istio docs ops traffic management deploy guidelines title Traffic Management Best Practices weight 20 owner istio wg networking maintainers aliases help ops traffic management deploy guidelines forceinlinetoc true Configuration best practices to avoid networking or traffic management issues help ops deploy guidelines

Answer:
---
title: Traffic Management Best Practices
description: Configuration best practices to avoid networking or traffic management issues.
force_inline_toc: true
weight: 20
aliases:
  - /help/ops/traffic-management/deploy-guidelines
  - /help/ops/deploy-guidelines
  - /docs/ops/traffic-management/deploy-guidelines
owner: istio/wg-networking-maintainers
test: n/a
---

This section provides specific deployment or configuration guidelines to avoid networking or traffic management issues.

## Set default routes for services

Although the default Istio behavior conveniently sends traffic from any
source to all versions of a destination service without any rules being set,
creating a `VirtualService` with a default route for every service,
right from the start, is generally considered a best practice in Istio.

Even if you initially have only one version of a service, as soon as you decide
to deploy a second version, you need to have a routing rule in place **before**
the new version is started, to prevent it from immediately receiving traffic
in an uncontrolled way.

Another potential issue when relying on Istio's default round-robin routing is
due to a subtlety in Istio's destination rule evaluation algorithm.
When routing a request, Envoy first evaluates route rules in virtual services
to determine if a particular subset is being routed to.
If so, only then will it activate any destination rule policies corresponding to the subset.
Consequently, Istio only applies the policies you define for specific subsets if
you **explicitly** routed traffic to the corresponding subset.

For example, consider the following destination rule as the one and only configuration defined for the
*reviews* service, that is, there are no route rules in a corresponding `VirtualService` definition:

apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: reviews
spec:
  host: reviews
  subsets:
  - name: v1
    labels:
      version: v1
    trafficPolicy:
      connectionPool:
        tcp:
          maxConnections: 100

Even if Istio’s default round-robin routing calls "v1" instances on occasion,
maybe even always if "v1" is the only running version, the above traffic policy
will never be invoked.

You can fix the above example in one of two ways. You can either move the
traffic policy up a level in the `DestinationRule` to make it apply to any version:

apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: reviews
spec:
  host: reviews
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
  subsets:
  - name: v1
    labels:
      version: v1

Or, better yet, define a proper route rule for the service in the `VirtualService` definition.
For example, add a simple route rule for "reviews:v1":

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: reviews
spec:
  hosts:
  - reviews
  http:
  - route:
    - destination:
        host: reviews
        subset: v1

## Control configuration sharing across namespaces {#cross-namespace-configuration}

You can define virtual services, destination rules, or service entries
in one namespace and then reuse them in other namespaces, if they are exported
to those namespaces.
Istio exports all traffic management resources to all namespaces by default,
but you can override the visibility with the `exportTo` field.
For example, only requests from workloads in the same namespace can be affected by the following virtual service:

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: myservice
spec:
  hosts:
  - myservice.com
  exportTo:
  - "."
  http:
  - route:
    - destination:
        host: myservice

You can similarly control the visibility of a Kubernetes `Service` using the `networking.istio.io/exportTo` annotation.

Setting the visibility of destination rules in a particular namespace doesn't
guarantee the rule is used. Exporting a destination rule to other namespaces enables you to use it
in those namespaces, but to actually be applied during a request the namespace also needs to be
on the destination rule lookup path:

1. client namespace
1. service namespace
1. the configured `meshconfig.rootNamespace` namespace (`istio-system` by default)

For example, consider the following destination rule:

apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: myservice
spec:
  host: myservice.default.svc.cluster.local
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100

Let's assume you create this destination rule in namespace `ns1`.

If you send a request to the `myservice` service from a client in `ns1`, the destination
rule would be applied, because it is in the first namespace on the lookup path, that is,
in the client namespace.

If you now send the request from a different namespace, for example `ns2`,
the client is no longer in the same namespace as the destination rule, `ns1`.
Because the corresponding service, `myservice.default.svc.cluster.local`, is also not in `ns1`,
but rather in the `default` namespace, the destination rule will also not be found in
the second namespace of the lookup path, the service namespace.

Even if the `myservice` service is exported to all namespaces and therefore visible
in `ns2` and the destination rule is also exported to all namespaces, including `ns2`,
it will not be applied during the request from `ns2` because it's not in any
of the namespaces on the lookup path.

You can avoid this problem by creating the destination rule in the same namespace as
the corresponding service, `default` in this example. It would then get applied to requests
from clients in any namespace.
You can also move the destination rule to the `istio-system` namespace, the third namespace on
the lookup path, although this isn't recommended unless the destination rule is really a global
configuration that is applicable in all namespaces, and it would require administrator authority.

Istio uses this restricted destination rule lookup path for two reasons:

1. Prevent destination rules from being defined that can override the behavior of services
   in completely unrelated namespaces.
1. Have a clear lookup order in case there is more than one destination rule for
   the same host.

## Split large virtual services and destination rules into multiple resources {#split-virtual-services}

In situations where it is inconvenient to define the complete set of route rules or policies for a particular
host in a single `VirtualService` or `DestinationRule` resource, it may be preferable to incrementally specify
the configuration for the host in multiple resources.
The control plane will merge such destination rules
and merge such virtual services if they are bound to a gateway.

Consider the case of a `VirtualService` bound to an ingress gateway exposing an application host which uses
path-based delegation to several implementation services, something like this:

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: myapp
spec:
  hosts:
  - myapp.com
  gateways:
  - myapp-gateway
  http:
  - match:
    - uri:
        prefix: /service1
    route:
    - destination:
        host: service1.default.svc.cluster.local
  - match:
    - uri:
        prefix: /service2
    route:
    - destination:
        host: service2.default.svc.cluster.local
  - match:
    ...

The downside of this kind of configuration is that other configuration (e.g., route rules) for any of the
underlying microservices, will need to also be included in this single configuration file, instead of
in separate resources associated with, and potentially owned by, the individual service teams.
See [Route rules have no effect on ingress gateway requests](/docs/ops/common-problems/network-issues/#route-rules-have-no-effect-on-ingress-gateway-requests)
for details.

To avoid this problem, it may be preferable to break up the configuration of `myapp.com` into several
`VirtualService` fragments, one per backend service. For example:

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: myapp-service1
spec:
  hosts:
  - myapp.com
  gateways:
  - myapp-gateway
  http:
  - match:
    - uri:
        prefix: /service1
    route:
    - destination:
        host: service1.default.svc.cluster.local
---
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: myapp-service2
spec:
  hosts:
  - myapp.com
  gateways:
  - myapp-gateway
  http:
  - match:
    - uri:
        prefix: /service2
    route:
    - destination:
        host: service2.default.svc.cluster.local
---
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: myapp-...

When a second and subsequent `VirtualService` for an existing host is applied, `istiod` will merge
the additional route rules into the existing configuration of the host. There are, however, several
caveats with this feature that must be considered carefully when using it.

1. Although the order of evaluation for rules in any given source `VirtualService` will be retained,
   the cross-resource order is UNDEFINED. In other words, there is no guaranteed order of evaluation
   for rules across the fragment configurations, so it will only have predictable behavior if there
   are no conflicting rules or order dependency between rules across fragments.
1. There should only be one "catch-all" rule (i.e., a rule without a `match` field) in the fragments.
   All such "catch-all" rules will be moved to the end of the list in the merged configuration, but
   since they catch all requests, whichever is applied first will essentially override and disable any others.
1. A `VirtualService` can only be fragmented this way if it is bound to a gateway.
   Host merging is not supported in sidecars.

A `DestinationRule` can also be fragmented with similar merge semantics and restrictions.

1. There should only be one definition of any given subset across multiple destination rules for the same host.
   If there is more than one with the same name, the first definition is used and any following duplicates are discarded.
   No merging of subset content is supported.
1. There should only be one top-level `trafficPolicy` for the same host.
   When top-level traffic policies are defined in multiple destination rules, the first one processed will be used.
   Any following top-level `trafficPolicy` configuration is discarded.
1. Unlike virtual service merging, destination rule merging works in both sidecars and gateways.

## Avoid 503 errors while reconfiguring service routes

When setting route rules to direct traffic to specific versions (subsets) of a service, care must be taken to ensure
that the subsets are available before they are used in the routes. Otherwise, calls to the service may return
503 errors during a reconfiguration period.

Creating both the `VirtualServices` and `DestinationRules` that define the corresponding subsets using a single `kubectl`
call (e.g., `kubectl apply -f myVirtualServiceAndDestinationRule.yaml` is not sufficient because the
resources propagate (from the configuration server, i.e., Kubernetes API server) to the istiod instances in an eventually consistent manner. If the
`VirtualService` using the subsets arrives before the `DestinationRule` where the subsets are defined, the Envoy configuration generated by istiod would refer to non-existent upstream pools. This results in HTTP 503 errors until all configuration objects are available to istiod.

To make sure services will have zero down-time when configuring routes with subsets, follow a "make-before-break" process as described below:

* When adding new subsets:

    1. Update `DestinationRules` to add a new subset first, before updating any `VirtualServices` that use it. Apply the rule using `kubectl` or any platform-specific tooling.

    1. Wait a few seconds for the `DestinationRule` configuration to propagate to the Envoy sidecars

    1. Update the `VirtualService` to refer to the newly added subsets.

* When removing subsets:

    1. Update `VirtualServices` to remove any references to a subset, before removing the subset from a `DestinationRule`.

    1. Wait a few seconds for the `VirtualService` configuration to propagate to the Envoy sidecars.

    1. Update the `DestinationRule` to remove the unused subsets.

title  Traffic Management Best Practices description  Configuration best practices to avoid networking or traffic management issues  force inline toc  true weight  20 aliases       help ops traffic management deploy guidelines      help ops deploy guidelines      docs ops traffic management deploy guidelines owner  istio wg networking maintainers test  n a      This section provides specific deployment or configuration guidelines to avoid networking or traffic management issues      Set default routes for services  Although the default Istio behavior conveniently sends traffic from any source to all versions of a destination service without any rules being set  creating a  VirtualService  with a default route for every service  right from the start  is generally considered a best practice in Istio   Even if you initially have only one version of a service  as soon as you decide to deploy a second version  you need to have a routing rule in place   before   the new version is started  to prevent it from immediately receiving traffic in an uncontrolled way   Another potential issue when relying on Istio s default round robin routing is due to a subtlety in Istio s destination rule evaluation algorithm  When routing a request  Envoy first evaluates route rules in virtual services to determine if a particular subset is being routed to  If so  only then will it activate any destination rule policies corresponding to the subset  Consequently  Istio only applies the policies you define for specific subsets if you   explicitly   routed traffic to the corresponding subset   For example  consider the following destination rule as the one and only configuration defined for the  reviews  service  that is  there are no route rules in a corresponding  VirtualService  definition    apiVersion  networking istio io v1 kind  DestinationRule metadata    name  reviews spec    host  reviews   subsets      name  v1     labels        version  v1     trafficPolicy        connectionPool          tcp            maxConnections  100   Even if Istio s default round robin routing calls  v1  instances on occasion  maybe even always if  v1  is the only running version  the above traffic policy will never be invoked   You can fix the above example in one of two ways  You can either move the traffic policy up a level in the  DestinationRule  to make it apply to any version    apiVersion  networking istio io v1 kind  DestinationRule metadata    name  reviews spec    host  reviews   trafficPolicy      connectionPool        tcp          maxConnections  100   subsets      name  v1     labels        version  v1   Or  better yet  define a proper route rule for the service in the  VirtualService  definition  For example  add a simple route rule for  reviews v1     apiVersion  networking istio io v1 kind  VirtualService metadata    name  reviews spec    hosts      reviews   http      route        destination          host  reviews         subset  v1      Control configuration sharing across namespaces   cross namespace configuration   You can define virtual services  destination rules  or service entries in one namespace and then reuse them in other namespaces  if they are exported to those namespaces  Istio exports all traffic management resources to all namespaces by default  but you can override the visibility with the  exportTo  field  For example  only requests from workloads in the same namespace can be affected by the following virtual service    apiVersion  networking istio io v1 kind  VirtualService metadata    name  myservice spec    hosts      myservice com   exportTo            http      route        destination          host  myservice    You can similarly control the visibility of a Kubernetes  Service  using the  networking istio io exportTo  annotation    Setting the visibility of destination rules in a particular namespace doesn t guarantee the rule is used  Exporting a destination rule to other namespaces enables you to use it in those namespaces  but to actually be applied during a request the namespace also needs to be on the destination rule lookup path   1  client namespace 1  service namespace 1  the configured  meshconfig rootNamespace  namespace   istio system  by default   For example  consider the following destination rule    apiVersion  networking istio io v1 kind  DestinationRule metadata    name  myservice spec    host  myservice default svc cluster local   trafficPolicy      connectionPool        tcp          maxConnections  100   Let s assume you create this destination rule in namespace  ns1    If you send a request to the  myservice  service from a client in  ns1   the destination rule would be applied  because it is in the first namespace on the lookup path  that is  in the client namespace   If you now send the request from a different namespace  for example  ns2   the client is no longer in the same namespace as the destination rule   ns1   Because the corresponding service   myservice default svc cluster local   is also not in  ns1   but rather in the  default  namespace  the destination rule will also not be found in the second namespace of the lookup path  the service namespace   Even if the  myservice  service is exported to all namespaces and therefore visible in  ns2  and the destination rule is also exported to all namespaces  including  ns2   it will not be applied during the request from  ns2  because it s not in any of the namespaces on the lookup path   You can avoid this problem by creating the destination rule in the same namespace as the corresponding service   default  in this example  It would then get applied to requests from clients in any namespace  You can also move the destination rule to the  istio system  namespace  the third namespace on the lookup path  although this isn t recommended unless the destination rule is really a global configuration that is applicable in all namespaces  and it would require administrator authority   Istio uses this restricted destination rule lookup path for two reasons   1  Prevent destination rules from being defined that can override the behavior of services    in completely unrelated namespaces  1  Have a clear lookup order in case there is more than one destination rule for    the same host      Split large virtual services and destination rules into multiple resources   split virtual services   In situations where it is inconvenient to define the complete set of route rules or policies for a particular host in a single  VirtualService  or  DestinationRule  resource  it may be preferable to incrementally specify the configuration for the host in multiple resources  The control plane will merge such destination rules and merge such virtual services if they are bound to a gateway   Consider the case of a  VirtualService  bound to an ingress gateway exposing an application host which uses path based delegation to several implementation services  something like this    apiVersion  networking istio io v1 kind  VirtualService metadata    name  myapp spec    hosts      myapp com   gateways      myapp gateway   http      match        uri          prefix   service1     route        destination          host  service1 default svc cluster local     match        uri          prefix   service2     route        destination          host  service2 default svc cluster local     match            The downside of this kind of configuration is that other configuration  e g   route rules  for any of the underlying microservices  will need to also be included in this single configuration file  instead of in separate resources associated with  and potentially owned by  the individual service teams  See  Route rules have no effect on ingress gateway requests   docs ops common problems network issues  route rules have no effect on ingress gateway requests  for details   To avoid this problem  it may be preferable to break up the configuration of  myapp com  into several  VirtualService  fragments  one per backend service  For example    apiVersion  networking istio io v1 kind  VirtualService metadata    name  myapp service1 spec    hosts      myapp com   gateways      myapp gateway   http      match        uri          prefix   service1     route        destination          host  service1 default svc cluster local     apiVersion  networking istio io v1 kind  VirtualService metadata    name  myapp service2 spec    hosts      myapp com   gateways      myapp gateway   http      match        uri          prefix   service2     route        destination          host  service2 default svc cluster local     apiVersion  networking istio io v1 kind  VirtualService metadata    name  myapp       When a second and subsequent  VirtualService  for an existing host is applied   istiod  will merge the additional route rules into the existing configuration of the host  There are  however  several caveats with this feature that must be considered carefully when using it   1  Although the order of evaluation for rules in any given source  VirtualService  will be retained     the cross resource order is UNDEFINED  In other words  there is no guaranteed order of evaluation    for rules across the fragment configurations  so it will only have predictable behavior if there    are no conflicting rules or order dependency between rules across fragments  1  There should only be one  catch all  rule  i e   a rule without a  match  field  in the fragments     All such  catch all  rules will be moved to the end of the list in the merged configuration  but    since they catch all requests  whichever is applied first will essentially override and disable any others  1  A  VirtualService  can only be fragmented this way if it is bound to a gateway     Host merging is not supported in sidecars   A  DestinationRule  can also be fragmented with similar merge semantics and restrictions   1  There should only be one definition of any given subset across multiple destination rules for the same host     If there is more than one with the same name  the first definition is used and any following duplicates are discarded     No merging of subset content is supported  1  There should only be one top level  trafficPolicy  for the same host     When top level traffic policies are defined in multiple destination rules  the first one processed will be used     Any following top level  trafficPolicy  configuration is discarded  1  Unlike virtual service merging  destination rule merging works in both sidecars and gateways      Avoid 503 errors while reconfiguring service routes  When setting route rules to direct traffic to specific versions  subsets  of a service  care must be taken to ensure that the subsets are available before they are used in the routes  Otherwise  calls to the service may return 503 errors during a reconfiguration period   Creating both the  VirtualServices  and  DestinationRules  that define the corresponding subsets using a single  kubectl  call  e g    kubectl apply  f myVirtualServiceAndDestinationRule yaml  is not sufficient because the resources propagate  from the configuration server  i e   Kubernetes API server  to the istiod instances in an eventually consistent manner  If the  VirtualService  using the subsets arrives before the  DestinationRule  where the subsets are defined  the Envoy configuration generated by istiod would refer to non existent upstream pools  This results in HTTP 503 errors until all configuration objects are available to istiod   To make sure services will have zero down time when configuring routes with subsets  follow a  make before break  process as described below     When adding new subsets       1  Update  DestinationRules  to add a new subset first  before updating any  VirtualServices  that use it  Apply the rule using  kubectl  or any platform specific tooling       1  Wait a few seconds for the  DestinationRule  configuration to propagate to the Envoy sidecars      1  Update the  VirtualService  to refer to the newly added subsets     When removing subsets       1  Update  VirtualServices  to remove any references to a subset  before removing the subset from a  DestinationRule        1  Wait a few seconds for the  VirtualService  configuration to propagate to the Envoy sidecars       1  Update the  DestinationRule  to remove the unused subsets


