kubernetes secret max length
https://kubernetes.io/docs/concepts/configuration/secret/
Secrets
2022-11-15
None
<div><div><p>A Secret is an object that contains a small amount of sensitive data such as
a password, a token, or a key. Such information might otherwise be put in a
<a href="/docs/concepts/workloads/pods/">Pod</a> specification or in a
<a href="/docs/reference/glossary/?all=true#term-image">container image</a>. Using a
Secret means that you don't need to include confidential data in your
application code.</p><p>Because Secrets can be created independently of the Pods that use them, there
is less risk of the Secret (and its data) being exposed during the workflow of
creating, viewing, and editing Pods. Kubernetes, and applications that run in
your cluster, can also take additional precautions with Secrets, such as avoiding
writing secret data to nonvolatile storage.</p><p>Secrets are similar to <a href="/docs/concepts/configuration/configmap/">ConfigMaps</a>
but are specifically intended to hold confidential data.</p><p>See <a href="#information-security-for-secrets">Information security for Secrets</a> for more details.</p><h2>Uses for Secrets</h2><p>There are three main ways for a Pod to use a Secret:</p><ul><li>As <a href="#using-secrets-as-files-from-a-pod">files</a> in a
<a href="/docs/concepts/storage/volumes/">volume</a> mounted on one or more of
its containers.</li><li>As <a href="#using-secrets-as-environment-variables">container environment variable</a>.</li><li>By the <a href="#using-imagepullsecrets">kubelet when pulling images</a> for the Pod.</li></ul><p>The Kubernetes control plane also uses Secrets; for example,
<a href="#bootstrap-token-secrets">bootstrap token Secrets</a> are a mechanism to
help automate node registration.</p><h3>Alternatives to Secrets</h3><p>Rather than using a Secret to protect confidential data, you can pick from alternatives.</p><p>Here are some of your options:</p><ul><li>if your cloud-native component needs to authenticate to another application that you
know is running within the same Kubernetes cluster, you can use a
<a href="/docs/reference/access-authn-authz/authentication/#service-account-tokens">ServiceAccount</a>
and its tokens to identify your client.</li><li>there are third-party tools that you can run, either within or outside your cluster,
that provide secrets management. For example, a service that Pods access over HTTPS,
that reveals a secret if the client correctly authenticates (for example, with a ServiceAccount
token).</li><li>for authentication, you can implement a custom signer for X.509 certificates, and use
<a href="/docs/reference/access-authn-authz/certificate-signing-requests/">CertificateSigningRequests</a>
to let that custom signer issue certificates to Pods that need them.</li><li>you can use a <a href="/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/">device plugin</a>
to expose node-local encryption hardware to a specific Pod. For example, you can schedule
trusted Pods onto nodes that provide a Trusted Platform Module, configured out-of-band.</li></ul><p>You can also combine two or more of those options, including the option to use Secret objects themselves.</p><p>For example: implement (or deploy) an <a href="/docs/concepts/extend-kubernetes/operator/">operator</a>
that fetches short-lived session tokens from an external service, and then creates Secrets based
on those short-lived session tokens. Pods running in your cluster can make use of the session tokens,
and operator ensures they are valid. This separation means that you can run Pods that are unaware of
the exact mechanisms for issuing and refreshing those session tokens.</p><h2>Working with Secrets</h2><h3>Creating a Secret</h3><p>There are several options to create a Secret:</p><ul><li><a href="/docs/tasks/configmap-secret/managing-secret-using-kubectl/">Use <code>kubectl</code></a></li><li><a href="/docs/tasks/configmap-secret/managing-secret-using-config-file/">Use a configuration file</a></li><li><a href="/docs/tasks/configmap-secret/managing-secret-using-kustomize/">Use the Kustomize tool</a></li></ul><h4>Constraints on Secret names and data</h4><p>The name of a Secret object must be a valid
<a href="/docs/concepts/overview/working-with-objects/names#dns-subdomain-names">DNS subdomain name</a>.</p><p>You can specify the <code>data</code> and/or the <code>stringData</code> field when creating a
configuration file for a Secret. The <code>data</code> and the <code>stringData</code> fields are optional.
The values for all keys in the <code>data</code> field have to be base64-encoded strings.
If the conversion to base64 string is not desirable, you can choose to specify
the <code>stringData</code> field instead, which accepts arbitrary strings as values.</p><p>The keys of <code>data</code> and <code>stringData</code> must consist of alphanumeric characters,
<code>-</code>, <code>_</code> or <code>.</code>. All key-value pairs in the <code>stringData</code> field are internally
merged into the <code>data</code> field. If a key appears in both the <code>data</code> and the
<code>stringData</code> field, the value specified in the <code>stringData</code> field takes
precedence.</p><h4>Size limit</h4><p>Individual secrets are limited to 1MiB in size. This is to discourage creation
of very large secrets that could exhaust the API server and kubelet memory.
However, creation of many smaller secrets could also exhaust memory. You can
use a <a href="/docs/concepts/policy/resource-quotas/">resource quota</a> to limit the
number of Secrets (or other resources) in a namespace.</p><h3>Editing a Secret</h3><p>You can edit an existing Secret unless it is <a href="#secret-immutable">immutable</a>. To
edit a Secret, use one of the following methods:</p><ul><li><a href="/docs/tasks/configmap-secret/managing-secret-using-kubectl/#edit-secret">Use <code>kubectl</code></a></li><li><a href="/docs/tasks/configmap-secret/managing-secret-using-config-file/#edit-secret">Use a configuration file</a></li></ul><p>You can also edit the data in a Secret using the <a href="/docs/tasks/configmap-secret/managing-secret-using-kustomize/#edit-secret">Kustomize tool</a>. However, this
method creates a new <code>Secret</code> object with the edited data.</p><p>Depending on how you created the Secret, as well as how the Secret is used in
your Pods, updates to existing <code>Secret</code> objects are propagated automatically to
Pods that use the data. For more information, refer to <a href="#mounted-secrets-are-updated-automatically">Mounted Secrets are updated automatically</a>.</p><h3>Using a Secret</h3><p>Secrets can be mounted as data volumes or exposed as
<a href="/docs/concepts/containers/container-environment/">environment variables</a>
to be used by a container in a Pod. Secrets can also be used by other parts of the
system, without being directly exposed to the Pod. For example, Secrets can hold
credentials that other parts of the system should use to interact with external
systems on your behalf.</p><p>Secret volume sources are validated to ensure that the specified object
reference actually points to an object of type Secret. Therefore, a Secret
needs to be created before any Pods that depend on it.</p><p>If the Secret cannot be fetched (perhaps because it does not exist, or
due to a temporary lack of connection to the API server) the kubelet
periodically retries running that Pod. The kubelet also reports an Event
for that Pod, including details of the problem fetching the Secret.</p><h4>Optional Secrets</h4><p>When you reference a Secret in a Pod, you can mark the Secret as <em>optional</em>,
such as in the following example. If an optional Secret doesn't exist,
Kubernetes ignores it.</p><div><pre><code>apiVersion: v1
kind: Pod
metadata:
 name: mypod
spec:
 containers:
 - name: mypod
 image: redis
 volumeMounts:
 - name: foo
 mountPath: "/etc/foo"
 readOnly: true
 volumes:
 - name: foo
 secret:
 secretName: mysecret
 optional: true
</code></pre></div><p>By default, Secrets are required. None of a Pod's containers will start until
all non-optional Secrets are available.</p><p>If a Pod references a specific key in a non-optional Secret and that Secret
does exist, but is missing the named key, the Pod fails during startup.</p><h3>Using Secrets as files from a Pod</h3><p>If you want to access data from a Secret in a Pod, one way to do that is to
have Kubernetes make the value of that Secret be available as a file inside
the filesystem of one or more of the Pod's containers.</p><h4>Mounted Secrets are updated automatically</h4><p>When a volume contains data from a Secret, and that Secret is updated, Kubernetes tracks
this and updates the data in the volume, using an eventually-consistent approach.</p><p>The kubelet keeps a cache of the current keys and values for the Secrets that are used in
volumes for pods on that node.
You can configure the way that the kubelet detects changes from the cached values. The
<code>configMapAndSecretChangeDetectionStrategy</code> field in the
<a href="/docs/reference/config-api/kubelet-config.v1beta1/">kubelet configuration</a> controls
which strategy the kubelet uses. The default strategy is <code>Watch</code>.</p><p>Updates to Secrets can be either propagated by an API watch mechanism (the default), based on
a cache with a defined time-to-live, or polled from the cluster API server on each kubelet
synchronisation loop.</p><p>As a result, the total delay from the moment when the Secret is updated to the moment
when new keys are projected to the Pod can be as long as the kubelet sync period + cache
propagation delay, where the cache propagation delay depends on the chosen cache type
(following the same order listed in the previous paragraph, these are:
watch propagation delay, the configured cache TTL, or zero for direct polling).</p><h3>Using Secrets as environment variables</h3><p>To use a Secret in an <a href="/docs/concepts/containers/container-environment/">environment variable</a>
in a Pod:</p><ol><li>For each container in your Pod specification, add an environment variable
for each Secret key that you want to use to the
<code>env[].valueFrom.secretKeyRef</code> field.</li><li>Modify your image and/or command line so that the program looks for values
in the specified environment variables.</li></ol><p>For instructions, refer to
<a href="/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data">Define container environment variables using Secret data</a>.</p><h4>Invalid environment variables</h4><p>If your environment variable definitions in your Pod specification are
considered to be invalid environment variable names, those keys aren't made
available to your container. The Pod is allowed to start.</p><p>Kubernetes adds an Event with the reason set to <code>InvalidVariableNames</code> and a
message that lists the skipped invalid keys. The following example shows a Pod that refers to a Secret named <code>mysecret</code>, where <code>mysecret</code> contains 2 invalid keys: <code>1badkey</code> and <code>2alsobad</code>.</p><p>The output is similar to:</p><pre><code>LASTSEEN FIRSTSEEN COUNT NAME KIND SUBOBJECT TYPE REASON
0s 0s 1 dapi-test-pod Pod Warning InvalidEnvironmentVariableNames kubelet, 127.0.0.1 Keys [1badkey, 2alsobad] from the EnvFrom secret default/mysecret were skipped since they are considered invalid environment variable names.
</code></pre><h3>Container image pull secrets</h3><p>If you want to fetch container images from a private repository, you need a way for
the kubelet on each node to authenticate to that repository. You can configure
<em>image pull secrets</em> to make this possible. These secrets are configured at the Pod
level.</p><h4>Using imagePullSecrets</h4><p>The <code>imagePullSecrets</code> field is a list of references to secrets in the same namespace.
You can use an <code>imagePullSecrets</code> to pass a secret that contains a Docker (or other) image registry
password to the kubelet. The kubelet uses this information to pull a private image on behalf of your Pod.
See the <a href="/docs/reference/generated/kubernetes-api/v1.26/#podspec-v1-core">PodSpec API</a>
for more information about the <code>imagePullSecrets</code> field.</p><h5>Manually specifying an imagePullSecret</h5><p>You can learn how to specify <code>imagePullSecrets</code> from the
<a href="/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod">container images</a>
documentation.</p><h5>Arranging for imagePullSecrets to be automatically attached</h5><p>You can manually create <code>imagePullSecrets</code>, and reference these from a ServiceAccount. Any Pods
created with that ServiceAccount or created with that ServiceAccount by default, will get their
<code>imagePullSecrets</code> field set to that of the service account.
See <a href="/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account">Add ImagePullSecrets to a service account</a>
for a detailed explanation of that process.</p><h3>Using Secrets with static Pods</h3><p>You cannot use ConfigMaps or Secrets with <a href="/docs/tasks/configure-pod-container/static-pod/">static Pods</a>.</p><h2>Use cases</h2><h3>Use case: As container environment variables</h3><p>You can create a Secret and use it to
<a href="/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data">set environment variables for a container</a>.</p><h3>Use case: Pod with SSH keys</h3><p>Create a Secret containing some SSH keys:</p><div><pre><code>kubectl create secret generic ssh-key-secret --from-file=ssh-privatekey=/path/to/.ssh/id_rsa --from-file=ssh-publickey=/path/to/.ssh/id_rsa.pub
</code></pre></div><p>The output is similar to:</p><pre><code>secret "ssh-key-secret" created
</code></pre><p>You can also create a <code>kustomization.yaml</code> with a <code>secretGenerator</code> field containing ssh keys.</p><p>Now you can create a Pod which references the secret with the SSH key and
consumes it in a volume:</p><div><pre><code>apiVersion: v1
kind: Pod
metadata:
 name: secret-test-pod
 labels:
 name: secret-test
spec:
 volumes:
 - name: secret-volume
 secret:
 secretName: ssh-key-secret
 containers:
 - name: ssh-test-container
 image: mySshImage
 volumeMounts:
 - name: secret-volume
 readOnly: true
 mountPath: "/etc/secret-volume"
