FEATURE STATE: Kubernetes v1.30 [beta] This page explains how user namespaces are used in Kubernetes pods. A user namespace isolates the user running inside the container from the one in the host. A process running as root in a container can run as a different (non-root) user in the host; in other words, the process has full privileges for operations inside the user namespace, but is unprivileged for operations outside the namespace.

Production-Grade Container Orchestration

Resource Types ImageReview ImageReview ImageReview checks if the set of images in a pod are allowed. FieldDescription apiVersionstringimagepolicy.k8s.io/v1alpha1 kindstringImageReview metadata meta/v1.ObjectMeta Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata Refer to the Kubernetes API documentation for the fields of the metadata field. spec [Required] ImageReviewSpec Spec holds information about the pod being evaluated status ImageReviewStatus Status is filled in by the backend and indicates whether the pod should be allowed. ImageReviewContainerSpec Appears in:

This page assumes that you understand how to contribute to new content and review others' work, and are ready to learn about more ways to contribute. You need to use the Git command line client and other tools for some of these tasks. Propose improvements SIG Docs members can propose improvements. After you've been contributing to the Kubernetes documentation for a while, you may have ideas for improving the Style Guide , the Content Guide, the toolchain used to build the documentation, the website style, the processes for reviewing and merging pull requests, or other aspects of the documentation.

This example demonstrates how to limit the amount of storage consumed in a namespace. The following resources are used in the demonstration: ResourceQuota, LimitRange, and PersistentVolumeClaim. Before you begin You need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts.

This page shows how a Pod can use a downwardAPI volume, to expose information about itself to containers running in the Pod. A downwardAPI volume can expose Pod fields and container fields. In Kubernetes, there are two ways to expose Pod and container fields to a running container: Environment variables Volume files, as explained in this task Together, these two ways of exposing Pod and container fields are called the downward API.

Configure load balancing, port forwarding, or setup firewall or DNS configurations to access applications in a cluster.

This task shows how to scale a StatefulSet. Scaling a StatefulSet refers to increasing or decreasing the number of replicas. Before you begin StatefulSets are only available in Kubernetes version 1.5 or later. To check your version of Kubernetes, run kubectl version. Not all stateful applications scale nicely. If you are unsure about whether to scale your StatefulSets, see StatefulSet concepts or StatefulSet tutorial for further information. You should perform scaling only when you are confident that your stateful application cluster is completely healthy.

Production-Grade Container Orchestration

Node-pressure eviction is the process by which the kubelet proactively terminates pods to reclaim resources on nodes. Note: FEATURE STATE: Kubernetes v1.31 [beta] (enabled by default: true) The split image filesystem feature, which enables support for the containerfs filesystem, adds several new eviction signals, thresholds and metrics. To use containerfs, the Kubernetes release v1.33 requires the KubeletSeparateDiskGC feature gate to be enabled. Currently, only CRI-O (v1.29 or higher) offers the containerfs filesystem support.