Prompt:
Explain this text code:

Name:                           simmemleak-hra99
Namespace:                      default
Image(s):                       saadali/simmemleak
Node:                           kubernetes-node-tf0f/10.240.216.66
Labels:                         name=simmemleak
Status:                         Running
Reason:
Message:
IP:                             10.244.2.75
Containers:
  simmemleak:
    Image:  saadali/simmemleak:latest
    Limits:
      cpu:          100m
      memory:       50Mi
    State:          Running
      Started:      Tue, 07 Jul 2019 12:54:41 -0700
    Last State:     Terminated
      Reason:       OOMKilled
      Exit Code:    137
      Started:      Fri, 07 Jul 2019 12:54:30 -0700
      Finished:     Fri, 07 Jul 2019 12:54:33 -0700
    Ready:          False
    Restart Count:  5
Conditions:
  Type      Status
  Ready     False
Events:
  Type    Reason     Age   From               Message
  ----    ------     ----  ----               -------
  Normal  Scheduled  42s   default-scheduler  Successfully assigned simmemleak-hra99 to kubernetes-node-tf0f
  Normal  Pulled     41s   kubelet            Container image "saadali/simmemleak:latest" already present on machine
  Normal  Created    41s   kubelet            Created container simmemleak
  Normal  Started    40s   kubelet            Started container simmemleak
  Normal  Killing    32s   kubelet            Killing container with id ead3fb35-5cf5-44ed-9ae1-488115be66c6: Need to kill Pod

Response: This text code 7.5 - Resource Management for Pods and Containers | In the preceding example, the Restart Count: 5 indicates that the simmemleak container in the Pod was terminated and restarted five times (so far). The OOMKilled reason shows that the container tried


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Config

clusters:
- cluster:
    proxy-url: http://proxy.example.org:3128
    server: https://k8s.example.org/k8s/clusters/c-xxyyzz

Response:
  name: development

users:
- name: developer

contexts:
- context:
  name: development

Context: 7.6 - Organizing Cluster Access Using kubeconfig Files | This page outlines the differences in how resources are managed between Linux and Windows.


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Config

clusters:
- cluster:
    proxy-url: http://proxy.example.org:3128
    server: https://k8s.example.org/k8s/clusters/c-xxyyzz
  name: development

users:
- name: developer

contexts:
- context:
  name: development

Response: This yaml code 7.6 - Organizing Cluster Access Using kubeconfig Files | This page outlines the differences in how resources are managed between Linux and Windows.


Prompt:
Explain this text code:

spec.containers[*].securityContext.windowsOptions.hostProcess

Response: This text code 8.2 - Pod Security Standards | Allowed Values

Context: 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.initContainers[*].securityContext.windowsOptions.hostProcess

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.ephemeralContainers[*].securityContext.windowsOptions.hostProcess

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.ephemeralContainers[*].securityContext.privileged

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.containers[*].securityContext.capabilities.add

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.initContainers[*].securityContext.capabilities.add

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.ephemeralContainers[*].securityContext.capabilities.add

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.containers[*].lifecycle.postStart.tcpSocket.host

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.containers[*].lifecycle.preStop.tcpSocket.host

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.containers[*].lifecycle.postStart.httpGet.host

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.initContainers[*].livenessProbe.tcpSocket.host

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.initContainers[*].readinessProbe.tcpSocket.host

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.initContainers[*].lifecycle.postStart.tcpSocket.host

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.initContainers[*].lifecycle.preStop.tcpSocket.host

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.initContainers[*].lifecycle.postStart.httpGet.host

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.initContainers[*].lifecycle.preStop.httpGet.host

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.containers[*].securityContext.appArmorProfile.type

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.initContainers[*].securityContext.appArmorProfile.type

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.ephemeralContainers[*].securityContext.appArmorProfile.type

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

metadata.annotations["container.apparmor.security.beta.kubernetes.io/*"]

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.containers[*].securityContext.seLinuxOptions.type

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.initContainers[*].securityContext.seLinuxOptions.type

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.ephemeralContainers[*].securityContext.seLinuxOptions.type

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.containers[*].securityContext.seLinuxOptions.user

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.initContainers[*].securityContext.seLinuxOptions.user

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.ephemeralContainers[*].securityContext.seLinuxOptions.user

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.containers[*].securityContext.seLinuxOptions.role

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.initContainers[*].securityContext.seLinuxOptions.role

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.ephemeralContainers[*].securityContext.seLinuxOptions.role

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.ephemeralContainers[*].securityContext.procMount

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.containers[*].securityContext.seccompProfile.type

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.initContainers[*].securityContext.seccompProfile.type

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.ephemeralContainers[*].securityContext.seccompProfile.type

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.containers[*].securityContext.allowPrivilegeEscalation

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.initContainers[*].securityContext.allowPrivilegeEscalation

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.ephemeralContainers[*].securityContext.allowPrivilegeEscalation

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.initContainers[*].securityContext.runAsNonRoot

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.ephemeralContainers[*].securityContext.runAsNonRoot

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.ephemeralContainers[*].securityContext.runAsUser

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.containers[*].securityContext.seccompProfile.type

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.initContainers[*].securityContext.seccompProfile.type

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.ephemeralContainers[*].securityContext.seccompProfile.type

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.containers[*].securityContext.capabilities.drop

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.initContainers[*].securityContext.capabilities.drop

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.ephemeralContainers[*].securityContext.capabilities.drop

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.containers[*].securityContext.capabilities.add

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.initContainers[*].securityContext.capabilities.add

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Explain this text code:

spec.ephemeralContainers[*].securityContext.capabilities.add

Response: This text code 8.2 - Pod Security Standards | Allowed Values


Prompt:
Complete this yaml code:

# The per-mode level label indicates which policy level to apply for the mode.
#
# MODE must be one of `enforce`, `audit`, or `warn`.
# LEVEL must be one of `privileged`, `baseline`, or `restricted`.
pod-security.kubernetes.io/<MODE>: <LEVEL>

Response:
# Optional: per-mode version label that can be used to pin the policy to the
# version that shipped with a given Kubernetes minor version (for example v1.34).
#
# MODE must be one of `enforce`, `audit`, or `warn`.
# VERSION must be a valid Kubernetes minor version, or `latest`.
pod-security.kubernetes.io/<MODE>-version: <VERSION>

Context: 8.3 - Pod Security Admission | Check out Enforce Pod Security Standards with Namespace Labels to see example usage.


Prompt:
Explain this yaml code:

# The per-mode level label indicates which policy level to apply for the mode.
#
# MODE must be one of `enforce`, `audit`, or `warn`.
# LEVEL must be one of `privileged`, `baseline`, or `restricted`.
pod-security.kubernetes.io/<MODE>: <LEVEL>

# Optional: per-mode version label that can be used to pin the policy to the
# version that shipped with a given Kubernetes minor version (for example v1.34).
#
# MODE must be one of `enforce`, `audit`, or `warn`.
# VERSION must be a valid Kubernetes minor version, or `latest`.
pod-security.kubernetes.io/<MODE>-version: <VERSION>

Response: This yaml code 8.3 - Pod Security Admission | Check out Enforce Pod Security Standards with Namespace Labels to see example usage.


Prompt:
Explain this text code:

system:serviceaccount:kube-system:replicaset-controller

Response: This text code 8.3 - Pod Security Admission | Updates to the following pod fields are exempt from policy checks, meaning that if a pod update request only changes these fields, it will not be denied even if the pod is in violation of the current

Context: 8.3 - Pod Security Admission | Updates to the following pod fields are exempt from policy checks, meaning that if a pod update request only changes these fields, it will not be denied even if the pod is in violation of the current


Prompt:
Complete this yaml code:

apiVersion: v1
kind: ServiceAccount
metadata:

Response:
  annotations:
    kubernetes.io/enforce-mountable-secrets: "true"
  name: my-serviceaccount
  namespace: my-namespace

Context: 8.4 - Service Accounts | When this annotation is set to "true", the Kubernetes control plane ensures that the Secrets from this ServiceAccount are subject to certain mounting restrictions.


Prompt:
Explain this yaml code:

apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    kubernetes.io/enforce-mountable-secrets: "true"
  name: my-serviceaccount
  namespace: my-namespace

Response: This yaml code 8.4 - Service Accounts | When this annotation is set to "true", the Kubernetes control plane ensures that the Secrets from this ServiceAccount are subject to certain mounting restrictions.


Prompt:
Complete this json code:

{
    "apiVersion": "abac.authorization.kubernetes.io/v1beta1",
    "kind": "Policy",
    "spec": {
        "user": "bob",

Response:
        "namespace": "projectCaribou",
        "resource": "pods",
        "readonly": true
    }
}

Context: 8.8 - Controlling Access to the Kubernetes API | If Bob makes the following request, the request is authorized because he is allowed to read objects in the projectCaribou namespace:


Prompt:
Explain this json code:

{
    "apiVersion": "abac.authorization.kubernetes.io/v1beta1",
    "kind": "Policy",
    "spec": {
        "user": "bob",
        "namespace": "projectCaribou",
        "resource": "pods",
        "readonly": true
    }
}

Response: This json code 8.8 - Controlling Access to the Kubernetes API | If Bob makes the following request, the request is authorized because he is allowed to read objects in the projectCaribou namespace:


Prompt:
Complete this json code:

{
  "apiVersion": "authorization.k8s.io/v1beta1",
  "kind": "SubjectAccessReview",
  "spec": {
    "resourceAttributes": {
      "namespace": "projectCaribou",

Response:
      "verb": "get",
      "group": "unicorn.example.org",
      "resource": "pods"
    }
  }
}

Context: 8.8 - Controlling Access to the Kubernetes API | If Bob makes a request to write (create or update) to the objects in the projectCaribou namespace, his authorization is denied. If Bob makes a request to read (get) objects in a different namespace su


Prompt:
Explain this json code:

{
  "apiVersion": "authorization.k8s.io/v1beta1",
  "kind": "SubjectAccessReview",
  "spec": {
    "resourceAttributes": {
      "namespace": "projectCaribou",
      "verb": "get",
      "group": "unicorn.example.org",
      "resource": "pods"
    }
  }
}

Response: This json code 8.8 - Controlling Access to the Kubernetes API | If Bob makes a request to write (create or update) to the objects in the projectCaribou namespace, his authorization is denied. If Bob makes a request to read (get) objects in a different namespace su