</code></pre></div><p>When the container's command runs, the pieces of the key will be available in:</p><pre><code>/etc/secret-volume/ssh-publickey
/etc/secret-volume/ssh-privatekey
</code></pre><p>The container is then free to use the secret data to establish an SSH connection.</p><h3>Use case: Pods with prod / test credentials</h3><p>This example illustrates a Pod which consumes a secret containing production credentials and
another Pod which consumes a secret with test environment credentials.</p><p>You can create a <code>kustomization.yaml</code> with a <code>secretGenerator</code> field or run
<code>kubectl create secret</code>.</p><div><pre><code>kubectl create secret generic prod-db-secret --from-literal=username=produser --from-literal=password=Y4nys7f11
</code></pre></div><p>The output is similar to:</p><pre><code>secret "prod-db-secret" created
</code></pre><p>You can also create a secret for test environment credentials.</p><div><pre><code>kubectl create secret generic test-db-secret --from-literal=username=testuser --from-literal=password=iluvtests
</code></pre></div><p>The output is similar to:</p><pre><code>secret "test-db-secret" created
</code></pre><p>Now make the Pods:</p><div><pre><code>cat &lt;&lt;EOF &gt; pod.yaml
apiVersion: v1
kind: List
items:
- kind: Pod
 apiVersion: v1
 metadata:
 name: prod-db-client-pod
 labels:
 name: prod-db-client
 spec:
 volumes:
 - name: secret-volume
 secret:
 secretName: prod-db-secret
 containers:
 - name: db-client-container
 image: myClientImage
 volumeMounts:
 - name: secret-volume
 readOnly: true
 mountPath: "/etc/secret-volume"
- kind: Pod
 apiVersion: v1
 metadata:
 name: test-db-client-pod
 labels:
 name: test-db-client
 spec:
 volumes:
 - name: secret-volume
 secret:
 secretName: test-db-secret
 containers:
 - name: db-client-container
 image: myClientImage
 volumeMounts:
 - name: secret-volume
 readOnly: true
 mountPath: "/etc/secret-volume"
EOF
</code></pre></div><p>Add the pods to the same <code>kustomization.yaml</code>:</p><div><pre><code>cat &lt;&lt;EOF &gt;&gt; kustomization.yaml
resources:
- pod.yaml
EOF
</code></pre></div><p>Apply all those objects on the API server by running:</p><p>Both containers will have the following files present on their filesystems with the values
for each container's environment:</p><pre><code>/etc/secret-volume/username
/etc/secret-volume/password
</code></pre><p>Note how the specs for the two Pods differ only in one field; this facilitates
creating Pods with different capabilities from a common Pod template.</p><p>You could further simplify the base Pod specification by using two service accounts:</p><ol><li><code>prod-user</code> with the <code>prod-db-secret</code></li><li><code>test-user</code> with the <code>test-db-secret</code></li></ol><p>The Pod specification is shortened to:</p><div><pre><code>apiVersion: v1
kind: Pod
metadata:
 name: prod-db-client-pod
 labels:
 name: prod-db-client
spec:
 serviceAccount: prod-db-client
 containers:
 - name: db-client-container
 image: myClientImage
</code></pre></div><h3>Use case: dotfiles in a secret volume</h3><p>You can make your data "hidden" by defining a key that begins with a dot.
This key represents a dotfile or "hidden" file. For example, when the following secret
is mounted into a volume, <code>secret-volume</code>:</p><div><pre><code>apiVersion: v1
kind: Secret
metadata:
 name: dotfile-secret
data:
 .secret-file: dmFsdWUtMg0KDQo=
---
apiVersion: v1
kind: Pod
metadata:
 name: secret-dotfiles-pod
spec:
 volumes:
 - name: secret-volume
 secret:
 secretName: dotfile-secret
 containers:
 - name: dotfile-test-container
 image: registry.k8s.io/busybox
 command:
 - ls
 - "-l"
 - "/etc/secret-volume"
 volumeMounts:
 - name: secret-volume
 readOnly: true
 mountPath: "/etc/secret-volume"
</code></pre></div><p>The volume will contain a single file, called <code>.secret-file</code>, and
the <code>dotfile-test-container</code> will have this file present at the path
<code>/etc/secret-volume/.secret-file</code>.</p><h3>Use case: Secret visible to one container in a Pod</h3><p>Consider a program that needs to handle HTTP requests, do some complex business
logic, and then sign some messages with an HMAC. Because it has complex
application logic, there might be an unnoticed remote file reading exploit in
the server, which could expose the private key to an attacker.</p><p>This could be divided into two processes in two containers: a frontend container
which handles user interaction and business logic, but which cannot see the
private key; and a signer container that can see the private key, and responds
to simple signing requests from the frontend (for example, over localhost networking).</p><p>With this partitioned approach, an attacker now has to trick the application
server into doing something rather arbitrary, which may be harder than getting
it to read a file.</p><h2>Types of Secret</h2><p>When creating a Secret, you can specify its type using the <code>type</code> field of
the <a href="/docs/reference/kubernetes-api/config-and-storage-resources/secret-v1/">Secret</a>
resource, or certain equivalent <code>kubectl</code> command line flags (if available).
The Secret type is used to facilitate programmatic handling of the Secret data.</p><p>Kubernetes provides several built-in types for some common usage scenarios.
These types vary in terms of the validations performed and the constraints
Kubernetes imposes on them.</p><table><thead><tr><th>Built-in Type</th><th>Usage</th></tr></thead><tbody><tr><td><code>Opaque</code></td><td>arbitrary user-defined data</td></tr><tr><td><code>kubernetes.io/service-account-token</code></td><td>ServiceAccount token</td></tr><tr><td><code>kubernetes.io/dockercfg</code></td><td>serialized <code>~/.dockercfg</code> file</td></tr><tr><td><code>kubernetes.io/dockerconfigjson</code></td><td>serialized <code>~/.docker/config.json</code> file</td></tr><tr><td><code>kubernetes.io/basic-auth</code></td><td>credentials for basic authentication</td></tr><tr><td><code>kubernetes.io/ssh-auth</code></td><td>credentials for SSH authentication</td></tr><tr><td><code>kubernetes.io/tls</code></td><td>data for a TLS client or server</td></tr><tr><td><code>bootstrap.kubernetes.io/token</code></td><td>bootstrap token data</td></tr></tbody></table><p>You can define and use your own Secret type by assigning a non-empty string as the
<code>type</code> value for a Secret object (an empty string is treated as an <code>Opaque</code> type).</p><p>Kubernetes doesn't impose any constraints on the type name. However, if you
are using one of the built-in types, you must meet all the requirements defined
for that type.</p><p>If you are defining a type of secret that's for public use, follow the convention
and structure the secret type to have your domain name before the name, separated
by a <code>/</code>. For example: <code>cloud-hosting.example.net/cloud-api-credentials</code>.</p><h3>Opaque secrets</h3><p><code>Opaque</code> is the default Secret type if omitted from a Secret configuration file.
When you create a Secret using <code>kubectl</code>, you will use the <code>generic</code>
subcommand to indicate an <code>Opaque</code> Secret type. For example, the following
command creates an empty Secret of type <code>Opaque</code>.</p><div><pre><code>kubectl create secret generic empty-secret
kubectl get secret empty-secret
</code></pre></div><p>The output looks like:</p><pre><code>NAME TYPE DATA AGE
empty-secret Opaque 0 2m6s
</code></pre><p>The <code>DATA</code> column shows the number of data items stored in the Secret.
In this case, <code>0</code> means you have created an empty Secret.</p><h3>Service account token Secrets</h3><p>A <code>kubernetes.io/service-account-token</code> type of Secret is used to store a
token credential that identifies a
<a href="/docs/tasks/configure-pod-container/configure-service-account/">service account</a>.</p><p>Since 1.22, this type of Secret is no longer used to mount credentials into Pods,
and obtaining tokens via the <a href="/docs/reference/kubernetes-api/authentication-resources/token-request-v1/">TokenRequest</a>
API is recommended instead of using service account token Secret objects.
Tokens obtained from the <code>TokenRequest</code> API are more secure than ones stored in Secret objects,
because they have a bounded lifetime and are not readable by other API clients.
You can use the <a href="/docs/reference/generated/kubectl/kubectl-commands#-em-token-em-"><code>kubectl create token</code></a>
command to obtain a token from the <code>TokenRequest</code> API.</p><p>You should only create a service account token Secret object
if you can't use the <code>TokenRequest</code> API to obtain a token,
and the security exposure of persisting a non-expiring token credential
in a readable API object is acceptable to you.</p><p>When using this Secret type, you need to ensure that the
<code>kubernetes.io/service-account.name</code> annotation is set to an existing
service account name. If you are creating both the ServiceAccount and
the Secret objects, you should create the ServiceAccount object first.</p><p>After the Secret is created, a Kubernetes <a href="/docs/concepts/architecture/controller/">controller</a>
fills in some other fields such as the <code>kubernetes.io/service-account.uid</code> annotation, and the
<code>token</code> key in the <code>data</code> field, which is populated with an authentication token.</p><p>The following example configuration declares a service account token Secret:</p><div><pre><code>apiVersion: v1
kind: Secret
metadata:
 name: secret-sa-sample
 annotations:
 kubernetes.io/service-account.name: "sa-name"
type: kubernetes.io/service-account-token
data:
 # You can include additional key value pairs as you do with Opaque Secrets
 extra: YmFyCg==
</code></pre></div><p>After creating the Secret, wait for Kubernetes to populate the <code>token</code> key in the <code>data</code> field.</p><p>See the <a href="/docs/tasks/configure-pod-container/configure-service-account/">ServiceAccount</a>
documentation for more information on how service accounts work.
You can also check the <code>automountServiceAccountToken</code> field and the
<code>serviceAccountName</code> field of the
<a href="/docs/reference/generated/kubernetes-api/v1.26/#pod-v1-core"><code>Pod</code></a>
for information on referencing service account credentials from within Pods.</p><h3>Docker config Secrets</h3><p>You can use one of the following <code>type</code> values to create a Secret to
store the credentials for accessing a container image registry:</p><ul><li><code>kubernetes.io/dockercfg</code></li><li><code>kubernetes.io/dockerconfigjson</code></li></ul><p>The <code>kubernetes.io/dockercfg</code> type is reserved to store a serialized
<code>~/.dockercfg</code> which is the legacy format for configuring Docker command line.
When using this Secret type, you have to ensure the Secret <code>data</code> field
contains a <code>.dockercfg</code> key whose value is content of a <code>~/.dockercfg</code> file
encoded in the base64 format.</p><p>The <code>kubernetes.io/dockerconfigjson</code> type is designed for storing a serialized
JSON that follows the same format rules as the <code>~/.docker/config.json</code> file
which is a new format for <code>~/.dockercfg</code>.
When using this Secret type, the <code>data</code> field of the Secret object must
contain a <code>.dockerconfigjson</code> key, in which the content for the
<code>~/.docker/config.json</code> file is provided as a base64 encoded string.</p><p>Below is an example for a <code>kubernetes.io/dockercfg</code> type of Secret:</p><div><pre><code>apiVersion: v1
kind: Secret
metadata:
 name: secret-dockercfg
type: kubernetes.io/dockercfg
data:
 .dockercfg: |
 "&lt;base64 encoded ~/.dockercfg file&gt;"
</code></pre></div><p>When you create these types of Secrets using a manifest, the API
server checks whether the expected key exists in the <code>data</code> field, and
it verifies if the value provided can be parsed as a valid JSON. The API
server doesn't validate if the JSON actually is a Docker config file.</p><p>When you do not have a Docker config file, or you want to use <code>kubectl</code>
to create a Secret for accessing a container registry, you can do:</p><div><pre><code>kubectl create secret docker-registry secret-tiger-docker \
 --docker-email=tiger@acme.example \
 --docker-username=tiger \
 --docker-password=pass1234 \
 --docker-server=my-registry.example:5000
</code></pre></div><p>That command creates a Secret of type <code>kubernetes.io/dockerconfigjson</code>.
If you dump the <code>.data.dockerconfigjson</code> field from that new Secret and then
decode it from base64:</p><div><pre><code>kubectl get secret secret-tiger-docker -o jsonpath='{.data.*}' | base64 -d
</code></pre></div><p>then the output is equivalent to this JSON document (which is also a valid
Docker configuration file):</p><div><pre><code>{
 "auths": {
 "my-registry.example:5000": {
 "username": "tiger",
 "password": "pass1234",
 "email": "tiger@acme.example",
 "auth": "dGlnZXI6cGFzczEyMzQ="
 }
 }
}
</code></pre></div><h3>Basic authentication Secret</h3><p>The <code>kubernetes.io/basic-auth</code> type is provided for storing credentials needed
for basic authentication. When using this Secret type, the <code>data</code> field of the
Secret must contain one of the following two keys:</p><ul><li><code>username</code>: the user name for authentication</li><li><code>password</code>: the password or token for authentication</li></ul><p>Both values for the above two keys are base64 encoded strings. You can, of
course, provide the clear text content using the <code>stringData</code> for Secret
creation.</p><p>The following manifest is an example of a basic authentication Secret:</p><div><pre><code>apiVersion: v1
kind: Secret
metadata:
 name: secret-basic-auth
type: kubernetes.io/basic-auth
stringData:
 username: admin # required field for kubernetes.io/basic-auth
 password: t0p-Secret # required field for kubernetes.io/basic-auth
</code></pre></div><p>The basic authentication Secret type is provided only for convenience.
You can create an <code>Opaque</code> type for credentials used for basic authentication.
However, using the defined and public Secret type (<code>kubernetes.io/basic-auth</code>) helps other
