# Reference

This is the multi-page printable view of this section. Click here to print.Return to the regular view of this page.Reference1: Glossary2: API Overview2.1: Declarative API Validation2.2: Kubernetes API Concepts2.3: Server-Side Apply2.4: Client Libraries2.5: Common Expression Language in Kubernetes2.6: Kubernetes Deprecation Policy2.7: Deprecated API Migration Guide2.8: Kubernetes API health endpoints3: API Access Control3.1: Authenticating3.2: Authenticating with Bootstrap Tokens3.3: Authorization3.4: Using RBAC Authorization3.5: Using Node Authorization3.6: Webhook Mode3.7: Using ABAC Authorization3.8: Admission Control in Kubernetes3.9: Dynamic Admission Control3.10: Managing Service Accounts3.11: Certificates and Certificate Signing Requests3.12: Mapping PodSecurityPolicies to Pod Security Standards3.13: Kubelet authentication/authorization3.14: TLS bootstrapping3.15: Mutating Admission Policy3.16: Validating Admission Policy4: Well-Known Labels, Annotations and Taints4.1: Audit Annotations5: Kubernetes API5.1: Workload Resources5.1.1: Pod5.1.2: Binding5.1.3: PodTemplate5.1.4: ReplicationController5.1.5: ReplicaSet5.1.6: Deployment5.1.7: StatefulSet5.1.8: ControllerRevision5.1.9: DaemonSet5.1.10: Job5.1.11: CronJob5.1.12: HorizontalPodAutoscaler5.1.13: HorizontalPodAutoscaler5.1.14: PriorityClass5.1.15: DeviceTaintRule v1alpha35.1.16: ResourceClaim5.1.17: ResourceClaimTemplate5.1.18: ResourceSlice5.2: Service Resources5.2.1: Service5.2.2: Endpoints5.2.3: EndpointSlice5.2.4: Ingress5.2.5: IngressClass5.3: Config and Storage Resources5.3.1: ConfigMap5.3.2: Secret5.3.3: CSIDriver5.3.4: CSINode5.3.5: CSIStorageCapacity5.3.6: PersistentVolumeClaim5.3.7: PersistentVolume5.3.8: StorageClass5.3.9: StorageVersionMigration v1alpha15.3.10: Volume5.3.11: VolumeAttachment5.3.12: VolumeAttributesClass5.4: Authentication Resources5.4.1: ServiceAccount5.4.2: TokenRequest5.4.3: TokenReview5.4.4: CertificateSigningRequest5.4.5: ClusterTrustBundle v1beta15.4.6: SelfSubjectReview5.4.7: PodCertificateRequest v1alpha15.5: Authorization Resources5.5.1: LocalSubjectAccessReview5.5.2: SelfSubjectAccessReview5.5.3: SelfSubjectRulesReview5.5.4: SubjectAccessReview5.5.5: ClusterRole5.5.6: ClusterRoleBinding5.5.7: Role5.5.8: RoleBinding5.6: Policy Resources5.6.1: FlowSchema5.6.2: LimitRange5.6.3: ResourceQuota5.6.4: NetworkPolicy5.6.5: PodDisruptionBudget5.6.6: PriorityLevelConfiguration5.6.7: ValidatingAdmissionPolicy5.6.8: ValidatingAdmissionPolicyBinding5.6.9: MutatingAdmissionPolicy v1beta15.6.10: MutatingAdmissionPolicyBinding v1alpha15.7: Extend Resources5.7.1: CustomResourceDefinition5.7.2: DeviceClass5.7.3: MutatingWebhookConfiguration5.7.4: ValidatingWebhookConfiguration5.8: Cluster Resources5.8.1: APIService5.8.2: ComponentStatus5.8.3: Event5.8.4: IPAddress5.8.5: Lease5.8.6: LeaseCandidate v1beta15.8.7: Namespace5.8.8: Node5.8.9: RuntimeClass5.8.10: ServiceCIDR5.9: Common Definitions5.9.1: DeleteOptions5.9.2: LabelSelector5.9.3: ListMeta5.9.4: LocalObjectReference5.9.5: NodeSelectorRequirement5.9.6: ObjectFieldSelector5.9.7: ObjectMeta5.9.8: ObjectReference5.9.9: Patch5.9.10: Quantity5.9.11: ResourceFieldSelector5.9.12: Status5.9.13: TypedLocalObjectReference5.10: Other Resources5.10.1: MutatingAdmissionPolicyBindingList v1beta15.11: Common Parameters6: Instrumentation6.1: Kubernetes Component SLI Metrics6.2: CRI Pod & Container Metrics6.3: Node metrics data6.4: Understand Pressure Stall Information (PSI) Metrics6.5: Kubernetes z-pages6.6: Kubernetes Metrics Reference7: Kubernetes Issues and Security7.1: Kubernetes Issue Tracker7.2: Kubernetes Security and Disclosure Information7.3: Official CVE Feed8: Node Reference Information8.1: Kubelet Checkpoint API8.2: Linux Kernel Version Requirements8.3: Articles on dockershim Removal and on Using CRI-compatible Runtimes8.4: Node Labels Populated By The Kubelet8.5: Local Files And Paths Used By The Kubelet8.6: Kubelet Configuration Directory Merging8.7: Kubelet Device Manager API Versions8.8: Kubelet Systemd Watchdog8.9: Node Status8.10: Seccomp and Kubernetes8.11: Linux Node Swap Behaviors9: Networking Reference9.1: Protocols for Services9.2: Ports and Protocols9.3: Virtual IPs and Service Proxies10: Setup tools10.1: Kubeadm10.1.1: Kubeadm Generated10.1.1.1: 10.1.1.2: 10.1.1.2.1: 10.1.1.2.2: 10.1.1.2.3: 10.1.1.2.4: 10.1.1.2.5: 10.1.1.2.6: 10.1.1.2.7: 10.1.1.2.8: 10.1.1.2.9: 10.1.1.2.10: 10.1.1.2.11: 10.1.1.2.12: 10.1.1.2.13: 10.1.1.2.14: 10.1.1.2.15: 10.1.1.2.16: 10.1.1.3: 10.1.1.4: 10.1.1.4.1: 10.1.1.4.2: 10.1.1.4.3: 10.1.1.4.4: 10.1.1.4.5: 10.1.1.4.6: 10.1.1.4.7: 10.1.1.4.8: 10.1.1.4.9: 10.1.1.4.10: 10.1.1.5: 10.1.1.5.1: 10.1.1.5.2: 10.1.1.5.3: 10.1.1.5.4: 10.1.1.5.5: 10.1.1.5.6: 10.1.1.5.7: 10.1.1.5.8: 10.1.1.5.9: 10.1.1.5.10: 10.1.1.5.11: 10.1.1.5.12: 10.1.1.5.13: 10.1.1.5.14: 10.1.1.5.15: 10.1.1.5.16: 10.1.1.5.17: 10.1.1.5.18: 10.1.1.5.19: 10.1.1.5.20: 10.1.1.5.21: 10.1.1.5.22: 10.1.1.5.23: 10.1.1.5.24: 10.1.1.5.25: 10.1.1.5.26: 10.1.1.5.27: 10.1.1.5.28: 10.1.1.5.29: 10.1.1.5.30: 10.1.1.5.31: 10.1.1.5.32: 10.1.1.5.33: 10.1.1.5.34: 10.1.1.5.35: 10.1.1.5.36: 10.1.1.5.37: 10.1.1.5.38: 10.1.1.5.39: 10.1.1.5.40: 10.1.1.5.41: 10.1.1.5.42: 10.1.1.5.43: 10.1.1.5.44: 10.1.1.5.45: 10.1.1.5.46: 10.1.1.6: 10.1.1.6.1: 10.1.1.6.2: 10.1.1.6.3: 10.1.1.6.4: 10.1.1.6.5: 10.1.1.6.6: 10.1.1.6.7: 10.1.1.6.8: 10.1.1.6.9: 10.1.1.6.10: 10.1.1.6.11: 10.1.1.6.12: 10.1.1.6.13: 10.1.1.6.14: 10.1.1.7: 10.1.1.7.1: 10.1.1.8: 10.1.1.8.1: 10.1.1.8.2: 10.1.1.8.3: 10.1.1.8.4: 10.1.1.9: 10.1.1.9.1: 10.1.1.9.2: 10.1.1.9.3: 10.1.1.9.4: 10.1.1.10: 10.1.1.10.1: 10.1.1.10.2: 10.1.1.10.3: 10.1.1.10.4: 10.1.1.10.5: 10.1.1.10.6: 10.1.1.10.7: 10.1.1.10.8: 10.1.1.10.9: 10.1.1.10.10: 10.1.1.10.11: 10.1.1.10.12: 10.1.1.10.13: 10.1.1.10.14: 10.1.1.10.15: 10.1.1.10.16: 10.1.1.10.17: 10.1.1.10.18: 10.1.1.10.19: 10.1.1.10.20: 10.1.1.10.21: 10.1.1.10.22: 10.1.1.10.23: 10.1.1.10.24: 10.1.1.10.25: 10.1.1.10.26: 10.1.1.10.27: 10.1.1.11: 10.1.1.12: 10.1.2: kubeadm init10.1.3: kubeadm join10.1.4: kubeadm upgrade10.1.5: kubeadm upgrade phases10.1.6: kubeadm config10.1.7: kubeadm reset10.1.8: kubeadm token10.1.9: kubeadm version10.1.10: kubeadm alpha10.1.11: kubeadm certs10.1.12: kubeadm init phase10.1.13: kubeadm join phase10.1.14: kubeadm kubeconfig10.1.15: kubeadm reset phase10.1.16: Implementation details11: Command line tool (kubectl)11.1: Introduction to kubectl11.2: kubectl Quick Reference11.3: kubectl reference11.3.1: kubectl11.3.2: kubectl annotate11.3.3: kubectl api-resources11.3.4: kubectl api-versions11.3.5: kubectl apply11.3.5.1: kubectl apply edit-last-applied11.3.5.2: kubectl apply set-last-applied11.3.5.3: kubectl apply view-last-applied11.3.6: kubectl attach11.3.7: kubectl auth11.3.7.1: kubectl auth can-i11.3.7.2: kubectl auth reconcile11.3.7.3: kubectl auth whoami11.3.8: kubectl autoscale11.3.9: kubectl