Prompt:
Complete this yaml code:

apiVersion: kubescheduler.config.k8s.io/v1
kind: KubeSchedulerConfiguration
profiles:
  - schedulerName: my-scheduler
    plugins:
      # Disable specific plugins for different extension points
      # You can disable all plugins for an extension point using "*"
      queueSort:
        disabled:

Response:
        - name: "*"             # Disable all queueSort plugins
      # - name: "PrioritySort"  # Disable specific queueSort plugin
      filter:
        disabled:
        - name: "*"                 # Disable all filter plugins
      # - name: "NodeResourcesFit"  # Disable specific filter plugin
      permit:
        disabled:
        - name: "*"               # Disables all permit plugins
      # - name: "TaintToleration" # Disable specific permit plugin

Context: 8.13 - Hardening Guide - Scheduler Configuration | This creates a scheduler profile my-custom-scheduler. Whenever the .spec of a Pod does not have a value for .spec.schedulerName, the kube-scheduler runs for that Pod, using its main configuration, and


Prompt:
Explain this yaml code:

apiVersion: kubescheduler.config.k8s.io/v1
kind: KubeSchedulerConfiguration
profiles:
  - schedulerName: my-scheduler
    plugins:
      # Disable specific plugins for different extension points
      # You can disable all plugins for an extension point using "*"
      queueSort:
        disabled:
        - name: "*"             # Disable all queueSort plugins
      # - name: "PrioritySort"  # Disable specific queueSort plugin
      filter:
        disabled:
        - name: "*"                 # Disable all filter plugins
      # - name: "NodeResourcesFit"  # Disable specific filter plugin
      permit:
        disabled:
        - name: "*"               # Disables all permit plugins
      # - name: "TaintToleration" # Disable specific permit plugin

Response: This yaml code 8.13 - Hardening Guide - Scheduler Configuration | This creates a scheduler profile my-custom-scheduler. Whenever the .spec of a Pod does not have a value for .spec.schedulerName, the kube-scheduler runs for that Pod, using its main configuration, and


Prompt:
Explain this text code:

concepts/policy/limit-range/problematic-limit-range.yaml

Response: This text code 9.1 - Limit Ranges | along with a Pod that declares a CPU resource request of 700m, but not a limit:

Context: 9.1 - Limit Ranges | along with a Pod that declares a CPU resource request of 700m, but not a limit:


Prompt:
Complete this yaml code:

apiVersion: v1
kind: LimitRange
metadata:
  name: cpu-resource-constraint
spec:
  limits:
  - default: # this section defines default limits

Response:
      cpu: 500m
    defaultRequest: # this section defines default requests
      cpu: 500m
    max: # max and min define the limit range
      cpu: "1"
    min:
      cpu: 100m
    type: Container


Prompt:
Explain this yaml code:

apiVersion: v1
kind: LimitRange
metadata:
  name: cpu-resource-constraint
spec:
  limits:
  - default: # this section defines default limits
      cpu: 500m
    defaultRequest: # this section defines default requests
      cpu: 500m
    max: # max and min define the limit range
      cpu: "1"
    min:
      cpu: 100m
    type: Container

Response: This yaml code 9.1 - Limit Ranges | along with a Pod that declares a CPU resource request of 700m, but not a limit:


Prompt:
Explain this text code:

concepts/policy/limit-range/example-conflict-with-limitrange-cpu.yaml

Response: This text code 9.1 - Limit Ranges | then that Pod will not be scheduled, failing with an error similar to:

Context: 9.1 - Limit Ranges | then that Pod will not be scheduled, failing with an error similar to:


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: example-conflict-with-limitrange-cpu
spec:

Response:
  containers:
  - name: demo
    image: registry.k8s.io/pause:3.8
    resources:
      requests:
        cpu: 700m


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: example-conflict-with-limitrange-cpu
spec:
  containers:
  - name: demo
    image: registry.k8s.io/pause:3.8
    resources:
      requests:
        cpu: 700m

Response: This yaml code 9.1 - Limit Ranges | then that Pod will not be scheduled, failing with an error similar to:


Prompt:
Explain this text code:

Pod "example-conflict-with-limitrange-cpu" is invalid: spec.containers[0].resources.requests: Invalid value: "700m": must be less than or equal to cpu limit

Response: This text code 9.1 - Limit Ranges | If you set both request and limit, then that new Pod will be scheduled successfully even with the same LimitRange in place:

Context: 9.1 - Limit Ranges | If you set both request and limit, then that new Pod will be scheduled successfully even with the same LimitRange in place:


Prompt:
Explain this text code:

concepts/policy/limit-range/example-no-conflict-with-limitrange-cpu.yaml

Response: This text code 9.1 - Limit Ranges | Examples of policies that could be created using LimitRange are:

Context: 9.1 - Limit Ranges | Examples of policies that could be created using LimitRange are:


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: example-no-conflict-with-limitrange-cpu
spec:
  containers:

Response:
  - name: demo
    image: registry.k8s.io/pause:3.8
    resources:
      requests:
        cpu: 700m
      limits:
        cpu: 700m


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: example-no-conflict-with-limitrange-cpu
spec:
  containers:
  - name: demo
    image: registry.k8s.io/pause:3.8
    resources:
      requests:
        cpu: 700m
      limits:
        cpu: 700m

Response: This yaml code 9.1 - Limit Ranges | Examples of policies that could be created using LimitRange are:


Prompt:
Explain this text code:

<storage-class-name>.storageclass.storage.k8s.io/requests.storage

Response: This text code 9.2 - Resource Quotas | For example, if you want to quota storage with gold StorageClass separate from a bronze StorageClass, you can define a quota as follows:

Context: 9.2 - Resource Quotas | For example, if you want to quota storage with gold StorageClass separate from a bronze StorageClass, you can define a quota as follows:


Prompt:
Explain this text code:

<storage-class-name>.storageclass.storage.k8s.io/persistentvolumeclaims

Response: This text code 9.2 - Resource Quotas | For example, if you want to quota storage with gold StorageClass separate from a bronze StorageClass, you can define a quota as follows:


Prompt:
Explain this text code:

gold.storageclass.storage.k8s.io/requests.storage: 500Gi

Response: This text code 9.2 - Resource Quotas | When using a CRI container runtime, container logs will count against the ephemeral storage quota. This can result in the unexpected eviction of pods that have exhausted their storage quotas.

Context: 9.2 - Resource Quotas | When using a CRI container runtime, container logs will count against the ephemeral storage quota. This can result in the unexpected eviction of pods that have exhausted their storage quotas.


Prompt:
Explain this text code:

bronze.storageclass.storage.k8s.io/requests.storage: 100Gi

Response: This text code 9.2 - Resource Quotas | When using a CRI container runtime, container logs will count against the ephemeral storage quota. This can result in the unexpected eviction of pods that have exhausted their storage quotas.


Prompt:
Complete this yaml code:

scopeSelector:
    matchExpressions:
      - scopeName: PriorityClass

Response:
        operator: In
        values:
          - middle

Context: 9.2 - Resource Quotas | If the operator is Exists or DoesNotExist, the values field must NOT be specified.


Prompt:
Explain this yaml code:

scopeSelector:
    matchExpressions:
      - scopeName: PriorityClass
        operator: In
        values:
          - middle

Response: This yaml code 9.2 - Resource Quotas | If the operator is Exists or DoesNotExist, the values field must NOT be specified.


Prompt:
Complete this yaml code:

apiVersion: v1
kind: List
items:
- apiVersion: v1
  kind: ResourceQuota
  metadata:
    name: pods-high
  spec:
    hard:
      cpu: "1000"
      memory: "200Gi"
      pods: "10"
    scopeSelector:
      matchExpressions:
      - operator: In
        scopeName: PriorityClass
        values: ["high"]
- apiVersion: v1
  kind: ResourceQuota
  metadata:
    name: pods-medium
  spec:

Response:
    hard:
      cpu: "10"
      memory: "20Gi"
      pods: "10"
    scopeSelector:
      matchExpressions:
      - operator: In
        scopeName: PriorityClass
        values: ["medium"]
- apiVersion: v1
  kind: ResourceQuota
  metadata:
    name: pods-low
  spec:
    hard:
      cpu: "5"
      memory: "10Gi"
      pods: "10"
    scopeSelector:
      matchExpressions:
      - operator: In
        scopeName: PriorityClass
        values: ["low"]

Context: 9.2 - Resource Quotas | Apply the YAML using kubectl create.


Prompt:
Explain this yaml code:

apiVersion: v1
kind: List
items:
- apiVersion: v1
  kind: ResourceQuota
  metadata:
    name: pods-high
  spec:
    hard:
      cpu: "1000"
      memory: "200Gi"
      pods: "10"
    scopeSelector:
      matchExpressions:
      - operator: In
        scopeName: PriorityClass
        values: ["high"]
- apiVersion: v1
  kind: ResourceQuota
  metadata:
    name: pods-medium
  spec:
    hard:
      cpu: "10"
      memory: "20Gi"
      pods: "10"
    scopeSelector:
      matchExpressions:
      - operator: In
        scopeName: PriorityClass
        values: ["medium"]
- apiVersion: v1
  kind: ResourceQuota
  metadata:
    name: pods-low
  spec:
    hard:
      cpu: "5"
      memory: "10Gi"
      pods: "10"
    scopeSelector:
      matchExpressions:
      - operator: In
        scopeName: PriorityClass
        values: ["low"]

Response: This yaml code 9.2 - Resource Quotas | Apply the YAML using kubectl create.


Prompt:
Explain this text code:

resourcequota/pods-high created
resourcequota/pods-medium created
resourcequota/pods-low created

Response: This text code 9.2 - Resource Quotas | Verify that Used quota is 0 using kubectl describe quota.

Context: 9.2 - Resource Quotas | Verify that Used quota is 0 using kubectl describe quota.


Prompt:
Complete this text code:

Name:       pods-high
Namespace:  default
Resource    Used  Hard
--------    ----  ----
cpu         0     1k
memory      0     200Gi
pods        0     10

Name:       pods-low
Namespace:  default
Resource    Used  Hard

Response:
--------    ----  ----
cpu         0     5
memory      0     10Gi
pods        0     10

Name:       pods-medium
Namespace:  default
Resource    Used  Hard
--------    ----  ----
cpu         0     10
memory      0     20Gi
pods        0     10

Context: 9.2 - Resource Quotas | Create a pod with priority "high". Save the following YAML to a file high-priority-pod.yaml.


