Baseline guidelines around ensuring application security on Kubernetes, aimed at application developers

In order to support latency-critical and high-throughput workloads, Kubernetes offers a suite of Resource Managers. The managers aim to co-ordinate and optimise the alignment of node's resources for pods configured with a specific requirement for CPUs, devices, and memory (hugepages) resources. Hardware topology alignment policies Topology Manager is a kubelet component that aims to coordinate the set of components that are responsible for these optimizations. The overall resource management process is governed using the policy you specify.

FEATURE STATE: Kubernetes v1.18 [beta] This page explains how to add Windows worker nodes to a kubeadm cluster. Before you begin A running Windows Server 2022 (or higher) instance with administrative access. A running kubeadm cluster created by kubeadm init and following the steps in the document Creating a cluster with kubeadm. Adding Windows worker nodes Note:To facilitate the addition of Windows worker nodes to a cluster, PowerShell scripts from the repository https://sigs.

FEATURE STATE: Kubernetes v1.18 [beta] This page explains how to upgrade a Windows node created with kubeadm. Before you begin You need to have shell access to all the nodes, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. Your Kubernetes server must be at or later than version 1.

System component logs record events happening in cluster, which can be very useful for debugging. You can configure log verbosity to see more or less detail. Logs can be as coarse-grained as showing errors within a component, or as fine-grained as showing step-by-step traces of events (like HTTP access logs, pod state changes, controller actions, or scheduler decisions). Warning:In contrast to the command line flags described here, the log output itself does not fall under the Kubernetes API stability guarantees: individual log entries and their formatting may change from one release to the next!

Production-Grade Container Orchestration

Kubernetes has various types of probes: Liveness probe Readiness probe Startup probe Liveness probe Liveness probes determine when to restart a container. For example, liveness probes could catch a deadlock when an application is running but unable to make progress. If a container fails its liveness probe repeatedly, the kubelet restarts the container. Liveness probes do not wait for readiness probes to succeed. If you want to wait before executing a liveness probe, you can either define initialDelaySeconds or use a startup probe.

This page shows how to enable or disable feature gates to control specific Kubernetes features in your cluster. Enabling feature gates allows you to test and use Alpha or Beta features before they become generally available. Note:For some stable (GA) gates, you can also disable them, usually for one minor release after GA; however if you do that, your cluster may not be conformant as Kubernetes. Before you begin You need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster.

Define overall memory and CPU resource limits for a namespace.

This page shows how to change the default Storage Class that is used to provision volumes for PersistentVolumeClaims that have no special requirements. Before you begin You need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds: