# Tasks

This is the multi-page printable view of this section. Click here to print.Return to the regular view of this page.Tasks1: Install Tools1.1: Install and Set Up kubectl on Linux1.2: Install and Set Up kubectl on macOS1.3: Install and Set Up kubectl on Windows2: Administer a Cluster2.1: Administration with kubeadm2.1.1: Adding Linux worker nodes2.1.2: Adding Windows worker nodes2.1.3: Upgrading kubeadm clusters2.1.4: Upgrading Linux nodes2.1.5: Upgrading Windows nodes2.1.6: Configuring a cgroup driver2.1.7: Certificate Management with kubeadm2.1.8: Reconfiguring a kubeadm cluster2.1.9: Changing The Kubernetes Package Repository2.2: Overprovision Node Capacity For A Cluster2.3: Migrating from dockershim2.3.1: Changing the Container Runtime on a Node from Docker Engine to containerd2.3.2: Find Out What Container Runtime is Used on a Node2.3.3: Troubleshooting CNI plugin-related errors2.3.4: Check whether dockershim removal affects you2.3.5: Migrating telemetry and security agents from dockershim2.4: Generate Certificates Manually2.5: Manage Memory, CPU, and API Resources2.5.1: Configure Default Memory Requests and Limits for a Namespace2.5.2: Configure Default CPU Requests and Limits for a Namespace2.5.3: Configure Minimum and Maximum Memory Constraints for a Namespace2.5.4: Configure Minimum and Maximum CPU Constraints for a Namespace2.5.5: Configure Memory and CPU Quotas for a Namespace2.5.6: Configure a Pod Quota for a Namespace2.6: Install a Network Policy Provider2.6.1: Use Antrea for NetworkPolicy2.6.2: Use Calico for NetworkPolicy2.6.3: Use Cilium for NetworkPolicy2.6.4: Use Kube-router for NetworkPolicy2.6.5: Romana for NetworkPolicy2.6.6: Weave Net for NetworkPolicy2.7: Access Clusters Using the Kubernetes API2.8: Advertise Extended Resources for a Node2.9: Autoscale the DNS Service in a Cluster2.10: Change the Access Mode of a PersistentVolume to ReadWriteOncePod2.11: Change the default StorageClass2.12: Switching from Polling to CRI Event-based Updates to Container Status2.13: Change the Reclaim Policy of a PersistentVolume2.14: Cloud Controller Manager Administration2.15: Configure a kubelet image credential provider2.16: Configure Quotas for API Objects2.17: Control CPU Management Policies on the Node2.18: Control Topology Management Policies on a node2.19: Customizing DNS Service2.20: Debugging DNS Resolution2.21: Declare Network Policy2.22: Developing Cloud Controller Manager2.23: Enable Or Disable A Kubernetes API2.24: Encrypting Confidential Data at Rest2.25: Decrypt Confidential Data that is Already Encrypted at Rest2.26: Guaranteed Scheduling For Critical Add-On Pods2.27: IP Masquerade Agent User Guide2.28: Limit Storage Consumption2.29: Migrate Replicated Control Plane To Use Cloud Controller Manager2.30: Operating etcd clusters for Kubernetes2.31: Reserve Compute Resources for System Daemons2.32: Running Kubernetes Node Components as a Non-root User2.33: Safely Drain a Node2.34: Securing a Cluster2.35: Set Kubelet Parameters Via A Configuration File2.36: Share a Cluster with Namespaces2.37: Upgrade A Cluster2.38: Use Cascading Deletion in a Cluster2.39: Using a KMS provider for data encryption2.40: Using CoreDNS for Service Discovery2.41: Using NodeLocal DNSCache in Kubernetes Clusters2.42: Using sysctls in a Kubernetes Cluster2.43: Utilizing the NUMA-aware Memory Manager2.44: Verify Signed Kubernetes Artifacts3: Configure Pods and Containers3.1: Assign Memory Resources to Containers and Pods3.2: Assign CPU Resources to Containers and Pods3.3: Assign Devices to Pods and Containers3.3.1: Set Up DRA in a Cluster3.3.2: Allocate Devices to Workloads with DRA3.4: Assign Pod-level CPU and memory resources3.5: Configure GMSA for Windows Pods and containers3.6: Resize CPU and Memory Resources assigned to Containers3.7: Configure RunAsUserName for Windows pods and containers3.8: Create a Windows HostProcess Pod3.9: Configure Quality of Service for Pods3.10: Assign Extended Resources to a Container3.11: Configure a Pod to Use a Volume for Storage3.12: