配置 API

• 1: Client Authentication (v1beta1)
• 2: kube-apiserver Audit Configuration (v1)
• 3: kube-proxy Configuration (v1alpha1)
• 4: kube-scheduler Configuration (v1beta1)
• 5: kube-scheduler Policy Configuration (v1)
• 6: Kubelet Configuration (v1beta1)
• 7: WebhookAdmission Configuration (v1)

1 - Client Authentication (v1beta1)

Resource Types

• ExecCredential

ExecCredential

ExecCredential is used by exec-based plugins to communicate credentials to HTTP transports.

Field	Description
apiVersion string	client.authentication.k8s.io/v1beta1
kind string	ExecCredential
spec [Required] ExecCredentialSpec	Spec holds information passed to the plugin by the transport.
status ExecCredentialStatus	Status is filled in by the plugin and holds the credentials that the transport should use to contact the API.

Cluster

Appears in:

• ExecCredentialSpec

Cluster contains information to allow an exec plugin to communicate with the kubernetes cluster being authenticated to.

To ensure that this struct contains everything someone would need to communicate with a kubernetes cluster (just like they would via a kubeconfig), the fields should shadow "k8s.io/client-go/tools/clientcmd/api/v1".Cluster, with the exception of CertificateAuthority, since CA data will always be passed to the plugin as bytes.

Field	Description
server [Required] string	Server is the address of the kubernetes cluster (https://hostname:port).
tls-server-name string	TLSServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname used to contact the server is used.
insecure-skip-tls-verify bool	InsecureSkipTLSVerify skips the validity check for the server's certificate. This will make your HTTPS connections insecure.
certificate-authority-data []byte	CAData contains PEM-encoded certificate authority certificates. If empty, system roots should be used.
proxy-url string	ProxyURL is the URL to the proxy to be used for all requests to this cluster.
config k8s.io/apimachinery/pkg/runtime.RawExtension	Config holds additional config data that is specific to the exec plugin with regards to the cluster being authenticated to. This data is sourced from the clientcmd Cluster object's extensions[client.authentication.k8s.io/exec] field: clusters: name: my-cluster cluster: ... extensions: name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config extension: audience: 06e3fbd18de8 # arbitrary config In some environments, the user config may be exactly the same across many clusters (i.e. call this exec plugin) minus some details that are specific to each cluster such as the audience. This field allows the per cluster config to be directly specified with the cluster info. Using this field to store secret data is not recommended as one of the prime benefits of exec plugins is that no secrets need to be stored directly in the kubeconfig.

ExecCredentialSpec

Appears in:

• ExecCredential

ExecCredentialSpec holds request and runtime specific information provided by the transport.

Field	Description
cluster Cluster	Cluster contains information to allow an exec plugin to communicate with the kubernetes cluster being authenticated to. Note that Cluster is non-nil only when provideClusterInfo is set to true in the exec provider config (i.e., ExecConfig.ProvideClusterInfo).

ExecCredentialStatus

Appears in:

• ExecCredential

ExecCredentialStatus holds credentials for the transport to use.

Token and ClientKeyData are sensitive fields. This data should only be transmitted in-memory between client and exec plugin process. Exec plugin itself should at least be protected via file permissions.

Field	Description
expirationTimestamp meta/v1.Time	ExpirationTimestamp indicates a time when the provided credentials expire.
token [Required] string	Token is a bearer token used by the client for request authentication.
clientCertificateData [Required] string	PEM-encoded client TLS certificates (including intermediates, if any).
clientKeyData [Required] string	PEM-encoded private key for the above certificate.

2 - kube-apiserver Audit Configuration (v1)

Resource Types

• Event
• EventList
• Policy
• PolicyList

Event

Appears in:

• EventList

Event captures all the information that can be included in an API audit log.

Field	Description
apiVersion string	audit.k8s.io/v1
kind string	Event
level [Required] Level	AuditLevel at which event was generated
auditID [Required] k8s.io/apimachinery/pkg/types.UID	Unique audit ID, generated for each request.
stage [Required] Stage	Stage of the request handling when this event instance was generated.
requestURI [Required] string	RequestURI is the request URI as sent by the client to a server.
verb [Required] string	Verb is the kubernetes verb associated with the request. For non-resource requests, this is the lower-cased HTTP method.
user [Required] authentication/v1.UserInfo	Authenticated user information.
impersonatedUser authentication/v1.UserInfo	Impersonated user information.
sourceIPs []string	Source IPs, from where the request originated and intermediate proxies.
userAgent string	UserAgent records the user agent string reported by the client. Note that the UserAgent is provided by the client, and must not be trusted.
objectRef ObjectReference	Object reference this request is targeted at. Does not apply for List-type requests, or non-resource requests.
responseStatus meta/v1.Status	The response status, populated even when the ResponseObject is not a Status type. For successful responses, this will only include the Code and StatusSuccess. For non-status type error responses, this will be auto-populated with the error Message.
requestObject k8s.io/apimachinery/pkg/runtime.Unknown	API object from the request, in JSON format. The RequestObject is recorded as-is in the request (possibly re-encoded as JSON), prior to version conversion, defaulting, admission or merging. It is an external versioned object type, and may not be a valid object on its own. Omitted for non-resource requests. Only logged at Request Level and higher.
responseObject k8s.io/apimachinery/pkg/runtime.Unknown	API object returned in the response, in JSON. The ResponseObject is recorded after conversion to the external type, and serialized as JSON. Omitted for non-resource requests. Only logged at Response Level.
requestReceivedTimestamp meta/v1.MicroTime	Time the request reached the apiserver.
stageTimestamp meta/v1.MicroTime	Time the request reached current audit stage.
annotations map[string]string	Annotations is an unstructured key value map stored with an audit event that may be set by plugins invoked in the request serving chain, including authentication, authorization and admission plugins. Note that these annotations are for the audit event, and do not correspond to the metadata.annotations of the submitted object. Keys should uniquely identify the informing component to avoid name collisions (e.g. podsecuritypolicy.admission.k8s.io/policy). Values should be short. Annotations are included in the Metadata level.

EventList

EventList is a list of audit Events.

Field	Description
apiVersion string	audit.k8s.io/v1
kind string	EventList
metadata meta/v1.ListMeta	No description provided.
items [Required] []Event	No description provided.

Policy

Appears in:

• PolicyList

Policy defines the configuration of audit logging, and the rules for how different request categories are logged.

Field	Description
apiVersion string	audit.k8s.io/v1
kind string	Policy
metadata meta/v1.ObjectMeta	ObjectMeta is included for interoperability with API infrastructure.Refer to the Kubernetes API documentation for the fields of the metadata field.
rules [Required] []PolicyRule	Rules specify the audit Level a request should be recorded at. A request may match multiple rules, in which case the FIRST matching rule is used. The default audit level is None, but can be overridden by a catch-all rule at the end of the list. PolicyRules are strictly ordered.
omitStages []Stage	OmitStages is a list of stages for which no events are created. Note that this can also be specified per rule in which case the union of both are omitted.

PolicyList

PolicyList is a list of audit Policies.

Field	Description
apiVersion string	audit.k8s.io/v1
kind string	PolicyList
metadata meta/v1.ListMeta	No description provided.
items [Required] []Policy	No description provided.

GroupResources

Appears in:

• PolicyRule

GroupResources represents resource kinds in an API group.

Field	Description
group string	Group is the name of the API group that contains the resources. The empty string represents the core API group.
resources []string	Resources is a list of resources this rule applies to. For example: 'pods' matches pods. 'pods/log' matches the log subresource of pods. '∗' matches all resources and their subresources. 'pods/∗' matches all subresources of pods. '∗/scale' matches all scale subresources. If wildcard is present, the validation rule will ensure resources do not overlap with each other. An empty list implies all resources and subresources in this API groups apply.
resourceNames []string	ResourceNames is a list of resource instance names that the policy matches. Using this field requires Resources to be specified. An empty list implies that every instance of the resource is matched.

Level

(Alias of string)

Appears in:

• Event

• PolicyRule

Level defines the amount of information logged during auditing

ObjectReference

Appears in:

• Event

ObjectReference contains enough information to let you inspect or modify the referred object.

Field	Description
resource string	No description provided.
namespace string	No description provided.
name string	No description provided.
uid k8s.io/apimachinery/pkg/types.UID	No description provided.
apiGroup string	APIGroup is the name of the API group that contains the referred object. The empty string represents the core API group.
apiVersion string	APIVersion is the version of the API group that contains the referred object.
resourceVersion string	No description provided.
subresource string	No description provided.

PolicyRule

Appears in:

• Policy

PolicyRule maps requests based off metadata to an audit Level. Requests must match the rules of every field (an intersection of rules).

Field	Description
level [Required] Level	The Level that requests matching this rule are recorded at.
users []string	The users (by authenticated user name) this rule applies to. An empty list implies every user.
userGroups []string	The user groups this rule applies to. A user is considered matching if it is a member of any of the UserGroups. An empty list implies every user group.
verbs []string	The verbs that match this rule. An empty list implies every verb.
resources []GroupResources	Resources that this rule matches. An empty list implies all kinds in all API groups.
namespaces []string	Namespaces that this rule matches. The empty string "" matches non-namespaced resources. An empty list implies every namespace.
nonResourceURLs []string	NonResourceURLs is a set of URL paths that should be audited. ∗s are allowed, but only as the full, final step in the path. Examples: "/metrics" - Log requests for apiserver metrics "/healthz∗" - Log all health checks
omitStages []Stage	OmitStages is a list of stages for which no events are created. Note that this can also be specified policy wide in which case the union of both are omitted. An empty list means no restrictions will apply.

Stage

(Alias of string)

Appears in:

• Event

• Policy

• PolicyRule

Stage defines the stages in request handling that audit events may be generated.

3 - kube-proxy Configuration (v1alpha1)

Resource Types

• KubeProxyConfiguration

KubeProxyConfiguration

KubeProxyConfiguration contains everything necessary to configure the Kubernetes proxy server.