kubernetes reference weight 70 chenopis approvers nolist true contenttype concept Reference mainmenu true title Reference

Answer:
---
title: Reference
approvers:
- chenopis
linkTitle: "Reference"
main_menu: true
weight: 70
content_type: concept
no_list: true
---

<!-- overview -->

This section of the Kubernetes documentation contains references.

<!-- body -->

## API Reference

* [Glossary](/docs/reference/glossary/) -  a comprehensive, standardized list of Kubernetes terminology

* [Kubernetes API Reference](/docs/reference/kubernetes-api/)
* [One-page API Reference for Kubernetes ](/docs/reference/generated/kubernetes-api//)
* [Using The Kubernetes API](/docs/reference/using-api/) - overview of the API for Kubernetes.
* [API access control](/docs/reference/access-authn-authz/) - details on how Kubernetes controls API access
* [Well-Known Labels, Annotations and Taints](/docs/reference/labels-annotations-taints/)

## Officially supported client libraries

To call the Kubernetes API from a programming language, you can use
[client libraries](/docs/reference/using-api/client-libraries/). Officially supported
client libraries:

- [Kubernetes Go client library](https://github.com/kubernetes/client-go/)
- [Kubernetes Python client library](https://github.com/kubernetes-client/python)
- [Kubernetes Java client library](https://github.com/kubernetes-client/java)
- [Kubernetes JavaScript client library](https://github.com/kubernetes-client/javascript)
- [Kubernetes C# client library](https://github.com/kubernetes-client/csharp)
- [Kubernetes Haskell client library](https://github.com/kubernetes-client/haskell)

## CLI

* [kubectl](/docs/reference/kubectl/) - Main CLI tool for running commands and managing Kubernetes clusters.
  * [JSONPath](/docs/reference/kubectl/jsonpath/) - Syntax guide for using [JSONPath expressions](https://goessner.net/articles/JsonPath/) with kubectl.
* [kubeadm](/docs/reference/setup-tools/kubeadm/) - CLI tool to easily provision a secure Kubernetes cluster.

## Components

* [kubelet](/docs/reference/command-line-tools-reference/kubelet/) - The
  primary agent that runs on each node. The kubelet takes a set of PodSpecs
  and ensures that the described containers are running and healthy.
* [kube-apiserver](/docs/reference/command-line-tools-reference/kube-apiserver/) -
  REST API that validates and configures data for API objects such as  pods,
  services, replication controllers.
* [kube-controller-manager](/docs/reference/command-line-tools-reference/kube-controller-manager/) -
  Daemon that embeds the core control loops shipped with Kubernetes.
* [kube-proxy](/docs/reference/command-line-tools-reference/kube-proxy/) - Can
  do simple TCP/UDP stream forwarding or round-robin TCP/UDP forwarding across
  a set of back-ends.
* [kube-scheduler](/docs/reference/command-line-tools-reference/kube-scheduler/) -
  Scheduler that manages availability, performance, and capacity.

  * [Scheduler Policies](/docs/reference/scheduling/policies)
  * [Scheduler Profiles](/docs/reference/scheduling/config#profiles)

* List of [ports and protocols](/docs/reference/networking/ports-and-protocols/) that
  should be open on control plane and worker nodes

## Config APIs

This section hosts the documentation for "unpublished" APIs which are used to
configure  kubernetes components or tools. Most of these APIs are not exposed
by the API server in a RESTful way though they are essential for a user or an
operator to use or manage a cluster.

* [kubeconfig (v1)](/docs/reference/config-api/kubeconfig.v1/)
* [kube-apiserver admission (v1)](/docs/reference/config-api/apiserver-admission.v1/)
* [kube-apiserver configuration (v1alpha1)](/docs/reference/config-api/apiserver-config.v1alpha1/) and
* [kube-apiserver configuration (v1beta1)](/docs/reference/config-api/apiserver-config.v1beta1/) and
  [kube-apiserver configuration (v1)](/docs/reference/config-api/apiserver-config.v1/)
* [kube-apiserver event rate limit (v1alpha1)](/docs/reference/config-api/apiserver-eventratelimit.v1alpha1/)
* [kubelet configuration (v1alpha1)](/docs/reference/config-api/kubelet-config.v1alpha1/) and
  [kubelet configuration (v1beta1)](/docs/reference/config-api/kubelet-config.v1beta1/)
  [kubelet configuration (v1)](/docs/reference/config-api/kubelet-config.v1/)
* [kubelet credential providers (v1)](/docs/reference/config-api/kubelet-credentialprovider.v1/)
* [kube-scheduler configuration (v1beta3)](/docs/reference/config-api/kube-scheduler-config.v1beta3/) and
  [kube-scheduler configuration (v1)](/docs/reference/config-api/kube-scheduler-config.v1/)
* [kube-controller-manager configuration (v1alpha1)](/docs/reference/config-api/kube-controller-manager-config.v1alpha1/)
* [kube-proxy configuration (v1alpha1)](/docs/reference/config-api/kube-proxy-config.v1alpha1/)
* [`audit.k8s.io/v1` API](/docs/reference/config-api/apiserver-audit.v1/)
* [Client authentication API (v1beta1)](/docs/reference/config-api/client-authentication.v1beta1/) and
  [Client authentication API (v1)](/docs/reference/config-api/client-authentication.v1/)
* [WebhookAdmission configuration (v1)](/docs/reference/config-api/apiserver-webhookadmission.v1/)
* [ImagePolicy API (v1alpha1)](/docs/reference/config-api/imagepolicy.v1alpha1/)

## Config API for kubeadm

* [v1beta3](/docs/reference/config-api/kubeadm-config.v1beta3/)
* [v1beta4](/docs/reference/config-api/kubeadm-config.v1beta4/)

## External APIs

These are the APIs defined by the Kubernetes project, but are not implemented
by the core project:

* [Metrics API (v1beta1)](/docs/reference/external-api/metrics.v1beta1/)
* [Custom Metrics API (v1beta2)](/docs/reference/external-api/custom-metrics.v1beta2)
* [External Metrics API (v1beta1)](/docs/reference/external-api/external-metrics.v1beta1)

## Design Docs

An archive of the design docs for Kubernetes functionality. Good starting points are
[Kubernetes Architecture](https://git.k8s.io/design-proposals-archive/architecture/architecture.md) and
[Kubernetes Design Overview](https://git.k8s.io/design-proposals-archive).

