Principles and practices for good RBAC design for cluster operators.

This page provides a walkthrough for some steps you can follow to run Windows containers using Kubernetes. The page also highlights some Windows specific functionality within Kubernetes. It is important to note that creating and deploying services and workloads on Kubernetes behaves in much the same way for Linux and Windows containers. The kubectl commands to interface with the cluster are identical. The examples in this page are provided to jumpstart your experience with Windows containers.

To learn how to generate certificates for your cluster, see Certificates.

FEATURE STATE: Kubernetes v1.21 [alpha] CSI volume health monitoring allows CSI Drivers to detect abnormal volume conditions from the underlying storage systems and report them as events on PVCs or Pods. Volume health monitoring Kubernetes volume health monitoring is part of how Kubernetes implements the Container Storage Interface (CSI). Volume health monitoring feature is implemented in two components: an External Health Monitor controller, and the kubelet. If a CSI Driver supports Volume Health Monitoring feature from the controller side, an event will be reported on the related PersistentVolumeClaim (PVC) when an abnormal volume condition is detected on a CSI volume.

Storage capacity is limited and may vary depending on the node on which a pod runs: network-attached storage might not be accessible by all nodes, or storage is local to a node to begin with. FEATURE STATE: Kubernetes v1.24 [stable] This page describes how Kubernetes keeps track of storage capacity and how the scheduler uses that information to schedule Pods onto nodes that have access to enough storage capacity for the remaining missing volumes.

This page explains proxies used with Kubernetes. Proxies There are several different proxies you may encounter when using Kubernetes: The kubectl proxy: runs on a user's desktop or in a pod proxies from a localhost address to the Kubernetes apiserver client to proxy uses HTTP proxy to apiserver uses HTTPS locates apiserver adds authentication headers The apiserver proxy: is a bastion built into the apiserver connects a user outside of the cluster to cluster IPs which otherwise might not be reachable runs in the apiserver processes client to proxy uses HTTPS (or http if apiserver so configured) proxy to target may use HTTP or HTTPS as chosen by proxy using available information can be used to reach a Node, Pod, or Service does load balancing when used to reach a Service The kube proxy:

In order to support latency-critical and high-throughput workloads, Kubernetes offers a suite of Resource Managers. The managers aim to co-ordinate and optimise node's resources alignment for pods configured with a specific requirement for CPUs, devices, and memory (hugepages) resources. The main manager, the Topology Manager, is a Kubelet component that co-ordinates the overall resource management process through its policy. The configuration of individual managers is elaborated in dedicated documents:

System component logs record events happening in cluster, which can be very useful for debugging. You can configure log verbosity to see more or less detail. Logs can be as coarse-grained as showing errors within a component, or as fine-grained as showing step-by-step traces of events (like HTTP access logs, pod state changes, controller actions, or scheduler decisions). Warning:In contrast to the command line flags described here, the log output itself does not fall under the Kubernetes API stability guarantees: individual log entries and their formatting may change from one release to the next!

Kubernetes (version 1.3 through to the latest 1.31, and likely onwards) lets you use Container Network Interface (CNI) plugins for cluster networking. You must use a CNI plugin that is compatible with your cluster and that suits your needs. Different plugins are available (both open- and closed- source) in the wider Kubernetes ecosystem. A CNI plugin is required to implement the Kubernetes network model. You must use a CNI plugin that is compatible with the v0.

FEATURE STATE: Kubernetes v1.20 [stable] Kubernetes allow you to limit the number of process IDs (PIDs) that a Pod can use. You can also reserve a number of allocatable PIDs for each node for use by the operating system and daemons (rather than by Pods). Process IDs (PIDs) are a fundamental resource on nodes. It is trivial to hit the task limit without hitting any other resource limits, which can then cause instability to a host machine.