people to understand the purpose of your Secret, and sets a convention for what key names
to expect.
The Kubernetes API verifies that the required keys are set for a Secret of this type.</p><h3>SSH authentication secrets</h3><p>The builtin type <code>kubernetes.io/ssh-auth</code> is provided for storing data used in
SSH authentication. When using this Secret type, you will have to specify a
<code>ssh-privatekey</code> key-value pair in the <code>data</code> (or <code>stringData</code>) field
as the SSH credential to use.</p><p>The following manifest is an example of a Secret used for SSH public/private
key authentication:</p><div><pre><code>apiVersion: v1
kind: Secret
metadata:
 name: secret-ssh-auth
type: kubernetes.io/ssh-auth
data:
 # the data is abbreviated in this example
 ssh-privatekey: |
 MIIEpQIBAAKCAQEAulqb/Y ...
</code></pre></div><p>The SSH authentication Secret type is provided only for user's convenience.
You could instead create an <code>Opaque</code> type Secret for credentials used for SSH authentication.
However, using the defined and public Secret type (<code>kubernetes.io/ssh-auth</code>) helps other
people to understand the purpose of your Secret, and sets a convention for what key names
to expect.
and the API server does verify if the required keys are provided in a Secret configuration.</p><h3>TLS secrets</h3><p>Kubernetes provides a builtin Secret type <code>kubernetes.io/tls</code> for storing
a certificate and its associated key that are typically used for TLS.</p><p>One common use for TLS secrets is to configure encryption in transit for
an <a href="/docs/concepts/services-networking/ingress/">Ingress</a>, but you can also use it
with other resources or directly in your workload.
When using this type of Secret, the <code>tls.key</code> and the <code>tls.crt</code> key must be provided
in the <code>data</code> (or <code>stringData</code>) field of the Secret configuration, although the API
server doesn't actually validate the values for each key.</p><p>The following YAML contains an example config for a TLS Secret:</p><div><pre><code>apiVersion: v1
kind: Secret
metadata:
 name: secret-tls
type: kubernetes.io/tls
data:
 # the data is abbreviated in this example
 tls.crt: |
 MIIC2DCCAcCgAwIBAgIBATANBgkqh ...
 tls.key: |
 MIIEpgIBAAKCAQEA7yn3bRHQ5FHMQ ...
</code></pre></div><p>The TLS Secret type is provided for user's convenience. You can create an <code>Opaque</code>
for credentials used for TLS server and/or client. However, using the builtin Secret
type helps ensure the consistency of Secret format in your project; the API server
does verify if the required keys are provided in a Secret configuration.</p><p>When creating a TLS Secret using <code>kubectl</code>, you can use the <code>tls</code> subcommand
as shown in the following example:</p><div><pre><code>kubectl create secret tls my-tls-secret \
 --cert=path/to/cert/file \
 --key=path/to/key/file
</code></pre></div><p>The public/private key pair must exist before hand. The public key certificate
for <code>--cert</code> must be DER format as per
<a href="https://datatracker.ietf.org/doc/html/rfc7468#section-5.1">Section 5.1 of RFC 7468</a>,
and must match the given private key for <code>--key</code> (PKCS #8 in DER format;
<a href="https://datatracker.ietf.org/doc/html/rfc7468#section-11">Section 11 of RFC 7468</a>).</p><h3>Bootstrap token Secrets</h3><p>A bootstrap token Secret can be created by explicitly specifying the Secret
<code>type</code> to <code>bootstrap.kubernetes.io/token</code>. This type of Secret is designed for
tokens used during the node bootstrap process. It stores tokens used to sign
well-known ConfigMaps.</p><p>A bootstrap token Secret is usually created in the <code>kube-system</code> namespace and
named in the form <code>bootstrap-token-&lt;token-id&gt;</code> where <code>&lt;token-id&gt;</code> is a 6 character
string of the token ID.</p><p>As a Kubernetes manifest, a bootstrap token Secret might look like the
following:</p><div><pre><code>apiVersion: v1
kind: Secret
metadata:
 name: bootstrap-token-5emitj
 namespace: kube-system
type: bootstrap.kubernetes.io/token
data:
 auth-extra-groups: c3lzdGVtOmJvb3RzdHJhcHBlcnM6a3ViZWFkbTpkZWZhdWx0LW5vZGUtdG9rZW4=
 expiration: MjAyMC0wOS0xM1QwNDozOToxMFo=
 token-id: NWVtaXRq
 token-secret: a3E0Z2lodnN6emduMXAwcg==
 usage-bootstrap-authentication: dHJ1ZQ==
 usage-bootstrap-signing: dHJ1ZQ==
</code></pre></div><p>A bootstrap type Secret has the following keys specified under <code>data</code>:</p><ul><li><code>token-id</code>: A random 6 character string as the token identifier. Required.</li><li><code>token-secret</code>: A random 16 character string as the actual token secret. Required.</li><li><code>description</code>: A human-readable string that describes what the token is
used for. Optional.</li><li><code>expiration</code>: An absolute UTC time using <a href="https://datatracker.ietf.org/doc/html/rfc3339">RFC3339</a> specifying when the token
should be expired. Optional.</li><li><code>usage-bootstrap-&lt;usage&gt;</code>: A boolean flag indicating additional usage for
the bootstrap token.</li><li><code>auth-extra-groups</code>: A comma-separated list of group names that will be
authenticated as in addition to the <code>system:bootstrappers</code> group.</li></ul><p>The above YAML may look confusing because the values are all in base64 encoded
strings. In fact, you can create an identical Secret using the following YAML:</p><div><pre><code>apiVersion: v1
kind: Secret
metadata:
 # Note how the Secret is named
 name: bootstrap-token-5emitj
 # A bootstrap token Secret usually resides in the kube-system namespace
 namespace: kube-system
type: bootstrap.kubernetes.io/token
stringData:
 auth-extra-groups: "system:bootstrappers:kubeadm:default-node-token"
 expiration: "2020-09-13T04:39:10Z"
 # This token ID is used in the name
 token-id: "5emitj"
 token-secret: "kq4gihvszzgn1p0r"
 # This token can be used for authentication
 usage-bootstrap-authentication: "true"
 # and it can be used for signing
 usage-bootstrap-signing: "true"
</code></pre></div><h2>Immutable Secrets</h2><p><b>FEATURE STATE:</b> <code>Kubernetes v1.21 [stable]</code></p><p>Kubernetes lets you mark specific Secrets (and ConfigMaps) as <em>immutable</em>.
Preventing changes to the data of an existing Secret has the following benefits:</p><ul><li>protects you from accidental (or unwanted) updates that could cause applications outages</li><li>(for clusters that extensively use Secrets - at least tens of thousands of unique Secret
to Pod mounts), switching to immutable Secrets improves the performance of your cluster
by significantly reducing load on kube-apiserver. The kubelet does not need to maintain
a [watch] on any Secrets that are marked as immutable.</li></ul><h3>Marking a Secret as immutable</h3><p>You can create an immutable Secret by setting the <code>immutable</code> field to <code>true</code>. For example,</p><div><pre><code>apiVersion: v1
kind: Secret
metadata:
 ...
data:
 ...
immutable: true
</code></pre></div><p>You can also update any existing mutable Secret to make it immutable.</p><h2>Information security for Secrets</h2><p>Although ConfigMap and Secret work similarly, Kubernetes applies some additional
protection for Secret objects.</p><p>Secrets often hold values that span a spectrum of importance, many of which can
cause escalations within Kubernetes (e.g. service account tokens) and to
external systems. Even if an individual app can reason about the power of the
Secrets it expects to interact with, other apps within the same namespace can
render those assumptions invalid.</p><p>A Secret is only sent to a node if a Pod on that node requires it.
For mounting secrets into Pods, the kubelet stores a copy of the data into a <code>tmpfs</code>
so that the confidential data is not written to durable storage.
Once the Pod that depends on the Secret is deleted, the kubelet deletes its local copy
of the confidential data from the Secret.</p><p>There may be several containers in a Pod. By default, containers you define
only have access to the default ServiceAccount and its related Secret.
You must explicitly define environment variables or map a volume into a
container in order to provide access to any other Secret.</p><p>There may be Secrets for several Pods on the same node. However, only the
Secrets that a Pod requests are potentially visible within its containers.
Therefore, one Pod does not have access to the Secrets of another Pod.</p><h2>What's next</h2><ul><li>For guidelines to manage and improve the security of your Secrets, refer to
<a href="/docs/concepts/security/secrets-good-practices">Good practices for Kubernetes Secrets</a>.</li><li>Learn how to <a href="/docs/tasks/configmap-secret/managing-secret-using-kubectl/">manage Secrets using <code>kubectl</code></a></li><li>Learn how to <a href="/docs/tasks/configmap-secret/managing-secret-using-config-file/">manage Secrets using config file</a></li><li>Learn how to <a href="/docs/tasks/configmap-secret/managing-secret-using-kustomize/">manage Secrets using kustomize</a></li><li>Read the <a href="/docs/reference/kubernetes-api/config-and-storage-resources/secret-v1/">API reference</a> for <code>Secret</code></li></ul></div>||||I|||| * Documentation
 * Kubernetes Blog
 * Training
 * Partners
 * Community
 * Case Studies
 * Versions
 Release Information v1.26 v1.25 v1.24 v1.23 v1.22
 * English
 中文 (Chinese) 한국어 (Korean) 日本語 (Japanese) Français (French) Español (Spanish) Português (Portuguese) Bahasa Indonesia
 * 
 + Home
 o Available Documentation Versions
 + Getting started
 o Learning environment
 o Production environment
 - Container Runtimes
 - Installing Kubernetes with deployment tools
 * Bootstrapping clusters with kubeadm
 + Installing kubeadm
 + Troubleshooting kubeadm
 + Creating a cluster with kubeadm
 + Customizing components with the kubeadm API
 + Options for Highly Available Topology
 + Creating Highly Available Clusters with kubeadm
 + Set up a High Availability etcd Cluster with kubeadm
 + Configuring each kubelet in your cluster using kubeadm
 + Dual-stack support with kubeadm
 * Installing Kubernetes with kOps
 * Installing Kubernetes with Kubespray
 - Turnkey Cloud Solutions
 o Best practices
 - Considerations for large clusters
 - Running in multiple zones
 - Validate node setup
 - Enforcing Pod Security Standards
 - PKI certificates and requirements
 + Concepts
 o Overview
 - Kubernetes Components
 - The Kubernetes API
 - Working with Kubernetes Objects
 * Understanding Kubernetes Objects
 * Kubernetes Object Management
 * Object Names and IDs
 * Labels and Selectors
 * Namespaces
 * Annotations
 * Field Selectors
 * Finalizers
 * Owners and Dependents
 * Recommended Labels
 o Cluster Architecture
 - Nodes
 - Communication between Nodes and the Control Plane
 - Controllers
 - Leases
 - Cloud Controller Manager
 - About cgroup v2
 - Container Runtime Interface (CRI)
 - Garbage Collection
 o Containers
 - Images
 - Container Environment
 - Runtime Class
 - Container Lifecycle Hooks
 o Windows in Kubernetes
 - Windows containers in Kubernetes
 - Guide for scheduling Windows containers in Kubernetes
 o Workloads
 - Pods
 * Pod Lifecycle
 * Init Containers
 * Disruptions
 * Ephemeral Containers
 * Pod Quality of Service Classes
 * User Namespaces
 * Downward API
 - Workload Resources
 * Deployments
 * ReplicaSet
 * StatefulSets
 * DaemonSet
 * Jobs
 * Automatic Cleanup for Finished Jobs
 * CronJob
 * ReplicationController
 o Services, Load Balancing, and Networking
 - Service
 - Ingress
 - Ingress Controllers
 - EndpointSlices
 - Network Policies
 - DNS for Services and Pods
 - IPv4/IPv6 dual-stack
 - Topology Aware Hints
 - Networking on Windows
 - Service ClusterIP allocation
 - Service Internal Traffic Policy
 - Topology-aware traffic routing with topology keys
 o Storage
 - Volumes
 - Persistent Volumes
 - Projected Volumes
 - Ephemeral Volumes
 - Storage Classes
 - Dynamic Volume Provisioning
 - Volume Snapshots
 - Volume Snapshot Classes
 - CSI Volume Cloning
 - Storage Capacity
 - Node-specific Volume Limits
 - Volume Health Monitoring
 - Windows Storage
 o Configuration
 - Configuration Best Practices
 - ConfigMaps
 - Secrets
 - Resource Management for Pods and Containers
 - Organizing Cluster Access Using kubeconfig Files
 - Resource Management for Windows nodes
 o Security
 - Overview of Cloud Native Security
 - Pod Security Standards
 - Pod Security Admission
 - Pod Security Policies
 - Security For Windows Nodes
 - Controlling Access to the Kubernetes API
 - Role Based Access Control Good Practices
 - Good practices for Kubernetes Secrets
 - Multi-tenancy
 - Kubernetes API Server Bypass Risks
 - Security Checklist
 o Policies
 - Limit Ranges
 - Resource Quotas
 - Process ID Limits And Reservations
 - Node Resource Managers
 o Scheduling, Preemption and Eviction
 - Kubernetes Scheduler
 - Assigning Pods to Nodes
 - Pod Overhead
 - Pod Scheduling Readiness
 - Pod Topology Spread Constraints
 - Taints and Tolerations
 - Scheduling Framework
 - Dynamic Resource Allocation
 - Scheduler Performance Tuning
 - Resource Bin Packing
 - Pod Priority and Preemption
 - Node-pressure Eviction
 - API-initiated Eviction
 o Cluster Administration
 - Certificates
 - Managing Resources
 - Cluster Networking
 - Logging Architecture
 - Metrics For Kubernetes System Components
 - System Logs
 - Traces For Kubernetes System Components
 - Proxies in Kubernetes
 - API Priority and Fairness
 - Installing Addons
 o Extending Kubernetes
 - Compute, Storage, and Networking Extensions
 * Network Plugins
 * Device Plugins
 - Extending the Kubernetes API
 * Custom Resources
 * Kubernetes API Aggregation Layer
 - Operator pattern
 + Tasks
 o Install Tools
 - Install and Set Up kubectl on Linux
 - Install and Set Up kubectl on macOS
 - Install and Set Up kubectl on Windows
 o Administer a Cluster
 - Administration with kubeadm
 * Certificate Management with kubeadm
 * Configuring a cgroup driver
 * Reconfiguring a kubeadm cluster
 * Upgrading kubeadm clusters
 * Upgrading Windows nodes
 - Migrating from dockershim
 * Changing the Container Runtime on a Node from Docker Engine to containerd
 * Migrate Docker Engine nodes from dockershim to cri-dockerd
