Detailed explanation of Pressure Stall Information (PSI) metrics and how to use them to identify resource pressure in Kubernetes.

This page describes Kubernetes security and disclosure information. Security Announcements Join the kubernetes-security-announce group for emails about security and major API announcements. Report a Vulnerability We're extremely grateful for security researchers and users that report vulnerabilities to the Kubernetes Open Source Community. All reports are thoroughly investigated by a set of community volunteers. To make a report, submit your vulnerability to the Kubernetes bug bounty program. This allows triage and handling of the vulnerability with standardized response times.

Production-Grade Container Orchestration

When running Kubernetes in an environment with strict network boundaries, such as on-premises datacenter with physical network firewalls or Virtual Networks in Public Cloud, it is useful to be aware of the ports and protocols used by Kubernetes components. Control plane Protocol Direction Port Range Purpose Used By TCP Inbound 6443 Kubernetes API server All TCP Inbound 2379-2380 etcd server client API kube-apiserver, etcd TCP Inbound 10250 Kubelet API Self, Control plane TCP Inbound 10259 kube-scheduler Self TCP Inbound 10257 kube-controller-manager Self Although etcd ports are included in control plane section, you can also host your own etcd cluster externally or on custom ports.

Production-Grade Container Orchestration

This command prints the version of kubeadm. Synopsis Print the version of kubeadm kubeadm version [flags] Options -h, --help help for version -o, --output string Output format; available options are 'yaml', 'json' and 'short' Options inherited from parent commands --rootfs string The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

Synopsis Experimental: Check who you are and your attributes (groups, extra). This command is helpful to get yourself aware of the current user attributes, especially when dynamic authentication, e.g., token webhook, auth proxy, or OIDC provider, is enabled in the Kubernetes cluster. kubectl auth whoami Examples # Get your subject attributes kubectl auth whoami # Get your subject attributes in JSON format kubectl auth whoami -o json Options --allow-missing-template-keys     Default: true If true, ignore any errors in templates when a field or map key is missing in the template.

FEATURE STATE: Kubernetes v1.10 [stable] kubeadm init and kubeadm join together provide a nice user experience for creating a bare Kubernetes cluster from scratch, that aligns with the best-practices. However, it might not be obvious how kubeadm does that. This document provides additional details on what happens under the hood, with the aim of sharing knowledge on the best practices for a Kubernetes cluster. Core design principles The cluster that kubeadm init and kubeadm join set up should be:

Production-Grade Container Orchestration

Production-Grade Container Orchestration