title  Reference approvers    chenopis linkTitle   Reference  main menu  true weight  70 content type  concept no list  true           overview      This section of the Kubernetes documentation contains references        body         API Reference     Glossary   docs reference glossary      a comprehensive  standardized list of Kubernetes terminology     Kubernetes API Reference   docs reference kubernetes api      One page API Reference for Kubernetes    docs reference generated kubernetes api       Using The Kubernetes API   docs reference using api     overview of the API for Kubernetes     API access control   docs reference access authn authz     details on how Kubernetes controls API access    Well Known Labels  Annotations and Taints   docs reference labels annotations taints       Officially supported client libraries  To call the Kubernetes API from a programming language  you can use  client libraries   docs reference using api client libraries    Officially supported client libraries      Kubernetes Go client library  https   github com kubernetes client go      Kubernetes Python client library  https   github com kubernetes client python     Kubernetes Java client library  https   github com kubernetes client java     Kubernetes JavaScript client library  https   github com kubernetes client javascript     Kubernetes C  client library  https   github com kubernetes client csharp     Kubernetes Haskell client library  https   github com kubernetes client haskell      CLI     kubectl   docs reference kubectl     Main CLI tool for running commands and managing Kubernetes clusters       JSONPath   docs reference kubectl jsonpath     Syntax guide for using  JSONPath expressions  https   goessner net articles JsonPath   with kubectl     kubeadm   docs reference setup tools kubeadm     CLI tool to easily provision a secure Kubernetes cluster      Components     kubelet   docs reference command line tools reference kubelet     The   primary agent that runs on each node  The kubelet takes a set of PodSpecs   and ensures that the described containers are running and healthy     kube apiserver   docs reference command line tools reference kube apiserver       REST API that validates and configures data for API objects such as  pods    services  replication controllers     kube controller manager   docs reference command line tools reference kube controller manager       Daemon that embeds the core control loops shipped with Kubernetes     kube proxy   docs reference command line tools reference kube proxy     Can   do simple TCP UDP stream forwarding or round robin TCP UDP forwarding across   a set of back ends     kube scheduler   docs reference command line tools reference kube scheduler       Scheduler that manages availability  performance  and capacity          Scheduler Policies   docs reference scheduling policies       Scheduler Profiles   docs reference scheduling config profiles     List of  ports and protocols   docs reference networking ports and protocols   that   should be open on control plane and worker nodes     Config APIs  This section hosts the documentation for  unpublished  APIs which are used to configure  kubernetes components or tools  Most of these APIs are not exposed by the API server in a RESTful way though they are essential for a user or an operator to use or manage a cluster       kubeconfig  v1    docs reference config api kubeconfig v1      kube apiserver admission  v1    docs reference config api apiserver admission v1      kube apiserver configuration  v1alpha1    docs reference config api apiserver config v1alpha1   and    kube apiserver configuration  v1beta1    docs reference config api apiserver config v1beta1   and    kube apiserver configuration  v1    docs reference config api apiserver config v1      kube apiserver event rate limit  v1alpha1    docs reference config api apiserver eventratelimit v1alpha1      kubelet configuration  v1alpha1    docs reference config api kubelet config v1alpha1   and    kubelet configuration  v1beta1    docs reference config api kubelet config v1beta1      kubelet configuration  v1    docs reference config api kubelet config v1      kubelet credential providers  v1    docs reference config api kubelet credentialprovider v1      kube scheduler configuration  v1beta3    docs reference config api kube scheduler config v1beta3   and    kube scheduler configuration  v1    docs reference config api kube scheduler config v1      kube controller manager configuration  v1alpha1    docs reference config api kube controller manager config v1alpha1      kube proxy configuration  v1alpha1    docs reference config api kube proxy config v1alpha1       audit k8s io v1  API   docs reference config api apiserver audit v1      Client authentication API  v1beta1    docs reference config api client authentication v1beta1   and     Client authentication API  v1    docs reference config api client authentication v1      WebhookAdmission configuration  v1    docs reference config api apiserver webhookadmission v1      ImagePolicy API  v1alpha1    docs reference config api imagepolicy v1alpha1       Config API for kubeadm     v1beta3   docs reference config api kubeadm config v1beta3      v1beta4   docs reference config api kubeadm config v1beta4       External APIs  These are the APIs defined by the Kubernetes project  but are not implemented by the core project      Metrics API  v1beta1    docs reference external api metrics v1beta1      Custom Metrics API  v1beta2    docs reference external api custom metrics v1beta2     External Metrics API  v1beta1    docs reference external api external metrics v1beta1      Design Docs  An archive of the design docs for Kubernetes functionality  Good starting points are  Kubernetes Architecture  https   git k8s io design proposals archive architecture architecture md  and  Kubernetes Design Overview  https   git k8s io design proposals archive


kubernetes reference title SubjectAccessReview import k8s io api authorization v1 contenttype apireference apiVersion authorization k8s io v1 kind SubjectAccessReview apimetadata weight 4 autogenerated true SubjectAccessReview checks whether or not a user or group can perform an action

Answer:
---
api_metadata:
  apiVersion: "authorization.k8s.io/v1"
  import: "k8s.io/api/authorization/v1"
  kind: "SubjectAccessReview"
content_type: "api_reference"
description: "SubjectAccessReview checks whether or not a user or group can perform an action."
title: "SubjectAccessReview"
weight: 4
auto_generated: true
---

`apiVersion: authorization.k8s.io/v1`

`import "k8s.io/api/authorization/v1"`

## SubjectAccessReview {#SubjectAccessReview}

SubjectAccessReview checks whether or not a user or group can perform an action.

- **apiVersion**: authorization.k8s.io/v1

- **kind**: SubjectAccessReview

- **metadata** (ObjectMeta)

  Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

- **spec** (SubjectAccessReviewSpec), required

  Spec holds information about the request being evaluated

- **status** (SubjectAccessReviewStatus)

  Status is filled in by the server and indicates whether the request is allowed or not

## SubjectAccessReviewSpec {#SubjectAccessReviewSpec}

SubjectAccessReviewSpec is a description of the access request.  Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be set

- **extra** (map[string][]string)

  Extra corresponds to the user.Info.GetExtra() method from the authenticator.  Since that is input to the authorizer it needs a reflection here.

- **groups** ([]string)

  *Atomic: will be replaced during a merge*

  Groups is the groups you're testing for.

- **nonResourceAttributes** (NonResourceAttributes)

  NonResourceAttributes describes information for a non-resource access request

  *NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface*

  - **nonResourceAttributes.path** (string)

    Path is the URL path of the request

  - **nonResourceAttributes.verb** (string)

    Verb is the standard HTTP verb

- **resourceAttributes** (ResourceAttributes)

  ResourceAuthorizationAttributes describes information for a resource access request

  *ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface*

  - **resourceAttributes.fieldSelector** (FieldSelectorAttributes)

    fieldSelector describes the limitation on access based on field.  It can only limit access, not broaden it.

    This field  is alpha-level. To use this field, you must enable the `AuthorizeWithSelectors` feature gate (disabled by default).

    *FieldSelectorAttributes indicates a field limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.*

    - **resourceAttributes.fieldSelector.rawSelector** (string)

      rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook implementations are encouraged to ignore rawSelector. The kube-apiserver's *SubjectAccessReview will parse the rawSelector as long as the requirements are not present.

    - **resourceAttributes.fieldSelector.requirements** ([]FieldSelectorRequirement)

      *Atomic: will be replaced during a merge*

      requirements is the parsed interpretation of a field selector. All requirements must be met for a resource instance to match the selector. Webhook implementations should handle requirements, but how to handle them is up to the webhook. Since requirements can only limit the request, it is safe to authorize as unlimited request if the requirements are not understood.

      *FieldSelectorRequirement is a selector that contains values, a key, and an operator that relates the key and values.*

      - **resourceAttributes.fieldSelector.requirements.key** (string), required

        key is the field selector key that the requirement applies to.

      - **resourceAttributes.fieldSelector.requirements.operator** (string), required

        operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. The list of operators may grow in the future.

      - **resourceAttributes.fieldSelector.requirements.values** ([]string)

        *Atomic: will be replaced during a merge*

        values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.

  - **resourceAttributes.group** (string)

    Group is the API Group of the Resource.  "*" means all.

  - **resourceAttributes.labelSelector** (LabelSelectorAttributes)

    labelSelector describes the limitation on access based on labels.  It can only limit access, not broaden it.

    This field  is alpha-level. To use this field, you must enable the `AuthorizeWithSelectors` feature gate (disabled by default).

    *LabelSelectorAttributes indicates a label limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.*

    - **resourceAttributes.labelSelector.rawSelector** (string)

      rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook implementations are encouraged to ignore rawSelector. The kube-apiserver's *SubjectAccessReview will parse the rawSelector as long as the requirements are not present.

    - **resourceAttributes.labelSelector.requirements** ([]LabelSelectorRequirement)

      *Atomic: will be replaced during a merge*

      requirements is the parsed interpretation of a label selector. All requirements must be met for a resource instance to match the selector. Webhook implementations should handle requirements, but how to handle them is up to the webhook. Since requirements can only limit the request, it is safe to authorize as unlimited request if the requirements are not understood.

