API-initiated eviction is the process by which you use the Eviction API to create an Eviction object that triggers graceful pod termination. You can request eviction by calling the Eviction API directly, or programmatically using a client of the API server, like the kubectl drain command. This creates an Eviction object, which causes the API server to terminate the Pod. API-initiated evictions respect your configured PodDisruptionBudgets and terminationGracePeriodSeconds. Using the API to create an Eviction object for a Pod is like performing a policy-controlled DELETE operation on the Pod.

Principles and practices for good RBAC design for cluster operators.

A ConfigMap is an API object used to store non-confidential data in key-value pairs. Pods can consume ConfigMaps as environment variables, command-line arguments, or as configuration files in a volume. A ConfigMap allows you to decouple environment-specific configuration from your container images, so that your applications are easily portable. Caution:ConfigMap does not provide secrecy or encryption. If the data you want to store are confidential, use a Secret rather than a ConfigMap, or use additional (third party) tools to keep your data private.

FEATURE STATE: Kubernetes v1.24 [stable] When you run a Pod on a Node, the Pod itself takes an amount of system resources. These resources are additional to the resources needed to run the container(s) inside the Pod. In Kubernetes, Pod Overhead is a way to account for the resources consumed by the Pod infrastructure on top of the container requests & limits. In Kubernetes, the Pod's overhead is set at admission time according to the overhead associated with the Pod's RuntimeClass.

This page explains proxies used with Kubernetes. Proxies There are several different proxies you may encounter when using Kubernetes: The kubectl proxy: runs on a user's desktop or in a pod proxies from a localhost address to the Kubernetes apiserver client to proxy uses HTTP proxy to apiserver uses HTTPS locates apiserver adds authentication headers The apiserver proxy: is a bastion built into the apiserver connects a user outside of the cluster to cluster IPs which otherwise might not be reachable runs in the apiserver processes client to proxy uses HTTPS (or http if apiserver so configured) proxy to target may use HTTP or HTTPS as chosen by proxy using available information can be used to reach a Node, Pod, or Service does load balancing when used to reach a Service The kube proxy:

In order to support latency-critical and high-throughput workloads, Kubernetes offers a suite of Resource Managers. The managers aim to co-ordinate and optimise node's resources alignment for pods configured with a specific requirement for CPUs, devices, and memory (hugepages) resources. The main manager, the Topology Manager, is a Kubelet component that co-ordinates the overall resource management process through its policy. The configuration of individual managers is elaborated in dedicated documents:

Automatically manage the nodes in your cluster to adapt to demand.

kubeadm does not support automated ways of reconfiguring components that were deployed on managed nodes. One way of automating this would be by using a custom operator. To modify the components configuration you must manually edit associated cluster objects and files on disk. This guide shows the correct sequence of steps that need to be performed to achieve kubeadm cluster reconfiguration. Before you begin You need a cluster that was deployed using kubeadm Have administrator credentials (/etc/kubernetes/admin.

This page shows how to configure quotas for API objects, including PersistentVolumeClaims and Services. A quota restricts the number of objects, of a particular type, that can be created in a namespace. You specify quotas in a ResourceQuota object. Before you begin You need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts.

To learn how to generate certificates for your cluster, see Certificates.