 * Find Out What Container Runtime is Used on a Node
 * Troubleshooting CNI plugin-related errors
 * Check whether dockershim removal affects you
 * Migrating telemetry and security agents from dockershim
 - Generate Certificates Manually
 - Manage Memory, CPU, and API Resources
 * Configure Default Memory Requests and Limits for a Namespace
 * Configure Default CPU Requests and Limits for a Namespace
 * Configure Minimum and Maximum Memory Constraints for a Namespace
 * Configure Minimum and Maximum CPU Constraints for a Namespace
 * Configure Memory and CPU Quotas for a Namespace
 * Configure a Pod Quota for a Namespace
 - Install a Network Policy Provider
 * Use Antrea for NetworkPolicy
 * Use Calico for NetworkPolicy
 * Use Cilium for NetworkPolicy
 * Use Kube-router for NetworkPolicy
 * Romana for NetworkPolicy
 * Weave Net for NetworkPolicy
 - Access Clusters Using the Kubernetes API
 - Advertise Extended Resources for a Node
 - Autoscale the DNS Service in a Cluster
 - Change the default StorageClass
 - Change the Reclaim Policy of a PersistentVolume
 - Cloud Controller Manager Administration
 - Configure a kubelet image credential provider
 - Configure Quotas for API Objects
 - Control CPU Management Policies on the Node
 - Control Topology Management Policies on a node
 - Customizing DNS Service
 - Debugging DNS Resolution
 - Declare Network Policy
 - Developing Cloud Controller Manager
 - Enable Or Disable A Kubernetes API
 - Encrypting Secret Data at Rest
 - Guaranteed Scheduling For Critical Add-On Pods
 - IP Masquerade Agent User Guide
 - Limit Storage Consumption
 - Migrate Replicated Control Plane To Use Cloud Controller Manager
 - Namespaces Walkthrough
 - Operating etcd clusters for Kubernetes
 - Reconfigure a Node's Kubelet in a Live Cluster
 - Reserve Compute Resources for System Daemons
 - Running Kubernetes Node Components as a Non-root User
 - Safely Drain a Node
 - Securing a Cluster
 - Set Kubelet parameters via a config file
 - Share a Cluster with Namespaces
 - Upgrade A Cluster
 - Use Cascading Deletion in a Cluster
 - Using a KMS provider for data encryption
 - Using CoreDNS for Service Discovery
 - Using NodeLocal DNSCache in Kubernetes Clusters
 - Using sysctls in a Kubernetes Cluster
 - Utilizing the NUMA-aware Memory Manager
 - Verify Signed Kubernetes Artifacts
 o Configure Pods and Containers
 - Assign Memory Resources to Containers and Pods
 - Assign CPU Resources to Containers and Pods
 - Configure GMSA for Windows Pods and containers
 - Configure RunAsUserName for Windows pods and containers
 - Create a Windows HostProcess Pod
 - Configure Quality of Service for Pods
 - Assign Extended Resources to a Container
 - Configure a Pod to Use a Volume for Storage
 - Configure a Pod to Use a PersistentVolume for Storage
 - Configure a Pod to Use a Projected Volume for Storage
 - Configure a Security Context for a Pod or Container
 - Configure Service Accounts for Pods
 - Pull an Image from a Private Registry
 - Configure Liveness, Readiness and Startup Probes
 - Assign Pods to Nodes
 - Assign Pods to Nodes using Node Affinity
 - Configure Pod Initialization
 - Attach Handlers to Container Lifecycle Events
 - Configure a Pod to Use a ConfigMap
 - Share Process Namespace between Containers in a Pod
 - Use a User Namespace With a Pod
 - Create static Pods
 - Translate a Docker Compose File to Kubernetes Resources
 - Enforce Pod Security Standards by Configuring the Built-in Admission Controller
 - Enforce Pod Security Standards with Namespace Labels
 - Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller
 o Monitoring, Logging, and Debugging
 - Troubleshooting Applications
 * Debug Pods
 * Debug Services
 * Debug a StatefulSet
 * Determine the Reason for Pod Failure
 * Debug Init Containers
 * Debug Running Pods
 * Get a Shell to a Running Container
 - Troubleshooting Clusters
 * Resource metrics pipeline
 * Tools for Monitoring Resources
 * Monitor Node Health
 * Debugging Kubernetes nodes with crictl
 * Auditing
 * Debugging Kubernetes Nodes With Kubectl
 * Developing and debugging services locally using telepresence
 * Windows debugging tips
 o Manage Kubernetes Objects
 - Declarative Management of Kubernetes Objects Using Configuration Files
 - Declarative Management of Kubernetes Objects Using Kustomize
 - Managing Kubernetes Objects Using Imperative Commands
 - Imperative Management of Kubernetes Objects Using Configuration Files
 - Update API Objects in Place Using kubectl patch
 o Managing Secrets
 - Managing Secrets using kubectl
 - Managing Secrets using Configuration File
 - Managing Secrets using Kustomize
 o Inject Data Into Applications
 - Define a Command and Arguments for a Container
 - Define Dependent Environment Variables
 - Define Environment Variables for a Container
 - Expose Pod Information to Containers Through Environment Variables
 - Expose Pod Information to Containers Through Files
 - Distribute Credentials Securely Using Secrets
 o Run Applications
 - Run a Stateless Application Using a Deployment
 - Run a Single-Instance Stateful Application
 - Run a Replicated Stateful Application
 - Scale a StatefulSet
 - Delete a StatefulSet
 - Force Delete StatefulSet Pods
 - Horizontal Pod Autoscaling
 - HorizontalPodAutoscaler Walkthrough
 - Specifying a Disruption Budget for your Application
 - Accessing the Kubernetes API from a Pod
 o Run Jobs
 - Running Automated Tasks with a CronJob
 - Coarse Parallel Processing Using a Work Queue
 - Fine Parallel Processing Using a Work Queue
 - Indexed Job for Parallel Processing with Static Work Assignment
 - Job with Pod-to-Pod Communication
 - Parallel Processing using Expansions
 - Handling retriable and non-retriable pod failures with Pod failure policy
 o Access Applications in a Cluster
 - Deploy and Access the Kubernetes Dashboard
 - Accessing Clusters
 - Configure Access to Multiple Clusters
 - Use Port Forwarding to Access Applications in a Cluster
 - Use a Service to Access an Application in a Cluster
 - Connect a Frontend to a Backend Using Services
 - Create an External Load Balancer
 - List All Container Images Running in a Cluster
 - Set up Ingress on Minikube with the NGINX Ingress Controller
 - Communicate Between Containers in the Same Pod Using a Shared Volume
 - Configure DNS for a Cluster
 - Access Services Running on Clusters
 o Extend Kubernetes
 - Configure the Aggregation Layer
 - Use Custom Resources
 * Extend the Kubernetes API with CustomResourceDefinitions
 * Versions in CustomResourceDefinitions
 - Set up an Extension API Server
 - Configure Multiple Schedulers
 - Use an HTTP Proxy to Access the Kubernetes API
 - Use a SOCKS5 Proxy to Access the Kubernetes API
 - Set up Konnectivity service
 o TLS
 - Configure Certificate Rotation for the Kubelet
 - Manage TLS Certificates in a Cluster
 - Manual Rotation of CA Certificates
 o Manage Cluster Daemons
 - Perform a Rolling Update on a DaemonSet
 - Perform a Rollback on a DaemonSet
 o Networking
 - Adding entries to Pod /etc/hosts with HostAliases
 - Validate IPv4/IPv6 dual-stack
 o Extend kubectl with plugins
 o Manage HugePages
 o Schedule GPUs
 + Tutorials
 o Hello Minikube
 o Learn Kubernetes Basics
 - Create a Cluster
 * Using Minikube to Create a Cluster
 * Interactive Tutorial - Creating a Cluster
 - Deploy an App
 * Using kubectl to Create a Deployment
 * Interactive Tutorial - Deploying an App
 - Explore Your App
 * Viewing Pods and Nodes
 * Interactive Tutorial - Exploring Your App
 - Expose Your App Publicly
 * Using a Service to Expose Your App
 * Interactive Tutorial - Exposing Your App
 - Scale Your App
 * Running Multiple Instances of Your App
 * Interactive Tutorial - Scaling Your App
 - Update Your App
 * Performing a Rolling Update
 * Interactive Tutorial - Updating Your App
 o Configuration
 - Example: Configuring a Java Microservice
 * Externalizing config using MicroProfile, ConfigMaps and Secrets
 * Interactive Tutorial - Configuring a Java Microservice
 - Configuring Redis using a ConfigMap
 o Security
 - Apply Pod Security Standards at the Cluster Level
 - Apply Pod Security Standards at the Namespace Level
 - Restrict a Container's Access to Resources with AppArmor
 - Restrict a Container's Syscalls with seccomp
 o Stateless Applications
 - Exposing an External IP Address to Access an Application in a Cluster
 - Example: Deploying PHP Guestbook application with Redis
 o Stateful Applications
 - StatefulSet Basics
 - Example: Deploying WordPress and MySQL with Persistent Volumes
 - Example: Deploying Cassandra with a StatefulSet
 - Running ZooKeeper, A Distributed System Coordinator
 o Services
 - Connecting Applications with Services
 - Using Source IP
 + Reference
 o Glossary
 o API Overview
 - Kubernetes API Concepts
 - Server-Side Apply
 - Client Libraries
 - Kubernetes Deprecation Policy
 - Deprecated API Migration Guide
 - Kubernetes API health endpoints
 o API Access Control
 - Authenticating
 - Authenticating with Bootstrap Tokens
 - Certificate Signing Requests
 - Admission Controllers
 - Dynamic Admission Control
 - Managing Service Accounts
 - Authorization Overview
 - Using RBAC Authorization
 - Using ABAC Authorization
 - Using Node Authorization
 - Mapping PodSecurityPolicies to Pod Security Standards
 - Webhook Mode
 - Kubelet authentication/authorization
 - TLS bootstrapping
 - Validating Admission Policy
 o Well-Known Labels, Annotations and Taints
 - Audit Annotations
 o Kubernetes API
 - Workload Resources
 * Pod
 * PodTemplate
 * ReplicationController
 * ReplicaSet
 * Deployment
 * StatefulSet
 * ControllerRevision
 * DaemonSet
 * Job
 * CronJob
 * HorizontalPodAutoscaler
 * HorizontalPodAutoscaler
 * PriorityClass
 * PodScheduling v1alpha1
 * ResourceClaim v1alpha1
 * ResourceClaimTemplate v1alpha1
 * ResourceClass v1alpha1
 - Service Resources
 * Service
 * Endpoints
 * EndpointSlice
 * Ingress
 * IngressClass
 - Config and Storage Resources
 * ConfigMap
 * Secret
 * Volume
 * PersistentVolumeClaim
 * PersistentVolume
 * StorageClass
 * VolumeAttachment
 * CSIDriver
 * CSINode
 * CSIStorageCapacity
 - Authentication Resources
 * ServiceAccount
 * TokenRequest
 * TokenReview
 * CertificateSigningRequest
 - Authorization Resources
 * LocalSubjectAccessReview
 * SelfSubjectAccessReview
 * SelfSubjectRulesReview
 * SubjectAccessReview
 * SelfSubjectReview v1alpha1
 * ClusterRole
 * ClusterRoleBinding
 * Role
 * RoleBinding
 - Policy Resources
 * LimitRange
 * ResourceQuota
 * NetworkPolicy
 * PodDisruptionBudget
 - Extend Resources
 * CustomResourceDefinition
 * MutatingWebhookConfiguration
 * ValidatingWebhookConfiguration
 * ValidatingAdmissionPolicy v1alpha1
 - Cluster Resources
 * Node
 * Namespace
 * Event
 * APIService
 * Lease
 * RuntimeClass
 * FlowSchema v1beta3
 * PriorityLevelConfiguration v1beta3
 * Binding
 * ComponentStatus
 * ClusterCIDR v1alpha1
 - Common Definitions
 * DeleteOptions
 * LabelSelector
 * ListMeta
 * LocalObjectReference
 * NodeSelectorRequirement
 * ObjectFieldSelector
 * ObjectMeta
 * ObjectReference
 * Patch
 * Quantity
 * ResourceFieldSelector
 * Status
 * TypedLocalObjectReference
 - Other Resources
 * ValidatingAdmissionPolicyBindingList v1alpha1
 - Common Parameters
 o Instrumentation
 - Service Level Indicator Metrics
 - Node metrics data
 - Kubernetes Metrics Reference
 o Kubernetes Issues and Security
 - Kubernetes Issue Tracker
 - Kubernetes Security and Disclosure Information
 - Official CVE Feed
 o Node Reference Information
 - Kubelet Checkpoint API
 - Kubelet Device Manager API Versions
 - Articles on dockershim Removal and on Using CRI-compatible Runtimes
 o Networking Reference
 - Protocols for Services
 - Ports and Protocols
 - Virtual IPs and Service Proxies
 o Setup tools
 - Kubeadm
 * kubeadm init
 * kubeadm join
 * kubeadm upgrade
 * kubeadm config
 * kubeadm reset
 * kubeadm token
 * kubeadm version
 * kubeadm alpha
 * kubeadm certs
 * kubeadm init phase
 * kubeadm join phase
 * kubeadm kubeconfig
 * kubeadm reset phase
 * kubeadm upgrade phase
 * Implementation details
 o Command line tool (kubectl)
 - kubectl Cheat Sheet
 - kubectl Commands
 - kubectl
 - JSONPath Support
 - kubectl for Docker Users
 - kubectl Usage Conventions
 o Component tools
 - Feature Gates
 - Feature Gates (removed)
 - kubelet
 - kube-apiserver
 - kube-controller-manager
 - kube-proxy
 - kube-scheduler
 o Configuration APIs
 - Client Authentication (v1)
 - Client Authentication (v1beta1)
 - Event Rate Limit Configuration (v1alpha1)
 - Image Policy API (v1alpha1)
 - kube-apiserver Admission (v1)
 - kube-apiserver Audit Configuration (v1)
 - kube-apiserver Configuration (v1)
 - kube-apiserver Configuration (v1alpha1)
 - kube-apiserver Encryption Configuration (v1)
 - kube-proxy Configuration (v1alpha1)
 - kube-scheduler Configuration (v1)
 - kube-scheduler Configuration (v1beta2)
 - kube-scheduler Configuration (v1beta3)
 - kubeadm Configuration (v1beta2)
 - kubeadm Configuration (v1beta3)
 - kubeconfig (v1)
 - Kubelet Configuration (v1)
 - Kubelet Configuration (v1alpha1)
 - Kubelet Configuration (v1beta1)
 - Kubelet CredentialProvider (v1)
 - Kubelet CredentialProvider (v1alpha1)
 - Kubelet CredentialProvider (v1beta1)
 - WebhookAdmission Configuration (v1)
 o Scheduling
 - Scheduler Configuration
 - Scheduling Policies
 o Other Tools
 - Mapping from dockercli to crictl
 + Contribute
 o Suggesting content improvements
 o Contributing new content
 - Opening a pull request
 - Documenting for a release
 - Blogs and case studies
 o Reviewing changes
 - Reviewing pull requests
 - For approvers and reviewers
 o Localizing Kubernetes documentation
 o Participating in SIG Docs
 - Roles and responsibilities
 - PR wranglers
 o Documentation style overview
 - Content guide
 - Style guide
 - Diagram guide
 - Writing a new topic
 - Page content types
 - Content organization
 - Custom Hugo Shortcodes
 o Updating Reference Documentation
 - Quickstart
 - Contributing to the Upstream Kubernetes Code
 - Generating Reference Documentation for the Kubernetes API
 - Generating Reference Documentation for kubectl Commands
 - Generating Reference Pages for Kubernetes Components and Tools
 - 
 o Advanced contributing
 o Viewing Site Analytics
 + Docs smoke test page
 1. Kubernetes Documentation
 2. Concepts
 3. Configuration
 4. Secrets