Configure a Pod to Use a PersistentVolume for Storage3.13: Configure a Pod to Use a Projected Volume for Storage3.14: Configure a Security Context for a Pod or Container3.15: Configure Service Accounts for Pods3.16: Pull an Image from a Private Registry3.17: Configure Liveness, Readiness and Startup Probes3.18: Assign Pods to Nodes3.19: Assign Pods to Nodes using Node Affinity3.20: Configure Pod Initialization3.21: Attach Handlers to Container Lifecycle Events3.22: Configure a Pod to Use a ConfigMap3.23: Share Process Namespace between Containers in a Pod3.24: Use a User Namespace With a Pod3.25: Use an Image Volume With a Pod3.26: Create static Pods3.27: Translate a Docker Compose File to Kubernetes Resources3.28: Enforce Pod Security Standards by Configuring the Built-in Admission Controller3.29: Enforce Pod Security Standards with Namespace Labels3.30: Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller4: Monitoring, Logging, and Debugging4.1: Logging in Kubernetes4.2: Monitoring in Kubernetes4.3: Troubleshooting Applications4.3.1: Debug Pods4.3.2: Debug Services4.3.3: Debug a StatefulSet4.3.4: Determine the Reason for Pod Failure4.3.5: Debug Init Containers4.3.6: Debug Running Pods4.3.7: Get a Shell to a Running Container4.4: Troubleshooting Clusters4.4.1: Troubleshooting kubectl4.4.2: Resource metrics pipeline4.4.3: Tools for Monitoring Resources4.4.4: Monitor Node Health4.4.5: Debugging Kubernetes nodes with crictl4.4.6: Auditing4.4.7: Debugging Kubernetes Nodes With Kubectl4.4.8: Developing and debugging services locally using telepresence4.4.9: Windows debugging tips5: Manage Kubernetes Objects5.1: Declarative Management of Kubernetes Objects Using Configuration Files5.2: Declarative Management of Kubernetes Objects Using Kustomize5.3: Managing Kubernetes Objects Using Imperative Commands5.4: Imperative Management of Kubernetes Objects Using Configuration Files5.5: Update API Objects in Place Using kubectl patch5.6: Migrate Kubernetes Objects Using Storage Version Migration6: Managing Secrets6.1: Managing Secrets using kubectl6.2: Managing Secrets using Configuration File6.3: Managing Secrets using Kustomize7: Inject Data Into Applications7.1: Define a Command and Arguments for a Container7.2: Define Dependent Environment Variables7.3: Define Environment Variables for a Container7.4: Define Environment Variable Values Using An Init Container7.5: Expose Pod Information to Containers Through Environment Variables7.6: Expose Pod Information to Containers Through Files7.7: Distribute Credentials Securely Using Secrets8: Run Applications8.1: Run a Stateless Application Using a Deployment8.2: Run a Single-Instance Stateful Application8.3: Run a Replicated Stateful Application8.4: Scale a StatefulSet8.5: Delete a StatefulSet8.6: Force Delete StatefulSet Pods8.7: Horizontal Pod Autoscaling8.8: HorizontalPodAutoscaler Walkthrough8.9: Specifying a Disruption Budget for your Application8.10: Accessing the Kubernetes API from a Pod9: Run Jobs9.1: Running Automated Tasks with a CronJob9.2: Coarse Parallel Processing Using a Work Queue9.3: Fine Parallel Processing Using a Work Queue9.4: Indexed Job for Parallel Processing with Static Work Assignment9.5: Job with Pod-to-Pod Communication9.6: Parallel Processing using Expansions9.7: Handling retriable and non-retriable pod failures with Pod failure policy10: Access Applications in a Cluster10.1: Deploy and Access the Kubernetes Dashboard10.2: Accessing Clusters10.3: Configure Access to Multiple Clusters10.4: Use Port Forwarding to Access Applications in a Cluster10.5: Use a Service to Access an Application in a Cluster10.6: Connect a Frontend to a Backend Using Services10.7: Create an External Load Balancer10.8: List All Container Images Running in a Cluster10.9: Set up Ingress on Minikube with the NGINX Ingress Controller10.10: Communicate Between Containers in the Same Pod Using a Shared Volume10.11: Configure DNS for a Cluster10.12: Access Services Running on Clusters11: Extend Kubernetes11.1: Configure the Aggregation