      *A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.*

      - **resourceAttributes.labelSelector.requirements.key** (string), required

        key is the label key that the selector applies to.

      - **resourceAttributes.labelSelector.requirements.operator** (string), required

        operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.

      - **resourceAttributes.labelSelector.requirements.values** ([]string)

        *Atomic: will be replaced during a merge*

        values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

  - **resourceAttributes.name** (string)

    Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.

  - **resourceAttributes.namespace** (string)

    Namespace is the namespace of the action being requested.  Currently, there is no distinction between no namespace and all namespaces "" (empty) is defaulted for LocalSubjectAccessReviews "" (empty) is empty for cluster-scoped resources "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview

  - **resourceAttributes.resource** (string)

    Resource is one of the existing resource types.  "*" means all.

  - **resourceAttributes.subresource** (string)

    Subresource is one of the existing resource types.  "" means none.

  - **resourceAttributes.verb** (string)

    Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy.  "*" means all.

  - **resourceAttributes.version** (string)

    Version is the API Version of the Resource.  "*" means all.

- **uid** (string)

  UID information about the requesting user.

- **user** (string)

  User is the user you're testing for. If you specify "User" but not "Groups", then is it interpreted as "What if User were not a member of any groups

## SubjectAccessReviewStatus {#SubjectAccessReviewStatus}

SubjectAccessReviewStatus

- **allowed** (boolean), required

  Allowed is required. True if the action would be allowed, false otherwise.

- **denied** (boolean)

  Denied is optional. True if the action would be denied, otherwise false. If both allowed is false and denied is false, then the authorizer has no opinion on whether to authorize the action. Denied may not be true if Allowed is true.

- **evaluationError** (string)

  EvaluationError is an indication that some error occurred during the authorization check. It is entirely possible to get an error and be able to continue determine authorization status in spite of it. For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.

- **reason** (string)

  Reason is optional.  It indicates why a request was allowed or denied.

## Operations {#Operations}

### `create` create a SubjectAccessReview

#### HTTP Request

POST /apis/authorization.k8s.io/v1/subjectaccessreviews

#### Parameters

- **body**: SubjectAccessReview, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (SubjectAccessReview): OK

201 (SubjectAccessReview): Created

202 (SubjectAccessReview): Accepted

401: Unauthorized

api metadata    apiVersion   authorization k8s io v1    import   k8s io api authorization v1    kind   SubjectAccessReview  content type   api reference  description   SubjectAccessReview checks whether or not a user or group can perform an action   title   SubjectAccessReview  weight  4 auto generated  true           The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the   Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project        apiVersion  authorization k8s io v1    import  k8s io api authorization v1        SubjectAccessReview   SubjectAccessReview   SubjectAccessReview checks whether or not a user or group can perform an action    hr       apiVersion    authorization k8s io v1       kind    SubjectAccessReview       metadata     a href    ObjectMeta  a      Standard list metadata  More info  https   git k8s io community contributors devel sig architecture api conventions md metadata      spec     a href    SubjectAccessReviewSpec  a    required    Spec holds information about the request being evaluated      status     a href    SubjectAccessReviewStatus  a      Status is filled in by the server and indicates whether the request is allowed or not         SubjectAccessReviewSpec   SubjectAccessReviewSpec   SubjectAccessReviewSpec is a description of the access request   Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be set   hr       extra    map string   string     Extra corresponds to the user Info GetExtra   method from the authenticator   Since that is input to the authorizer it needs a reflection here       groups      string      Atomic  will be replaced during a merge       Groups is the groups you re testing for       nonResourceAttributes    NonResourceAttributes     NonResourceAttributes describes information for a non resource access request     a name  NonResourceAttributes    a     NonResourceAttributes includes the authorization attributes available for non resource requests to the Authorizer interface         nonResourceAttributes path    string       Path is the URL path of the request        nonResourceAttributes verb    string       Verb is the standard HTTP verb      resourceAttributes    ResourceAttributes     ResourceAuthorizationAttributes describes information for a resource access request     a name  ResourceAttributes    a     ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface         resourceAttributes fieldSelector    FieldSelectorAttributes       fieldSelector describes the limitation on access based on field   It can only limit access  not broaden it           This field  is alpha level  To use this field  you must enable the  AuthorizeWithSelectors  feature gate  disabled by default         a name  FieldSelectorAttributes    a       FieldSelectorAttributes indicates a field limited access  Webhook authors are encouraged to   ensure rawSelector and requirements are not both set   consider the requirements field if set   not try to parse or consider the rawSelector field if set  This is to avoid another CVE 2022 2880  i e  getting different systems to agree on how exactly to parse a query is not something we want   see https   www oxeye io resources golang parameter smuggling attack for more details  For the  SubjectAccessReview endpoints of the kube apiserver    If rawSelector is empty and requirements are empty  the request is not limited    If rawSelector is present and requirements are empty  the rawSelector will be parsed and limited if the parsing succeeds    If rawSelector is empty and requirements are present  the requirements should be honored   If rawSelector is present and requirements are present  the request is invalid            resourceAttributes fieldSelector rawSelector    string         rawSelector is the serialization of a field selector that would be included in a query parameter  Webhook implementations are encouraged to ignore rawSelector  The kube apiserver s  SubjectAccessReview will parse the rawSelector as long as the requirements are not present           resourceAttributes fieldSelector requirements      FieldSelectorRequirement          Atomic  will be replaced during a merge               requirements is the parsed interpretation of a field selector  All requirements must be met for a resource instance to match the selector  Webhook implementations should handle requirements  but how to handle them is up to the webhook  Since requirements can only limit the request  it is safe to authorize as unlimited request if the requirements are not understood          a name  FieldSelectorRequirement    a         FieldSelectorRequirement is a selector that contains values  a key  and an operator that relates the key and values              resourceAttributes fieldSelector requirements key    string   required          key is the field selector key that the requirement applies to             resourceAttributes fieldSelector requirements operator    string   required          operator represents a key s relationship to a set of values  Valid operators are In  NotIn  Exists  DoesNotExist  The list of operators may grow in the future             resourceAttributes fieldSelector requirements values      string            Atomic  will be replaced during a merge                   values is an array of string values  If the operator is In or NotIn  the values array must be non empty  If the operator is Exists or DoesNotExist  the values array must be empty         resourceAttributes group    string       Group is the API Group of the Resource       means all         resourceAttributes labelSelector    LabelSelectorAttributes       labelSelector describes the limitation on access based on labels   It can only limit access  not broaden it           This field  is alpha level  To use this field  you must enable the  AuthorizeWithSelectors  feature gate  disabled by default         a name  LabelSelectorAttributes    a       LabelSelectorAttributes indicates a label limited access  Webhook authors are encouraged to   ensure rawSelector and requirements are not both set   consider the requirements field if set   not try to parse or consider the rawSelector field if set  This is to avoid another CVE 2022 2880  i e  getting different systems to agree on how exactly to parse a query is not something we want   see https   www oxeye io resources golang parameter smuggling attack for more details  For the  SubjectAccessReview endpoints of the kube apiserver    If rawSelector is empty and requirements are empty  the request is not limited    If rawSelector is present and requirements are empty  the rawSelector will be parsed and limited if the parsing succeeds    If rawSelector is empty and requirements are present  the requirements should be honored   If rawSelector is present and requirements are present  the request is invalid            resourceAttributes labelSelector rawSelector    string         rawSelector is the serialization of a field selector that would be included in a query parameter  Webhook implementations are encouraged to ignore rawSelector  The kube apiserver s  SubjectAccessReview will parse the rawSelector as long as the requirements are not present           resourceAttributes labelSelector requirements      LabelSelectorRequirement          Atomic  will be replaced during a merge               requirements is the parsed interpretation of a label selector  All requirements must be met for a resource instance to match the selector  Webhook implementations should handle requirements  but how to handle them is up to the webhook  Since requirements can only limit the request  it is safe to authorize as unlimited request if the requirements are not understood          a name  LabelSelectorRequirement    a         A label selector requirement is a selector that contains values  a key  and an operator that relates the key and values              resourceAttributes labelSelector requirements key    string   required          key is the label key that the selector applies to             resourceAttributes labelSelector requirements operator    string   required          operator represents a key s relationship to a set of values  Valid operators are In  NotIn  Exists and DoesNotExist             resourceAttributes labelSelector requirements values      string            Atomic  will be replaced during a merge                   values is an array of string values  If the operator is In or NotIn  the values array must be non empty  If the operator is Exists or DoesNotExist  the values array must be empty  This array is replaced during a strategic merge patch         resourceAttributes name    string       Name is the name of the resource being requested for a  get  or deleted for a  delete       empty  means all         resourceAttributes namespace    string       Namespace is the namespace of the action being requested   Currently  there is no distinction between no namespace and all namespaces     empty  is defaulted for LocalSubjectAccessReviews     empty  is empty for cluster scoped resources     empty  means  all  for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview        resourceAttributes resource    string       Resource is one of the existing resource types       means all         resourceAttributes subresource    string       Subresource is one of the existing resource types      means none         resourceAttributes verb    string       Verb is a kubernetes resource API verb  like  get  list  watch  create  update  delete  proxy       means all         resourceAttributes version    string       Version is the API Version of the Resource       means all       uid    string     UID information about the requesting user       user    string     User is the user you re testing for  If you specify  User  but not  Groups   then is it interpreted as  What if User were not a member of any groups         SubjectAccessReviewStatus   SubjectAccessReviewStatus   SubjectAccessReviewStatus   hr       allowed    boolean   required    Allowed is required  True if the action would be allowed  false otherwise       denied    boolean     Denied is optional  True if the action would be denied  otherwise false  If both allowed is false and denied is false  then the authorizer has no opinion on whether to authorize the action  Denied may not be true if Allowed is true       evaluationError    string     EvaluationError is an indication that some error occurred during the authorization check  It is entirely possible to get an error and be able to continue determine authorization status in spite of it  For instance  RBAC can be missing a role  but enough roles are still present and bound to reason about the request       reason    string     Reason is optional   It indicates why a request was allowed or denied          Operations   Operations      hr             create  create a SubjectAccessReview       HTTP Request  POST  apis authorization k8s io v1 subjectaccessreviews       Parameters       body     a href    SubjectAccessReview  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    SubjectAccessReview  a    OK  201   a href    SubjectAccessReview  a    Created  202   a href    SubjectAccessReview  a    Accepted  401  Unauthorized