 Secrets

 A Secret is an object that contains a small amount of sensitive data such as a password, a token, or a key. Such information might otherwise be put in a Pod specification or in a container image. Using a Secret means that you don't need to include confidential data in your application code.

 Because Secrets can be created independently of the Pods that use them, there is less risk of the Secret (and its data) being exposed during the workflow of creating, viewing, and editing Pods. Kubernetes, and applications that run in your cluster, can also take additional precautions with Secrets, such as avoiding writing secret data to nonvolatile storage.

 Secrets are similar to ConfigMaps but are specifically intended to hold confidential data.

 Caution:

 Kubernetes Secrets are, by default, stored unencrypted in the API server's underlying data store (etcd). Anyone with API access can retrieve or modify a Secret, and so can anyone with access to etcd. Additionally, anyone who is authorized to create a Pod in a namespace can use that access to read any Secret in that namespace; this includes indirect access such as the ability to create a Deployment.

 In order to safely use Secrets, take at least the following steps:

 1. Enable Encryption at Rest for Secrets.
 2. Enable or configure RBAC rules with least-privilege access to Secrets.
 3. Restrict Secret access to specific containers.
 4. Consider using external Secret store providers.

 For more guidelines to manage and improve the security of your Secrets, refer to Good practices for Kubernetes Secrets.

 See Information security for Secrets for more details.

 Uses for Secrets

 There are three main ways for a Pod to use a Secret:

 * As files in a volume mounted on one or more of its containers.
 * As container environment variable.
 * By the kubelet when pulling images for the Pod.

 The Kubernetes control plane also uses Secrets; for example, bootstrap token Secrets are a mechanism to help automate node registration.

 Alternatives to Secrets

 Rather than using a Secret to protect confidential data, you can pick from alternatives.

 Here are some of your options:

 * if your cloud-native component needs to authenticate to another application that you know is running within the same Kubernetes cluster, you can use a ServiceAccount and its tokens to identify your client.
 * there are third-party tools that you can run, either within or outside your cluster, that provide secrets management. For example, a service that Pods access over HTTPS, that reveals a secret if the client correctly authenticates (for example, with a ServiceAccount token).
 * for authentication, you can implement a custom signer for X.509 certificates, and use CertificateSigningRequests to let that custom signer issue certificates to Pods that need them.
 * you can use a device plugin to expose node-local encryption hardware to a specific Pod. For example, you can schedule trusted Pods onto nodes that provide a Trusted Platform Module, configured out-of-band.

 You can also combine two or more of those options, including the option to use Secret objects themselves.

 For example: implement (or deploy) an operator that fetches short-lived session tokens from an external service, and then creates Secrets based on those short-lived session tokens. Pods running in your cluster can make use of the session tokens, and operator ensures they are valid. This separation means that you can run Pods that are unaware of the exact mechanisms for issuing and refreshing those session tokens.

 Working with Secrets

 Creating a Secret

 There are several options to create a Secret:

 * Use kubectl
 * Use a configuration file
 * Use the Kustomize tool

 Constraints on Secret names and data

 The name of a Secret object must be a valid DNS subdomain name.

 You can specify the data and/or the stringData field when creating a configuration file for a Secret. The data and the stringData fields are optional. The values for all keys in the data field have to be base64-encoded strings. If the conversion to base64 string is not desirable, you can choose to specify the stringData field instead, which accepts arbitrary strings as values.

 The keys of data and stringData must consist of alphanumeric characters, -, _ or .. All key-value pairs in the stringData field are internally merged into the data field. If a key appears in both the data and the stringData field, the value specified in the stringData field takes precedence.

 Size limit

 Individual secrets are limited to 1MiB in size. This is to discourage creation of very large secrets that could exhaust the API server and kubelet memory. However, creation of many smaller secrets could also exhaust memory. You can use a resource quota to limit the number of Secrets (or other resources) in a namespace.