Field	Description
apiVersion string	kubeproxy.config.k8s.io/v1alpha1
kind string	KubeProxyConfiguration
featureGates [Required] map[string]bool	featureGates is a map of feature names to bools that enable or disable alpha/experimental features.
bindAddress [Required] string	bindAddress is the IP address for the proxy server to serve on (set to 0.0.0.0 for all interfaces)
healthzBindAddress [Required] string	healthzBindAddress is the IP address and port for the health check server to serve on, defaulting to 0.0.0.0:10256
metricsBindAddress [Required] string	metricsBindAddress is the IP address and port for the metrics server to serve on, defaulting to 127.0.0.1:10249 (set to 0.0.0.0 for all interfaces)
bindAddressHardFail [Required] bool	bindAddressHardFail, if true, kube-proxy will treat failure to bind to a port as fatal and exit
enableProfiling [Required] bool	enableProfiling enables profiling via web interface on /debug/pprof handler. Profiling handlers will be handled by metrics server.
clusterCIDR [Required] string	clusterCIDR is the CIDR range of the pods in the cluster. It is used to bridge traffic coming from outside of the cluster. If not provided, no off-cluster bridging will be performed.
hostnameOverride [Required] string	hostnameOverride, if non-empty, will be used as the identity instead of the actual hostname.
clientConnection [Required] ClientConnectionConfiguration	clientConnection specifies the kubeconfig file and client connection settings for the proxy server to use when communicating with the apiserver.
iptables [Required] KubeProxyIPTablesConfiguration	iptables contains iptables-related configuration options.
ipvs [Required] KubeProxyIPVSConfiguration	ipvs contains ipvs-related configuration options.
oomScoreAdj [Required] int32	oomScoreAdj is the oom-score-adj value for kube-proxy process. Values must be within the range [-1000, 1000]
mode [Required] ProxyMode	mode specifies which proxy mode to use.
portRange [Required] string	portRange is the range of host ports (beginPort-endPort, inclusive) that may be consumed in order to proxy service traffic. If unspecified (0-0) then ports will be randomly chosen.
udpIdleTimeout [Required] meta/v1.Duration	udpIdleTimeout is how long an idle UDP connection will be kept open (e.g. '250ms', '2s'). Must be greater than 0. Only applicable for proxyMode=userspace.
conntrack [Required] KubeProxyConntrackConfiguration	conntrack contains conntrack-related configuration options.
configSyncPeriod [Required] meta/v1.Duration	configSyncPeriod is how often configuration from the apiserver is refreshed. Must be greater than 0.
nodePortAddresses [Required] []string	nodePortAddresses is the --nodeport-addresses value for kube-proxy process. Values must be valid IP blocks. These values are as a parameter to select the interfaces where nodeport works. In case someone would like to expose a service on localhost for local visit and some other interfaces for particular purpose, a list of IP blocks would do that. If set it to "127.0.0.0/8", kube-proxy will only select the loopback interface for NodePort. If set it to a non-zero IP block, kube-proxy will filter that down to just the IPs that applied to the node. An empty string slice is meant to select all network interfaces.
winkernel [Required] KubeProxyWinkernelConfiguration	winkernel contains winkernel-related configuration options.
showHiddenMetricsForVersion [Required] string	ShowHiddenMetricsForVersion is the version for which you want to show hidden metrics.
detectLocalMode [Required] LocalMode	DetectLocalMode determines mode to use for detecting local traffic, defaults to LocalModeClusterCIDR

KubeProxyConntrackConfiguration

Appears in:

• KubeProxyConfiguration

KubeProxyConntrackConfiguration contains conntrack settings for the Kubernetes proxy server.

Field	Description
maxPerCore [Required] int32	maxPerCore is the maximum number of NAT connections to track per CPU core (0 to leave the limit as-is and ignore min).
min [Required] int32	min is the minimum value of connect-tracking records to allocate, regardless of conntrackMaxPerCore (set maxPerCore=0 to leave the limit as-is).
tcpEstablishedTimeout [Required] meta/v1.Duration	tcpEstablishedTimeout is how long an idle TCP connection will be kept open (e.g. '2s'). Must be greater than 0 to set.
tcpCloseWaitTimeout [Required] meta/v1.Duration	tcpCloseWaitTimeout is how long an idle conntrack entry in CLOSE_WAIT state will remain in the conntrack table. (e.g. '60s'). Must be greater than 0 to set.

KubeProxyIPTablesConfiguration

Appears in:

• KubeProxyConfiguration

KubeProxyIPTablesConfiguration contains iptables-related configuration details for the Kubernetes proxy server.

Field	Description
masqueradeBit [Required] int32	masqueradeBit is the bit of the iptables fwmark space to use for SNAT if using the pure iptables proxy mode. Values must be within the range [0, 31].
masqueradeAll [Required] bool	masqueradeAll tells kube-proxy to SNAT everything if using the pure iptables proxy mode.
syncPeriod [Required] meta/v1.Duration	syncPeriod is the period that iptables rules are refreshed (e.g. '5s', '1m', '2h22m'). Must be greater than 0.
minSyncPeriod [Required] meta/v1.Duration	minSyncPeriod is the minimum period that iptables rules are refreshed (e.g. '5s', '1m', '2h22m').

KubeProxyIPVSConfiguration

Appears in:

• KubeProxyConfiguration

KubeProxyIPVSConfiguration contains ipvs-related configuration details for the Kubernetes proxy server.

Field	Description
syncPeriod [Required] meta/v1.Duration	syncPeriod is the period that ipvs rules are refreshed (e.g. '5s', '1m', '2h22m'). Must be greater than 0.
minSyncPeriod [Required] meta/v1.Duration	minSyncPeriod is the minimum period that ipvs rules are refreshed (e.g. '5s', '1m', '2h22m').
scheduler [Required] string	ipvs scheduler
excludeCIDRs [Required] []string	excludeCIDRs is a list of CIDR's which the ipvs proxier should not touch when cleaning up ipvs services.
strictARP [Required] bool	strict ARP configure arp_ignore and arp_announce to avoid answering ARP queries from kube-ipvs0 interface
tcpTimeout [Required] meta/v1.Duration	tcpTimeout is the timeout value used for idle IPVS TCP sessions. The default value is 0, which preserves the current timeout value on the system.
tcpFinTimeout [Required] meta/v1.Duration	tcpFinTimeout is the timeout value used for IPVS TCP sessions after receiving a FIN. The default value is 0, which preserves the current timeout value on the system.
udpTimeout [Required] meta/v1.Duration	udpTimeout is the timeout value used for IPVS UDP packets. The default value is 0, which preserves the current timeout value on the system.

KubeProxyWinkernelConfiguration

Appears in:

• KubeProxyConfiguration

KubeProxyWinkernelConfiguration contains Windows/HNS settings for the Kubernetes proxy server.

Field	Description
networkName [Required] string	networkName is the name of the network kube-proxy will use to create endpoints and policies
sourceVip [Required] string	sourceVip is the IP address of the source VIP endoint used for NAT when loadbalancing
enableDSR [Required] bool	enableDSR tells kube-proxy whether HNS policies should be created with DSR

LocalMode

(Alias of string)

Appears in:

• KubeProxyConfiguration

LocalMode represents modes to detect local traffic from the node

ProxyMode

(Alias of string)

Appears in:

• KubeProxyConfiguration

ProxyMode represents modes used by the Kubernetes proxy server.

Currently, three modes of proxy are available in Linux platform: 'userspace' (older, going to be EOL), 'iptables' (newer, faster), 'ipvs'(newest, better in performance and scalability).

Two modes of proxy are available in Windows platform: 'userspace'(older, stable) and 'kernelspace' (newer, faster).

In Linux platform, if proxy mode is blank, use the best-available proxy (currently iptables, but may change in the future). If the iptables proxy is selected, regardless of how, but the system's kernel or iptables versions are insufficient, this always falls back to the userspace proxy. IPVS mode will be enabled when proxy mode is set to 'ipvs', and the fall back path is firstly iptables and then userspace.

In Windows platform, if proxy mode is blank, use the best-available proxy (currently userspace, but may change in the future). If winkernel proxy is selected, regardless of how, but the Windows kernel can't support this mode of proxy, this always falls back to the userspace proxy.

ClientConnectionConfiguration

Appears in:

• KubeProxyConfiguration

ClientConnectionConfiguration contains details for constructing a client.

Field	Description
kubeconfig [Required] string	kubeconfig is the path to a KubeConfig file.
acceptContentTypes [Required] string	acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the default value of 'application/json'. This field will control all connections to the server used by a particular client.
contentType [Required] string	contentType is the content type used when sending data to the server from this client.
qps [Required] float32	qps controls the number of queries per second allowed for this connection.
burst [Required] int32	burst allows extra queries to accumulate when a client is exceeding its rate.

4 - kube-scheduler Configuration (v1beta1)

Resource Types

• Policy
• DefaultPreemptionArgs
• InterPodAffinityArgs
• KubeSchedulerConfiguration
• NodeAffinityArgs
• NodeLabelArgs
• NodeResourcesFitArgs
• NodeResourcesLeastAllocatedArgs
• NodeResourcesMostAllocatedArgs
• PodTopologySpreadArgs
• RequestedToCapacityRatioArgs
• ServiceAffinityArgs
• VolumeBindingArgs

Policy

Policy describes a struct for a policy resource used in api.

Field	Description
apiVersion string	kubescheduler.config.k8s.io/v1
kind string	Policy
predicates [Required] []PredicatePolicy	Holds the information to configure the fit predicate functions
priorities [Required] []PriorityPolicy	Holds the information to configure the priority functions
extenders [Required] []LegacyExtender	Holds the information to communicate with the extender(s)
hardPodAffinitySymmetricWeight [Required] int32	RequiredDuringScheduling affinity is not symmetric, but there is an implicit PreferredDuringScheduling affinity rule corresponding to every RequiredDuringScheduling affinity rule. HardPodAffinitySymmetricWeight represents the weight of implicit PreferredDuringScheduling affinity rule, in the range 1-100.
alwaysCheckAllPredicates [Required] bool	When AlwaysCheckAllPredicates is set to true, scheduler checks all the configured predicates even after one or more of them fails. When the flag is set to false, scheduler skips checking the rest of the predicates after it finds one predicate that failed.

ExtenderManagedResource

Appears in:

• Extender

• LegacyExtender

ExtenderManagedResource describes the arguments of extended resources managed by an extender.

Field	Description
name [Required] string	Name is the extended resource name.
ignoredByScheduler [Required] bool	IgnoredByScheduler indicates whether kube-scheduler should ignore this resource when applying predicates.