kubernetes reference ClusterRoleBinding references a ClusterRole but not contain it weight 6 title ClusterRoleBinding import k8s io api rbac v1 apiVersion rbac authorization k8s io v1 contenttype apireference apimetadata kind ClusterRoleBinding autogenerated true

Answer:
---
api_metadata:
  apiVersion: "rbac.authorization.k8s.io/v1"
  import: "k8s.io/api/rbac/v1"
  kind: "ClusterRoleBinding"
content_type: "api_reference"
description: "ClusterRoleBinding references a ClusterRole, but not contain it."
title: "ClusterRoleBinding"
weight: 6
auto_generated: true
---

`apiVersion: rbac.authorization.k8s.io/v1`

`import "k8s.io/api/rbac/v1"`

## ClusterRoleBinding {#ClusterRoleBinding}

ClusterRoleBinding references a ClusterRole, but not contain it.  It can reference a ClusterRole in the global namespace, and adds who information via Subject.

- **apiVersion**: rbac.authorization.k8s.io/v1

- **kind**: ClusterRoleBinding

- **metadata** (ObjectMeta)

  Standard object's metadata.

- **roleRef** (RoleRef), required

  RoleRef can only reference a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error. This field is immutable.

  *RoleRef contains information that points to the role being used*

  - **roleRef.apiGroup** (string), required

    APIGroup is the group for the resource being referenced

  - **roleRef.kind** (string), required

    Kind is the type of resource being referenced

  - **roleRef.name** (string), required

    Name is the name of resource being referenced

- **subjects** ([]Subject)

  *Atomic: will be replaced during a merge*

  Subjects holds references to the objects the role applies to.

  *Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference, or a value for non-objects such as user and group names.*

  - **subjects.kind** (string), required

    Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". If the Authorizer does not recognized the kind value, the Authorizer should report an error.

  - **subjects.name** (string), required

    Name of the object being referenced.

  - **subjects.apiGroup** (string)

    APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" for User and Group subjects.

  - **subjects.namespace** (string)

    Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty the Authorizer should report an error.

## ClusterRoleBindingList {#ClusterRoleBindingList}

ClusterRoleBindingList is a collection of ClusterRoleBindings

- **apiVersion**: rbac.authorization.k8s.io/v1

- **kind**: ClusterRoleBindingList

- **metadata** (ListMeta)

  Standard object's metadata.

- **items** ([]ClusterRoleBinding), required

  Items is a list of ClusterRoleBindings

## Operations {#Operations}

### `get` read the specified ClusterRoleBinding

#### HTTP Request

GET /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the ClusterRoleBinding

- **pretty** (*in query*): string

  pretty

#### Response

200 (ClusterRoleBinding): OK

401: Unauthorized

### `list` list or watch objects of kind ClusterRoleBinding

#### HTTP Request

GET /apis/rbac.authorization.k8s.io/v1/clusterrolebindings

#### Parameters

- **allowWatchBookmarks** (*in query*): boolean

  allowWatchBookmarks

- **continue** (*in query*): string

  continue

- **fieldSelector** (*in query*): string

  fieldSelector

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

- **watch** (*in query*): boolean

  watch

#### Response

200 (ClusterRoleBindingList): OK

401: Unauthorized

### `create` create a ClusterRoleBinding

#### HTTP Request

POST /apis/rbac.authorization.k8s.io/v1/clusterrolebindings

#### Parameters

- **body**: ClusterRoleBinding, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (ClusterRoleBinding): OK

201 (ClusterRoleBinding): Created

202 (ClusterRoleBinding): Accepted

401: Unauthorized

### `update` replace the specified ClusterRoleBinding

#### HTTP Request

PUT /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the ClusterRoleBinding

- **body**: ClusterRoleBinding, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (ClusterRoleBinding): OK

201 (ClusterRoleBinding): Created

401: Unauthorized

### `patch` partially update the specified ClusterRoleBinding

#### HTTP Request

PATCH /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the ClusterRoleBinding

- **body**: Patch, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **force** (*in query*): boolean

  force

- **pretty** (*in query*): string

  pretty

#### Response

200 (ClusterRoleBinding): OK

201 (ClusterRoleBinding): Created

401: Unauthorized

### `delete` delete a ClusterRoleBinding

#### HTTP Request

DELETE /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the ClusterRoleBinding

- **body**: DeleteOptions

- **dryRun** (*in query*): string

  dryRun

- **gracePeriodSeconds** (*in query*): integer

  gracePeriodSeconds

- **pretty** (*in query*): string

  pretty

- **propagationPolicy** (*in query*): string

  propagationPolicy

#### Response

200 (Status): OK

202 (Status): Accepted

401: Unauthorized

### `deletecollection` delete collection of ClusterRoleBinding

#### HTTP Request

DELETE /apis/rbac.authorization.k8s.io/v1/clusterrolebindings

#### Parameters

- **body**: DeleteOptions

- **continue** (*in query*): string

  continue

- **dryRun** (*in query*): string

  dryRun

- **fieldSelector** (*in query*): string

  fieldSelector

- **gracePeriodSeconds** (*in query*): integer

  gracePeriodSeconds

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **propagationPolicy** (*in query*): string