Prompt:
Explain this text code:

Name:       pods-high
Namespace:  default
Resource    Used  Hard
--------    ----  ----
cpu         0     1k
memory      0     200Gi
pods        0     10

Name:       pods-low
Namespace:  default
Resource    Used  Hard
--------    ----  ----
cpu         0     5
memory      0     10Gi
pods        0     10

Name:       pods-medium
Namespace:  default
Resource    Used  Hard
--------    ----  ----
cpu         0     10
memory      0     20Gi
pods        0     10

Response: This text code 9.2 - Resource Quotas | Create a pod with priority "high". Save the following YAML to a file high-priority-pod.yaml.


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: high-priority
spec:
  containers:
  - name: high-priority
    image: ubuntu
    command: ["/bin/sh"]

Response:
    args: ["-c", "while true; do echo hello; sleep 10;done"]
    resources:
      requests:
        memory: "10Gi"
        cpu: "500m"
      limits:
        memory: "10Gi"
        cpu: "500m"
  priorityClassName: high

Context: 9.2 - Resource Quotas | Apply it with kubectl create.


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: high-priority
spec:
  containers:
  - name: high-priority
    image: ubuntu
    command: ["/bin/sh"]
    args: ["-c", "while true; do echo hello; sleep 10;done"]
    resources:
      requests:
        memory: "10Gi"
        cpu: "500m"
      limits:
        memory: "10Gi"
        cpu: "500m"
  priorityClassName: high

Response: This yaml code 9.2 - Resource Quotas | Apply it with kubectl create.


Prompt:
Complete this text code:

Name:       pods-high
Namespace:  default
Resource    Used  Hard
--------    ----  ----
cpu         500m  1k
memory      10Gi  200Gi
pods        1     10

Name:       pods-low
Namespace:  default
Resource    Used  Hard

Response:
--------    ----  ----
cpu         0     5
memory      0     10Gi
pods        0     10

Name:       pods-medium
Namespace:  default
Resource    Used  Hard
--------    ----  ----
cpu         0     10
memory      0     20Gi
pods        0     10

Context: 9.2 - Resource Quotas | Operators can use CrossNamespacePodAffinity quota scope to limit which namespaces are allowed to have pods with affinity terms that cross namespaces. Specifically, it controls which pods are allowed t


Prompt:
Explain this text code:

Name:       pods-high
Namespace:  default
Resource    Used  Hard
--------    ----  ----
cpu         500m  1k
memory      10Gi  200Gi
pods        1     10

Name:       pods-low
Namespace:  default
Resource    Used  Hard
--------    ----  ----
cpu         0     5
memory      0     10Gi
pods        0     10

Name:       pods-medium
Namespace:  default
Resource    Used  Hard
--------    ----  ----
cpu         0     10
memory      0     20Gi
pods        0     10

Response: This text code 9.2 - Resource Quotas | Operators can use CrossNamespacePodAffinity quota scope to limit which namespaces are allowed to have pods with affinity terms that cross namespaces. Specifically, it controls which pods are allowed t


Prompt:
Complete this yaml code:

apiVersion: v1
kind: ResourceQuota
metadata:
  name: disable-cross-namespace-affinity
  namespace: foo-ns
spec:

Response:
  hard:
    pods: "0"
  scopeSelector:
    matchExpressions:
    - scopeName: CrossNamespacePodAffinity
      operator: Exists

Context: 9.2 - Resource Quotas | If operators want to disallow using namespaces and namespaceSelector by default, and only allow it for specific namespaces, they could configure CrossNamespacePodAffinity as a limited resource by sett


Prompt:
Explain this yaml code:

apiVersion: v1
kind: ResourceQuota
metadata:
  name: disable-cross-namespace-affinity
  namespace: foo-ns
spec:
  hard:
    pods: "0"
  scopeSelector:
    matchExpressions:
    - scopeName: CrossNamespacePodAffinity
      operator: Exists

Response: This yaml code 9.2 - Resource Quotas | If operators want to disallow using namespaces and namespaceSelector by default, and only allow it for specific namespaces, they could configure CrossNamespacePodAffinity as a limited resource by sett


Prompt:
Complete this yaml code:

apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: "ResourceQuota"
  configuration:
    apiVersion: apiserver.config.k8s.io/v1

Response:
    kind: ResourceQuotaConfiguration
    limitedResources:
    - resource: pods
      matchScopes:
      - scopeName: CrossNamespacePodAffinity
        operator: Exists

Context: 9.2 - Resource Quotas | With the above configuration, pods can use namespaces and namespaceSelector in pod affinity only if the namespace where they are created have a resource quota object with CrossNamespacePodAffinity sco


Prompt:
Explain this yaml code:

apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: "ResourceQuota"
  configuration:
    apiVersion: apiserver.config.k8s.io/v1
    kind: ResourceQuotaConfiguration
    limitedResources:
    - resource: pods
      matchScopes:
      - scopeName: CrossNamespacePodAffinity
        operator: Exists

Response: This yaml code 9.2 - Resource Quotas | With the above configuration, pods can use namespaces and namespaceSelector in pod affinity only if the namespace where they are created have a resource quota object with CrossNamespacePodAffinity sco


Prompt:
Explain this text code:

status.modifyVolumeStatus.targetVolumeAttributesClassName

Response: This text code 9.2 - Resource Quotas | A quota is matched and consumed only if scopeSelector in the quota spec selects the PVC.

Context: 9.2 - Resource Quotas | A quota is matched and consumed only if scopeSelector in the quota spec selects the PVC.


Prompt:
Complete this yaml code:

apiVersion: v1
kind: List
items:
- apiVersion: v1
  kind: ResourceQuota
  metadata:
    name: pvcs-gold
  spec:
    hard:
      requests.storage: "10Gi"
      persistentvolumeclaims: "10"
    scopeSelector:
      matchExpressions:
      - operator: In
        scopeName: VolumeAttributesClass
        values: ["gold"]
- apiVersion: v1
  kind: ResourceQuota
  metadata:
    name: pvcs-silver
  spec:

Response:
    hard:
      requests.storage: "20Gi"
      persistentvolumeclaims: "10"
    scopeSelector:
      matchExpressions:
      - operator: In
        scopeName: VolumeAttributesClass
        values: ["silver"]
- apiVersion: v1
  kind: ResourceQuota
  metadata:
    name: pvcs-copper
  spec:
    hard:
      requests.storage: "30Gi"
      persistentvolumeclaims: "10"
    scopeSelector:
      matchExpressions:
      - operator: In
        scopeName: VolumeAttributesClass
        values: ["copper"]


Prompt:
Explain this yaml code:

apiVersion: v1
kind: List
items:
- apiVersion: v1
  kind: ResourceQuota
  metadata:
    name: pvcs-gold
  spec:
    hard:
      requests.storage: "10Gi"
      persistentvolumeclaims: "10"
    scopeSelector:
      matchExpressions:
      - operator: In
        scopeName: VolumeAttributesClass
        values: ["gold"]
- apiVersion: v1
  kind: ResourceQuota
  metadata:
    name: pvcs-silver
  spec:
    hard:
      requests.storage: "20Gi"
      persistentvolumeclaims: "10"
    scopeSelector:
      matchExpressions:
      - operator: In
        scopeName: VolumeAttributesClass
        values: ["silver"]
- apiVersion: v1
  kind: ResourceQuota
  metadata:
    name: pvcs-copper
  spec:
    hard:
      requests.storage: "30Gi"
      persistentvolumeclaims: "10"
    scopeSelector:
      matchExpressions:
      - operator: In
        scopeName: VolumeAttributesClass
        values: ["copper"]

Response: This yaml code 9.2 - Resource Quotas | Apply the YAML using kubectl create.


Prompt:
Explain this text code:

resourcequota/pvcs-gold created
resourcequota/pvcs-silver created
resourcequota/pvcs-copper created

Response: This text code 9.2 - Resource Quotas | Verify that Used quota is 0 using kubectl describe quota.


Prompt:
Complete this text code:

Name:                   pvcs-gold
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  0     10
requests.storage        0     10Gi

Name:                   pvcs-silver
Namespace:              default
Resource                Used  Hard

Response:
--------                ----  ----
persistentvolumeclaims  0     10
requests.storage        0     20Gi

Name:                   pvcs-copper
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  0     10
requests.storage        0     30Gi

Context: 9.2 - Resource Quotas | Create a pvc with volume attributes class "gold". Save the following YAML to a file gold-vac-pvc.yaml.


Prompt:
Explain this text code:

Name:                   pvcs-gold
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  0     10
requests.storage        0     10Gi

Name:                   pvcs-silver
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  0     10
requests.storage        0     20Gi

Name:                   pvcs-copper
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  0     10
requests.storage        0     30Gi

Response: This text code 9.2 - Resource Quotas | Create a pvc with volume attributes class "gold". Save the following YAML to a file gold-vac-pvc.yaml.


Prompt:
Complete this yaml code:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: gold-vac-pvc
spec:
  accessModes:

Response:
    - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi
  storageClassName:  # change this to the name of the storage class you want to use
  volumeAttributesClassName: gold


Prompt:
Explain this yaml code:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: gold-vac-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi
  storageClassName:  # change this to the name of the storage class you want to use
  volumeAttributesClassName: gold

Response: This yaml code 9.2 - Resource Quotas | Apply it with kubectl create.


Prompt:
Complete this text code:

Name:                   pvcs-gold
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  1     10
requests.storage        2Gi   10Gi

Name:                   pvcs-silver
Namespace:              default
Resource                Used  Hard

Response:
--------                ----  ----
persistentvolumeclaims  0     10
requests.storage        0     20Gi

Name:                   pvcs-copper
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  0     10
requests.storage        0     30Gi

Context: 9.2 - Resource Quotas | Once the PVC is bound, it is allowed to modify the desired volume attributes class. Let's change it to "silver" with kubectl patch.