ExtenderTLSConfig

Appears in:

• Extender

• LegacyExtender

ExtenderTLSConfig contains settings to enable TLS with extender

Field	Description
insecure [Required] bool	Server should be accessed without verifying the TLS certificate. For testing only.
serverName [Required] string	ServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname used to contact the server is used.
certFile [Required] string	Server requires TLS client certificate authentication
keyFile [Required] string	Server requires TLS client certificate authentication
caFile [Required] string	Trusted root certificates for server
certData [Required] []byte	CertData holds PEM-encoded bytes (typically read from a client certificate file). CertData takes precedence over CertFile
keyData [Required] []byte	KeyData holds PEM-encoded bytes (typically read from a client certificate key file). KeyData takes precedence over KeyFile
caData [Required] []byte	CAData holds PEM-encoded bytes (typically read from a root certificates bundle). CAData takes precedence over CAFile

LabelPreference

Appears in:

• PriorityArgument

LabelPreference holds the parameters that are used to configure the corresponding priority function

Field	Description
label [Required] string	Used to identify node "groups"
presence [Required] bool	This is a boolean flag If true, higher priority is given to nodes that have the label If false, higher priority is given to nodes that do not have the label

LabelsPresence

Appears in:

• PredicateArgument

LabelsPresence holds the parameters that are used to configure the corresponding predicate in scheduler policy configuration.

Field	Description
labels [Required] []string	The list of labels that identify node "groups" All of the labels should be either present (or absent) for the node to be considered a fit for hosting the pod
presence [Required] bool	The boolean flag that indicates whether the labels should be present or absent from the node

LegacyExtender

Appears in:

• Policy

LegacyExtender holds the parameters used to communicate with the extender. If a verb is unspecified/empty, it is assumed that the extender chose not to provide that extension.

Field	Description
urlPrefix [Required] string	URLPrefix at which the extender is available
filterVerb [Required] string	Verb for the filter call, empty if not supported. This verb is appended to the URLPrefix when issuing the filter call to extender.
preemptVerb [Required] string	Verb for the preempt call, empty if not supported. This verb is appended to the URLPrefix when issuing the preempt call to extender.
prioritizeVerb [Required] string	Verb for the prioritize call, empty if not supported. This verb is appended to the URLPrefix when issuing the prioritize call to extender.
weight [Required] int64	The numeric multiplier for the node scores that the prioritize call generates. The weight should be a positive integer
bindVerb [Required] string	Verb for the bind call, empty if not supported. This verb is appended to the URLPrefix when issuing the bind call to extender. If this method is implemented by the extender, it is the extender's responsibility to bind the pod to apiserver. Only one extender can implement this function.
enableHttps [Required] bool	EnableHTTPS specifies whether https should be used to communicate with the extender
tlsConfig [Required] ExtenderTLSConfig	TLSConfig specifies the transport layer security config
httpTimeout [Required] time.Duration	HTTPTimeout specifies the timeout duration for a call to the extender. Filter timeout fails the scheduling of the pod. Prioritize timeout is ignored, k8s/other extenders priorities are used to select the node.
nodeCacheCapable [Required] bool	NodeCacheCapable specifies that the extender is capable of caching node information, so the scheduler should only send minimal information about the eligible nodes assuming that the extender already cached full details of all nodes in the cluster
managedResources []ExtenderManagedResource	ManagedResources is a list of extended resources that are managed by this extender. - A pod will be sent to the extender on the Filter, Prioritize and Bind (if the extender is the binder) phases iff the pod requests at least one of the extended resources in this list. If empty or unspecified, all pods will be sent to this extender. - If IgnoredByScheduler is set to true for a resource, kube-scheduler will skip checking the resource in predicates.
ignorable [Required] bool	Ignorable specifies if the extender is ignorable, i.e. scheduling should not fail when the extender returns an error or is not reachable.

PredicateArgument

Appears in:

• PredicatePolicy

PredicateArgument represents the arguments to configure predicate functions in scheduler policy configuration. Only one of its members may be specified

Field	Description
serviceAffinity [Required] ServiceAffinity	The predicate that provides affinity for pods belonging to a service It uses a label to identify nodes that belong to the same "group"
labelsPresence [Required] LabelsPresence	The predicate that checks whether a particular node has a certain label defined or not, regardless of value

PredicatePolicy

Appears in:

• Policy

PredicatePolicy describes a struct of a predicate policy.

Field	Description
name [Required] string	Identifier of the predicate policy For a custom predicate, the name can be user-defined For the Kubernetes provided predicates, the name is the identifier of the pre-defined predicate
argument [Required] PredicateArgument	Holds the parameters to configure the given predicate

PriorityArgument

Appears in:

• PriorityPolicy

PriorityArgument represents the arguments to configure priority functions in scheduler policy configuration. Only one of its members may be specified

Field	Description
serviceAntiAffinity [Required] ServiceAntiAffinity	The priority function that ensures a good spread (anti-affinity) for pods belonging to a service It uses a label to identify nodes that belong to the same "group"
labelPreference [Required] LabelPreference	The priority function that checks whether a particular node has a certain label defined or not, regardless of value
requestedToCapacityRatioArguments [Required] RequestedToCapacityRatioArguments	The RequestedToCapacityRatio priority function is parametrized with function shape.

PriorityPolicy

Appears in:

• Policy

PriorityPolicy describes a struct of a priority policy.

Field	Description
name [Required] string	Identifier of the priority policy For a custom priority, the name can be user-defined For the Kubernetes provided priority functions, the name is the identifier of the pre-defined priority function
weight [Required] int64	The numeric multiplier for the node scores that the priority function generates The weight should be non-zero and can be a positive or a negative integer
argument [Required] PriorityArgument	Holds the parameters to configure the given priority function

RequestedToCapacityRatioArguments

Appears in:

• PriorityArgument

RequestedToCapacityRatioArguments holds arguments specific to RequestedToCapacityRatio priority function.

Field	Description
shape [Required] []UtilizationShapePoint	Array of point defining priority function shape.
resources [Required] []ResourceSpec	No description provided.

ResourceSpec

Appears in:

• RequestedToCapacityRatioArguments

ResourceSpec represents single resource and weight for bin packing of priority RequestedToCapacityRatioArguments.

Field	Description
name [Required] string	Name of the resource to be managed by RequestedToCapacityRatio function.
weight [Required] int64	Weight of the resource.

ServiceAffinity

Appears in:

• PredicateArgument

ServiceAffinity holds the parameters that are used to configure the corresponding predicate in scheduler policy configuration.

Field	Description
labels [Required] []string	The list of labels that identify node "groups" All of the labels should match for the node to be considered a fit for hosting the pod

ServiceAntiAffinity

Appears in:

• PriorityArgument

ServiceAntiAffinity holds the parameters that are used to configure the corresponding priority function

Field	Description
label [Required] string	Used to identify node "groups"

UtilizationShapePoint

Appears in:

• RequestedToCapacityRatioArguments

UtilizationShapePoint represents single point of priority function shape.

Field	Description
utilization [Required] int32	Utilization (x axis). Valid values are 0 to 100. Fully utilized node maps to 100.
score [Required] int32	Score assigned to given utilization (y axis). Valid values are 0 to 10.

ClientConnectionConfiguration

Appears in:

• KubeSchedulerConfiguration

ClientConnectionConfiguration contains details for constructing a client.

Field	Description
kubeconfig [Required] string	kubeconfig is the path to a KubeConfig file.
acceptContentTypes [Required] string	acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the default value of 'application/json'. This field will control all connections to the server used by a particular client.
contentType [Required] string	contentType is the content type used when sending data to the server from this client.
qps [Required] float32	qps controls the number of queries per second allowed for this connection.
burst [Required] int32	burst allows extra queries to accumulate when a client is exceeding its rate.

DebuggingConfiguration

Appears in:

• KubeSchedulerConfiguration

DebuggingConfiguration holds configuration for Debugging related features.

Field	Description
enableProfiling [Required] bool	enableProfiling enables profiling via web interface host:port/debug/pprof/
enableContentionProfiling [Required] bool	enableContentionProfiling enables lock contention profiling, if enableProfiling is true.

LeaderElectionConfiguration

Appears in:

• KubeSchedulerConfiguration

LeaderElectionConfiguration defines the configuration of leader election clients for components that can run with leader election enabled.

Field	Description
leaderElect [Required] bool	leaderElect enables a leader election client to gain leadership before executing the main loop. Enable this when running replicated components for high availability.
leaseDuration [Required] meta/v1.Duration	leaseDuration is the duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate. This is only applicable if leader election is enabled.
renewDeadline [Required] meta/v1.Duration	renewDeadline is the interval between attempts by the acting master to renew a leadership slot before it stops leading. This must be less than or equal to the lease duration. This is only applicable if leader election is enabled.
retryPeriod [Required] meta/v1.Duration	retryPeriod is the duration the clients should wait between attempting acquisition and renewal of a leadership. This is only applicable if leader election is enabled.
resourceLock [Required] string	resourceLock indicates the resource object type that will be used to lock during leader election cycles.
resourceName [Required] string	resourceName indicates the name of resource object that will be used to lock during leader election cycles.
resourceNamespace [Required] string	resourceName indicates the namespace of resource object that will be used to lock during leader election cycles.

LoggingConfiguration

Appears in:

• KubeletConfiguration

LoggingConfiguration contains logging options Refer Logs Options for more information.

Field	Description
format [Required] string	Format Flag specifies the structure of log messages. default value of format is `text`
sanitization [Required] bool	[Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)

DefaultPreemptionArgs

DefaultPreemptionArgs holds arguments used to configure the DefaultPreemption plugin.

Field	Description
apiVersion string	kubescheduler.config.k8s.io/v1beta1
kind string	DefaultPreemptionArgs
minCandidateNodesPercentage [Required] int32	MinCandidateNodesPercentage is the minimum number of candidates to shortlist when dry running preemption as a percentage of number of nodes. Must be in the range [0, 100]. Defaults to 10% of the cluster size if unspecified.
minCandidateNodesAbsolute [Required] int32	MinCandidateNodesAbsolute is the absolute minimum number of candidates to shortlist. The likely number of candidates enumerated for dry running preemption is given by the formula: numCandidates = max(numNodes ∗ minCandidateNodesPercentage, minCandidateNodesAbsolute) We say "likely" because there are other factors such as PDB violations that play a role in the number of candidates shortlisted. Must be at least 0 nodes. Defaults to 100 nodes if unspecified.

InterPodAffinityArgs

InterPodAffinityArgs holds arguments used to configure the InterPodAffinity plugin.