  propagationPolicy

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

#### Response

200 (Status): OK

401: Unauthorized

api metadata    apiVersion   rbac authorization k8s io v1    import   k8s io api rbac v1    kind   ClusterRoleBinding  content type   api reference  description   ClusterRoleBinding references a ClusterRole  but not contain it   title   ClusterRoleBinding  weight  6 auto generated  true           The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the   Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project        apiVersion  rbac authorization k8s io v1    import  k8s io api rbac v1        ClusterRoleBinding   ClusterRoleBinding   ClusterRoleBinding references a ClusterRole  but not contain it   It can reference a ClusterRole in the global namespace  and adds who information via Subject    hr       apiVersion    rbac authorization k8s io v1       kind    ClusterRoleBinding       metadata     a href    ObjectMeta  a      Standard object s metadata       roleRef    RoleRef   required    RoleRef can only reference a ClusterRole in the global namespace  If the RoleRef cannot be resolved  the Authorizer must return an error  This field is immutable      a name  RoleRef    a     RoleRef contains information that points to the role being used         roleRef apiGroup    string   required      APIGroup is the group for the resource being referenced        roleRef kind    string   required      Kind is the type of resource being referenced        roleRef name    string   required      Name is the name of resource being referenced      subjects      Subject      Atomic  will be replaced during a merge       Subjects holds references to the objects the role applies to      a name  Subject    a     Subject contains a reference to the object or user identities a role binding applies to   This can either hold a direct API object reference  or a value for non objects such as user and group names          subjects kind    string   required      Kind of object being referenced  Values defined by this API group are  User    Group   and  ServiceAccount   If the Authorizer does not recognized the kind value  the Authorizer should report an error         subjects name    string   required      Name of the object being referenced         subjects apiGroup    string       APIGroup holds the API group of the referenced subject  Defaults to    for ServiceAccount subjects  Defaults to  rbac authorization k8s io  for User and Group subjects         subjects namespace    string       Namespace of the referenced object   If the object kind is non namespace  such as  User  or  Group   and this value is not empty the Authorizer should report an error          ClusterRoleBindingList   ClusterRoleBindingList   ClusterRoleBindingList is a collection of ClusterRoleBindings   hr       apiVersion    rbac authorization k8s io v1       kind    ClusterRoleBindingList       metadata     a href    ListMeta  a      Standard object s metadata       items       a href    ClusterRoleBinding  a    required    Items is a list of ClusterRoleBindings         Operations   Operations      hr             get  read the specified ClusterRoleBinding       HTTP Request  GET  apis rbac authorization k8s io v1 clusterrolebindings  name        Parameters       name     in path    string  required    name of the ClusterRoleBinding       pretty     in query    string     a href    pretty  a          Response   200   a href    ClusterRoleBinding  a    OK  401  Unauthorized        list  list or watch objects of kind ClusterRoleBinding       HTTP Request  GET  apis rbac authorization k8s io v1 clusterrolebindings       Parameters       allowWatchBookmarks     in query    boolean     a href    allowWatchBookmarks  a        continue     in query    string     a href    continue  a        fieldSelector     in query    string     a href    fieldSelector  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a        watch     in query    boolean     a href    watch  a          Response   200   a href    ClusterRoleBindingList  a    OK  401  Unauthorized        create  create a ClusterRoleBinding       HTTP Request  POST  apis rbac authorization k8s io v1 clusterrolebindings       Parameters       body     a href    ClusterRoleBinding  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    ClusterRoleBinding  a    OK  201   a href    ClusterRoleBinding  a    Created  202   a href    ClusterRoleBinding  a    Accepted  401  Unauthorized        update  replace the specified ClusterRoleBinding       HTTP Request  PUT  apis rbac authorization k8s io v1 clusterrolebindings  name        Parameters       name     in path    string  required    name of the ClusterRoleBinding       body     a href    ClusterRoleBinding  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    ClusterRoleBinding  a    OK  201   a href    ClusterRoleBinding  a    Created  401  Unauthorized        patch  partially update the specified ClusterRoleBinding       HTTP Request  PATCH  apis rbac authorization k8s io v1 clusterrolebindings  name        Parameters       name     in path    string  required    name of the ClusterRoleBinding       body     a href    Patch  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        force     in query    boolean     a href    force  a        pretty     in query    string     a href    pretty  a          Response   200   a href    ClusterRoleBinding  a    OK  201   a href    ClusterRoleBinding  a    Created  401  Unauthorized        delete  delete a ClusterRoleBinding       HTTP Request  DELETE  apis rbac authorization k8s io v1 clusterrolebindings  name        Parameters       name     in path    string  required    name of the ClusterRoleBinding       body     a href    DeleteOptions  a            dryRun     in query    string     a href    dryRun  a        gracePeriodSeconds     in query    integer     a href    gracePeriodSeconds  a        pretty     in query    string     a href    pretty  a        propagationPolicy     in query    string     a href    propagationPolicy  a          Response   200   a href    Status  a    OK  202   a href    Status  a    Accepted  401  Unauthorized        deletecollection  delete collection of ClusterRoleBinding       HTTP Request  DELETE  apis rbac authorization k8s io v1 clusterrolebindings       Parameters       body     a href    DeleteOptions  a            continue     in query    string     a href    continue  a        dryRun     in query    string     a href    dryRun  a        fieldSelector     in query    string     a href    fieldSelector  a        gracePeriodSeconds     in query    integer     a href    gracePeriodSeconds  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        propagationPolicy     in query    string     a href    propagationPolicy  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a          Response   200   a href    Status  a    OK  401  Unauthorized


kubernetes reference weight 2 import k8s io api authorization v1 contenttype apireference SelfSubjectAccessReview checks whether or the current user can perform an action apiVersion authorization k8s io v1 apimetadata title SelfSubjectAccessReview autogenerated true kind SelfSubjectAccessReview

Answer:
---
api_metadata:
  apiVersion: "authorization.k8s.io/v1"
  import: "k8s.io/api/authorization/v1"
  kind: "SelfSubjectAccessReview"
content_type: "api_reference"
description: "SelfSubjectAccessReview checks whether or the current user can perform an action."
title: "SelfSubjectAccessReview"
weight: 2
auto_generated: true
---

`apiVersion: authorization.k8s.io/v1`

`import "k8s.io/api/authorization/v1"`

## SelfSubjectAccessReview {#SelfSubjectAccessReview}

SelfSubjectAccessReview checks whether or the current user can perform an action.  Not filling in a spec.namespace means "in all namespaces".  Self is a special case, because users should always be able to check whether they can perform an action

- **apiVersion**: authorization.k8s.io/v1

- **kind**: SelfSubjectAccessReview

- **metadata** (ObjectMeta)

  Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

- **spec** (SelfSubjectAccessReviewSpec), required

  Spec holds information about the request being evaluated.  user and groups must be empty

- **status** (SubjectAccessReviewStatus)

  Status is filled in by the server and indicates whether the request is allowed or not

## SelfSubjectAccessReviewSpec {#SelfSubjectAccessReviewSpec}

SelfSubjectAccessReviewSpec is a description of the access request.  Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be set

- **nonResourceAttributes** (NonResourceAttributes)

  NonResourceAttributes describes information for a non-resource access request

  *NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface*

  - **nonResourceAttributes.path** (string)

    Path is the URL path of the request

  - **nonResourceAttributes.verb** (string)

    Verb is the standard HTTP verb

- **resourceAttributes** (ResourceAttributes)

  ResourceAuthorizationAttributes describes information for a resource access request

  *ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface*

  - **resourceAttributes.fieldSelector** (FieldSelectorAttributes)

    fieldSelector describes the limitation on access based on field.  It can only limit access, not broaden it.

    This field  is alpha-level. To use this field, you must enable the `AuthorizeWithSelectors` feature gate (disabled by default).

    *FieldSelectorAttributes indicates a field limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.*

    - **resourceAttributes.fieldSelector.rawSelector** (string)

      rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook implementations are encouraged to ignore rawSelector. The kube-apiserver's *SubjectAccessReview will parse the rawSelector as long as the requirements are not present.

    - **resourceAttributes.fieldSelector.requirements** ([]FieldSelectorRequirement)

      *Atomic: will be replaced during a merge*

      requirements is the parsed interpretation of a field selector. All requirements must be met for a resource instance to match the selector. Webhook implementations should handle requirements, but how to handle them is up to the webhook. Since requirements can only limit the request, it is safe to authorize as unlimited request if the requirements are not understood.

      *FieldSelectorRequirement is a selector that contains values, a key, and an operator that relates the key and values.*

      - **resourceAttributes.fieldSelector.requirements.key** (string), required

        key is the field selector key that the requirement applies to.

      - **resourceAttributes.fieldSelector.requirements.operator** (string), required

        operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. The list of operators may grow in the future.

      - **resourceAttributes.fieldSelector.requirements.values** ([]string)

        *Atomic: will be replaced during a merge*

        values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.

  - **resourceAttributes.group** (string)

    Group is the API Group of the Resource.  "*" means all.

  - **resourceAttributes.labelSelector** (LabelSelectorAttributes)

    labelSelector describes the limitation on access based on labels.  It can only limit access, not broaden it.

    This field  is alpha-level. To use this field, you must enable the `AuthorizeWithSelectors` feature gate (disabled by default).

    *LabelSelectorAttributes indicates a label limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.*

    - **resourceAttributes.labelSelector.rawSelector** (string)

      rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook implementations are encouraged to ignore rawSelector. The kube-apiserver's *SubjectAccessReview will parse the rawSelector as long as the requirements are not present.

    - **resourceAttributes.labelSelector.requirements** ([]LabelSelectorRequirement)

      *Atomic: will be replaced during a merge*

      requirements is the parsed interpretation of a label selector. All requirements must be met for a resource instance to match the selector. Webhook implementations should handle requirements, but how to handle them is up to the webhook. Since requirements can only limit the request, it is safe to authorize as unlimited request if the requirements are not understood.

      *A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.*

      - **resourceAttributes.labelSelector.requirements.key** (string), required

        key is the label key that the selector applies to.

      - **resourceAttributes.labelSelector.requirements.operator** (string), required

        operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.