 Editing a Secret

 You can edit an existing Secret unless it is immutable. To edit a Secret, use one of the following methods:

 * Use kubectl
 * Use a configuration file

 You can also edit the data in a Secret using the Kustomize tool. However, this method creates a new Secret object with the edited data.

 Depending on how you created the Secret, as well as how the Secret is used in your Pods, updates to existing Secret objects are propagated automatically to Pods that use the data. For more information, refer to Mounted Secrets are updated automatically.

 Using a Secret

 Secrets can be mounted as data volumes or exposed as environment variables to be used by a container in a Pod. Secrets can also be used by other parts of the system, without being directly exposed to the Pod. For example, Secrets can hold credentials that other parts of the system should use to interact with external systems on your behalf.

 Secret volume sources are validated to ensure that the specified object reference actually points to an object of type Secret. Therefore, a Secret needs to be created before any Pods that depend on it.

 If the Secret cannot be fetched (perhaps because it does not exist, or due to a temporary lack of connection to the API server) the kubelet periodically retries running that Pod. The kubelet also reports an Event for that Pod, including details of the problem fetching the Secret.

 Optional Secrets

 When you reference a Secret in a Pod, you can mark the Secret as optional, such as in the following example. If an optional Secret doesn't exist, Kubernetes ignores it.

 apiVersion: v1
 kind: Pod
 metadata:
 name: mypod
 spec:
 containers:
 - name: mypod
 image: redis
 volumeMounts:
 - name: foo
 mountPath: "/etc/foo"
 readOnly: true
 volumes:
 - name: foo
 secret:
 secretName: mysecret
 optional: true
 

 By default, Secrets are required. None of a Pod's containers will start until all non-optional Secrets are available.

 If a Pod references a specific key in a non-optional Secret and that Secret does exist, but is missing the named key, the Pod fails during startup.

 Using Secrets as files from a Pod

 If you want to access data from a Secret in a Pod, one way to do that is to have Kubernetes make the value of that Secret be available as a file inside the filesystem of one or more of the Pod's containers.

 Note:

 Versions of Kubernetes before v1.22 automatically created credentials for accessing the Kubernetes API. This older mechanism was based on creating token Secrets that could then be mounted into running Pods. In more recent versions, including Kubernetes v1.26, API credentials are obtained directly by using the TokenRequest API, and are mounted into Pods using a projected volume. The tokens obtained using this method have bounded lifetimes, and are automatically invalidated when the Pod they are mounted into is deleted.

 You can still manually create a service account token Secret; for example, if you need a token that never expires. However, using the TokenRequest subresource to obtain a token to access the API is recommended instead. You can use the kubectl create token command to obtain a token from the TokenRequest API.

 Mounted Secrets are updated automatically

 When a volume contains data from a Secret, and that Secret is updated, Kubernetes tracks this and updates the data in the volume, using an eventually-consistent approach.

 Note: A container using a Secret as a subPath volume mount does not receive automated Secret updates.

 The kubelet keeps a cache of the current keys and values for the Secrets that are used in volumes for pods on that node. You can configure the way that the kubelet detects changes from the cached values. The configMapAndSecretChangeDetectionStrategy field in the kubelet configuration controls which strategy the kubelet uses. The default strategy is Watch.

 Updates to Secrets can be either propagated by an API watch mechanism (the default), based on a cache with a defined time-to-live, or polled from the cluster API server on each kubelet synchronisation loop.

 As a result, the total delay from the moment when the Secret is updated to the moment when new keys are projected to the Pod can be as long as the kubelet sync period + cache propagation delay, where the cache propagation delay depends on the chosen cache type (following the same order listed in the previous paragraph, these are: watch propagation delay, the configured cache TTL, or zero for direct polling).

 Using Secrets as environment variables

 To use a Secret in an environment variable in a Pod:

 1. For each container in your Pod specification, add an environment variable for each Secret key that you want to use to the env[].valueFrom.secretKeyRef field.
 2. Modify your image and/or command line so that the program looks for values in the specified environment variables.

 For instructions, refer to Define container environment variables using Secret data.

 Invalid environment variables

 If your environment variable definitions in your Pod specification are considered to be invalid environment variable names, those keys aren't made available to your container. The Pod is allowed to start.

 Kubernetes adds an Event with the reason set to InvalidVariableNames and a message that lists the skipped invalid keys. The following example shows a Pod that refers to a Secret named mysecret, where mysecret contains 2 invalid keys: 1badkey and 2alsobad.

 kubectl get events
 

 The output is similar to:

 LASTSEEN FIRSTSEEN COUNT NAME KIND SUBOBJECT TYPE REASON
 0s 0s 1 dapi-test-pod Pod Warning InvalidEnvironmentVariableNames kubelet, 127.0.0.1 Keys [1badkey, 2alsobad] from the EnvFrom secret default/mysecret were skipped since they are considered invalid environment variable names.
 

 Container image pull secrets

 If you want to fetch container images from a private repository, you need a way for the kubelet on each node to authenticate to that repository. You can configure image pull secrets to make this possible. These secrets are configured at the Pod level.

 Using imagePullSecrets

 The imagePullSecrets field is a list of references to secrets in the same namespace. You can use an imagePullSecrets to pass a secret that contains a Docker (or other) image registry password to the kubelet. The kubelet uses this information to pull a private image on behalf of your Pod. See the PodSpec API for more information about the imagePullSecrets field.

 Manually specifying an imagePullSecret

 You can learn how to specify imagePullSecrets from the container images documentation.

 Arranging for imagePullSecrets to be automatically attached

 You can manually create imagePullSecrets, and reference these from a ServiceAccount. Any Pods created with that ServiceAccount or created with that ServiceAccount by default, will get their imagePullSecrets field set to that of the service account. See Add ImagePullSecrets to a service account for a detailed explanation of that process.

 Using Secrets with static Pods

 You cannot use ConfigMaps or Secrets with static Pods.

 Use cases

 Use case: As container environment variables

 You can create a Secret and use it to set environment variables for a container.

 Use case: Pod with SSH keys

 Create a Secret containing some SSH keys:

 kubectl create secret generic ssh-key-secret --from-file=ssh-privatekey=/path/to/.ssh/id_rsa --from-file=ssh-publickey=/path/to/.ssh/id_rsa.pub
 

 The output is similar to:

 secret "ssh-key-secret" created
 

 You can also create a kustomization.yaml with a secretGenerator field containing ssh keys.

 Caution:

 Think carefully before sending your own SSH keys: other users of the cluster may have access to the Secret.

 You could instead create an SSH private key representing a service identity that you want to be accessible to all the users with whom you share the Kubernetes cluster, and that you can revoke if the credentials are compromised.

 Now you can create a Pod which references the secret with the SSH key and consumes it in a volume:

 apiVersion: v1
 kind: Pod
 metadata:
 name: secret-test-pod
 labels:
 name: secret-test
 spec:
 volumes:
 - name: secret-volume
 secret:
 secretName: ssh-key-secret
 containers:
 - name: ssh-test-container
 image: mySshImage
 volumeMounts:
 - name: secret-volume
 readOnly: true
 mountPath: "/etc/secret-volume"
 

 When the container's command runs, the pieces of the key will be available in:

 /etc/secret-volume/ssh-publickey
 /etc/secret-volume/ssh-privatekey
 

 The container is then free to use the secret data to establish an SSH connection.

 Use case: Pods with prod / test credentials

 This example illustrates a Pod which consumes a secret containing production credentials and another Pod which consumes a secret with test environment credentials.

 You can create a kustomization.yaml with a secretGenerator field or run kubectl create secret.

 kubectl create secret generic prod-db-secret --from-literal=username=produser --from-literal=password=Y4nys7f11
 

 The output is similar to:

 secret "prod-db-secret" created
 

 You can also create a secret for test environment credentials.

 kubectl create secret generic test-db-secret --from-literal=username=testuser --from-literal=password=iluvtests
 

 The output is similar to:

 secret "test-db-secret" created
 
 Note:

 Special characters such as $, \, *, =, and ! will be interpreted by your shell and require escaping.

 In most shells, the easiest way to escape the password is to surround it with single quotes ('). For example, if your actual password is S!B\*d$zDsb=, you should execute the command this way:

 kubectl create secret generic dev-db-secret --from-literal=username=devuser --from-literal=password='S!B\*d$zDsb='
 

 You do not need to escape special characters in passwords from files (--from-file).

 Now make the Pods:

 cat <<EOF > pod.yaml
 apiVersion: v1
 kind: List
 items:
 - kind: Pod
 apiVersion: v1
 metadata:
 name: prod-db-client-pod
 labels:
 name: prod-db-client
 spec:
 volumes:
 - name: secret-volume
 secret:
 secretName: prod-db-secret
 containers:
 - name: db-client-container
 image: myClientImage
 volumeMounts:
 - name: secret-volume
 readOnly: true
 mountPath: "/etc/secret-volume"
 - kind: Pod
 apiVersion: v1
 metadata:
 name: test-db-client-pod
 labels:
 name: test-db-client
 spec:
 volumes:
 - name: secret-volume
 secret:
 secretName: test-db-secret
 containers:
 - name: db-client-container
 image: myClientImage
 volumeMounts:
 - name: secret-volume
 readOnly: true
 mountPath: "/etc/secret-volume"
 EOF
 

 Add the pods to the same kustomization.yaml:

 cat <<EOF >> kustomization.yaml
 resources:
 - pod.yaml
 EOF
 

 Apply all those objects on the API server by running:

 kubectl apply -k .
 

 Both containers will have the following files present on their filesystems with the values for each container's environment:

 /etc/secret-volume/username
 /etc/secret-volume/password
 

 Note how the specs for the two Pods differ only in one field; this facilitates creating Pods with different capabilities from a common Pod template.

 You could further simplify the base Pod specification by using two service accounts:

 1. prod-user with the prod-db-secret
 2. test-user with the test-db-secret

 The Pod specification is shortened to:

 apiVersion: v1
 kind: Pod
 metadata:
 name: prod-db-client-pod
 labels:
 name: prod-db-client
 spec:
 serviceAccount: prod-db-client
 containers:
 - name: db-client-container
 image: myClientImage
 

 Use case: dotfiles in a secret volume

 You can make your data "hidden" by defining a key that begins with a dot. This key represents a dotfile or "hidden" file. For example, when the following secret is mounted into a volume, secret-volume:

 apiVersion: v1
 kind: Secret
 metadata:
 name: dotfile-secret
 data:
 .secret-file: dmFsdWUtMg0KDQo=
 ---
 apiVersion: v1
 kind: Pod
 metadata:
 name: secret-dotfiles-pod
 spec:
 volumes:
 - name: secret-volume
 secret:
 secretName: dotfile-secret
 containers:
 - name: dotfile-test-container
 image: registry.k8s.io/busybox
 command:
 - ls
 - "-l"
 - "/etc/secret-volume"
 volumeMounts:
 - name: secret-volume
 readOnly: true
 mountPath: "/etc/secret-volume"
 

 The volume will contain a single file, called .secret-file, and the dotfile-test-container will have this file present at the path /etc/secret-volume/.secret-file.

 Note: Files beginning with dot characters are hidden from the output of ls -l; you must use ls -la to see them when listing directory contents.

 Use case: Secret visible to one container in a Pod

 Consider a program that needs to handle HTTP requests, do some complex business logic, and then sign some messages with an HMAC. Because it has complex application logic, there might be an unnoticed remote file reading exploit in the server, which could expose the private key to an attacker.

 This could be divided into two processes in two containers: a frontend container which handles user interaction and business logic, but which cannot see the private key; and a signer container that can see the private key, and responds to simple signing requests from the frontend (for example, over localhost networking).

 With this partitioned approach, an attacker now has to trick the application server into doing something rather arbitrary, which may be harder than getting it to read a file.

 Types of Secret

 When creating a Secret, you can specify its type using the type field of the Secret resource, or certain equivalent kubectl command line flags (if available). The Secret type is used to facilitate programmatic handling of the Secret data.

 Kubernetes provides several built-in types for some common usage scenarios. These types vary in terms of the validations performed and the constraints Kubernetes imposes on them.