Field	Description
apiVersion string	kubescheduler.config.k8s.io/v1beta1
kind string	InterPodAffinityArgs
hardPodAffinityWeight [Required] int32	HardPodAffinityWeight is the scoring weight for existing pods with a matching hard affinity to the incoming pod.

KubeSchedulerConfiguration

KubeSchedulerConfiguration configures a scheduler

Field	Description
apiVersion string	kubescheduler.config.k8s.io/v1beta1
kind string	KubeSchedulerConfiguration
parallelism [Required] int32	Parallelism defines the amount of parallelism in algorithms for scheduling a Pods. Must be greater than 0. Defaults to 16
leaderElection [Required] LeaderElectionConfiguration	LeaderElection defines the configuration of leader election client.
clientConnection [Required] ClientConnectionConfiguration	ClientConnection specifies the kubeconfig file and client connection settings for the proxy server to use when communicating with the apiserver.
healthzBindAddress [Required] string	HealthzBindAddress is the IP address and port for the health check server to serve on, defaulting to 0.0.0.0:10251
metricsBindAddress [Required] string	MetricsBindAddress is the IP address and port for the metrics server to serve on, defaulting to 0.0.0.0:10251.
DebuggingConfiguration [Required] DebuggingConfiguration	(Members of DebuggingConfiguration are embedded into this type.) DebuggingConfiguration holds configuration for Debugging related features TODO: We might wanna make this a substruct like Debugging componentbaseconfigv1alpha1.DebuggingConfiguration
percentageOfNodesToScore [Required] int32	PercentageOfNodesToScore is the percentage of all nodes that once found feasible for running a pod, the scheduler stops its search for more feasible nodes in the cluster. This helps improve scheduler's performance. Scheduler always tries to find at least "minFeasibleNodesToFind" feasible nodes no matter what the value of this flag is. Example: if the cluster size is 500 nodes and the value of this flag is 30, then scheduler stops finding further feasible nodes once it finds 150 feasible ones. When the value is 0, default percentage (5%--50% based on the size of the cluster) of the nodes will be scored.
podInitialBackoffSeconds [Required] int64	PodInitialBackoffSeconds is the initial backoff for unschedulable pods. If specified, it must be greater than 0. If this value is null, the default value (1s) will be used.
podMaxBackoffSeconds [Required] int64	PodMaxBackoffSeconds is the max backoff for unschedulable pods. If specified, it must be greater than podInitialBackoffSeconds. If this value is null, the default value (10s) will be used.
profiles [Required] []KubeSchedulerProfile	Profiles are scheduling profiles that kube-scheduler supports. Pods can choose to be scheduled under a particular profile by setting its associated scheduler name. Pods that don't specify any scheduler name are scheduled with the "default-scheduler" profile, if present here.
extenders [Required] []Extender	Extenders are the list of scheduler extenders, each holding the values of how to communicate with the extender. These extenders are shared by all scheduler profiles.

NodeAffinityArgs

NodeAffinityArgs holds arguments to configure the NodeAffinity plugin.

Field	Description
apiVersion string	kubescheduler.config.k8s.io/v1beta1
kind string	NodeAffinityArgs
addedAffinity core/v1.NodeAffinity	AddedAffinity is applied to all Pods additionally to the NodeAffinity specified in the PodSpec. That is, Nodes need to satisfy AddedAffinity AND .spec.NodeAffinity. AddedAffinity is empty by default (all Nodes match). When AddedAffinity is used, some Pods with affinity requirements that match a specific Node (such as Daemonset Pods) might remain unschedulable.

NodeLabelArgs

NodeLabelArgs holds arguments used to configure the NodeLabel plugin.

Field	Description
apiVersion string	kubescheduler.config.k8s.io/v1beta1
kind string	NodeLabelArgs
presentLabels [Required] []string	PresentLabels should be present for the node to be considered a fit for hosting the pod
absentLabels [Required] []string	AbsentLabels should be absent for the node to be considered a fit for hosting the pod
presentLabelsPreference [Required] []string	Nodes that have labels in the list will get a higher score.
absentLabelsPreference [Required] []string	Nodes that don't have labels in the list will get a higher score.

NodeResourcesFitArgs

NodeResourcesFitArgs holds arguments used to configure the NodeResourcesFit plugin.

Field	Description
apiVersion string	kubescheduler.config.k8s.io/v1beta1
kind string	NodeResourcesFitArgs
ignoredResources [Required] []string	IgnoredResources is the list of resources that NodeResources fit filter should ignore.
ignoredResourceGroups [Required] []string	IgnoredResourceGroups defines the list of resource groups that NodeResources fit filter should ignore. e.g. if group is ["example.com"], it will ignore all resource names that begin with "example.com", such as "example.com/aaa" and "example.com/bbb". A resource group name can't contain '/'.

NodeResourcesLeastAllocatedArgs

NodeResourcesLeastAllocatedArgs holds arguments used to configure NodeResourcesLeastAllocated plugin.

Field	Description
apiVersion string	kubescheduler.config.k8s.io/v1beta1
kind string	NodeResourcesLeastAllocatedArgs
resources [Required] []ResourceSpec	Resources to be managed, if no resource is provided, default resource set with both the weight of "cpu" and "memory" set to "1" will be applied. Resource with "0" weight will not accountable for the final score.

NodeResourcesMostAllocatedArgs

NodeResourcesMostAllocatedArgs holds arguments used to configure NodeResourcesMostAllocated plugin.

Field	Description
apiVersion string	kubescheduler.config.k8s.io/v1beta1
kind string	NodeResourcesMostAllocatedArgs
resources [Required] []ResourceSpec	Resources to be managed, if no resource is provided, default resource set with both the weight of "cpu" and "memory" set to "1" will be applied. Resource with "0" weight will not accountable for the final score.

PodTopologySpreadArgs

PodTopologySpreadArgs holds arguments used to configure the PodTopologySpread plugin.

Field	Description
apiVersion string	kubescheduler.config.k8s.io/v1beta1
kind string	PodTopologySpreadArgs
defaultConstraints []core/v1.TopologySpreadConstraint	DefaultConstraints defines topology spread constraints to be applied to Pods that don't define any in `pod.spec.topologySpreadConstraints`. `.defaultConstraints[∗].labelSelectors` must be empty, as they are deduced from the Pod's membership to Services, ReplicationControllers, ReplicaSets or StatefulSets. When not empty, .defaultingType must be "List".
defaultingType PodTopologySpreadConstraintsDefaulting	DefaultingType determines how .defaultConstraints are deduced. Can be one of "System" or "List". "System": Use kubernetes defined constraints that spread Pods among Nodes and Zones. "List": Use constraints defined in .defaultConstraints. Defaults to "List" if feature gate DefaultPodTopologySpread is disabled and to "System" if enabled.

RequestedToCapacityRatioArgs

RequestedToCapacityRatioArgs holds arguments used to configure RequestedToCapacityRatio plugin.

Field	Description
apiVersion string	kubescheduler.config.k8s.io/v1beta1
kind string	RequestedToCapacityRatioArgs
shape [Required] []UtilizationShapePoint	Points defining priority function shape
resources [Required] []ResourceSpec	Resources to be managed

ServiceAffinityArgs

ServiceAffinityArgs holds arguments used to configure the ServiceAffinity plugin.

Field	Description
apiVersion string	kubescheduler.config.k8s.io/v1beta1
kind string	ServiceAffinityArgs
affinityLabels [Required] []string	AffinityLabels are homogeneous for pods that are scheduled to a node. (i.e. it returns true IFF this pod can be added to this node such that all other pods in the same service are running on nodes with the exact same values for Labels).
antiAffinityLabelsPreference [Required] []string	AntiAffinityLabelsPreference are the labels to consider for service anti affinity scoring.

VolumeBindingArgs

VolumeBindingArgs holds arguments used to configure the VolumeBinding plugin.

Field	Description
apiVersion string	kubescheduler.config.k8s.io/v1beta1
kind string	VolumeBindingArgs
bindTimeoutSeconds [Required] int64	BindTimeoutSeconds is the timeout in seconds in volume binding operation. Value must be non-negative integer. The value zero indicates no waiting. If this value is nil, the default value (600) will be used.

Extender

Appears in:

• KubeSchedulerConfiguration

Extender holds the parameters used to communicate with the extender. If a verb is unspecified/empty, it is assumed that the extender chose not to provide that extension.

Field	Description
urlPrefix [Required] string	URLPrefix at which the extender is available
filterVerb [Required] string	Verb for the filter call, empty if not supported. This verb is appended to the URLPrefix when issuing the filter call to extender.
preemptVerb [Required] string	Verb for the preempt call, empty if not supported. This verb is appended to the URLPrefix when issuing the preempt call to extender.
prioritizeVerb [Required] string	Verb for the prioritize call, empty if not supported. This verb is appended to the URLPrefix when issuing the prioritize call to extender.
weight [Required] int64	The numeric multiplier for the node scores that the prioritize call generates. The weight should be a positive integer
bindVerb [Required] string	Verb for the bind call, empty if not supported. This verb is appended to the URLPrefix when issuing the bind call to extender. If this method is implemented by the extender, it is the extender's responsibility to bind the pod to apiserver. Only one extender can implement this function.
enableHTTPS [Required] bool	EnableHTTPS specifies whether https should be used to communicate with the extender
tlsConfig [Required] ExtenderTLSConfig	TLSConfig specifies the transport layer security config
httpTimeout [Required] meta/v1.Duration	HTTPTimeout specifies the timeout duration for a call to the extender. Filter timeout fails the scheduling of the pod. Prioritize timeout is ignored, k8s/other extenders priorities are used to select the node.
nodeCacheCapable [Required] bool	NodeCacheCapable specifies that the extender is capable of caching node information, so the scheduler should only send minimal information about the eligible nodes assuming that the extender already cached full details of all nodes in the cluster
managedResources []ExtenderManagedResource	ManagedResources is a list of extended resources that are managed by this extender. - A pod will be sent to the extender on the Filter, Prioritize and Bind (if the extender is the binder) phases iff the pod requests at least one of the extended resources in this list. If empty or unspecified, all pods will be sent to this extender. - If IgnoredByScheduler is set to true for a resource, kube-scheduler will skip checking the resource in predicates.
ignorable [Required] bool	Ignorable specifies if the extender is ignorable, i.e. scheduling should not fail when the extender returns an error or is not reachable.

KubeSchedulerProfile

Appears in:

• KubeSchedulerConfiguration

KubeSchedulerProfile is a scheduling profile.