certificate11.3.9.1: kubectl certificate approve11.3.9.2: kubectl certificate deny11.3.10: kubectl cluster-info11.3.10.1: kubectl cluster-info dump11.3.11: kubectl completion11.3.12: kubectl config11.3.12.1: kubectl config current-context11.3.12.2: kubectl config delete-cluster11.3.12.3: kubectl config delete-context11.3.12.4: kubectl config delete-user11.3.12.5: kubectl config get-clusters11.3.12.6: kubectl config get-contexts11.3.12.7: kubectl config get-users11.3.12.8: kubectl config rename-context11.3.12.9: kubectl config set11.3.12.10: kubectl config set-cluster11.3.12.11: kubectl config set-context11.3.12.12: kubectl config set-credentials11.3.12.13: kubectl config unset11.3.12.14: kubectl config use-context11.3.12.15: kubectl config view11.3.13: kubectl cordon11.3.14: kubectl cp11.3.15: kubectl create11.3.15.1: kubectl create clusterrole11.3.15.2: kubectl create clusterrolebinding11.3.15.3: kubectl create configmap11.3.15.4: kubectl create cronjob11.3.15.5: kubectl create deployment11.3.15.6: kubectl create ingress11.3.15.7: kubectl create job11.3.15.8: kubectl create namespace11.3.15.9: kubectl create poddisruptionbudget11.3.15.10: kubectl create priorityclass11.3.15.11: kubectl create quota11.3.15.12: kubectl create role11.3.15.13: kubectl create rolebinding11.3.15.14: kubectl create secret11.3.15.15: kubectl create secret docker-registry11.3.15.16: kubectl create secret generic11.3.15.17: kubectl create secret tls11.3.15.18: kubectl create service11.3.15.19: kubectl create service clusterip11.3.15.20: kubectl create service externalname11.3.15.21: kubectl create service loadbalancer11.3.15.22: kubectl create service nodeport11.3.15.23: kubectl create serviceaccount11.3.15.24: kubectl create token11.3.16: kubectl debug11.3.17: kubectl delete11.3.18: kubectl describe11.3.19: kubectl diff11.3.20: kubectl drain11.3.21: kubectl edit11.3.22: kubectl events11.3.23: kubectl exec11.3.24: kubectl explain11.3.25: kubectl expose11.3.26: kubectl get11.3.27: kubectl kustomize11.3.28: kubectl label11.3.29: kubectl logs11.3.30: kubectl options11.3.31: kubectl patch11.3.32: kubectl plugin11.3.32.1: kubectl plugin list11.3.33: kubectl port-forward11.3.34: kubectl proxy11.3.35: kubectl replace11.3.36: kubectl rollout11.3.36.1: kubectl rollout history11.3.36.2: kubectl rollout pause11.3.36.3: kubectl rollout restart11.3.36.4: kubectl rollout resume11.3.36.5: kubectl rollout status11.3.36.6: kubectl rollout undo11.3.37: kubectl run11.3.38: kubectl scale11.3.39: kubectl set11.3.39.1: kubectl set env11.3.39.2: kubectl set image11.3.39.3: kubectl set resources11.3.39.4: kubectl set selector11.3.39.5: kubectl set serviceaccount11.3.39.6: kubectl set subject11.3.40: kubectl taint11.3.41: kubectl top11.3.41.1: kubectl top node11.3.41.2: kubectl top pod11.3.42: kubectl uncordon11.3.43: kubectl version11.3.44: kubectl wait11.4: kubectl Commands11.5: kubectl11.6: JSONPath Support11.7: kubectl for Docker Users11.8: kubectl Usage Conventions11.9: Kubectl user preferences (kuberc)12: Component tools12.1: Feature Gates12.2: Feature Gates (removed)12.3: kube-apiserver12.4: kube-controller-manager12.5: kube-proxy12.6: kube-scheduler12.7: kubelet13: Debug cluster13.1: Flow control14: Configuration APIs14.1: Client Authentication (v1)14.2: Client Authentication (v1beta1)14.3: Event Rate Limit Configuration (v1alpha1)14.4: Image Policy API (v1alpha1)14.5: kube-apiserver Admission (v1)14.6: kube-apiserver Audit Configuration (v1)14.7: kube-apiserver Configuration (v1)14.8: kube-apiserver Configuration (v1alpha1)14.9: kube-apiserver Configuration (v1beta1)14.10: kube-controller-manager Configuration (v1alpha1)14.11: kube-proxy Configuration (v1alpha1)14.12: kube-scheduler Configuration (v1)14.13: kubeadm Configuration (v1beta3)14.14: kubeadm Configuration (v1beta4)14.15: kubeconfig (v1)14.16: Kubelet Configuration (v1)14.17: Kubelet Configuration (v1alpha1)14.18: Kubelet Configuration (v1beta1)14.19: Kubelet CredentialProvider (v1)14.20: kuberc (v1alpha1)14.21: WebhookAdmission Configuration (v1)15: External APIs15.1: Kubernetes Custom Metrics (v1beta2)15.2: Kubernetes External Metrics (v1beta1)15.3: Kubernetes Metrics (v1beta1)16: Scheduling16.1: Scheduler Configuration16.2: Scheduling Policies17: Other ToolsThis section of the Kubernetes documentation contains references.API ReferenceGlossary - a comprehensive, standardized list of Kubernetes terminologyKubernetes API ReferenceOne-page API Reference for Kubernetes v1.34Using The Kubernetes API - overview of the API for Kubernetes.API access control - details on how Kubernetes controls API accessWell-Known Labels, Annotations and TaintsOfficially supported client librariesTo call the Kubernetes API from a programming language, you can use client libraries. Officially supported client libraries:Kubernetes Go client libraryKubernetes Python client libraryKubernetes Java client libraryKubernetes JavaScript client libraryKubernetes C# client libraryKubernetes Haskell client libraryCLIkubectl - Main CLI tool for running commands and managing Kubernetes clusters.JSONPath - Syntax guide for using JSONPath expressions with kubectl.kubeadm - CLI tool to easily provision a secure Kubernetes cluster.Componentskubelet - The primary agent that runs on each node. The kubelet takes a set of PodSpecs and ensures that the described containers are running and healthy.kube-apiserver - REST API that validates and configures data for API objects such as pods, services, replication controllers.kube-controller-manager - Daemon that embeds the core control loops shipped with Kubernetes.kube-proxy - Can do simple TCP/UDP stream forwarding or round-robin TCP/UDP forwarding across a set of back-ends.kube-scheduler - Scheduler that manages availability, performance, and capacity.Scheduler PoliciesScheduler ProfilesList of ports and protocols that should be open on control plane and worker nodesConfig APIsThis section hosts the documentation for "unpublished" APIs which are used to configure kubernetes components or tools. Most of these APIs are not exposed by the API server in a RESTful way though they are essential for a user or an operator to use or manage a cluster.kubeconfig (v1)kuberc (v1alpha1)kube-apiserver admission (v1)kube-apiserver configuration (v1alpha1) andkube-apiserver configuration (v1beta1) and kube-apiserver configuration (v1)kube-apiserver event rate limit (v1alpha1)kubelet configuration (v1alpha1) and kubelet configuration (v1beta1) kubelet configuration (v1)kubelet credential providers (v1) kube-scheduler configuration (v1)kube-controller-manager configuration (v1alpha1)kube-proxy configuration (v1alpha1)audit.k8s.io/v1 APIClient authentication API (v1beta1) and Client authentication API (v1)WebhookAdmission configuration (v1)ImagePolicy API (v1alpha1)Config API for kubeadmv1beta3v1beta4External APIsThese