 Built-in Type Usage 
 Opaque arbitrary user-defined data 
 kubernetes.io/service-account-token ServiceAccount token 
 kubernetes.io/dockercfg serialized ~/.dockercfg file 
 kubernetes.io/dockerconfigjson serialized ~/.docker/config.json file
 kubernetes.io/basic-auth credentials for basic authentication 
 kubernetes.io/ssh-auth credentials for SSH authentication 
 kubernetes.io/tls data for a TLS client or server 
 bootstrap.kubernetes.io/token bootstrap token data 
 

 You can define and use your own Secret type by assigning a non-empty string as the type value for a Secret object (an empty string is treated as an Opaque type).

 Kubernetes doesn't impose any constraints on the type name. However, if you are using one of the built-in types, you must meet all the requirements defined for that type.

 If you are defining a type of secret that's for public use, follow the convention and structure the secret type to have your domain name before the name, separated by a /. For example: cloud-hosting.example.net/cloud-api-credentials.

 Opaque secrets

 Opaque is the default Secret type if omitted from a Secret configuration file. When you create a Secret using kubectl, you will use the generic subcommand to indicate an Opaque Secret type. For example, the following command creates an empty Secret of type Opaque.

 kubectl create secret generic empty-secret
 kubectl get secret empty-secret
 

 The output looks like:

 NAME TYPE DATA AGE
 empty-secret Opaque 0 2m6s
 

 The DATA column shows the number of data items stored in the Secret. In this case, 0 means you have created an empty Secret.

 Service account token Secrets

 A kubernetes.io/service-account-token type of Secret is used to store a token credential that identifies a service account.

 Since 1.22, this type of Secret is no longer used to mount credentials into Pods, and obtaining tokens via the TokenRequest API is recommended instead of using service account token Secret objects. Tokens obtained from the TokenRequest API are more secure than ones stored in Secret objects, because they have a bounded lifetime and are not readable by other API clients. You can use the kubectl create token command to obtain a token from the TokenRequest API.

 You should only create a service account token Secret object if you can't use the TokenRequest API to obtain a token, and the security exposure of persisting a non-expiring token credential in a readable API object is acceptable to you.

 When using this Secret type, you need to ensure that the kubernetes.io/service-account.name annotation is set to an existing service account name. If you are creating both the ServiceAccount and the Secret objects, you should create the ServiceAccount object first.

 After the Secret is created, a Kubernetes controller fills in some other fields such as the kubernetes.io/service-account.uid annotation, and the token key in the data field, which is populated with an authentication token.

 The following example configuration declares a service account token Secret:

 apiVersion: v1
 kind: Secret
 metadata:
 name: secret-sa-sample
 annotations:
 kubernetes.io/service-account.name: "sa-name"
 type: kubernetes.io/service-account-token
 data:
 # You can include additional key value pairs as you do with Opaque Secrets
 extra: YmFyCg==
 

 After creating the Secret, wait for Kubernetes to populate the token key in the data field.

 See the ServiceAccount documentation for more information on how service accounts work. You can also check the automountServiceAccountToken field and the serviceAccountName field of the Pod for information on referencing service account credentials from within Pods.

 Docker config Secrets

 You can use one of the following type values to create a Secret to store the credentials for accessing a container image registry:

 * kubernetes.io/dockercfg
 * kubernetes.io/dockerconfigjson

 The kubernetes.io/dockercfg type is reserved to store a serialized ~/.dockercfg which is the legacy format for configuring Docker command line. When using this Secret type, you have to ensure the Secret data field contains a .dockercfg key whose value is content of a ~/.dockercfg file encoded in the base64 format.

 The kubernetes.io/dockerconfigjson type is designed for storing a serialized JSON that follows the same format rules as the ~/.docker/config.json file which is a new format for ~/.dockercfg. When using this Secret type, the data field of the Secret object must contain a .dockerconfigjson key, in which the content for the ~/.docker/config.json file is provided as a base64 encoded string.

 Below is an example for a kubernetes.io/dockercfg type of Secret:

 apiVersion: v1
 kind: Secret
 metadata:
 name: secret-dockercfg
 type: kubernetes.io/dockercfg
 data:
 .dockercfg: |
 "<base64 encoded ~/.dockercfg file>"
 
 Note: If you do not want to perform the base64 encoding, you can choose to use the stringData field instead.

 When you create these types of Secrets using a manifest, the API server checks whether the expected key exists in the data field, and it verifies if the value provided can be parsed as a valid JSON. The API server doesn't validate if the JSON actually is a Docker config file.

 When you do not have a Docker config file, or you want to use kubectl to create a Secret for accessing a container registry, you can do:

 kubectl create secret docker-registry secret-tiger-docker \
 --docker-email=tiger@acme.example \
 --docker-username=tiger \
 --docker-password=pass1234 \
 --docker-server=my-registry.example:5000
 

 That command creates a Secret of type kubernetes.io/dockerconfigjson. If you dump the .data.dockerconfigjson field from that new Secret and then decode it from base64:

 kubectl get secret secret-tiger-docker -o jsonpath='{.data.*}' | base64 -d
 

 then the output is equivalent to this JSON document (which is also a valid Docker configuration file):

 {
 "auths": {
 "my-registry.example:5000": {
 "username": "tiger",
 "password": "pass1234",
 "email": "tiger@acme.example",
 "auth": "dGlnZXI6cGFzczEyMzQ="
 }
 }
 }
 
 Note: The auth value there is base64 encoded; it is obscured but not secret. Anyone who can read that Secret can learn the registry access bearer token.

 Basic authentication Secret

 The kubernetes.io/basic-auth type is provided for storing credentials needed for basic authentication. When using this Secret type, the data field of the Secret must contain one of the following two keys:

 * username: the user name for authentication
 * password: the password or token for authentication

 Both values for the above two keys are base64 encoded strings. You can, of course, provide the clear text content using the stringData for Secret creation.

 The following manifest is an example of a basic authentication Secret:

 apiVersion: v1
 kind: Secret
 metadata:
 name: secret-basic-auth
 type: kubernetes.io/basic-auth
 stringData:
 username: admin # required field for kubernetes.io/basic-auth
 password: t0p-Secret # required field for kubernetes.io/basic-auth
 

 The basic authentication Secret type is provided only for convenience. You can create an Opaque type for credentials used for basic authentication. However, using the defined and public Secret type (kubernetes.io/basic-auth) helps other people to understand the purpose of your Secret, and sets a convention for what key names to expect. The Kubernetes API verifies that the required keys are set for a Secret of this type.

 SSH authentication secrets

 The builtin type kubernetes.io/ssh-auth is provided for storing data used in SSH authentication. When using this Secret type, you will have to specify a ssh-privatekey key-value pair in the data (or stringData) field as the SSH credential to use.

 The following manifest is an example of a Secret used for SSH public/private key authentication:

 apiVersion: v1
 kind: Secret
 metadata:
 name: secret-ssh-auth
 type: kubernetes.io/ssh-auth
 data:
 # the data is abbreviated in this example
 ssh-privatekey: |
 MIIEpQIBAAKCAQEAulqb/Y ...
 

 The SSH authentication Secret type is provided only for user's convenience. You could instead create an Opaque type Secret for credentials used for SSH authentication. However, using the defined and public Secret type (kubernetes.io/ssh-auth) helps other people to understand the purpose of your Secret, and sets a convention for what key names to expect. and the API server does verify if the required keys are provided in a Secret configuration.

 Caution: SSH private keys do not establish trusted communication between an SSH client and host server on their own. A secondary means of establishing trust is needed to mitigate "man in the middle" attacks, such as a known_hosts file added to a ConfigMap.

 TLS secrets

 Kubernetes provides a builtin Secret type kubernetes.io/tls for storing a certificate and its associated key that are typically used for TLS.

 One common use for TLS secrets is to configure encryption in transit for an Ingress, but you can also use it with other resources or directly in your workload. When using this type of Secret, the tls.key and the tls.crt key must be provided in the data (or stringData) field of the Secret configuration, although the API server doesn't actually validate the values for each key.

 The following YAML contains an example config for a TLS Secret:

 apiVersion: v1
 kind: Secret
 metadata:
 name: secret-tls
 type: kubernetes.io/tls
 data:
 # the data is abbreviated in this example
 tls.crt: |
 MIIC2DCCAcCgAwIBAgIBATANBgkqh ...
 tls.key: |
 MIIEpgIBAAKCAQEA7yn3bRHQ5FHMQ ...
 

 The TLS Secret type is provided for user's convenience. You can create an Opaque for credentials used for TLS server and/or client. However, using the builtin Secret type helps ensure the consistency of Secret format in your project; the API server does verify if the required keys are provided in a Secret configuration.

 When creating a TLS Secret using kubectl, you can use the tls subcommand as shown in the following example:

 kubectl create secret tls my-tls-secret \
 --cert=path/to/cert/file \
 --key=path/to/key/file
 

 The public/private key pair must exist before hand. The public key certificate for --cert must be DER format as per Section 5.1 of RFC 7468, and must match the given private key for --key (PKCS #8 in DER format; Section 11 of RFC 7468).

 Note:

 A kubernetes.io/tls Secret stores the Base64-encoded DER data for keys and certificates. If you're familiar with PEM format for private keys and for certificates, the base64 data are the same as that format except that you omit the initial and the last lines that are used in PEM.

 For example, for a certificate, you do not include --------BEGIN CERTIFICATE----- and -------END CERTIFICATE----.

 Bootstrap token Secrets

 A bootstrap token Secret can be created by explicitly specifying the Secret type to bootstrap.kubernetes.io/token. This type of Secret is designed for tokens used during the node bootstrap process. It stores tokens used to sign well-known ConfigMaps.

 A bootstrap token Secret is usually created in the kube-system namespace and named in the form bootstrap-token-<token-id> where <token-id> is a 6 character string of the token ID.

 As a Kubernetes manifest, a bootstrap token Secret might look like the following:

 apiVersion: v1
 kind: Secret
 metadata:
 name: bootstrap-token-5emitj
 namespace: kube-system
 type: bootstrap.kubernetes.io/token
 data:
 auth-extra-groups: c3lzdGVtOmJvb3RzdHJhcHBlcnM6a3ViZWFkbTpkZWZhdWx0LW5vZGUtdG9rZW4=
 expiration: MjAyMC0wOS0xM1QwNDozOToxMFo=
 token-id: NWVtaXRq
 token-secret: a3E0Z2lodnN6emduMXAwcg==
 usage-bootstrap-authentication: dHJ1ZQ==
 usage-bootstrap-signing: dHJ1ZQ==
 

 A bootstrap type Secret has the following keys specified under data:

 * token-id: A random 6 character string as the token identifier. Required.
 * token-secret: A random 16 character string as the actual token secret. Required.
 * description: A human-readable string that describes what the token is used for. Optional.
 * expiration: An absolute UTC time using RFC3339 specifying when the token should be expired. Optional.
 * usage-bootstrap-<usage>: A boolean flag indicating additional usage for the bootstrap token.
 * auth-extra-groups: A comma-separated list of group names that will be authenticated as in addition to the system:bootstrappers group.

 The above YAML may look confusing because the values are all in base64 encoded strings. In fact, you can create an identical Secret using the following YAML:

 apiVersion: v1
 kind: Secret
 metadata:
 # Note how the Secret is named
 name: bootstrap-token-5emitj
 # A bootstrap token Secret usually resides in the kube-system namespace
 namespace: kube-system
 type: bootstrap.kubernetes.io/token
 stringData:
 auth-extra-groups: "system:bootstrappers:kubeadm:default-node-token"
 expiration: "2020-09-13T04:39:10Z"
 # This token ID is used in the name
 token-id: "5emitj"
 token-secret: "kq4gihvszzgn1p0r"
 # This token can be used for authentication
 usage-bootstrap-authentication: "true"
 # and it can be used for signing
 usage-bootstrap-signing: "true"
 

 Immutable Secrets

 FEATURE STATE: Kubernetes v1.21 [stable]

 Kubernetes lets you mark specific Secrets (and ConfigMaps) as immutable. Preventing changes to the data of an existing Secret has the following benefits:

 * protects you from accidental (or unwanted) updates that could cause applications outages
 * (for clusters that extensively use Secrets - at least tens of thousands of unique Secret to Pod mounts), switching to immutable Secrets improves the performance of your cluster by significantly reducing load on kube-apiserver. The kubelet does not need to maintain a [watch] on any Secrets that are marked as immutable.