Field	Description
schedulerName [Required] string	SchedulerName is the name of the scheduler associated to this profile. If SchedulerName matches with the pod's "spec.schedulerName", then the pod is scheduled with this profile.
plugins [Required] Plugins	Plugins specify the set of plugins that should be enabled or disabled. Enabled plugins are the ones that should be enabled in addition to the default plugins. Disabled plugins are any of the default plugins that should be disabled. When no enabled or disabled plugin is specified for an extension point, default plugins for that extension point will be used if there is any. If a QueueSort plugin is specified, the same QueueSort Plugin and PluginConfig must be specified for all profiles.
pluginConfig [Required] []PluginConfig	PluginConfig is an optional set of custom plugin arguments for each plugin. Omitting config args for a plugin is equivalent to using the default config for that plugin.

Plugin

Appears in:

• PluginSet

Plugin specifies a plugin name and its weight when applicable. Weight is used only for Score plugins.

Field	Description
name [Required] string	Name defines the name of plugin
weight [Required] int32	Weight defines the weight of plugin, only used for Score plugins.

PluginConfig

Appears in:

• KubeSchedulerProfile

PluginConfig specifies arguments that should be passed to a plugin at the time of initialization. A plugin that is invoked at multiple extension points is initialized once. Args can have arbitrary structure. It is up to the plugin to process these Args.

Field	Description
name [Required] string	Name defines the name of plugin being configured
args [Required] k8s.io/apimachinery/pkg/runtime.RawExtension	Args defines the arguments passed to the plugins at the time of initialization. Args can have arbitrary structure.

PluginSet

Appears in:

• Plugins

PluginSet specifies enabled and disabled plugins for an extension point. If an array is empty, missing, or nil, default plugins at that extension point will be used.

Field	Description
enabled [Required] []Plugin	Enabled specifies plugins that should be enabled in addition to default plugins. These are called after default plugins and in the same order specified here.
disabled [Required] []Plugin	Disabled specifies default plugins that should be disabled. When all default plugins need to be disabled, an array containing only one "∗" should be provided.

Plugins

Appears in:

• KubeSchedulerProfile

Plugins include multiple extension points. When specified, the list of plugins for a particular extension point are the only ones enabled. If an extension point is omitted from the config, then the default set of plugins is used for that extension point. Enabled plugins are called in the order specified here, after default plugins. If they need to be invoked before default plugins, default plugins must be disabled and re-enabled here in desired order.

Field	Description
queueSort [Required] PluginSet	QueueSort is a list of plugins that should be invoked when sorting pods in the scheduling queue.
preFilter [Required] PluginSet	PreFilter is a list of plugins that should be invoked at "PreFilter" extension point of the scheduling framework.
filter [Required] PluginSet	Filter is a list of plugins that should be invoked when filtering out nodes that cannot run the Pod.
postFilter [Required] PluginSet	PostFilter is a list of plugins that are invoked after filtering phase, no matter whether filtering succeeds or not.
preScore [Required] PluginSet	PreScore is a list of plugins that are invoked before scoring.
score [Required] PluginSet	Score is a list of plugins that should be invoked when ranking nodes that have passed the filtering phase.
reserve [Required] PluginSet	Reserve is a list of plugins invoked when reserving/unreserving resources after a node is assigned to run the pod.
permit [Required] PluginSet	Permit is a list of plugins that control binding of a Pod. These plugins can prevent or delay binding of a Pod.
preBind [Required] PluginSet	PreBind is a list of plugins that should be invoked before a pod is bound.
bind [Required] PluginSet	Bind is a list of plugins that should be invoked at "Bind" extension point of the scheduling framework. The scheduler call these plugins in order. Scheduler skips the rest of these plugins as soon as one returns success.
postBind [Required] PluginSet	PostBind is a list of plugins that should be invoked after a pod is successfully bound.

PodTopologySpreadConstraintsDefaulting

(Alias of string)

Appears in:

• PodTopologySpreadArgs

PodTopologySpreadConstraintsDefaulting defines how to set default constraints for the PodTopologySpread plugin.

ResourceSpec

Appears in:

• NodeResourcesLeastAllocatedArgs

• NodeResourcesMostAllocatedArgs

• RequestedToCapacityRatioArgs

ResourceSpec represents single resource and weight for bin packing of priority RequestedToCapacityRatioArguments.

Field	Description
name [Required] string	Name of the resource to be managed by RequestedToCapacityRatio function.
weight [Required] int64	Weight of the resource.

UtilizationShapePoint

Appears in:

• RequestedToCapacityRatioArgs

UtilizationShapePoint represents single point of priority function shape.

Field	Description
utilization [Required] int32	Utilization (x axis). Valid values are 0 to 100. Fully utilized node maps to 100.
score [Required] int32	Score assigned to given utilization (y axis). Valid values are 0 to 10.

5 - kube-scheduler Policy Configuration (v1)

Resource Types

• Policy

Policy

Policy describes a struct for a policy resource used in api.

Field	Description
apiVersion string	kubescheduler.config.k8s.io/v1
kind string	Policy
predicates [Required] []PredicatePolicy	Holds the information to configure the fit predicate functions
priorities [Required] []PriorityPolicy	Holds the information to configure the priority functions
extenders [Required] []LegacyExtender	Holds the information to communicate with the extender(s)
hardPodAffinitySymmetricWeight [Required] int32	RequiredDuringScheduling affinity is not symmetric, but there is an implicit PreferredDuringScheduling affinity rule corresponding to every RequiredDuringScheduling affinity rule. HardPodAffinitySymmetricWeight represents the weight of implicit PreferredDuringScheduling affinity rule, in the range 1-100.
alwaysCheckAllPredicates [Required] bool	When AlwaysCheckAllPredicates is set to true, scheduler checks all the configured predicates even after one or more of them fails. When the flag is set to false, scheduler skips checking the rest of the predicates after it finds one predicate that failed.

ExtenderManagedResource

Appears in:

• Extender

• LegacyExtender

ExtenderManagedResource describes the arguments of extended resources managed by an extender.

Field	Description
name [Required] string	Name is the extended resource name.
ignoredByScheduler [Required] bool	IgnoredByScheduler indicates whether kube-scheduler should ignore this resource when applying predicates.

ExtenderTLSConfig

Appears in:

• Extender

• LegacyExtender

ExtenderTLSConfig contains settings to enable TLS with extender

Field	Description
insecure [Required] bool	Server should be accessed without verifying the TLS certificate. For testing only.
serverName [Required] string	ServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname used to contact the server is used.
certFile [Required] string	Server requires TLS client certificate authentication
keyFile [Required] string	Server requires TLS client certificate authentication
caFile [Required] string	Trusted root certificates for server
certData [Required] []byte	CertData holds PEM-encoded bytes (typically read from a client certificate file). CertData takes precedence over CertFile
keyData [Required] []byte	KeyData holds PEM-encoded bytes (typically read from a client certificate key file). KeyData takes precedence over KeyFile
caData [Required] []byte	CAData holds PEM-encoded bytes (typically read from a root certificates bundle). CAData takes precedence over CAFile

LabelPreference

Appears in:

• PriorityArgument

LabelPreference holds the parameters that are used to configure the corresponding priority function

Field	Description
label [Required] string	Used to identify node "groups"
presence [Required] bool	This is a boolean flag If true, higher priority is given to nodes that have the label If false, higher priority is given to nodes that do not have the label

LabelsPresence

Appears in:

• PredicateArgument

LabelsPresence holds the parameters that are used to configure the corresponding predicate in scheduler policy configuration.

Field	Description
labels [Required] []string	The list of labels that identify node "groups" All of the labels should be either present (or absent) for the node to be considered a fit for hosting the pod
presence [Required] bool	The boolean flag that indicates whether the labels should be present or absent from the node

LegacyExtender

Appears in:

• Policy

LegacyExtender holds the parameters used to communicate with the extender. If a verb is unspecified/empty, it is assumed that the extender chose not to provide that extension.

Field	Description
urlPrefix [Required] string	URLPrefix at which the extender is available
filterVerb [Required] string	Verb for the filter call, empty if not supported. This verb is appended to the URLPrefix when issuing the filter call to extender.
preemptVerb [Required] string	Verb for the preempt call, empty if not supported. This verb is appended to the URLPrefix when issuing the preempt call to extender.
prioritizeVerb [Required] string	Verb for the prioritize call, empty if not supported. This verb is appended to the URLPrefix when issuing the prioritize call to extender.
weight [Required] int64	The numeric multiplier for the node scores that the prioritize call generates. The weight should be a positive integer
bindVerb [Required] string	Verb for the bind call, empty if not supported. This verb is appended to the URLPrefix when issuing the bind call to extender. If this method is implemented by the extender, it is the extender's responsibility to bind the pod to apiserver. Only one extender can implement this function.
enableHttps [Required] bool	EnableHTTPS specifies whether https should be used to communicate with the extender
tlsConfig [Required] ExtenderTLSConfig	TLSConfig specifies the transport layer security config
httpTimeout [Required] time.Duration	HTTPTimeout specifies the timeout duration for a call to the extender. Filter timeout fails the scheduling of the pod. Prioritize timeout is ignored, k8s/other extenders priorities are used to select the node.
nodeCacheCapable [Required] bool	NodeCacheCapable specifies that the extender is capable of caching node information, so the scheduler should only send minimal information about the eligible nodes assuming that the extender already cached full details of all nodes in the cluster
managedResources []ExtenderManagedResource	ManagedResources is a list of extended resources that are managed by this extender. - A pod will be sent to the extender on the Filter, Prioritize and Bind (if the extender is the binder) phases iff the pod requests at least one of the extended resources in this list. If empty or unspecified, all pods will be sent to this extender. - If IgnoredByScheduler is set to true for a resource, kube-scheduler will skip checking the resource in predicates.
ignorable [Required] bool	Ignorable specifies if the extender is ignorable, i.e. scheduling should not fail when the extender returns an error or is not reachable.

PredicateArgument

Appears in:

• PredicatePolicy

PredicateArgument represents the arguments to configure predicate functions in scheduler policy configuration. Only one of its members may be specified

Field	Description
serviceAffinity [Required] ServiceAffinity	The predicate that provides affinity for pods belonging to a service It uses a label to identify nodes that belong to the same "group"
labelsPresence [Required] LabelsPresence	The predicate that checks whether a particular node has a certain label defined or not, regardless of value

PredicatePolicy

Appears in:

• Policy

PredicatePolicy describes a struct of a predicate policy.

