Synopsis Experimental: Check who you are and your attributes (groups, extra). This command is helpful to get yourself aware of the current user attributes, especially when dynamic authentication, e.g., token webhook, auth proxy, or OIDC provider, is enabled in the Kubernetes cluster. kubectl auth whoami Examples # Get your subject attributes. kubectl auth whoami # Get your subject attributes in JSON format. kubectl auth whoami -o json Options --allow-missing-template-keys     Default: true If true, ignore any errors in templates when a field or map key is missing in the template.

When running Kubernetes in an environment with strict network boundaries, such as on-premises datacenter with physical network firewalls or Virtual Networks in Public Cloud, it is useful to be aware of the ports and protocols used by Kubernetes components. Control plane Protocol Direction Port Range Purpose Used By TCP Inbound 6443 Kubernetes API server All TCP Inbound 2379-2380 etcd server client API kube-apiserver, etcd TCP Inbound 10250 Kubelet API Self, Control plane TCP Inbound 10259 kube-scheduler Self TCP Inbound 10257 kube-controller-manager Self Although etcd ports are included in control plane section, you can also host your own etcd cluster externally or on custom ports.

kubectl is the Kubernetes cli version of a swiss army knife, and can do many things. While this Book is focused on using kubectl to declaratively manage applications in Kubernetes, it also covers other kubectl functions. Command Families Most kubectl commands typically fall into one of a few categories: Type Used For Description Declarative Resource Management Deployment and operations (e.g. GitOps) Declaratively manage Kubernetes workloads using resource configuration Imperative Resource Management Development Only Run commands to manage Kubernetes workloads using Command Line arguments and flags Printing Workload State Debugging Print information about workloads Interacting with Containers Debugging Exec, attach, cp, logs Cluster Management Cluster operations Drain and cordon Nodes Declarative Application Management The preferred approach for managing resources is through declarative files called resource configuration used with the kubectl Apply command.

Synopsis Creates an autoscaler that automatically chooses and sets the number of pods that run in a Kubernetes cluster. Looks up a deployment, replica set, stateful set, or replication controller by name and creates an autoscaler that uses the given resource as a reference. An autoscaler can automatically increase or decrease number of pods deployed within the system as needed. kubectl autoscale (-f FILENAME | TYPE NAME | TYPE/NAME) [--min=MINPODS] --max=MAXPODS [--cpu-percent=CPU] Examples # Auto scale a deployment "foo", with the number of pods between 2 and 10, no target CPU utilization specified so a default autoscaling policy will be used kubectl autoscale deployment foo --min=2 --max=10 # Auto scale a replication controller "foo", with the number of pods between 1 and 5, target CPU utilization at 80% kubectl autoscale rc foo --max=5 --cpu-percent=80 Options --allow-missing-template-keys     Default: true If true, ignore any errors in templates when a field or map key is missing in the template.

This command prints the version of kubeadm. Print the version of kubeadm Synopsis Print the version of kubeadm kubeadm version [flags] Options -h, --help help for version -o, --output string Output format; available options are 'yaml', 'json' and 'short' Options inherited from parent commands --rootfs string [EXPERIMENTAL] The path to the 'real' host root filesystem.

Resource Types CredentialProviderConfig CredentialProviderConfig CredentialProviderConfig is the configuration containing information about each exec credential provider. Kubelet reads this configuration from disk and enables each provider as specified by the CredentialProvider type. FieldDescription apiVersionstringkubelet.config.k8s.io/v1alpha1 kindstringCredentialProviderConfig providers [Required] []CredentialProvider providers is a list of credential provider plugins that will be enabled by the kubelet. Multiple providers may match against a single image, in which case credentials from all providers will be returned to the kubelet.

Resource Types CredentialProviderRequest CredentialProviderResponse CredentialProviderRequest CredentialProviderRequest includes the image that the kubelet requires authentication for. Kubelet will pass this request object to the plugin via stdin. In general, plugins should prefer responding with the same apiVersion they were sent. FieldDescription apiVersionstringcredentialprovider.kubelet.k8s.io/v1 kindstringCredentialProviderRequest image [Required] string image is the container image that is being pulled as part of the credential provider plugin request. Plugins may optionally parse the image to extract any information required to fetch credentials.

Synopsis Display resource (CPU/memory) usage of pods. The 'top pod' command allows you to see the resource consumption of pods. Due to the metrics pipeline delay, they may be unavailable for a few minutes since pod creation. kubectl top pod [NAME | -l label] Examples # Show metrics for all pods in the default namespace kubectl top pod # Show metrics for all pods in the given namespace kubectl top pod --namespace=NAMESPACE # Show metrics for a given pod and its containers kubectl top pod POD_NAME --containers # Show metrics for the pods defined by label name=myLabel kubectl top pod -l name=myLabel Options -A, --all-namespaces If present, list the requested object(s) across all namespaces.

Kubectl supports JSONPath template. JSONPath template is composed of JSONPath expressions enclosed by curly braces {}. Kubectl uses JSONPath expressions to filter on specific fields in the JSON object and format the output. In addition to the original JSONPath template syntax, the following functions and syntax are valid: Use double quotes to quote text inside JSONPath expressions. Use the range, end operators to iterate lists. Use negative slice indices to step backwards through a list.

Package v1 is the v1 version of the API. Resource Types AdmissionConfiguration EncryptionConfiguration AdmissionConfiguration AdmissionConfiguration provides versioned configuration for admission controllers. FieldDescription apiVersionstringapiserver.config.k8s.io/v1 kindstringAdmissionConfiguration plugins []AdmissionPluginConfiguration Plugins allows specifying a configuration per admission control plugin. EncryptionConfiguration EncryptionConfiguration stores the complete configuration for encryption providers. It also allows the use of wildcards to specify the resources that should be encrypted. Use '*.<group>' to encrypt all resources within a group or '*.*' to encrypt all resources.