Prompt:
Explain this text code:

Name:                   pvcs-gold
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  1     10
requests.storage        2Gi   10Gi

Name:                   pvcs-silver
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  0     10
requests.storage        0     20Gi

Name:                   pvcs-copper
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  0     10
requests.storage        0     30Gi

Response: This text code 9.2 - Resource Quotas | Once the PVC is bound, it is allowed to modify the desired volume attributes class. Let's change it to "silver" with kubectl patch.


Prompt:
Explain this shell code:

kubectl patch pvc gold-vac-pvc --type='merge' -p '{"spec":{"volumeAttributesClassName":"silver"}}'

Response: This shell code 9.2 - Resource Quotas | Verify that "Used" stats for "silver" volume attributes class quota, pvcs-silver has changed, pvcs-copper is unchanged, and pvcs-gold might be unchanged or released, which depends on the PVC's status.

Context: 9.2 - Resource Quotas | Verify that "Used" stats for "silver" volume attributes class quota, pvcs-silver has changed, pvcs-copper is unchanged, and pvcs-gold might be unchanged or released, which depends on the PVC's status.


Prompt:
Complete this text code:

Name:                   pvcs-gold
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  1     10
requests.storage        2Gi   10Gi

Name:                   pvcs-silver
Namespace:              default
Resource                Used  Hard

Response:
--------                ----  ----
persistentvolumeclaims  1     10
requests.storage        2Gi   20Gi

Name:                   pvcs-copper
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  0     10
requests.storage        0     30Gi

Context: 9.2 - Resource Quotas | Let's change it to "copper" with kubectl patch.


Prompt:
Explain this text code:

Name:                   pvcs-gold
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  1     10
requests.storage        2Gi   10Gi

Name:                   pvcs-silver
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  1     10
requests.storage        2Gi   20Gi

Name:                   pvcs-copper
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  0     10
requests.storage        0     30Gi

Response: This text code 9.2 - Resource Quotas | Let's change it to "copper" with kubectl patch.


Prompt:
Explain this shell code:

kubectl patch pvc gold-vac-pvc --type='merge' -p '{"spec":{"volumeAttributesClassName":"copper"}}'

Response: This shell code 9.2 - Resource Quotas | Verify that "Used" stats for "copper" volume attributes class quota, pvcs-copper has changed, pvcs-silver and pvcs-gold might be unchanged or released, which depends on the PVC's status.

Context: 9.2 - Resource Quotas | Verify that "Used" stats for "copper" volume attributes class quota, pvcs-copper has changed, pvcs-silver and pvcs-gold might be unchanged or released, which depends on the PVC's status.


Prompt:
Complete this text code:

Name:                   pvcs-gold
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  1     10
requests.storage        2Gi   10Gi

Name:                   pvcs-silver
Namespace:              default
Resource                Used  Hard

Response:
--------                ----  ----
persistentvolumeclaims  1     10
requests.storage        2Gi   20Gi

Name:                   pvcs-copper
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  1     10
requests.storage        2Gi   30Gi

Context: 9.2 - Resource Quotas | Print the manifest of the PVC using the following command:


Prompt:
Explain this text code:

Name:                   pvcs-gold
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  1     10
requests.storage        2Gi   10Gi

Name:                   pvcs-silver
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  1     10
requests.storage        2Gi   20Gi

Name:                   pvcs-copper
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  1     10
requests.storage        2Gi   30Gi

Response: This text code 9.2 - Resource Quotas | Print the manifest of the PVC using the following command:


Prompt:
Complete this yaml code:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: gold-vac-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi
  storageClassName: default

Response:
  volumeAttributesClassName: copper
status:
  accessModes:
    - ReadWriteOnce
  capacity:
    storage: 2Gi
  currentVolumeAttributesClassName: gold
  phase: Bound
  modifyVolumeStatus:
    status: InProgress
    targetVolumeAttributesClassName: silver
  storageClassName: default

Context: 9.2 - Resource Quotas | Wait a moment for the volume modification to complete, then verify the quota again.


Prompt:
Explain this yaml code:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: gold-vac-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi
  storageClassName: default
  volumeAttributesClassName: copper
status:
  accessModes:
    - ReadWriteOnce
  capacity:
    storage: 2Gi
  currentVolumeAttributesClassName: gold
  phase: Bound
  modifyVolumeStatus:
    status: InProgress
    targetVolumeAttributesClassName: silver
  storageClassName: default

Response: This yaml code 9.2 - Resource Quotas | Wait a moment for the volume modification to complete, then verify the quota again.


Prompt:
Complete this text code:

Name:                   pvcs-gold
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  0     10
requests.storage        0     10Gi

Name:                   pvcs-silver
Namespace:              default
Resource                Used  Hard

Response:
--------                ----  ----
persistentvolumeclaims  0     10
requests.storage        0     20Gi

Name:                   pvcs-copper
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  1     10
requests.storage        2Gi   30Gi

Context: 9.2 - Resource Quotas | When allocating compute resources, each container may specify a request and a limit value for either CPU or memory. The quota can be configured to quota either value.


Prompt:
Explain this text code:

Name:                   pvcs-gold
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  0     10
requests.storage        0     10Gi

Name:                   pvcs-silver
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  0     10
requests.storage        0     20Gi

Name:                   pvcs-copper
Namespace:              default
Resource                Used  Hard
--------                ----  ----
persistentvolumeclaims  1     10
requests.storage        2Gi   30Gi

Response: This text code 9.2 - Resource Quotas | When allocating compute resources, each container may specify a request and a limit value for either CPU or memory. The quota can be configured to quota either value.


Prompt:
Complete this shell code:

cat <<EOF > compute-resources.yaml
apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-resources
spec:

Response:
  hard:
    requests.cpu: "1"
    requests.memory: "1Gi"
    limits.cpu: "2"
    limits.memory: "2Gi"
    requests.nvidia.com/gpu: 4
EOF

Context: 9.2 - Resource Quotas | kubectl also supports object count quota for all standard namespaced resources using the syntax count/<resource>.<group>:


Prompt:
Explain this shell code:

cat <<EOF > compute-resources.yaml
apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-resources
spec:
  hard:
    requests.cpu: "1"
    requests.memory: "1Gi"
    limits.cpu: "2"
    limits.memory: "2Gi"
    requests.nvidia.com/gpu: 4
EOF

Response: This shell code 9.2 - Resource Quotas | kubectl also supports object count quota for all standard namespaced resources using the syntax count/<resource>.<group>:


Prompt:
Explain this shell code:

kubectl create -f ./compute-resources.yaml --namespace=myspace

Response: This shell code 9.2 - Resource Quotas | kubectl also supports object count quota for all standard namespaced resources using the syntax count/<resource>.<group>:


Prompt:
Complete this shell code:

cat <<EOF > object-counts.yaml
apiVersion: v1
kind: ResourceQuota
metadata:
  name: object-counts
spec:
  hard:

Response:
    configmaps: "10"
    persistentvolumeclaims: "4"
    pods: "4"
    replicationcontrollers: "20"
    secrets: "10"
    services: "10"
    services.loadbalancers: "2"
EOF


Prompt:
Explain this shell code:

cat <<EOF > object-counts.yaml
apiVersion: v1
kind: ResourceQuota
metadata:
  name: object-counts
spec:
  hard:
    configmaps: "10"
    persistentvolumeclaims: "4"
    pods: "4"
    replicationcontrollers: "20"
    secrets: "10"
    services: "10"
    services.loadbalancers: "2"
EOF

Response: This shell code 9.2 - Resource Quotas | kubectl also supports object count quota for all standard namespaced resources using the syntax count/<resource>.<group>:


Prompt:
Explain this shell code:

kubectl create -f ./object-counts.yaml --namespace=myspace

Response: This shell code 9.2 - Resource Quotas | kubectl also supports object count quota for all standard namespaced resources using the syntax count/<resource>.<group>:


Prompt:
Explain this none code:

NAME                    AGE
compute-resources       30s
object-counts           32s

Response: This none code 9.2 - Resource Quotas | kubectl also supports object count quota for all standard namespaced resources using the syntax count/<resource>.<group>:


Prompt:
Explain this shell code:

kubectl describe quota compute-resources --namespace=myspace

Response: This shell code 9.2 - Resource Quotas | kubectl also supports object count quota for all standard namespaced resources using the syntax count/<resource>.<group>:


Prompt:
Complete this none code:

Name:                    compute-resources
Namespace:               myspace
Resource                 Used  Hard
--------                 ----  ----

Response:
limits.cpu               0     2
limits.memory            0     2Gi
requests.cpu             0     1
requests.memory          0     1Gi
requests.nvidia.com/gpu  0     4


Prompt:
Explain this none code:

Name:                    compute-resources
Namespace:               myspace
Resource                 Used  Hard
--------                 ----  ----
limits.cpu               0     2
limits.memory            0     2Gi
requests.cpu             0     1
requests.memory          0     1Gi
requests.nvidia.com/gpu  0     4

Response: This none code 9.2 - Resource Quotas | kubectl also supports object count quota for all standard namespaced resources using the syntax count/<resource>.<group>:


Prompt:
Explain this shell code:

kubectl describe quota object-counts --namespace=myspace

Response: This shell code 9.2 - Resource Quotas | kubectl also supports object count quota for all standard namespaced resources using the syntax count/<resource>.<group>:


Prompt:
Complete this none code:

Name:                   object-counts
Namespace:              myspace
Resource                Used    Hard
--------                ----    ----
configmaps              0       10

Response:
persistentvolumeclaims  0       4
pods                    0       4
replicationcontrollers  0       20
secrets                 1       10
services                0       10
services.loadbalancers  0       2


Prompt:
Explain this none code:

Name:                   object-counts
Namespace:              myspace
Resource                Used    Hard
--------                ----    ----
configmaps              0       10
persistentvolumeclaims  0       4
pods                    0       4
replicationcontrollers  0       20
secrets                 1       10
services                0       10
services.loadbalancers  0       2

Response: This none code 9.2 - Resource Quotas | kubectl also supports object count quota for all standard namespaced resources using the syntax count/<resource>.<group>:


Prompt:
Explain this shell code:

kubectl create quota test --hard=count/deployments.apps=2,count/replicasets.apps=4,count/pods=3,count/secrets=4 --namespace=myspace

Response: This shell code 9.2 - Resource Quotas | ResourceQuotas are independent of the cluster capacity. They are expressed in absolute units. So, if you add nodes to your cluster, this does not automatically give each namespace the ability to consu