Field	Description
name [Required] string	Identifier of the predicate policy For a custom predicate, the name can be user-defined For the Kubernetes provided predicates, the name is the identifier of the pre-defined predicate
argument [Required] PredicateArgument	Holds the parameters to configure the given predicate

PriorityArgument

Appears in:

• PriorityPolicy

PriorityArgument represents the arguments to configure priority functions in scheduler policy configuration. Only one of its members may be specified

Field	Description
serviceAntiAffinity [Required] ServiceAntiAffinity	The priority function that ensures a good spread (anti-affinity) for pods belonging to a service It uses a label to identify nodes that belong to the same "group"
labelPreference [Required] LabelPreference	The priority function that checks whether a particular node has a certain label defined or not, regardless of value
requestedToCapacityRatioArguments [Required] RequestedToCapacityRatioArguments	The RequestedToCapacityRatio priority function is parametrized with function shape.

PriorityPolicy

Appears in:

• Policy

PriorityPolicy describes a struct of a priority policy.

Field	Description
name [Required] string	Identifier of the priority policy For a custom priority, the name can be user-defined For the Kubernetes provided priority functions, the name is the identifier of the pre-defined priority function
weight [Required] int64	The numeric multiplier for the node scores that the priority function generates The weight should be non-zero and can be a positive or a negative integer
argument [Required] PriorityArgument	Holds the parameters to configure the given priority function

RequestedToCapacityRatioArguments

Appears in:

• PriorityArgument

RequestedToCapacityRatioArguments holds arguments specific to RequestedToCapacityRatio priority function.

Field	Description
shape [Required] []UtilizationShapePoint	Array of point defining priority function shape.
resources [Required] []ResourceSpec	No description provided.

ResourceSpec

Appears in:

• RequestedToCapacityRatioArguments

ResourceSpec represents single resource and weight for bin packing of priority RequestedToCapacityRatioArguments.

Field	Description
name [Required] string	Name of the resource to be managed by RequestedToCapacityRatio function.
weight [Required] int64	Weight of the resource.

ServiceAffinity

Appears in:

• PredicateArgument

ServiceAffinity holds the parameters that are used to configure the corresponding predicate in scheduler policy configuration.

Field	Description
labels [Required] []string	The list of labels that identify node "groups" All of the labels should match for the node to be considered a fit for hosting the pod

ServiceAntiAffinity

Appears in:

• PriorityArgument

ServiceAntiAffinity holds the parameters that are used to configure the corresponding priority function

Field	Description
label [Required] string	Used to identify node "groups"

UtilizationShapePoint

Appears in:

• RequestedToCapacityRatioArguments

UtilizationShapePoint represents single point of priority function shape.

Field	Description
utilization [Required] int32	Utilization (x axis). Valid values are 0 to 100. Fully utilized node maps to 100.
score [Required] int32	Score assigned to given utilization (y axis). Valid values are 0 to 10.

6 - Kubelet Configuration (v1beta1)

