Kubernetes provides a certificates.k8s.io API, which lets you provision TLS certificates signed by a Certificate Authority (CA) that you control. These CA and certificates can be used by your workloads to establish trust. certificates.k8s.io API uses a protocol that is similar to the ACME draft. Note:Certificates created using the certificates.k8s.io API are signed by a dedicated CA. It is possible to configure your cluster to use the cluster root CA for this purpose, but you should never rely on this.

Understand how to protect traffic within your cluster using Transport Layer Security (TLS).

This page provides details of version compatibility between the Kubernetes device plugin API, and different versions of Kubernetes itself. Compatibility matrix v1alpha1 v1beta1 Kubernetes 1.21 - ✓ Kubernetes 1.22 - ✓ Kubernetes 1.23 - ✓ Kubernetes 1.24 - ✓ Kubernetes 1.25 - ✓ Kubernetes 1.26 - ✓ Key: ✓ Exactly the same features / API objects in both device plugin API and the Kubernetes version. + The device plugin API has features or API objects that may not be present in the Kubernetes cluster, either because the device plugin API has added additional new API calls, or that the server has removed an old API call.

FEATURE STATE: Kubernetes v1.30 [stable] This page provides an overview of Validating Admission Policy. What is Validating Admission Policy? Validating admission policies offer a declarative, in-process alternative to validating admission webhooks. Validating admission policies use the Common Expression Language (CEL) to declare the validation rules of a policy. Validation admission policies are highly configurable, enabling policy authors to define policies that can be parameterized and scoped to resources as needed by cluster administrators.

Mechanisms for accessing metrics at node, volume, pod and container level, as seen by the kubelet.

Synopsis Set a context entry in kubeconfig. Specifying a name that already exists will merge new fields on top of existing values for those fields. kubectl config set-context [NAME | --current] [--cluster=cluster_nickname] [--user=user_nickname] [--namespace=namespace] Examples # Set the user field on the gce context entry without touching other values kubectl config set-context gce --user=cluster-admin Options --cluster string cluster for the context entry in kubeconfig --current Modify the current context

Synopsis Display one or many resources. Prints a table of the most important information about the specified resources. You can filter the list using a label selector and the --selector flag. If the desired resource type is namespaced you will only see results in the current namespace if you don't specify any namespace. By specifying the output as 'template' and providing a Go template as the value of the --template flag, you can filter the attributes of the fetched resources.

Synopsis kubectl controls the Kubernetes cluster manager. Find more information in Command line tool (kubectl). kubectl [flags] Options --add-dir-header If true, adds the file directory to the header of the log messages --alsologtostderr log to standard error as well as files --as string Username to impersonate for the operation --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --azure-container-registry-config string Path to the file containing Azure container registry configuration information.

Synopsis Create a ClusterIP service with the specified name. kubectl create service clusterip NAME [--tcp=<port>:<targetPort>] [--dry-run=server|client|none] Examples # Create a new ClusterIP service named my-cs kubectl create service clusterip my-cs --tcp=5678:8080 # Create a new ClusterIP service named my-cs (in headless mode) kubectl create service clusterip my-cs --clusterip="None" Options --allow-missing-template-keys     Default: true If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.

Synopsis The kubelet is the primary "node agent" that runs on each node. It can register the node with the apiserver using one of: the hostname; a flag to override the hostname; or specific logic for a cloud provider. The kubelet works in terms of a PodSpec. A PodSpec is a YAML or JSON object that describes a pod. The kubelet takes a set of PodSpecs that are provided through various mechanisms (primarily through the apiserver) and ensures that the containers described in those PodSpecs are running and healthy.