Context: 9.2 - Resource Quotas | ResourceQuotas are independent of the cluster capacity. They are expressed in absolute units. So, if you add nodes to your cluster, this does not automatically give each namespace the ability to consu


Prompt:
Explain this shell code:

kubectl create deployment nginx --image=nginx --namespace=myspace --replicas=2

Response: This shell code 9.2 - Resource Quotas | ResourceQuotas are independent of the cluster capacity. They are expressed in absolute units. So, if you add nodes to your cluster, this does not automatically give each namespace the ability to consu


Prompt:
Complete this text code:

Name:                         test
Namespace:                    myspace
Resource                      Used  Hard
--------                      ----  ----

Response:
count/deployments.apps        1     2
count/pods                    2     3
count/replicasets.apps        1     4
count/secrets                 1     4


Prompt:
Explain this text code:

Name:                         test
Namespace:                    myspace
Resource                      Used  Hard
--------                      ----  ----
count/deployments.apps        1     2
count/pods                    2     3
count/replicasets.apps        1     4
count/secrets                 1     4

Response: This text code 9.2 - Resource Quotas | ResourceQuotas are independent of the cluster capacity. They are expressed in absolute units. So, if you add nodes to your cluster, this does not automatically give each namespace the ability to consu


Prompt:
Complete this yaml code:

apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: "ResourceQuota"
  configuration:
    apiVersion: apiserver.config.k8s.io/v1

Response:
    kind: ResourceQuotaConfiguration
    limitedResources:
    - resource: pods
      matchScopes:
      - scopeName: PriorityClass
        operator: In
        values: ["cluster-services"]

Context: 9.2 - Resource Quotas | Then, create a resource quota object in the kube-system namespace:


Prompt:
Explain this yaml code:

apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- name: "ResourceQuota"
  configuration:
    apiVersion: apiserver.config.k8s.io/v1
    kind: ResourceQuotaConfiguration
    limitedResources:
    - resource: pods
      matchScopes:
      - scopeName: PriorityClass
        operator: In
        values: ["cluster-services"]

Response: This yaml code 9.2 - Resource Quotas | Then, create a resource quota object in the kube-system namespace:


Prompt:
Complete this yaml code:

apiVersion: v1
kind: ResourceQuota
metadata:
  name: pods-cluster-services
spec:

Response:
  scopeSelector:
    matchExpressions:
      - operator : In
        scopeName: PriorityClass
        values: ["cluster-services"]

Context: 9.2 - Resource Quotas | In this case, a pod creation will be allowed if:


Prompt:
Explain this yaml code:

apiVersion: v1
kind: ResourceQuota
metadata:
  name: pods-cluster-services
spec:
  scopeSelector:
    matchExpressions:
      - operator : In
        scopeName: PriorityClass
        values: ["cluster-services"]

Response: This yaml code 9.2 - Resource Quotas | In this case, a pod creation will be allowed if:


Prompt:
Explain this shell code:

kubectl apply -f https://k8s.io/examples/policy/priority-class-resourcequota.yaml -n kube-system

Response: This shell code 9.2 - Resource Quotas | In this case, a pod creation will be allowed if:


Prompt:
Complete this yaml code:

spec:
  containers:

Response:
  - name: nginx
    image: nginx

Context: 9.4 - Node Resource Managers | The pod above runs in the BestEffort QoS class because no resource requests or limits are specified. It runs in the shared pool.


Prompt:
Explain this yaml code:

spec:
  containers:
  - name: nginx
    image: nginx

Response: This yaml code 9.4 - Node Resource Managers | The pod above runs in the BestEffort QoS class because no resource requests or limits are specified. It runs in the shared pool.


Prompt:
Complete this yaml code:

spec:
  containers:
  - name: nginx
    image: nginx

Response:
    resources:
      limits:
        memory: "200Mi"
      requests:
        memory: "100Mi"

Context: 9.4 - Node Resource Managers | The pod above runs in the Burstable QoS class because resource requests do not equal limits and the cpu quantity is not specified. It runs in the shared pool.


Prompt:
Explain this yaml code:

spec:
  containers:
  - name: nginx
    image: nginx
    resources:
      limits:
        memory: "200Mi"
      requests:
        memory: "100Mi"

Response: This yaml code 9.4 - Node Resource Managers | The pod above runs in the Burstable QoS class because resource requests do not equal limits and the cpu quantity is not specified. It runs in the shared pool.


Prompt:
Complete this yaml code:

spec:
  containers:
  - name: nginx
    image: nginx
    resources:

Response:
      limits:
        memory: "200Mi"
        cpu: "2"
      requests:
        memory: "100Mi"
        cpu: "1"

Context: 9.4 - Node Resource Managers | The pod above runs in the Burstable QoS class because resource requests do not equal limits. It runs in the shared pool.


Prompt:
Explain this yaml code:

spec:
  containers:
  - name: nginx
    image: nginx
    resources:
      limits:
        memory: "200Mi"
        cpu: "2"
      requests:
        memory: "100Mi"
        cpu: "1"

Response: This yaml code 9.4 - Node Resource Managers | The pod above runs in the Burstable QoS class because resource requests do not equal limits. It runs in the shared pool.


Prompt:
Complete this yaml code:

spec:
  containers:
  - name: nginx
    image: nginx
    resources:

Response:
      limits:
        memory: "200Mi"
        cpu: "2"
      requests:
        memory: "200Mi"
        cpu: "2"

Context: 9.4 - Node Resource Managers | The pod above runs in the Guaranteed QoS class because requests are equal to limits. And the container's resource limit for the CPU resource is an integer greater than or equal to one. The nginx conta


Prompt:
Explain this yaml code:

spec:
  containers:
  - name: nginx
    image: nginx
    resources:
      limits:
        memory: "200Mi"
        cpu: "2"
      requests:
        memory: "200Mi"
        cpu: "2"

Response: This yaml code 9.4 - Node Resource Managers | The pod above runs in the Guaranteed QoS class because requests are equal to limits. And the container's resource limit for the CPU resource is an integer greater than or equal to one. The nginx conta


Prompt:
Complete this yaml code:

spec:
  containers:
  - name: nginx
    image: nginx
    resources:

Response:
      limits:
        memory: "200Mi"
        cpu: "1.5"
      requests:
        memory: "200Mi"
        cpu: "1.5"

Context: 9.4 - Node Resource Managers | The pod above runs in the Guaranteed QoS class because requests are equal to limits. But the container's resource limit for the CPU resource is a fraction. It runs in the shared pool.


Prompt:
Explain this yaml code:

spec:
  containers:
  - name: nginx
    image: nginx
    resources:
      limits:
        memory: "200Mi"
        cpu: "1.5"
      requests:
        memory: "200Mi"
        cpu: "1.5"

Response: This yaml code 9.4 - Node Resource Managers | The pod above runs in the Guaranteed QoS class because requests are equal to limits. But the container's resource limit for the CPU resource is a fraction. It runs in the shared pool.


Prompt:
Complete this yaml code:

spec:
  containers:
  - name: nginx
    image: nginx

Response:
    resources:
      limits:
        memory: "200Mi"
        cpu: "2"

Context: 9.4 - Node Resource Managers | The pod above runs in the Guaranteed QoS class because only limits are specified and requests are set equal to limits when not explicitly specified. And the container's resource limit for the CPU reso


Prompt:
Explain this yaml code:

spec:
  containers:
  - name: nginx
    image: nginx
    resources:
      limits:
        memory: "200Mi"
        cpu: "2"

Response: This yaml code 9.4 - Node Resource Managers | The pod above runs in the Guaranteed QoS class because only limits are specified and requests are set equal to limits when not explicitly specified. And the container's resource limit for the CPU reso


Prompt:
Explain this text code:

example.com.node-restriction.kubernetes.io/fips=true

Response: This text code 10.2 - Assigning Pods to Nodes | nodeSelector is the simplest recommended form of node selection constraint. You can add the nodeSelector field to your Pod specification and specify the node labels you want the target node to have. K

Context: 10.2 - Assigning Pods to Nodes | nodeSelector is the simplest recommended form of node selection constraint. You can add the nodeSelector field to your Pod specification and specify the node labels you want the target node to have. K


Prompt:
Explain this text code:

example.com.node-restriction.kubernetes.io/pci-dss=true

Response: This text code 10.2 - Assigning Pods to Nodes | nodeSelector is the simplest recommended form of node selection constraint. You can add the nodeSelector field to your Pod specification and specify the node labels you want the target node to have. K


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: with-node-affinity
spec:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: topology.kubernetes.io/zone
            operator: In
            values:

Response:
            - antarctica-east1
            - antarctica-west1
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 1
        preference:
          matchExpressions:
          - key: another-node-label-key
            operator: In
            values:
            - another-node-label-value
  containers:
  - name: with-node-affinity
    image: registry.k8s.io/pause:3.8

Context: 10.2 - Assigning Pods to Nodes | In this example, the following rules apply:


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: with-node-affinity
spec:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: topology.kubernetes.io/zone
            operator: In
            values:
            - antarctica-east1
            - antarctica-west1
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 1
        preference:
          matchExpressions:
          - key: another-node-label-key
            operator: In
            values:
            - another-node-label-value
  containers:
  - name: with-node-affinity
    image: registry.k8s.io/pause:3.8

Response: This yaml code 10.2 - Assigning Pods to Nodes | In this example, the following rules apply:


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: with-affinity-preferred-weight
spec:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: kubernetes.io/os
            operator: In
            values:
            - linux
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 1

Response:
        preference:
          matchExpressions:
          - key: label-1
            operator: In
            values:
            - key-1
      - weight: 50
        preference:
          matchExpressions:
          - key: label-2
            operator: In
            values:
            - key-2
  containers:
  - name: with-node-affinity
    image: registry.k8s.io/pause:3.8

Context: 10.2 - Assigning Pods to Nodes | If there are two possible nodes that match the preferredDuringSchedulingIgnoredDuringExecution rule, one with the label-1:key-1 label and another with the label-2:key-2 label, the scheduler considers


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: with-affinity-preferred-weight
spec:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: kubernetes.io/os
            operator: In
            values:
            - linux
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 1
        preference:
          matchExpressions:
          - key: label-1
            operator: In
            values:
            - key-1
      - weight: 50
        preference:
          matchExpressions:
          - key: label-2
            operator: In
            values:
            - key-2
  containers:
  - name: with-node-affinity
    image: registry.k8s.io/pause:3.8