Resource Types

• KubeletConfiguration
• SerializedNodeConfigSource

KubeletConfiguration

KubeletConfiguration contains the configuration for the Kubelet

Field	Description
apiVersion string	kubelet.config.k8s.io/v1beta1
kind string	KubeletConfiguration
enableServer [Required] bool	enableServer enables Kubelet's secured server. Note: Kubelet's insecure port is controlled by the readOnlyPort option. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Default: true
staticPodPath string	staticPodPath is the path to the directory containing local (static) pods to run, or the path to a single static pod file. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that the set of static pods specified at the new path may be different than the ones the Kubelet initially started with, and this may disrupt your node. Default: ""
syncFrequency meta/v1.Duration	syncFrequency is the max period between synchronizing running containers and config. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that shortening this duration may have a negative performance impact, especially as the number of Pods on the node increases. Alternatively, increasing this duration will result in longer refresh times for ConfigMaps and Secrets. Default: "1m"
fileCheckFrequency meta/v1.Duration	fileCheckFrequency is the duration between checking config files for new data Dynamic Kubelet Config (beta): If dynamically updating this field, consider that shortening the duration will cause the Kubelet to reload local Static Pod configurations more frequently, which may have a negative performance impact. Default: "20s"
httpCheckFrequency meta/v1.Duration	httpCheckFrequency is the duration between checking http for new data Dynamic Kubelet Config (beta): If dynamically updating this field, consider that shortening the duration will cause the Kubelet to poll staticPodURL more frequently, which may have a negative performance impact. Default: "20s"
staticPodURL string	staticPodURL is the URL for accessing static pods to run Dynamic Kubelet Config (beta): If dynamically updating this field, consider that the set of static pods specified at the new URL may be different than the ones the Kubelet initially started with, and this may disrupt your node. Default: ""
staticPodURLHeader map[string][]string	staticPodURLHeader is a map of slices with HTTP headers to use when accessing the podURL Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may disrupt the ability to read the latest set of static pods from StaticPodURL. Default: nil
address string	address is the IP address for the Kubelet to serve on (set to 0.0.0.0 for all interfaces). Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Default: "0.0.0.0"
port int32	port is the port for the Kubelet to serve on. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Default: 10250
readOnlyPort int32	readOnlyPort is the read-only port for the Kubelet to serve on with no authentication/authorization. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Default: 0 (disabled)
tlsCertFile string	tlsCertFile is the file containing x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If tlsCertFile and tlsPrivateKeyFile are not provided, a self-signed certificate and key are generated for the public address and saved to the directory passed to the Kubelet's --cert-dir flag. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Default: ""
tlsPrivateKeyFile string	tlsPrivateKeyFile is the file containing x509 private key matching tlsCertFile Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Default: ""
tlsCipherSuites []string	TLSCipherSuites is the list of allowed cipher suites for the server. Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Default: nil
tlsMinVersion string	TLSMinVersion is the minimum TLS version supported. Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Default: ""
rotateCertificates bool	rotateCertificates enables client certificate rotation. The Kubelet will request a new certificate from the certificates.k8s.io API. This requires an approver to approve the certificate signing requests. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that disabling it may disrupt the Kubelet's ability to authenticate with the API server after the current certificate expires. Default: false
serverTLSBootstrap bool	serverTLSBootstrap enables server certificate bootstrap. Instead of self signing a serving certificate, the Kubelet will request a certificate from the certificates.k8s.io API. This requires an approver to approve the certificate signing requests. The RotateKubeletServerCertificate feature must be enabled. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that disabling it will stop the renewal of Kubelet server certificates, which can disrupt components that interact with the Kubelet server in the long term, due to certificate expiration. Default: false
authentication KubeletAuthentication	authentication specifies how requests to the Kubelet's server are authenticated Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Defaults: anonymous: enabled: false webhook: enabled: true cacheTTL: "2m"
authorization KubeletAuthorization	authorization specifies how requests to the Kubelet's server are authorized Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Defaults: mode: Webhook webhook: cacheAuthorizedTTL: "5m" cacheUnauthorizedTTL: "30s"
registryPullQPS int32	registryPullQPS is the limit of registry pulls per second. Set to 0 for no limit. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may impact scalability by changing the amount of traffic produced by image pulls. Default: 5
registryBurst int32	registryBurst is the maximum size of bursty pulls, temporarily allows pulls to burst to this number, while still not exceeding registryPullQPS. Only used if registryPullQPS > 0. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may impact scalability by changing the amount of traffic produced by image pulls. Default: 10
eventRecordQPS int32	eventRecordQPS is the maximum event creations per second. If 0, there is no limit enforced. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may impact scalability by changing the amount of traffic produced by event creations. Default: 5
eventBurst int32	eventBurst is the maximum size of a burst of event creations, temporarily allows event creations to burst to this number, while still not exceeding eventRecordQPS. Only used if eventRecordQPS > 0. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may impact scalability by changing the amount of traffic produced by event creations. Default: 10
enableDebuggingHandlers bool	enableDebuggingHandlers enables server endpoints for log access and local running of containers and commands, including the exec, attach, logs, and portforward features. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that disabling it may disrupt components that interact with the Kubelet server. Default: true
enableContentionProfiling bool	enableContentionProfiling enables lock contention profiling, if enableDebuggingHandlers is true. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that enabling it may carry a performance impact. Default: false
healthzPort int32	healthzPort is the port of the localhost healthz endpoint (set to 0 to disable) Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may disrupt components that monitor Kubelet health. Default: 10248
healthzBindAddress string	healthzBindAddress is the IP address for the healthz server to serve on Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may disrupt components that monitor Kubelet health. Default: "127.0.0.1"
oomScoreAdj int32	oomScoreAdj is The oom-score-adj value for kubelet process. Values must be within the range [-1000, 1000]. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may impact the stability of nodes under memory pressure. Default: -999
clusterDomain string	clusterDomain is the DNS domain for this cluster. If set, kubelet will configure all containers to search this domain in addition to the host's search domains. Dynamic Kubelet Config (beta): Dynamically updating this field is not recommended, as it should be kept in sync with the rest of the cluster. Default: ""
clusterDNS []string	clusterDNS is a list of IP addresses for the cluster DNS server. If set, kubelet will configure all containers to use this for DNS resolution instead of the host's DNS servers. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that changes will only take effect on Pods created after the update. Draining the node is recommended before changing this field. Default: nil
streamingConnectionIdleTimeout meta/v1.Duration	streamingConnectionIdleTimeout is the maximum time a streaming connection can be idle before the connection is automatically closed. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may impact components that rely on infrequent updates over streaming connections to the Kubelet server. Default: "4h"
nodeStatusUpdateFrequency meta/v1.Duration	nodeStatusUpdateFrequency is the frequency that kubelet computes node status. If node lease feature is not enabled, it is also the frequency that kubelet posts node status to master. Note: When node lease feature is not enabled, be cautious when changing the constant, it must work with nodeMonitorGracePeriod in nodecontroller. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may impact node scalability, and also that the node controller's nodeMonitorGracePeriod must be set to N∗NodeStatusUpdateFrequency, where N is the number of retries before the node controller marks the node unhealthy. Default: "10s"
nodeStatusReportFrequency meta/v1.Duration	nodeStatusReportFrequency is the frequency that kubelet posts node status to master if node status does not change. Kubelet will ignore this frequency and post node status immediately if any change is detected. It is only used when node lease feature is enabled. nodeStatusReportFrequency's default value is 1m. But if nodeStatusUpdateFrequency is set explicitly, nodeStatusReportFrequency's default value will be set to nodeStatusUpdateFrequency for backward compatibility. Default: "1m"
nodeLeaseDurationSeconds int32	nodeLeaseDurationSeconds is the duration the Kubelet will set on its corresponding Lease, when the NodeLease feature is enabled. This feature provides an indicator of node health by having the Kubelet create and periodically renew a lease, named after the node, in the kube-node-lease namespace. If the lease expires, the node can be considered unhealthy. The lease is currently renewed every 10s, per KEP-0009. In the future, the lease renewal interval may be set based on the lease duration. Requires the NodeLease feature gate to be enabled. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that decreasing the duration may reduce tolerance for issues that temporarily prevent the Kubelet from renewing the lease (e.g. a short-lived network issue). Default: 40
imageMinimumGCAge meta/v1.Duration	imageMinimumGCAge is the minimum age for an unused image before it is garbage collected. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may trigger or delay garbage collection, and may change the image overhead on the node. Default: "2m"
imageGCHighThresholdPercent int32	imageGCHighThresholdPercent is the percent of disk usage after which image garbage collection is always run. The percent is calculated as this field value out of 100. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may trigger or delay garbage collection, and may change the image overhead on the node. Default: 85
imageGCLowThresholdPercent int32	imageGCLowThresholdPercent is the percent of disk usage before which image garbage collection is never run. Lowest disk usage to garbage collect to. The percent is calculated as this field value out of 100. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may trigger or delay garbage collection, and may change the image overhead on the node. Default: 80
volumeStatsAggPeriod meta/v1.Duration	How frequently to calculate and cache volume disk usage for all pods Dynamic Kubelet Config (beta): If dynamically updating this field, consider that shortening the period may carry a performance impact. Default: "1m"
kubeletCgroups string	kubeletCgroups is the absolute name of cgroups to isolate the kubelet in Dynamic Kubelet Config (beta): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: ""
systemCgroups string	systemCgroups is absolute name of cgroups in which to place all non-kernel processes that are not already in a container. Empty for no container. Rolling back the flag requires a reboot. Dynamic Kubelet Config (beta): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: ""
cgroupRoot string	cgroupRoot is the root cgroup to use for pods. This is handled by the container runtime on a best effort basis. Dynamic Kubelet Config (beta): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: ""
cgroupsPerQOS bool	Enable QoS based Cgroup hierarchy: top level cgroups for QoS Classes And all Burstable and BestEffort pods are brought up under their specific top level QoS cgroup. Dynamic Kubelet Config (beta): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: true
cgroupDriver string	driver that the kubelet uses to manipulate cgroups on the host (cgroupfs or systemd) Dynamic Kubelet Config (beta): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: "cgroupfs"
cpuManagerPolicy string	CPUManagerPolicy is the name of the policy to use. Requires the CPUManager feature gate to be enabled. Dynamic Kubelet Config (beta): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: "none"
cpuManagerReconcilePeriod meta/v1.Duration	CPU Manager reconciliation period. Requires the CPUManager feature gate to be enabled. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that shortening the period may carry a performance impact. Default: "10s"
topologyManagerPolicy string	TopologyManagerPolicy is the name of the policy to use. Policies other than "none" require the TopologyManager feature gate to be enabled. Dynamic Kubelet Config (beta): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: "none"
topologyManagerScope string	TopologyManagerScope represents the scope of topology hint generation that topology manager requests and hint providers generate. "pod" scope requires the TopologyManager feature gate to be enabled. Default: "container"
qosReserved map[string]string	qosReserved is a set of resource name to percentage pairs that specify the minimum percentage of a resource reserved for exclusive use by the guaranteed QoS tier. Currently supported resources: "memory" Requires the QOSReserved feature gate to be enabled. Dynamic Kubelet Config (beta): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: nil
runtimeRequestTimeout meta/v1.Duration	runtimeRequestTimeout is the timeout for all runtime requests except long running requests - pull, logs, exec and attach. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Default: "2m"
hairpinMode string	hairpinMode specifies how the Kubelet should configure the container bridge for hairpin packets. Setting this flag allows endpoints in a Service to loadbalance back to themselves if they should try to access their own Service. Values: "promiscuous-bridge": make the container bridge promiscuous. "hairpin-veth": set the hairpin flag on container veth interfaces. "none": do nothing. Generally, one must set --hairpin-mode=hairpin-veth to achieve hairpin NAT, because promiscuous-bridge assumes the existence of a container bridge named cbr0. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may require a node reboot, depending on the network plugin. Default: "promiscuous-bridge"
maxPods int32	maxPods is the number of pods that can run on this Kubelet. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that changes may cause Pods to fail admission on Kubelet restart, and may change the value reported in Node.Status.Capacity[v1.ResourcePods], thus affecting future scheduling decisions. Increasing this value may also decrease performance, as more Pods can be packed into a single node. Default: 110
podCIDR string	The CIDR to use for pod IP addresses, only used in standalone mode. In cluster mode, this is obtained from the master. Dynamic Kubelet Config (beta): This field should always be set to the empty default. It should only set for standalone Kubelets, which cannot use Dynamic Kubelet Config. Default: ""
podPidsLimit int64	PodPidsLimit is the maximum number of pids in any pod. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that lowering it may prevent container processes from forking after the change. Default: -1
resolvConf string	ResolverConfig is the resolver configuration file used as the basis for the container DNS resolution configuration. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that changes will only take effect on Pods created after the update. Draining the node is recommended before changing this field. Default: "/etc/resolv.conf"
runOnce bool	RunOnce causes the Kubelet to check the API server once for pods, run those in addition to the pods specified by static pod files, and exit. Default: false
cpuCFSQuota bool	cpuCFSQuota enables CPU CFS quota enforcement for containers that specify CPU limits. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that disabling it may reduce node stability. Default: true
cpuCFSQuotaPeriod meta/v1.Duration	CPUCFSQuotaPeriod is the CPU CFS quota period value, cpu.cfs_period_us. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that limits set for containers will result in different cpu.cfs_quota settings. This will trigger container restarts on the node being reconfigured. Default: "100ms"
nodeStatusMaxImages int32	nodeStatusMaxImages caps the number of images reported in Node.Status.Images. Note: If -1 is specified, no cap will be applied. If 0 is specified, no image is returned. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that different values can be reported on node status. Default: 50
maxOpenFiles int64	maxOpenFiles is Number of files that can be opened by Kubelet process. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may impact the ability of the Kubelet to interact with the node's filesystem. Default: 1000000
contentType string	contentType is contentType of requests sent to apiserver. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may impact the ability for the Kubelet to communicate with the API server. If the Kubelet loses contact with the API server due to a change to this field, the change cannot be reverted via dynamic Kubelet config. Default: "application/vnd.kubernetes.protobuf"
kubeAPIQPS int32	kubeAPIQPS is the QPS to use while talking with kubernetes apiserver Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may impact scalability by changing the amount of traffic the Kubelet sends to the API server. Default: 5
kubeAPIBurst int32	kubeAPIBurst is the burst to allow while talking with kubernetes apiserver Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may impact scalability by changing the amount of traffic the Kubelet sends to the API server. Default: 10
serializeImagePulls bool	serializeImagePulls when enabled, tells the Kubelet to pull images one at a time. We recommend ∗not∗ changing the default value on nodes that run docker daemon with version < 1.9 or an Aufs storage backend. Issue #10959 has more details. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may impact the performance of image pulls. Default: true
evictionHard map[string]string	Map of signal names to quantities that defines hard eviction thresholds. For example: {"memory.available": "300Mi"}. To explicitly disable, pass a 0% or 100% threshold on an arbitrary resource. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may trigger or delay Pod evictions. Default: memory.available: "100Mi" nodefs.available: "10%" nodefs.inodesFree: "5%" imagefs.available: "15%"
evictionSoft map[string]string	Map of signal names to quantities that defines soft eviction thresholds. For example: {"memory.available": "300Mi"}. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may trigger or delay Pod evictions, and may change the allocatable reported by the node. Default: nil
evictionSoftGracePeriod map[string]string	Map of signal names to quantities that defines grace periods for each soft eviction signal. For example: {"memory.available": "30s"}. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may trigger or delay Pod evictions. Default: nil
evictionPressureTransitionPeriod meta/v1.Duration	Duration for which the kubelet has to wait before transitioning out of an eviction pressure condition. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that lowering it may decrease the stability of the node when the node is overcommitted. Default: "5m"
evictionMaxPodGracePeriod int32	Maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met. This value effectively caps the Pod's TerminationGracePeriodSeconds value during soft evictions. Note: Due to issue #64530, the behavior has a bug where this value currently just overrides the grace period during soft eviction, which can increase the grace period from what is set on the Pod. This bug will be fixed in a future release. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that lowering it decreases the amount of time Pods will have to gracefully clean up before being killed during a soft eviction. Default: 0
evictionMinimumReclaim map[string]string	Map of signal names to quantities that defines minimum reclaims, which describe the minimum amount of a given resource the kubelet will reclaim when performing a pod eviction while that resource is under pressure. For example: {"imagefs.available": "2Gi"} Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may change how well eviction can manage resource pressure. Default: nil
podsPerCore int32	podsPerCore is the maximum number of pods per core. Cannot exceed MaxPods. If 0, this field is ignored. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that changes may cause Pods to fail admission on Kubelet restart, and may change the value reported in Node.Status.Capacity[v1.ResourcePods], thus affecting future scheduling decisions. Increasing this value may also decrease performance, as more Pods can be packed into a single node. Default: 0
enableControllerAttachDetach bool	enableControllerAttachDetach enables the Attach/Detach controller to manage attachment/detachment of volumes scheduled to this node, and disables kubelet from executing any attach/detach operations Dynamic Kubelet Config (beta): If dynamically updating this field, consider that changing which component is responsible for volume management on a live node may result in volumes refusing to detach if the node is not drained prior to the update, and if Pods are scheduled to the node before the volumes.kubernetes.io/controller-managed-attach-detach annotation is updated by the Kubelet. In general, it is safest to leave this value set the same as local config. Default: true
protectKernelDefaults bool	protectKernelDefaults, if true, causes the Kubelet to error if kernel flags are not as it expects. Otherwise the Kubelet will attempt to modify kernel flags to match its expectation. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that enabling it may cause the Kubelet to crash-loop if the Kernel is not configured as Kubelet expects. Default: false
makeIPTablesUtilChains bool	If true, Kubelet ensures a set of iptables rules are present on host. These rules will serve as utility rules for various components, e.g. KubeProxy. The rules will be created based on IPTablesMasqueradeBit and IPTablesDropBit. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that disabling it will prevent the Kubelet from healing locally misconfigured iptables rules. Default: true
iptablesMasqueradeBit int32	iptablesMasqueradeBit is the bit of the iptables fwmark space to mark for SNAT Values must be within the range [0, 31]. Must be different from other mark bits. Warning: Please match the value of the corresponding parameter in kube-proxy. TODO: clean up IPTablesMasqueradeBit in kube-proxy Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it needs to be coordinated with other components, like kube-proxy, and the update will only be effective if MakeIPTablesUtilChains is enabled. Default: 14
iptablesDropBit int32	iptablesDropBit is the bit of the iptables fwmark space to mark for dropping packets. Values must be within the range [0, 31]. Must be different from other mark bits. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it needs to be coordinated with other components, like kube-proxy, and the update will only be effective if MakeIPTablesUtilChains is enabled. Default: 15
featureGates map[string]bool	featureGates is a map of feature names to bools that enable or disable alpha/experimental features. This field modifies piecemeal the built-in default values from "k8s.io/kubernetes/pkg/features/kube_features.go". Dynamic Kubelet Config (beta): If dynamically updating this field, consider the documentation for the features you are enabling or disabling. While we encourage feature developers to make it possible to dynamically enable and disable features, some changes may require node reboots, and some features may require careful coordination to retroactively disable. Default: nil
failSwapOn bool	failSwapOn tells the Kubelet to fail to start if swap is enabled on the node. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that setting it to true will cause the Kubelet to crash-loop if swap is enabled. Default: true
containerLogMaxSize string	A quantity defines the maximum size of the container log file before it is rotated. For example: "5Mi" or "256Ki". Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may trigger log rotation. Default: "10Mi"
containerLogMaxFiles int32	Maximum number of container log files that can be present for a container. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that lowering it may cause log files to be deleted. Default: 5
configMapAndSecretChangeDetectionStrategy ResourceChangeDetectionStrategy	ConfigMapAndSecretChangeDetectionStrategy is a mode in which config map and secret managers are running. Default: "Watch"
systemReserved map[string]string	systemReserved is a set of ResourceName=ResourceQuantity (e.g. cpu=200m,memory=150G) pairs that describe resources reserved for non-kubernetes components. Currently only cpu and memory are supported. See http://kubernetes.io/docs/user-guide/compute-resources for more detail. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may not be possible to increase the reserved resources, because this requires resizing cgroups. Always look for a NodeAllocatableEnforced event after updating this field to ensure that the update was successful. Default: nil
kubeReserved map[string]string	A set of ResourceName=ResourceQuantity (e.g. cpu=200m,memory=150G) pairs that describe resources reserved for kubernetes system components. Currently cpu, memory and local storage for root file system are supported. See http://kubernetes.io/docs/user-guide/compute-resources for more detail. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may not be possible to increase the reserved resources, because this requires resizing cgroups. Always look for a NodeAllocatableEnforced event after updating this field to ensure that the update was successful. Default: nil
reservedSystemCPUs [Required] string	This ReservedSystemCPUs option specifies the cpu list reserved for the host level system threads and kubernetes related threads. This provide a "static" CPU list rather than the "dynamic" list by system-reserved and kube-reserved. This option overwrites CPUs provided by system-reserved and kube-reserved.
showHiddenMetricsForVersion string	The previous version for which you want to show hidden metrics. Only the previous minor version is meaningful, other values will not be allowed. The format is ., e.g.: '1.16'. The purpose of this format is make sure you have the opportunity to notice if the next release hides additional metrics, rather than being surprised when they are permanently removed in the release after that. Default: ""
systemReservedCgroup string	This flag helps kubelet identify absolute name of top level cgroup used to enforce `SystemReserved` compute resource reservation for OS system daemons. Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) doc for more information. Dynamic Kubelet Config (beta): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: ""
kubeReservedCgroup string	This flag helps kubelet identify absolute name of top level cgroup used to enforce `KubeReserved` compute resource reservation for Kubernetes node system daemons. Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) doc for more information. Dynamic Kubelet Config (beta): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: ""
enforceNodeAllocatable []string	This flag specifies the various Node Allocatable enforcements that Kubelet needs to perform. This flag accepts a list of options. Acceptable options are `none`, `pods`, `system-reserved` & `kube-reserved`. If `none` is specified, no other options may be specified. Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) doc for more information. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that removing enforcements may reduce the stability of the node. Alternatively, adding enforcements may reduce the stability of components which were using more than the reserved amount of resources; for example, enforcing kube-reserved may cause Kubelets to OOM if it uses more than the reserved resources, and enforcing system-reserved may cause system daemons to OOM if they use more than the reserved resources. Default: ["pods"]
allowedUnsafeSysctls []string	A comma separated whitelist of unsafe sysctls or sysctl patterns (ending in ∗). Unsafe sysctl groups are kernel.shm∗, kernel.msg∗, kernel.sem, fs.mqueue.∗, and net.∗. These sysctls are namespaced but not allowed by default. For example: "kernel.msg∗,net.ipv4.route.min_pmtu" Default: []
volumePluginDir string	volumePluginDir is the full path of the directory in which to search for additional third party volume plugins. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that changing the volumePluginDir may disrupt workloads relying on third party volume plugins. Default: "/usr/libexec/kubernetes/kubelet-plugins/volume/exec/"
providerID string	providerID, if set, sets the unique id of the instance that an external provider (i.e. cloudprovider) can use to identify a specific node. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may impact the ability of the Kubelet to interact with cloud providers. Default: ""
kernelMemcgNotification bool	kernelMemcgNotification, if set, the kubelet will integrate with the kernel memcg notification to determine if memory eviction thresholds are crossed rather than polling. Dynamic Kubelet Config (beta): If dynamically updating this field, consider that it may impact the way Kubelet interacts with the kernel. Default: false
logging [Required] LoggingConfiguration	Logging specifies the options of logging. Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. Defaults: Format: text
enableSystemLogHandler bool	enableSystemLogHandler enables system logs via web interface host:port/logs/ Default: true
shutdownGracePeriod meta/v1.Duration	ShutdownGracePeriod specifies the total duration that the node should delay the shutdown and total grace period for pod termination during a node shutdown. Default: "30s"
shutdownGracePeriodCriticalPods meta/v1.Duration	ShutdownGracePeriodCriticalPods specifies the duration used to terminate critical pods during a node shutdown. This should be less than ShutdownGracePeriod. For example, if ShutdownGracePeriod=30s, and ShutdownGracePeriodCriticalPods=10s, during a node shutdown the first 20 seconds would be reserved for gracefully terminating normal pods, and the last 10 seconds would be reserved for terminating critical pods. Default: "10s"