Layer11.2: Use Custom Resources11.2.1: Extend the Kubernetes API with CustomResourceDefinitions11.2.2: Versions in CustomResourceDefinitions11.3: Set up an Extension API Server11.4: Configure Multiple Schedulers11.5: Use an HTTP Proxy to Access the Kubernetes API11.6: Use a SOCKS5 Proxy to Access the Kubernetes API11.7: Set up Konnectivity service12: TLS12.1: Issue a Certificate for a Kubernetes API Client Using A CertificateSigningRequest12.2: Configure Certificate Rotation for the Kubelet12.3: Manage TLS Certificates in a Cluster12.4: Manual Rotation of CA Certificates13: Manage Cluster Daemons13.1: Building a Basic DaemonSet13.2: Perform a Rolling Update on a DaemonSet13.3: Perform a Rollback on a DaemonSet13.4: Running Pods on Only Some Nodes14: Networking14.1: Adding entries to Pod /etc/hosts with HostAliases14.2: Extend Service IP Ranges14.3: Kubernetes Default Service CIDR Reconfiguration14.4: Validate IPv4/IPv6 dual-stack15: Extend kubectl with plugins16: Manage HugePages17: Schedule GPUsThis section of the Kubernetes documentation contains pages that show how to do individual tasks. A task page shows how to do a single thing, typically by giving a short sequence of steps.If you would like to write a task page, see Creating a Documentation Pull Request.1 - Install ToolsSet up Kubernetes tools on your computer.kubectlThe Kubernetes command-line tool, kubectl, allows you to run commands against Kubernetes clusters. You can use kubectl to deploy applications, inspect and manage cluster resources, and view logs. For more information including a complete list of kubectl operations, see the kubectl reference documentation.kubectl is installable on a variety of Linux platforms, macOS and Windows. Find your preferred operating system below.Install kubectl on LinuxInstall kubectl on macOSInstall kubectl on Windowskindkind lets you run Kubernetes on your local computer. This tool requires that you have either Docker or Podman installed.The kind Quick Start page shows you what you need to do to get up and running with kind.View kind Quick Start GuideminikubeLike kind, minikube is a tool that lets you run Kubernetes locally. minikube runs an all-in-one or a multi-node local Kubernetes cluster on your personal computer (including Windows, macOS and Linux PCs) so that you can try out Kubernetes, or for daily development work.You can follow the official Get Started! guide if your focus is on getting the tool installed.View minikube Get Started! GuideOnce you have minikube working, you can use it to run a sample application.kubeadmYou can use the kubeadm tool to create and manage Kubernetes clusters. It performs the actions necessary to get a minimum viable, secure cluster up and running in a user friendly way.Installing kubeadm shows you how to install kubeadm. Once installed, you can use it to create a cluster.View kubeadm Install Guide1.1 - Install and Set Up kubectl on LinuxBefore you beginYou must use a kubectl version that is within one minor version difference of your cluster. For example, a v1.34 client can communicate with v1.33, v1.34, and v1.35 control planes. Using the latest compatible version of kubectl helps avoid unforeseen issues.Install kubectl on LinuxThe following methods exist for installing kubectl on Linux:Install kubectl binary with curl on LinuxInstall using native package managementInstall using other package managementInstall kubectl binary with curl on LinuxDownload the latest release with the command: curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/arm64/kubectl" Note:To download a specific version, replace the $(curl -L -s https://dl.k8s.io/release/stable.txt) portion of the command with the specific version.For example, to download version 1.34.0 on Linux x86-64, type:curl -LO https://dl.k8s.io/release/v1.34.0/bin/linux/amd64/kubectl And for Linux ARM64, type:curl -LO https://dl.k8s.io/release/v1.34.0/bin/linux/arm64/kubectl Validate the binary (optional)Download the kubectl checksum file: curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl.sha256" curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/arm64/kubectl.sha256" Validate the kubectl binary against the checksum file:echo "$(cat kubectl.sha256) kubectl" | sha256sum --check If valid, the output is:kubectl: OK If the check fails, sha256 exits with nonzero status and prints output similar to:kubectl: FAILED sha256sum: WARNING: 1 computed checksum did NOT match Note:Download the same version of the binary and checksum.Install kubectlsudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl Note:If you do not have root access on the target system, you can still install kubectl to the ~/.local/bin directory:chmod +x kubectl mkdir -p ~/.local/bin mv ./kubectl ~/.local/bin/kubectl # and then append (or prepend) ~/.local/bin to $PATH Test to ensure the version you installed is up-to-date:kubectl version --client Or use this for detailed view of version:kubectl version --client --output=yaml Install using native package managementUpdate the apt package index and install packages needed to use the Kubernetes apt repository:sudo apt-get update # apt-transport-https may be a dummy package; if so, you can skip that package sudo apt-get install -y apt-transport-https ca-certificates curl gnupg Download the public signing key for the Kubernetes package repositories. The same signing key is used for all repositories so you can disregard the version in the URL:# If the folder `/etc/apt/keyrings` does not exist, it should be created before the curl command, read the note below. # sudo mkdir -p -m 755 /etc/apt/keyrings curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.34/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg sudo chmod 644 /etc/apt/keyrings/kubernetes-apt-keyring.gpg # allow unprivileged APT programs to read this keyring Note:In releases older than Debian 12 and Ubuntu 22.04, folder /etc/apt/keyrings does not exist by default, and it should be created before the curl command.Add the appropriate Kubernetes apt repository. If you want to use Kubernetes version different than v1.34, replace v1.34 with the desired minor version in the command below:# This overwrites any existing configuration in /etc/apt/sources.list.d/kubernetes.list echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.34/deb/ /' | sudo tee /etc/apt/sources.list.d/kubernetes.list sudo chmod 644 /etc/apt/sources.list.d/kubernetes.list # helps tools such as command-not-found to work correctly Note:To upgrade kubectl to another minor release, you'll need to bump the version in /etc/apt/sources.list.d/kubernetes.list before running apt-get update and apt-get upgrade. This procedure is described in more detail in Changing The Kubernetes Package Repository.Update apt package index, then install kubectl:sudo apt-get update sudo apt-get install -y kubectl Add the Kubernetes yum repository. If you want to use Kubernetes version different than v1.34, replace v1.34 with the desired minor version in the command below.# This overwrites any existing configuration in /etc/yum.repos.d/kubernetes.repo cat <<EOF | sudo tee /etc/yum.repos.d/kubernetes.repo [kubernetes] name=Kubernetes baseurl=https://pkgs.k8s.io/core:/stable:/v1.34/rpm/ enabled=1 gpgcheck=1 gpgkey=https://pkgs.k8s.io/core:/stable:/v1.34/rpm/repodata/repomd.xml.key EOF Note:To upgrade kubectl to another minor release, you'll need to bump the version in /etc/yum.repos.d/kubernetes.repo before running yum update. This procedure is described in more detail in Changing The Kubernetes Package Repository.Install kubectl using yum:sudo yum install -y kubectl Add the Kubernetes zypper repository. If you want to use Kubernetes version different than v1.34, replace v1.34 with the desired minor version in the command below.