are the APIs defined by the Kubernetes project, but are not implemented by the core project:Metrics API (v1beta1)Custom Metrics API (v1beta2)External Metrics API (v1beta1)Design DocsAn archive of the design docs for Kubernetes functionality. Good starting points are Kubernetes Architecture and Kubernetes Design Overview.1 - Glossary2 - API OverviewThis section provides reference information for the Kubernetes API.The REST API is the fundamental fabric of Kubernetes. All operations and communications between components, and external user commands are REST API calls that the API Server handles. Consequently, everything in the Kubernetes platform is treated as an API object and has a corresponding entry in the API.The Kubernetes API reference lists the API for Kubernetes version v1.34.For general background information, read The Kubernetes API. Controlling Access to the Kubernetes API describes how clients can authenticate to the Kubernetes API server, and how their requests are authorized.API versioningThe JSON and Protobuf serialization schemas follow the same guidelines for schema changes. The following descriptions cover both formats.The API versioning and software versioning are indirectly related. The API and release versioning proposal describes the relationship between API versioning and software versioning.Different API versions indicate different levels of stability and support. You can find more information about the criteria for each level in the API Changes documentation.Here's a summary of each level:Alpha:The version names contain alpha (for example, v1alpha1).Built-in alpha API versions are disabled by default and must be explicitly enabled in the kube-apiserver configuration to be used.The software may contain bugs. Enabling a feature may expose bugs.Support for an alpha API may be dropped at any time without notice.The API may change in incompatible ways in a later software release without notice.The software is recommended for use only in short-lived testing clusters, due to increased risk of bugs and lack of long-term support.Beta:The version names contain beta (for example, v2beta3).Built-in beta API versions are disabled by default and must be explicitly enabled in the kube-apiserver configuration to be used (except for beta versions of APIs introduced prior to Kubernetes 1.22, which were enabled by default).Built-in beta API versions have a maximum lifetime of 9 months or 3 minor releases (whichever is longer) from introduction to deprecation, and 9 months or 3 minor releases (whichever is longer) from deprecation to removal.The software is well tested. Enabling a feature is considered safe.The support for a feature will not be dropped, though the details may change.The schema and/or semantics of objects may change in incompatible ways in a subsequent beta or stable API version. When this happens, migration instructions are provided. Adapting to a subsequent beta or stable API version may require editing or re-creating API objects, and may not be straightforward. The migration may require downtime for applications that rely on the feature.The software is not recommended for production uses. Subsequent releases may introduce incompatible changes. Use of beta API versions is required to transition to subsequent beta or stable API versions once the beta API version is deprecated and no longer served.Note:Please try beta features and provide