod-priority-preemption/#preemption
|
||||
short_description: >
|
||||
Preemption logic in Kubernetes helps a pending Pod to find a suitable Node by evicting low priority Pods existing on that Node.
|
||||
|
||||
@@ -14,4 +14,4 @@ tags:
|
||||
|
||||
<!--more-->
|
||||
|
||||
If a Pod cannot be scheduled, the scheduler tries to [preempt](/docs/concepts/configuration/pod-priority-preemption/#preemption) lower priority Pods to make scheduling of the pending Pod possible.
|
||||
If a Pod cannot be scheduled, the scheduler tries to [preempt](/docs/concepts/scheduling-eviction/pod-priority-preemption/#preemption) lower priority Pods to make scheduling of the pending Pod possible.
|
||||
|
||||
Executable → Regular
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user