# This overwrites any existing configuration in /etc/zypp/repos.d/kubernetes.repo cat <<EOF | sudo tee /etc/zypp/repos.d/kubernetes.repo [kubernetes] name=Kubernetes baseurl=https://pkgs.k8s.io/core:/stable:/v1.34/rpm/ enabled=1 gpgcheck=1 gpgkey=https://pkgs.k8s.io/core:/stable:/v1.34/rpm/repodata/repomd.xml.key EOF Note:To upgrade kubectl to another minor release, you'll need to bump the version in /etc/zypp/repos.d/kubernetes.repo before running zypper update. This procedure is described in more detail in Changing The Kubernetes Package Repository.Update zypper and confirm the new repo addition:sudo zypper update When this message appears, press 't' or 'a':New repository or package signing key received: Repository: Kubernetes Key Fingerprint: 1111 2222 3333 4444 5555 6666 7777 8888 9999 AAAA Key Name: isv:kubernetes OBS Project <isv:kubernetes@build.opensuse.org> Key Algorithm: RSA 2048 Key Created: Thu 25 Aug 2022 01:21:11 PM -03 Key Expires: Sat 02 Nov 2024 01:21:11 PM -03 (expires in 85 days) Rpm Name: gpg-pubkey-9a296436-6307a177 Note: Signing data enables the recipient to verify that no modifications occurred after the data were signed. Accepting data with no, wrong or unknown signature can lead to a corrupted system and in extreme cases even to a system compromise. Note: A GPG pubkey is clearly identified by its fingerprint. Do not rely on the key's name. If you are not sure whether the presented key is authentic, ask the repository provider or check their web site. Many providers maintain a web page showing the fingerprints of the GPG keys they are using. Do you want to reject the key, trust temporarily, or trust always? [r/t/a/?] (r): a Install kubectl using zypper:sudo zypper install -y kubectl Install using other package managementIf you are on Ubuntu or another Linux distribution that supports the snap package manager, kubectl is available as a snap application.snap install kubectl --classic kubectl version --client If you are on Linux and using Homebrew package manager, kubectl is available for installation.brew install kubectl kubectl version --client Verify kubectl configurationIn order for kubectl to find and access a Kubernetes cluster, it needs a kubeconfig file, which is created automatically when you create a cluster using kube-up.sh or successfully deploy a Minikube cluster. By default, kubectl configuration is located at ~/.kube/config.Check that kubectl is properly configured by getting the cluster state:kubectl cluster-info If you see a URL response, kubectl is correctly configured to access your cluster.If you see a message similar to the following, kubectl is not configured correctly or is not able to connect to a Kubernetes cluster.The connection to the server <server-name:port> was refused - did you specify the right host or port? For example, if you are intending to run a Kubernetes cluster on your laptop (locally), you will need a tool like Minikube to be installed first and then re-run the commands stated above.If kubectl cluster-info returns the url response but you can't access your cluster, to check whether it is configured properly, use:kubectl cluster-info dump Troubleshooting the 'No Auth Provider Found' error messageIn Kubernetes 1.26, kubectl removed the built-in authentication for the following cloud providers' managed Kubernetes offerings. These providers have released kubectl plugins to provide the cloud-specific authentication. For instructions, refer to the following provider documentation:Azure AKS: kubelogin pluginGoogle Kubernetes Engine: gke-gcloud-auth-plugin(There could also be other reasons to see the same error message, unrelated to that change.)Optional kubectl configurations and pluginsEnable shell autocompletionkubectl provides autocompletion support for Bash, Zsh, Fish, and PowerShell, which can save you a lot of typing.Below are the procedures to set up autocompletion for Bash, Fish, and Zsh.IntroductionThe kubectl completion script for Bash can be generated with the command kubectl completion bash. Sourcing the completion script in your shell enables kubectl autocompletion.However, the completion script depends on bash-completion, which means that you have to install this software first (you can test if you have bash-completion already installed by running type _init_completion).Install bash-completionbash-completion is