Response: This yaml code 10.2 - Assigning Pods to Nodes | If there are two possible nodes that match the preferredDuringSchedulingIgnoredDuringExecution rule, one with the label-1:key-1 label and another with the label-2:key-2 label, the scheduler considers


Prompt:
Complete this yaml code:

apiVersion: kubescheduler.config.k8s.io/v1
kind: KubeSchedulerConfiguration

profiles:
  - schedulerName: default-scheduler
  - schedulerName: foo-scheduler
    pluginConfig:
      - name: NodeAffinity

Response:
        args:
          addedAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
              - matchExpressions:
                - key: scheduler-profile
                  operator: In
                  values:
                  - foo

Context: 10.2 - Assigning Pods to Nodes | The addedAffinity is applied to all Pods that set .spec.schedulerName to foo-scheduler, in addition to the NodeAffinity specified in the PodSpec. That is, in order to match the Pod, nodes need to sati


Prompt:
Explain this yaml code:

apiVersion: kubescheduler.config.k8s.io/v1
kind: KubeSchedulerConfiguration

profiles:
  - schedulerName: default-scheduler
  - schedulerName: foo-scheduler
    pluginConfig:
      - name: NodeAffinity
        args:
          addedAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
              - matchExpressions:
                - key: scheduler-profile
                  operator: In
                  values:
                  - foo

Response: This yaml code 10.2 - Assigning Pods to Nodes | The addedAffinity is applied to all Pods that set .spec.schedulerName to foo-scheduler, in addition to the NodeAffinity specified in the PodSpec. That is, in order to match the Pod, nodes need to sati


Prompt:
Explain this text code:

podAffinity.requiredDuringSchedulingIgnoredDuringExecution

Response: This text code 10.2 - Assigning Pods to Nodes | Soft Constraints (Scoring):

Context: 10.2 - Assigning Pods to Nodes | Soft Constraints (Scoring):


Prompt:
Explain this text code:

podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution

Response: This text code 10.2 - Assigning Pods to Nodes | Soft Constraints (Scoring):


Prompt:
Explain this text code:

podAffinity.preferredDuringSchedulingIgnoredDuringExecution

Response: This text code 10.2 - Assigning Pods to Nodes | Ignored Fields:

Context: 10.2 - Assigning Pods to Nodes | Ignored Fields:


Prompt:
Explain this text code:

podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution

Response: This text code 10.2 - Assigning Pods to Nodes | Ignored Fields:


Prompt:
Explain this text code:

podAffinity.preferredDuringSchedulingIgnoredDuringExecution

Response: This text code 10.2 - Assigning Pods to Nodes | If the current Pod being scheduled is the first in a series that have affinity to themselves, it is allowed to be scheduled if it passes all other affinity checks. This is determined by verifying that

Context: 10.2 - Assigning Pods to Nodes | If the current Pod being scheduled is the first in a series that have affinity to themselves, it is allowed to be scheduled if it passes all other affinity checks. This is determined by verifying that


Prompt:
Explain this text code:

podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution

Response: This text code 10.2 - Assigning Pods to Nodes | If the current Pod being scheduled is the first in a series that have affinity to themselves, it is allowed to be scheduled if it passes all other affinity checks. This is determined by verifying that


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: with-pod-affinity
spec:
  affinity:
    podAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchExpressions:
          - key: security
            operator: In
            values:
            - S1

Response:
        topologyKey: topology.kubernetes.io/zone
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
            - key: security
              operator: In
              values:
              - S2
          topologyKey: topology.kubernetes.io/zone
  containers:
  - name: with-pod-affinity
    image: registry.k8s.io/pause:3.8

Context: 10.2 - Assigning Pods to Nodes | This example defines one Pod affinity rule and one Pod anti-affinity rule. The Pod affinity rule uses the "hard" requiredDuringSchedulingIgnoredDuringExecution, while the anti-affinity rule uses the "


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: with-pod-affinity
spec:
  affinity:
    podAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchExpressions:
          - key: security
            operator: In
            values:
            - S1
        topologyKey: topology.kubernetes.io/zone
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
            - key: security
              operator: In
              values:
              - S2
          topologyKey: topology.kubernetes.io/zone
  containers:
  - name: with-pod-affinity
    image: registry.k8s.io/pause:3.8

Response: This yaml code 10.2 - Assigning Pods to Nodes | This example defines one Pod affinity rule and one Pod anti-affinity rule. The Pod affinity rule uses the "hard" requiredDuringSchedulingIgnoredDuringExecution, while the anti-affinity rule uses the "


Prompt:
Complete this yaml code:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: application-server
...
spec:
  template:
    spec:
      affinity:
        podAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:

Response:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - database
            topologyKey: topology.kubernetes.io/zone
            # Only Pods from a given rollout are taken into consideration when calculating pod affinity.
            # If you update the Deployment, the replacement Pods follow their own affinity rules
            # (if there are any defined in the new Pod template)
            matchLabelKeys:
            - pod-template-hash

Context: 10.2 - Assigning Pods to Nodes | The mismatchLabelKeys field is a beta-level field and is enabled by default in Kubernetes 1.34. When you want to disable it, you have to disable it explicitly via the MatchLabelKeysInPodAffinity featu


Prompt:
Explain this yaml code:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: application-server
...
spec:
  template:
    spec:
      affinity:
        podAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - database
            topologyKey: topology.kubernetes.io/zone
            # Only Pods from a given rollout are taken into consideration when calculating pod affinity.
            # If you update the Deployment, the replacement Pods follow their own affinity rules
            # (if there are any defined in the new Pod template)
            matchLabelKeys:
            - pod-template-hash

Response: This yaml code 10.2 - Assigning Pods to Nodes | The mismatchLabelKeys field is a beta-level field and is enabled by default in Kubernetes 1.34. When you want to disable it, you have to disable it explicitly via the MatchLabelKeysInPodAffinity featu


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Pod
metadata:
  labels:
    # Assume that all relevant Pods have a "tenant" label set
    tenant: tenant-a
...
spec:
  affinity:
    podAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      # ensure that Pods associated with this tenant land on the correct node pool
      - matchLabelKeys:
          - tenant
        topologyKey: node-pool

Response:
    podAntiAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      # ensure that Pods associated with this tenant can't schedule to nodes used for another tenant
      - mismatchLabelKeys:
        - tenant # whatever the value of the "tenant" label for this Pod, prevent
                 # scheduling to nodes in any pool where any Pod from a different
                 # tenant is running.
        labelSelector:
          # We have to have the labelSelector which selects only Pods with the tenant label,
          # otherwise this Pod would have anti-affinity against Pods from daemonsets as well, for example,
          # which aren't supposed to have the tenant label.
          matchExpressions:
          - key: tenant
            operator: Exists
        topologyKey: node-pool

Context: 10.2 - Assigning Pods to Nodes | Inter-pod affinity and anti-affinity can be even more useful when they are used with higher level collections such as ReplicaSets, StatefulSets, Deployments, etc. These rules allow you to configure th


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Pod
metadata:
  labels:
    # Assume that all relevant Pods have a "tenant" label set
    tenant: tenant-a
...
spec:
  affinity:
    podAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      # ensure that Pods associated with this tenant land on the correct node pool
      - matchLabelKeys:
          - tenant
        topologyKey: node-pool
    podAntiAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      # ensure that Pods associated with this tenant can't schedule to nodes used for another tenant
      - mismatchLabelKeys:
        - tenant # whatever the value of the "tenant" label for this Pod, prevent
                 # scheduling to nodes in any pool where any Pod from a different
                 # tenant is running.
        labelSelector:
          # We have to have the labelSelector which selects only Pods with the tenant label,
          # otherwise this Pod would have anti-affinity against Pods from daemonsets as well, for example,
          # which aren't supposed to have the tenant label.
          matchExpressions:
          - key: tenant
            operator: Exists
        topologyKey: node-pool

Response: This yaml code 10.2 - Assigning Pods to Nodes | Inter-pod affinity and anti-affinity can be even more useful when they are used with higher level collections such as ReplicaSets, StatefulSets, Deployments, etc. These rules allow you to configure th


Prompt:
Complete this yaml code:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis-cache
spec:
  selector:
    matchLabels:
      app: store
  replicas: 3
  template:
    metadata:
      labels:
        app: store

Response:
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - store
            topologyKey: "kubernetes.io/hostname"
      containers:
      - name: redis-server
        image: redis:3.2-alpine

Context: 10.2 - Assigning Pods to Nodes | The following example Deployment for the web servers creates replicas with the label app=web-store. The Pod affinity rule tells the scheduler to place each replica on a node that has a Pod with the la


Prompt:
Explain this yaml code:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis-cache
spec:
  selector:
    matchLabels:
      app: store
  replicas: 3
  template:
    metadata:
      labels:
        app: store
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - store
            topologyKey: "kubernetes.io/hostname"
      containers:
      - name: redis-server
        image: redis:3.2-alpine

Response: This yaml code 10.2 - Assigning Pods to Nodes | The following example Deployment for the web servers creates replicas with the label app=web-store. The Pod affinity rule tells the scheduler to place each replica on a node that has a Pod with the la


Prompt:
Complete this yaml code:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-server
spec:
  selector:
    matchLabels:
      app: web-store
  replicas: 3
  template:
    metadata:
      labels:
        app: web-store
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:

Response:
              matchExpressions:
              - key: app
                operator: In
                values:
                - web-store
            topologyKey: "kubernetes.io/hostname"
        podAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - store
            topologyKey: "kubernetes.io/hostname"
      containers:
      - name: web-app
        image: nginx:1.16-alpine

Context: 10.2 - Assigning Pods to Nodes | Creating the two preceding Deployments results in the following cluster layout, where each web server is co-located with a cache, on three separate nodes.


Prompt:
Explain this yaml code:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-server
spec:
  selector:
    matchLabels:
      app: web-store
  replicas: 3
  template:
    metadata:
      labels:
        app: web-store
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - web-store
            topologyKey: "kubernetes.io/hostname"
        podAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - store
            topologyKey: "kubernetes.io/hostname"
      containers:
      - name: web-app
        image: nginx:1.16-alpine

Response: This yaml code 10.2 - Assigning Pods to Nodes | Creating the two preceding Deployments results in the following cluster layout, where each web server is co-located with a cache, on three separate nodes.