SerializedNodeConfigSource

SerializedNodeConfigSource allows us to serialize v1.NodeConfigSource. This type is used internally by the Kubelet for tracking checkpointed dynamic configs. It exists in the kubeletconfig API group because it is classified as a versioned input to the Kubelet.

Field	Description
apiVersion string	kubelet.config.k8s.io/v1beta1
kind string	SerializedNodeConfigSource
source core/v1.NodeConfigSource	Source is the source that we are serializing

HairpinMode

(Alias of string)

HairpinMode denotes how the kubelet should configure networking to handle hairpin packets.

KubeletAnonymousAuthentication

Appears in:

• KubeletAuthentication

Field	Description
enabled bool	enabled allows anonymous requests to the kubelet server. Requests that are not rejected by another authentication method are treated as anonymous requests. Anonymous requests have a username of system:anonymous, and a group name of system:unauthenticated.

KubeletAuthentication

Appears in:

• KubeletConfiguration

Field	Description
x509 KubeletX509Authentication	x509 contains settings related to x509 client certificate authentication
webhook KubeletWebhookAuthentication	webhook contains settings related to webhook bearer token authentication
anonymous KubeletAnonymousAuthentication	anonymous contains settings related to anonymous authentication

KubeletAuthorization

Appears in:

• KubeletConfiguration

Field	Description
mode KubeletAuthorizationMode	mode is the authorization mode to apply to requests to the kubelet server. Valid values are AlwaysAllow and Webhook. Webhook mode uses the SubjectAccessReview API to determine authorization.
webhook KubeletWebhookAuthorization	webhook contains settings related to Webhook authorization.

KubeletAuthorizationMode

(Alias of string)

Appears in:

• KubeletAuthorization

KubeletWebhookAuthentication

Appears in:

• KubeletAuthentication

Field	Description
enabled bool	enabled allows bearer token authentication backed by the tokenreviews.authentication.k8s.io API
cacheTTL meta/v1.Duration	cacheTTL enables caching of authentication results

KubeletWebhookAuthorization

Appears in:

• KubeletAuthorization

Field	Description
cacheAuthorizedTTL meta/v1.Duration	cacheAuthorizedTTL is the duration to cache 'authorized' responses from the webhook authorizer.
cacheUnauthorizedTTL meta/v1.Duration	cacheUnauthorizedTTL is the duration to cache 'unauthorized' responses from the webhook authorizer.

KubeletX509Authentication

Appears in:

• KubeletAuthentication

Field	Description
clientCAFile string	clientCAFile is the path to a PEM-encoded certificate bundle. If set, any request presenting a client certificate signed by one of the authorities in the bundle is authenticated with a username corresponding to the CommonName, and groups corresponding to the Organization in the client certificate.

ResourceChangeDetectionStrategy

(Alias of string)

Appears in:

• KubeletConfiguration

ResourceChangeDetectionStrategy denotes a mode in which internal managers (secret, configmap) are discovering object changes.

LoggingConfiguration

Appears in:

• KubeletConfiguration

LoggingConfiguration contains logging options Refer Logs Options for more information.

Field	Description
format [Required] string	Format Flag specifies the structure of log messages. default value of format is `text`
sanitization [Required] bool	[Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)

7 - WebhookAdmission Configuration (v1)

Package v1 is the v1 version of the API.

Resource Types

• WebhookAdmission

WebhookAdmission

WebhookAdmission provides configuration for the webhook admission controller.

Field	Description
apiVersion string	apiserver.config.k8s.io/v1
kind string	WebhookAdmission
kubeConfigFile [Required] string	KubeConfigFile is the path to the kubeconfig file.