provided by many package managers (see here). You can install it with apt-get install bash-completion or yum install bash-completion, etc.The above commands create /usr/share/bash-completion/bash_completion, which is the main script of bash-completion. Depending on your package manager, you have to manually source this file in your ~/.bashrc file.To find out, reload your shell and run type _init_completion. If the command succeeds, you're already set, otherwise add the following to your ~/.bashrc file:source /usr/share/bash-completion/bash_completion Reload your shell and verify that bash-completion is correctly installed by typing type _init_completion.Enable kubectl autocompletionBashYou now need to ensure that the kubectl completion script gets sourced in all your shell sessions. There are two ways in which you can do this: echo 'source <(kubectl completion bash)' >>~/.bashrc kubectl completion bash | sudo tee /etc/bash_completion.d/kubectl > /dev/null sudo chmod a+r /etc/bash_completion.d/kubectl If you have an alias for kubectl, you can extend shell completion to work with that alias:echo 'alias k=kubectl' >>~/.bashrc echo 'complete -o default -F __start_kubectl k' >>~/.bashrc Note:bash-completion sources all completion scripts in /etc/bash_completion.d.Both approaches are equivalent. After reloading your shell, kubectl autocompletion should be working. To enable bash autocompletion in current session of shell, source the ~/.bashrc file:source ~/.bashrc Note:Autocomplete for Fish requires kubectl 1.23 or later.The kubectl completion script for Fish can be generated with the command kubectl completion fish. Sourcing the completion script in your shell enables kubectl autocompletion.To do so in all your shell sessions, add the following line to your ~/.config/fish/config.fish file:kubectl completion fish | source After reloading your shell, kubectl autocompletion should be working.The kubectl completion script for Zsh can be generated with the command kubectl completion zsh. Sourcing the completion script in your shell enables kubectl autocompletion.To do so in all your shell sessions, add the following to your ~/.zshrc file:source <(kubectl completion zsh) If you have an alias for kubectl, kubectl autocompletion will automatically work with it.After reloading your shell, kubectl autocompletion should be working.If you get an error like 2: command not found: compdef, then add the following to the beginning of your ~/.zshrc file:autoload -Uz compinit compinit Configure kubercSee kuberc for more information.Install kubectl convert pluginA plugin for Kubernetes command-line tool kubectl, which allows you to convert manifests between different API versions. This can be particularly helpful to migrate manifests to a non-deprecated api version with newer Kubernetes release. For more info, visit migrate to non deprecated apisDownload the latest release with the command: curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl-convert" curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/arm64/kubectl-convert" Validate the binary (optional)Download the kubectl-convert checksum file: curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl-convert.sha256" curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/arm64/kubectl-convert.sha256" Validate the kubectl-convert binary against the checksum file:echo "$(cat kubectl-convert.sha256) kubectl-convert" | sha256sum --check If valid, the output is:kubectl-convert: OK If the check fails, sha256 exits with nonzero status and prints output similar to:kubectl-convert: FAILED sha256sum: WARNING: 1 computed checksum did NOT match Note:Download the same version of the binary and checksum.Install kubectl-convertsudo install -o root -g root -m 0755 kubectl-convert /usr/local/bin/kubectl-convert Verify plugin is successfully installedkubectl convert --help If you do not see an error, it means the plugin is successfully installed.After installing the plugin, clean up the installation files:rm kubectl-convert kubectl-convert.sha256 What's