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: nginx

Response:
spec:
  containers:
  - name: nginx
    image: nginx
  nodeName: kube-01

Context: 10.2 - Assigning Pods to Nodes | The above Pod will only run on the node kube-01.


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  containers:
  - name: nginx
    image: nginx
  nodeName: kube-01

Response: This yaml code 10.2 - Assigning Pods to Nodes | The above Pod will only run on the node kube-01.


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Pod
metadata:

Response:
  name: nginx
...
status:
  nominatedNodeName: kube-01

Context: 10.2 - Assigning Pods to Nodes | You can use topology spread constraints to control how Pods are spread across your cluster among failure-domains such as regions, zones, nodes, or among any other topology domains that you define. You


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: nginx
...
status:
  nominatedNodeName: kube-01

Response: This yaml code 10.2 - Assigning Pods to Nodes | You can use topology spread constraints to control how Pods are spread across your cluster among failure-domains such as regions, zones, nodes, or among any other topology domains that you define. You


Prompt:
Complete this yaml code:

# You need to change this example to match the actual runtime name, and per-Pod
# resource overhead, that the container runtime is adding in your cluster.
apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:

Response:
  name: kata-fc
handler: kata-fc
overhead:
  podFixed:
    memory: "120Mi"
    cpu: "250m"

Context: 10.3 - Pod Overhead | Workloads which are created which specify the kata-fc RuntimeClass handler will take the memory and cpu overheads into account for resource quota calculations, node scheduling, as well as Pod cgroup s


Prompt:
Explain this yaml code:

# You need to change this example to match the actual runtime name, and per-Pod
# resource overhead, that the container runtime is adding in your cluster.
apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: kata-fc
handler: kata-fc
overhead:
  podFixed:
    memory: "120Mi"
    cpu: "250m"

Response: This yaml code 10.3 - Pod Overhead | Workloads which are created which specify the kata-fc RuntimeClass handler will take the memory and cpu overheads into account for resource quota calculations, node scheduling, as well as Pod cgroup s


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
spec:
  runtimeClassName: kata-fc
  containers:
  - name: busybox-ctr
    image: busybox:1.28
    stdin: true

Response:
    tty: true
    resources:
      limits:
        cpu: 500m
        memory: 100Mi
  - name: nginx-ctr
    image: nginx
    resources:
      limits:
        cpu: 1500m
        memory: 100Mi

Context: 10.3 - Pod Overhead | At admission time the RuntimeClass admission controller updates the workload's PodSpec to include the overhead as described in the RuntimeClass. If the PodSpec already has this field defined, the Pod


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
spec:
  runtimeClassName: kata-fc
  containers:
  - name: busybox-ctr
    image: busybox:1.28
    stdin: true
    tty: true
    resources:
      limits:
        cpu: 500m
        memory: 100Mi
  - name: nginx-ctr
    image: nginx
    resources:
      limits:
        cpu: 1500m
        memory: 100Mi

Response: This yaml code 10.3 - Pod Overhead | At admission time the RuntimeClass admission controller updates the workload's PodSpec to include the overhead as described in the RuntimeClass. If the PodSpec already has this field defined, the Pod


Prompt:
Explain this bash code:

kubectl get pod test-pod -o jsonpath='{.spec.overhead}'

Response: This bash code 10.3 - Pod Overhead | The output is:

Context: 10.3 - Pod Overhead | The output is:


Prompt:
Explain this bash code:

kubectl get pod test-pod -o jsonpath='{.spec.containers[*].resources.limits}'

Response: This bash code 10.3 - Pod Overhead | The total container requests are 2000m CPU and 200MiB of memory:

Context: 10.3 - Pod Overhead | The total container requests are 2000m CPU and 200MiB of memory:


Prompt:
Explain this text code:

map[cpu: 500m memory:100Mi] map[cpu:1500m memory:100Mi]

Response: This text code 10.3 - Pod Overhead | Check this against what is observed by the node:

Context: 10.3 - Pod Overhead | Check this against what is observed by the node:


Prompt:
Explain this text code:

Namespace    Name       CPU Requests  CPU Limits   Memory Requests  Memory Limits  AGE
  ---------    ----       ------------  ----------   ---------------  -------------  ---
  default      test-pod   2250m (56%)   2250m (56%)  320Mi (1%)       320Mi (1%)     36m

Response: This text code 10.3 - Pod Overhead | Check the Pod's memory cgroups on the node where the workload is running. In the following example, crictl is used on the node, which provides a CLI for CRI-compatible container runtimes. This is an a

Context: 10.3 - Pod Overhead | Check the Pod's memory cgroups on the node where the workload is running. In the following example, crictl is used on the node, which provides a CLI for CRI-compatible container runtimes. This is an a


Prompt:
Explain this bash code:

# Run this on the node where the Pod is scheduled
POD_ID="$(sudo crictl pods --name test-pod -q)"

Response: This bash code 10.3 - Pod Overhead | From this, you can determine the cgroup path for the Pod:

Context: 10.3 - Pod Overhead | From this, you can determine the cgroup path for the Pod:


Prompt:
Explain this bash code:

# Run this on the node where the Pod is scheduled
sudo crictl inspectp -o=json $POD_ID | grep cgroupsPath

Response: This bash code 10.3 - Pod Overhead | The resulting cgroup path includes the Pod's pause container. The Pod level cgroup is one directory above.

Context: 10.3 - Pod Overhead | The resulting cgroup path includes the Pod's pause container. The Pod level cgroup is one directory above.


Prompt:
Explain this text code:

"cgroupsPath": "/kubepods/podd7f4b509-cf94-4951-9417-d1087c92a5b2/7ccf55aee35dd16aca4189c952d83487297f3cd760f1bbf09620e206e7d0c27a"

Response: This text code 10.3 - Pod Overhead | In this specific case, the pod cgroup path is kubepods/podd7f4b509-cf94-4951-9417-d1087c92a5b2. Verify the Pod level cgroup setting for memory:

Context: 10.3 - Pod Overhead | In this specific case, the pod cgroup path is kubepods/podd7f4b509-cf94-4951-9417-d1087c92a5b2. Verify the Pod level cgroup setting for memory:


Prompt:
Explain this bash code:

# Run this on the node where the Pod is scheduled.
# Also, change the name of the cgroup to match the cgroup allocated for your pod.
 cat /sys/fs/cgroup/memory/kubepods/podd7f4b509-cf94-4951-9417-d1087c92a5b2/memory.limit_in_bytes

Response: This bash code 10.3 - Pod Overhead | This is 320 MiB, as expected:

Context: 10.3 - Pod Overhead | This is 320 MiB, as expected:


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
spec:

Response:
  schedulingGates:
  - name: example.com/foo
  - name: example.com/bar
  containers:
  - name: pause
    image: registry.k8s.io/pause:3.6

Context: 10.4 - Pod Scheduling Readiness | After the Pod's creation, you can check its state using:


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
spec:
  schedulingGates:
  - name: example.com/foo
  - name: example.com/bar
  containers:
  - name: pause
    image: registry.k8s.io/pause:3.6

Response: This yaml code 10.4 - Pod Scheduling Readiness | After the Pod's creation, you can check its state using:


Prompt:
Explain this none code:

NAME       READY   STATUS            RESTARTS   AGE
test-pod   0/1     SchedulingGated   0          7s

Response: This none code 10.4 - Pod Scheduling Readiness | You can also check its schedulingGates field by running:

Context: 10.4 - Pod Scheduling Readiness | You can also check its schedulingGates field by running:


Prompt:
Explain this bash code:

kubectl get pod test-pod -o jsonpath='{.spec.schedulingGates}'

Response: This bash code 10.4 - Pod Scheduling Readiness | The output is:

Context: 10.4 - Pod Scheduling Readiness | The output is:


Prompt:
Explain this none code:

[{"name":"example.com/foo"},{"name":"example.com/bar"}]

Response: This none code 10.4 - Pod Scheduling Readiness | To inform scheduler this Pod is ready for scheduling, you can remove its schedulingGates entirely by reapplying a modified manifest:

Context: 10.4 - Pod Scheduling Readiness | To inform scheduler this Pod is ready for scheduling, you can remove its schedulingGates entirely by reapplying a modified manifest:


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: test-pod

Response:
spec:
  containers:
  - name: pause
    image: registry.k8s.io/pause:3.6

Context: 10.4 - Pod Scheduling Readiness | You can check if the schedulingGates is cleared by running:


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
spec:
  containers:
  - name: pause
    image: registry.k8s.io/pause:3.6

Response: This yaml code 10.4 - Pod Scheduling Readiness | You can check if the schedulingGates is cleared by running:


Prompt:
Explain this bash code:

kubectl get pod test-pod -o jsonpath='{.spec.schedulingGates}'

Response: This bash code 10.4 - Pod Scheduling Readiness | The output is expected to be empty. And you can check its latest status by running:

Context: 10.4 - Pod Scheduling Readiness | The output is expected to be empty. And you can check its latest status by running:


Prompt:
Explain this none code:

NAME       READY   STATUS    RESTARTS   AGE   IP         NODE
test-pod   1/1     Running   0          15s   10.0.0.4   node-2

Response: This none code 10.4 - Pod Scheduling Readiness | The metric scheduler_pending_pods comes with a new label "gated" to distinguish whether a Pod has been tried scheduling but claimed as unschedulable, or explicitly marked as not ready for scheduling.

Context: 10.4 - Pod Scheduling Readiness | The metric scheduler_pending_pods comes with a new label "gated" to distinguish whether a Pod has been tried scheduling but claimed as unschedulable, or explicitly marked as not ready for scheduling.


Prompt:
Explain this text code:

.requiredDuringSchedulingIgnoredDuringExecution.NodeSelectorTerms

Response: This text code 10.4 - Pod Scheduling Readiness | For .preferredDuringSchedulingIgnoredDuringExecution, all updates are allowed. This is because preferred terms are not authoritative, and so policy controllers don't validate those terms.

Context: 10.4 - Pod Scheduling Readiness | For .preferredDuringSchedulingIgnoredDuringExecution, all updates are allowed. This is because preferred terms are not authoritative, and so policy controllers don't validate those terms.