      - **resourceAttributes.labelSelector.requirements.values** ([]string)

        *Atomic: will be replaced during a merge*

        values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

  - **resourceAttributes.name** (string)

    Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.

  - **resourceAttributes.namespace** (string)

    Namespace is the namespace of the action being requested.  Currently, there is no distinction between no namespace and all namespaces "" (empty) is defaulted for LocalSubjectAccessReviews "" (empty) is empty for cluster-scoped resources "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview

  - **resourceAttributes.resource** (string)

    Resource is one of the existing resource types.  "*" means all.

  - **resourceAttributes.subresource** (string)

    Subresource is one of the existing resource types.  "" means none.

  - **resourceAttributes.verb** (string)

    Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy.  "*" means all.

  - **resourceAttributes.version** (string)

    Version is the API Version of the Resource.  "*" means all.

## Operations {#Operations}

### `create` create a SelfSubjectAccessReview

#### HTTP Request

POST /apis/authorization.k8s.io/v1/selfsubjectaccessreviews

#### Parameters

- **body**: SelfSubjectAccessReview, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (SelfSubjectAccessReview): OK

201 (SelfSubjectAccessReview): Created

202 (SelfSubjectAccessReview): Accepted

401: Unauthorized

api metadata    apiVersion   authorization k8s io v1    import   k8s io api authorization v1    kind   SelfSubjectAccessReview  content type   api reference  description   SelfSubjectAccessReview checks whether or the current user can perform an action   title   SelfSubjectAccessReview  weight  2 auto generated  true           The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the   Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project        apiVersion  authorization k8s io v1    import  k8s io api authorization v1        SelfSubjectAccessReview   SelfSubjectAccessReview   SelfSubjectAccessReview checks whether or the current user can perform an action   Not filling in a spec namespace means  in all namespaces    Self is a special case  because users should always be able to check whether they can perform an action   hr       apiVersion    authorization k8s io v1       kind    SelfSubjectAccessReview       metadata     a href    ObjectMeta  a      Standard list metadata  More info  https   git k8s io community contributors devel sig architecture api conventions md metadata      spec     a href    SelfSubjectAccessReviewSpec  a    required    Spec holds information about the request being evaluated   user and groups must be empty      status     a href    SubjectAccessReviewStatus  a      Status is filled in by the server and indicates whether the request is allowed or not         SelfSubjectAccessReviewSpec   SelfSubjectAccessReviewSpec   SelfSubjectAccessReviewSpec is a description of the access request   Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be set   hr       nonResourceAttributes    NonResourceAttributes     NonResourceAttributes describes information for a non resource access request     a name  NonResourceAttributes    a     NonResourceAttributes includes the authorization attributes available for non resource requests to the Authorizer interface         nonResourceAttributes path    string       Path is the URL path of the request        nonResourceAttributes verb    string       Verb is the standard HTTP verb      resourceAttributes    ResourceAttributes     ResourceAuthorizationAttributes describes information for a resource access request     a name  ResourceAttributes    a     ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface         resourceAttributes fieldSelector    FieldSelectorAttributes       fieldSelector describes the limitation on access based on field   It can only limit access  not broaden it           This field  is alpha level  To use this field  you must enable the  AuthorizeWithSelectors  feature gate  disabled by default         a name  FieldSelectorAttributes    a       FieldSelectorAttributes indicates a field limited access  Webhook authors are encouraged to   ensure rawSelector and requirements are not both set   consider the requirements field if set   not try to parse or consider the rawSelector field if set  This is to avoid another CVE 2022 2880  i e  getting different systems to agree on how exactly to parse a query is not something we want   see https   www oxeye io resources golang parameter smuggling attack for more details  For the  SubjectAccessReview endpoints of the kube apiserver    If rawSelector is empty and requirements are empty  the request is not limited    If rawSelector is present and requirements are empty  the rawSelector will be parsed and limited if the parsing succeeds    If rawSelector is empty and requirements are present  the requirements should be honored   If rawSelector is present and requirements are present  the request is invalid            resourceAttributes fieldSelector rawSelector    string         rawSelector is the serialization of a field selector that would be included in a query parameter  Webhook implementations are encouraged to ignore rawSelector  The kube apiserver s  SubjectAccessReview will parse the rawSelector as long as the requirements are not present           resourceAttributes fieldSelector requirements      FieldSelectorRequirement          Atomic  will be replaced during a merge               requirements is the parsed interpretation of a field selector  All requirements must be met for a resource instance to match the selector  Webhook implementations should handle requirements  but how to handle them is up to the webhook  Since requirements can only limit the request  it is safe to authorize as unlimited request if the requirements are not understood          a name  FieldSelectorRequirement    a         FieldSelectorRequirement is a selector that contains values  a key  and an operator that relates the key and values              resourceAttributes fieldSelector requirements key    string   required          key is the field selector key that the requirement applies to             resourceAttributes fieldSelector requirements operator    string   required          operator represents a key s relationship to a set of values  Valid operators are In  NotIn  Exists  DoesNotExist  The list of operators may grow in the future             resourceAttributes fieldSelector requirements values      string            Atomic  will be replaced during a merge                   values is an array of string values  If the operator is In or NotIn  the values array must be non empty  If the operator is Exists or DoesNotExist  the values array must be empty         resourceAttributes group    string       Group is the API Group of the Resource       means all         resourceAttributes labelSelector    LabelSelectorAttributes       labelSelector describes the limitation on access based on labels   It can only limit access  not broaden it           This field  is alpha level  To use this field  you must enable the  AuthorizeWithSelectors  feature gate  disabled by default         a name  LabelSelectorAttributes    a       LabelSelectorAttributes indicates a label limited access  Webhook authors are encouraged to   ensure rawSelector and requirements are not both set   consider the requirements field if set   not try to parse or consider the rawSelector field if set  This is to avoid another CVE 2022 2880  i e  getting different systems to agree on how exactly to parse a query is not something we want   see https   www oxeye io resources golang parameter smuggling attack for more details  For the  SubjectAccessReview endpoints of the kube apiserver    If rawSelector is empty and requirements are empty  the request is not limited    If rawSelector is present and requirements are empty  the rawSelector will be parsed and limited if the parsing succeeds    If rawSelector is empty and requirements are present  the requirements should be honored   If rawSelector is present and requirements are present  the request is invalid            resourceAttributes labelSelector rawSelector    string         rawSelector is the serialization of a field selector that would be included in a query parameter  Webhook implementations are encouraged to ignore rawSelector  The kube apiserver s  SubjectAccessReview will parse the rawSelector as long as the requirements are not present           resourceAttributes labelSelector requirements      LabelSelectorRequirement          Atomic  will be replaced during a merge               requirements is the parsed interpretation of a label selector  All requirements must be met for a resource instance to match the selector  Webhook implementations should handle requirements  but how to handle them is up to the webhook  Since requirements can only limit the request  it is safe to authorize as unlimited request if the requirements are not understood          a name  LabelSelectorRequirement    a         A label selector requirement is a selector that contains values  a key  and an operator that relates the key and values              resourceAttributes labelSelector requirements key    string   required          key is the label key that the selector applies to             resourceAttributes labelSelector requirements operator    string   required          operator represents a key s relationship to a set of values  Valid operators are In  NotIn  Exists and DoesNotExist             resourceAttributes labelSelector requirements values      string            Atomic  will be replaced during a merge                   values is an array of string values  If the operator is In or NotIn  the values array must be non empty  If the operator is Exists or DoesNotExist  the values array must be empty  This array is replaced during a strategic merge patch         resourceAttributes name    string       Name is the name of the resource being requested for a  get  or deleted for a  delete       empty  means all         resourceAttributes namespace    string       Namespace is the namespace of the action being requested   Currently  there is no distinction between no namespace and all namespaces     empty  is defaulted for LocalSubjectAccessReviews     empty  is empty for cluster scoped resources     empty  means  all  for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview        resourceAttributes resource    string       Resource is one of the existing resource types       means all         resourceAttributes subresource    string       Subresource is one of the existing resource types      means none         resourceAttributes verb    string       Verb is a kubernetes resource API verb  like  get  list  watch  create  update  delete  proxy       means all         resourceAttributes version    string       Version is the API Version of the Resource       means all          Operations   Operations      hr             create  create a SelfSubjectAccessReview       HTTP Request  POST  apis authorization k8s io v1 selfsubjectaccessreviews       Parameters       body     a href    SelfSubjectAccessReview  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    SelfSubjectAccessReview  a    OK  201   a href    SelfSubjectAccessReview  a    Created  202   a href    SelfSubjectAccessReview  a    Accepted  401  Unauthorized