Kubernetes provides a certificates.k8s.io API, which lets you provision TLS certificates signed by a Certificate Authority (CA) that you control. These CA and certificates can be used by your workloads to establish trust. certificates.k8s.io API uses a protocol that is similar to the ACME draft. Note:Certificates created using the certificates.k8s.io API are signed by a dedicated CA. It is possible to configure your cluster to use the cluster root CA for this purpose, but you should never rely on this.

Role-based access control (RBAC) is a method of regulating access to computer or network resources based on the roles of individual users within your organization. RBAC authorization uses the rbac.authorization.k8s.io API group to drive authorization decisions, allowing you to dynamically configure policies through the Kubernetes API. To enable RBAC, start the API server with the --authorization-config flag set to a file that includes the RBAC authorizer; for example: apiVersion: apiserver.

Mechanisms for accessing metrics at node, volume, pod and container level, as seen by the kubelet.

Bootstrap tokens are used for establishing bidirectional trust between a node joining the cluster and a control-plane node, as described in authenticating with bootstrap tokens. kubeadm init creates an initial token with a 24-hour TTL. The following commands allow you to manage such a token and also to create and manage new ones. kubeadm token create Create bootstrap tokens on the server Synopsis This command will create a bootstrap token for you.

Production-Grade Container Orchestration

Synopsis Update existing container image(s) of resources. Possible resources include (case insensitive): pod (po), replicationcontroller (rc), deployment (deploy), daemonset (ds), statefulset (sts), cronjob (cj), replicaset (rs) kubectl set image (-f FILENAME | TYPE NAME) CONTAINER_NAME_1=CONTAINER_IMAGE_1 ... CONTAINER_NAME_N=CONTAINER_IMAGE_N Examples # Set a deployment's nginx container image to 'nginx:1.9.1', and its busybox container image to 'busybox' kubectl set image deployment/nginx busybox=busybox nginx=nginx:1.9.1 # Update all deployments' and rc's nginx container's image to 'nginx:1.

Production-Grade Container Orchestration

Resource Types DefaultPreemptionArgs DynamicResourcesArgs InterPodAffinityArgs KubeSchedulerConfiguration NodeAffinityArgs NodeResourcesBalancedAllocationArgs NodeResourcesFitArgs PodTopologySpreadArgs VolumeBindingArgs ClientConnectionConfiguration Appears in: KubeSchedulerConfiguration ClientConnectionConfiguration contains details for constructing a client. FieldDescription kubeconfig [Required] string kubeconfig is the path to a KubeConfig file. acceptContentTypes [Required] string acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the default value of 'application/json'. This field will control all connections to the server used by a particular client.

Resource Types Preference Preference Preference stores elements of KubeRC configuration file FieldDescription apiVersionstringkubectl.config.k8s.io/v1beta1 kindstringPreference defaults [Required] []CommandDefaults defaults allow changing default option values of commands. This is especially useful, when user doesn't want to explicitly set options each time. aliases [Required] []AliasOverride aliases allow defining command aliases for existing kubectl commands, with optional default option values. If the alias name collides with a built-in command, built-in command always takes precedence. Option overrides defined in the defaults section do NOT apply to aliases for the same command.

Synopsis The kubelet is the primary "node agent" that runs on each node. It can register the node with the apiserver using one of: the hostname; a flag to override the hostname; or specific logic for a cloud provider. The kubelet works in terms of a PodSpec. A PodSpec is a YAML or JSON object that describes a pod. The kubelet takes a set of PodSpecs that are provided through various mechanisms (primarily through the apiserver) and ensures that the containers described in those PodSpecs are running and healthy.