Prompt:
Complete this yaml code:

---
apiVersion: v1
kind: Pod
metadata:
  name: example-pod
spec:
  # Configure a topology spread constraint
  topologySpreadConstraints:

Response:
    - maxSkew: <integer>
      minDomains: <integer> # optional
      topologyKey: <string>
      whenUnsatisfiable: <string>
      labelSelector: <object>
      matchLabelKeys: <list> # optional; beta since v1.27
      nodeAffinityPolicy: [Honor|Ignore] # optional; beta since v1.26
      nodeTaintsPolicy: [Honor|Ignore] # optional; beta since v1.26
  ### other Pod fields go here

Context: 10.5 - Pod Topology Spread Constraints | You can read more about this field by running kubectl explain Pod.spec.topologySpreadConstraints or refer to the scheduling section of the API reference for Pod.


Prompt:
Explain this yaml code:

---
apiVersion: v1
kind: Pod
metadata:
  name: example-pod
spec:
  # Configure a topology spread constraint
  topologySpreadConstraints:
    - maxSkew: <integer>
      minDomains: <integer> # optional
      topologyKey: <string>
      whenUnsatisfiable: <string>
      labelSelector: <object>
      matchLabelKeys: <list> # optional; beta since v1.27
      nodeAffinityPolicy: [Honor|Ignore] # optional; beta since v1.26
      nodeTaintsPolicy: [Honor|Ignore] # optional; beta since v1.26
  ### other Pod fields go here

Response: This yaml code 10.5 - Pod Topology Spread Constraints | You can read more about this field by running kubectl explain Pod.spec.topologySpreadConstraints or refer to the scheduling section of the API reference for Pod.


Prompt:
Complete this yaml code:

topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: DoNotSchedule

Response:
          labelSelector:
            matchLabels:
              app: foo
          matchLabelKeys:
            - pod-template-hash

Context: 10.5 - Pod Topology Spread Constraints | The matchLabelKeys field is a beta-level field and enabled by default in 1.27. You can disable it by disabling the MatchLabelKeysInPodTopologySpread feature gate.


Prompt:
Explain this yaml code:

topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app: foo
          matchLabelKeys:
            - pod-template-hash

Response: This yaml code 10.5 - Pod Topology Spread Constraints | The matchLabelKeys field is a beta-level field and enabled by default in 1.27. You can disable it by disabling the MatchLabelKeysInPodTopologySpread feature gate.


Prompt:
Complete this text code:

NAME    STATUS   ROLES    AGE     VERSION   LABELS
node1   Ready    <none>   4m26s   v1.16.0   node=node1,zone=zoneA

Response:
node2   Ready    <none>   3m58s   v1.16.0   node=node2,zone=zoneA
node3   Ready    <none>   3m17s   v1.16.0   node=node3,zone=zoneB
node4   Ready    <none>   2m43s   v1.16.0   node=node4,zone=zoneB

Context: 10.5 - Pod Topology Spread Constraints | Then the cluster is logically viewed as below:


Prompt:
Explain this text code:

NAME    STATUS   ROLES    AGE     VERSION   LABELS
node1   Ready    <none>   4m26s   v1.16.0   node=node1,zone=zoneA
node2   Ready    <none>   3m58s   v1.16.0   node=node2,zone=zoneA
node3   Ready    <none>   3m17s   v1.16.0   node=node3,zone=zoneB
node4   Ready    <none>   2m43s   v1.16.0   node=node4,zone=zoneB

Response: This text code 10.5 - Pod Topology Spread Constraints | Then the cluster is logically viewed as below:


Prompt:
Explain this text code:

pods/topology-spread-constraints/one-constraint.yaml

Response: This text code 10.5 - Pod Topology Spread Constraints | From that manifest, topologyKey: zone implies the even distribution will only be applied to nodes that are labeled zone: <any value> (nodes that don't have a zone label are skipped). The field whenUns

Context: 10.5 - Pod Topology Spread Constraints | From that manifest, topologyKey: zone implies the even distribution will only be applied to nodes that are labeled zone: <any value> (nodes that don't have a zone label are skipped). The field whenUns


Prompt:
Complete this yaml code:

kind: Pod
apiVersion: v1
metadata:
  name: mypod
  labels:
    foo: bar
spec:
  topologySpreadConstraints:

Response:
  - maxSkew: 1
    topologyKey: zone
    whenUnsatisfiable: DoNotSchedule
    labelSelector:
      matchLabels:
        foo: bar
  containers:
  - name: pause
    image: registry.k8s.io/pause:3.1


Prompt:
Explain this yaml code:

kind: Pod
apiVersion: v1
metadata:
  name: mypod
  labels:
    foo: bar
spec:
  topologySpreadConstraints:
  - maxSkew: 1
    topologyKey: zone
    whenUnsatisfiable: DoNotSchedule
    labelSelector:
      matchLabels:
        foo: bar
  containers:
  - name: pause
    image: registry.k8s.io/pause:3.1

Response: This yaml code 10.5 - Pod Topology Spread Constraints | From that manifest, topologyKey: zone implies the even distribution will only be applied to nodes that are labeled zone: <any value> (nodes that don't have a zone label are skipped). The field whenUns


Prompt:
Explain this text code:

pods/topology-spread-constraints/two-constraints.yaml

Response: This text code 10.5 - Pod Topology Spread Constraints | In this case, to match the first constraint, the incoming Pod can only be placed onto nodes in zone B; while in terms of the second constraint, the incoming Pod can only be scheduled to the node node4

Context: 10.5 - Pod Topology Spread Constraints | In this case, to match the first constraint, the incoming Pod can only be placed onto nodes in zone B; while in terms of the second constraint, the incoming Pod can only be scheduled to the node node4


Prompt:
Complete this yaml code:

kind: Pod
apiVersion: v1
metadata:
  name: mypod
  labels:
    foo: bar
spec:
  topologySpreadConstraints:
  - maxSkew: 1
    topologyKey: zone
    whenUnsatisfiable: DoNotSchedule

Response:
    labelSelector:
      matchLabels:
        foo: bar
  - maxSkew: 1
    topologyKey: node
    whenUnsatisfiable: DoNotSchedule
    labelSelector:
      matchLabels:
        foo: bar
  containers:
  - name: pause
    image: registry.k8s.io/pause:3.1


Prompt:
Explain this yaml code:

kind: Pod
apiVersion: v1
metadata:
  name: mypod
  labels:
    foo: bar
spec:
  topologySpreadConstraints:
  - maxSkew: 1
    topologyKey: zone
    whenUnsatisfiable: DoNotSchedule
    labelSelector:
      matchLabels:
        foo: bar
  - maxSkew: 1
    topologyKey: node
    whenUnsatisfiable: DoNotSchedule
    labelSelector:
      matchLabels:
        foo: bar
  containers:
  - name: pause
    image: registry.k8s.io/pause:3.1

Response: This yaml code 10.5 - Pod Topology Spread Constraints | In this case, to match the first constraint, the incoming Pod can only be placed onto nodes in zone B; while in terms of the second constraint, the incoming Pod can only be scheduled to the node node4


Prompt:
Explain this text code:

pods/topology-spread-constraints/one-constraint-with-nodeaffinity.yaml

Response: This text code 10.5 - Pod Topology Spread Constraints | There are some implicit conventions worth noting here:

Context: 10.5 - Pod Topology Spread Constraints | There are some implicit conventions worth noting here:


Prompt:
Complete this yaml code:

kind: Pod
apiVersion: v1
metadata:
  name: mypod
  labels:
    foo: bar
spec:
  topologySpreadConstraints:
  - maxSkew: 1
    topologyKey: zone
    whenUnsatisfiable: DoNotSchedule
    labelSelector:
      matchLabels:

Response:
        foo: bar
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: zone
            operator: NotIn
            values:
            - zoneC
  containers:
  - name: pause
    image: registry.k8s.io/pause:3.1


Prompt:
Explain this yaml code:

kind: Pod
apiVersion: v1
metadata:
  name: mypod
  labels:
    foo: bar
spec:
  topologySpreadConstraints:
  - maxSkew: 1
    topologyKey: zone
    whenUnsatisfiable: DoNotSchedule
    labelSelector:
      matchLabels:
        foo: bar
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: zone
            operator: NotIn
            values:
            - zoneC
  containers:
  - name: pause
    image: registry.k8s.io/pause:3.1

Response: This yaml code 10.5 - Pod Topology Spread Constraints | There are some implicit conventions worth noting here:


Prompt:
Complete this yaml code:

apiVersion: kubescheduler.config.k8s.io/v1
kind: KubeSchedulerConfiguration

profiles:
  - schedulerName: default-scheduler
    pluginConfig:

Response:
      - name: PodTopologySpread
        args:
          defaultConstraints:
            - maxSkew: 1
              topologyKey: topology.kubernetes.io/zone
              whenUnsatisfiable: ScheduleAnyway
          defaultingType: List

Context: 10.5 - Pod Topology Spread Constraints | If you don't configure any cluster-level default constraints for pod topology spreading, then kube-scheduler acts as if you specified the following default topology constraints:


Prompt:
Explain this yaml code:

apiVersion: kubescheduler.config.k8s.io/v1
kind: KubeSchedulerConfiguration

profiles:
  - schedulerName: default-scheduler
    pluginConfig:
      - name: PodTopologySpread
        args:
          defaultConstraints:
            - maxSkew: 1
              topologyKey: topology.kubernetes.io/zone
              whenUnsatisfiable: ScheduleAnyway
          defaultingType: List

Response: This yaml code 10.5 - Pod Topology Spread Constraints | If you don't configure any cluster-level default constraints for pod topology spreading, then kube-scheduler acts as if you specified the following default topology constraints:


Prompt:
Complete this yaml code:

defaultConstraints:
  - maxSkew: 3
    topologyKey: "kubernetes.io/hostname"

Response:
    whenUnsatisfiable: ScheduleAnyway
  - maxSkew: 5
    topologyKey: "topology.kubernetes.io/zone"
    whenUnsatisfiable: ScheduleAnyway

Context: 10.5 - Pod Topology Spread Constraints | Also, the legacy SelectorSpread plugin, which provides an equivalent behavior, is disabled by default.