 Marking a Secret as immutable

 You can create an immutable Secret by setting the immutable field to true. For example,

 apiVersion: v1
 kind: Secret
 metadata:
 ...
 data:
 ...
 immutable: true
 

 You can also update any existing mutable Secret to make it immutable.

 Note: Once a Secret or ConfigMap is marked as immutable, it is not possible to revert this change nor to mutate the contents of the data field. You can only delete and recreate the Secret. Existing Pods maintain a mount point to the deleted Secret - it is recommended to recreate these pods.

 Information security for Secrets

 Although ConfigMap and Secret work similarly, Kubernetes applies some additional protection for Secret objects.

 Secrets often hold values that span a spectrum of importance, many of which can cause escalations within Kubernetes (e.g. service account tokens) and to external systems. Even if an individual app can reason about the power of the Secrets it expects to interact with, other apps within the same namespace can render those assumptions invalid.

 A Secret is only sent to a node if a Pod on that node requires it. For mounting secrets into Pods, the kubelet stores a copy of the data into a tmpfs so that the confidential data is not written to durable storage. Once the Pod that depends on the Secret is deleted, the kubelet deletes its local copy of the confidential data from the Secret.

 There may be several containers in a Pod. By default, containers you define only have access to the default ServiceAccount and its related Secret. You must explicitly define environment variables or map a volume into a container in order to provide access to any other Secret.

 There may be Secrets for several Pods on the same node. However, only the Secrets that a Pod requests are potentially visible within its containers. Therefore, one Pod does not have access to the Secrets of another Pod.

 Warning: Any containers that run with privileged: true on a node can access all Secrets used on that node.

 What's next

 * For guidelines to manage and improve the security of your Secrets, refer to Good practices for Kubernetes Secrets.
 * Learn how to manage Secrets using kubectl
 * Learn how to manage Secrets using config file
 * Learn how to manage Secrets using kustomize
 * Read the API reference for Secret

 Feedback

 Was this page helpful?

 Yes No

 Thanks for the feedback. If you have a specific, answerable question about how to use Kubernetes, ask it on Stack Overflow. Open an issue in the GitHub repo if you want to report a problem or suggest an improvement.

 Last modified November 15, 2022 at 11:15 PM PST: Clean up wording and remove duplicate content (679d205d3d)
 Edit this page Create child page Create an issue Print entire section
 * Uses for Secrets
 + Alternatives to Secrets
 * Working with Secrets
 + Creating a Secret
 + Editing a Secret
 + Using a Secret
 + Using Secrets as files from a Pod
 + Using Secrets as environment variables
 + Container image pull secrets
 + Using Secrets with static Pods
 * Use cases
 + Use case: As container environment variables
 + Use case: Pod with SSH keys
 + Use case: Pods with prod / test credentials
 + Use case: dotfiles in a secret volume
 + Use case: Secret visible to one container in a Pod
 * Types of Secret
 + Opaque secrets
 + Service account token Secrets
 + Docker config Secrets
 + Basic authentication Secret
 + SSH authentication secrets
 + TLS secrets
 + Bootstrap token Secrets
 * Immutable Secrets
 + Marking a Secret as immutable
 * Information security for Secrets
 * What's next
 Home Blog Training Partners Community Case Studies
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 © 2023 The Kubernetes Authors | Documentation Distributed under CC BY 4.0
 Copyright © 2023 The Linux Foundation ®. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page
 ICP license: 京ICP备17074266号-3
A Secret is an object that contains a small amount of sensitive data such as
a password, a token, or a key. Such information might otherwise be put in a
Pod specification or in a
container image. Using a
Secret means that you don't need to include confidential data in your
application code. Because Secrets can be created independently of the Pods that use them, there
is less risk of the Secret (and its data) being exposed during the workflow of
creating, viewing, and editing Pods. Kubernetes, and applications that run in
your cluster, can also take additional precautions with Secrets, such as avoiding
writing secret data to nonvolatile storage. Secrets are similar to ConfigMaps
but are specifically intended to hold confidential data. See Information security for Secrets for more details. Uses for Secrets There are three main ways for a Pod to use a Secret:  As files in a
volume mounted on one or more of
its containers. As container environment variable. By the kubelet when pulling images for the Pod.  The Kubernetes control plane also uses Secrets; for example,
bootstrap token Secrets are a mechanism to
help automate node registration. Alternatives to Secrets Rather than using a Secret to protect confidential data, you can pick from alternatives. Here are some of your options:  if your cloud-native component needs to authenticate to another application that you
know is running within the same Kubernetes cluster, you can use a
ServiceAccount
and its tokens to identify your client. there are third-party tools that you can run, either within or outside your cluster,
that provide secrets management. For example, a service that Pods access over HTTPS,
that reveals a secret if the client correctly authenticates (for example, with a ServiceAccount
token). for authentication, you can implement a custom signer for X.509 certificates, and use
CertificateSigningRequests
to let that custom signer issue certificates to Pods that need them. you can use a device plugin
to expose node-local encryption hardware to a specific Pod. For example, you can schedule
trusted Pods onto nodes that provide a Trusted Platform Module, configured out-of-band.  You can also combine two or more of those options, including the option to use Secret objects themselves. For example: implement (or deploy) an operator
that fetches short-lived session tokens from an external service, and then creates Secrets based
on those short-lived session tokens. Pods running in your cluster can make use of the session tokens,
and operator ensures they are valid. This separation means that you can run Pods that are unaware of
the exact mechanisms for issuing and refreshing those session tokens. Working with Secrets Creating a Secret There are several options to create a Secret:   Use kubectl    Use a configuration file   Use the Kustomize tool   Constraints on Secret names and data The name of a Secret object must be a valid
DNS subdomain name. You can specify the data and/or the stringData field when creating a
configuration file for a Secret. The data and the stringData fields are optional.
The values for all keys in the data field have to be base64-encoded strings.
If the conversion to base64 string is not desirable, you can choose to specify
the stringData field instead, which accepts arbitrary strings as values. The keys of data and stringData must consist of alphanumeric characters,
-, _ or .. All key-value pairs in the stringData field are internally
merged into the data field. If a key appears in both the data and the
stringData field, the value specified in the stringData field takes
precedence. Size limit Individual secrets are limited to 1MiB in size. This is to discourage creation
of very large secrets that could exhaust the API server and kubelet memory.
However, creation of many smaller secrets could also exhaust memory. You can
use a resource quota to limit the
number of Secrets (or other resources) in a namespace. Editing a Secret You can edit an existing Secret unless it is immutable. To
edit a Secret, use one of the following methods:   Use kubectl    Use a configuration file   You can also edit the data in a Secret using the Kustomize tool. However, this
method creates a new Secret object with the edited data. Depending on how you created the Secret, as well as how the Secret is used in
your Pods, updates to existing Secret objects are propagated automatically to
Pods that use the data. For more information, refer to Mounted Secrets are updated automatically. Using a Secret Secrets can be mounted as data volumes or exposed as
environment variables
to be used by a container in a Pod. Secrets can also be used by other parts of the
system, without being directly exposed to the Pod. For example, Secrets can hold
credentials that other parts of the system should use to interact with external
systems on your behalf. Secret volume sources are validated to ensure that the specified object
reference actually points to an object of type Secret. Therefore, a Secret
needs to be created before any Pods that depend on it. If the Secret cannot be fetched (perhaps because it does not exist, or
due to a temporary lack of connection to the API server) the kubelet
periodically retries running that Pod. The kubelet also reports an Event
for that Pod, including details of the problem fetching the Secret. Optional Secrets When you reference a Secret in a Pod, you can mark the Secret as optional,
such as in the following example. If an optional Secret doesn't exist,
Kubernetes ignores it.   apiVersion: v1
kind: Pod
metadata:
 name: mypod
spec:
 containers:
 - name: mypod
 image: redis
 volumeMounts:
 - name: foo
 mountPath: "/etc/foo"
 readOnly: true
 volumes:
 - name: foo
 secret:
 secretName: mysecret
 optional: true
   By default, Secrets are required. None of a Pod's containers will start until
all non-optional Secrets are available. If a Pod references a specific key in a non-optional Secret and that Secret
does exist, but is missing the named key, the Pod fails during startup. Using Secrets as files from a Pod If you want to access data from a Secret in a Pod, one way to do that is to
have Kubernetes make the value of that Secret be available as a file inside
the filesystem of one or more of the Pod's containers. Mounted Secrets are updated automatically When a volume contains data from a Secret, and that Secret is updated, Kubernetes tracks
this and updates the data in the volume, using an eventually-consistent approach. The kubelet keeps a cache of the current keys and values for the Secrets that are used in
volumes for pods on that node.
You can configure the way that the kubelet detects changes from the cached values. The
configMapAndSecretChangeDetectionStrategy field in the
kubelet configuration controls
which strategy the kubelet uses. The default strategy is Watch. Updates to Secrets can be either propagated by an API watch mechanism (the default), based on
a cache with a defined time-to-live, or polled from the cluster API server on each kubelet
synchronisation loop. As a result, the total delay from the moment when the Secret is updated to the moment
when new keys are projected to the Pod can be as long as the kubelet sync period + cache
propagation delay, where the cache propagation delay depends on the chosen cache type
(following the same order listed in the previous paragraph, these are:
watch propagation delay, the configured cache TTL, or zero for direct polling). Using Secrets as environment variables To use a Secret in an environment variable
in a Pod:  For each container in your Pod specification, add an environment variable
for each Secret key that you want to use to the
env[].valueFrom.secretKeyRef field. Modify your image and/or command line so that the program looks for values
in the specified environment variables.  For instructions, refer to
Define container environment variables using Secret data. Invalid environment variables If your environment variable definitions in your Pod specification are
considered to be invalid environment variable names, those keys aren't made
available to your container. The Pod is allowed to start. Kubernetes adds an Event with the reason set to InvalidVariableNames and a
message that lists the skipped invalid keys. The following example shows a Pod that refers to a Secret named mysecret, where mysecret contains 2 invalid keys: 1badkey and 2alsobad. The output is similar to:  LASTSEEN FIRSTSEEN COUNT NAME KIND SUBOBJECT TYPE REASON
0s 0s 1 dapi-test-pod Pod Warning InvalidEnvironmentVariableNames kubelet, 127.0.0.1 Keys [1badkey, 2alsobad] from the EnvFrom secret default/mysecret were skipped since they are considered invalid environment variable names.
  Container image pull secrets If you want to fetch container images from a private repository, you need a way for
the kubelet on each node to authenticate to that repository. You can configure
image pull secrets to make this possible. These secrets are configured at the Pod
level. Using imagePullSecrets The imagePullSecrets field is a list of references to secrets in the same namespace.
You can use an imagePullSecrets to pass a secret that contains a Docker (or other) image registry
password to the kubelet. The kubelet uses this information to pull a private image on behalf of your Pod.
See the PodSpec API
for more information about the imagePullSecrets field. Manually specifying an imagePullSecret You can learn how to specify imagePullSecrets from the
container images
documentation. Arranging for imagePullSecrets to be automatically attached You can manually create imagePullSecrets, and reference these from a ServiceAccount. Any Pods
created with that ServiceAccount or created with that ServiceAccount by default, will get their
imagePullSecrets field set to that of the service account.
See Add ImagePullSecrets to a service account
for a detailed explanation of that process. Using Secrets with static Pods You cannot use ConfigMaps or Secrets with static Pods. Use cases Use case: As container environment variables You can create a Secret and use it to
set environment variables for a container. Use case: Pod with SSH keys Create a Secret containing some SSH keys:   kubectl create secret generic ssh-key-secret --from-file=ssh-privatekey=/path/to/.ssh/id_rsa --from-file=ssh-publickey=/path/to/.ssh/id_rsa.pub
   The output is similar to:  secret "ssh-key-secret" created
  You can also create a kustomization.yaml with a secretGenerator field containing ssh keys. Now you can create a Pod which references the secret with the SSH key and
consumes it in a volume:   apiVersion: v1
kind: Pod
metadata:
 name: secret-test-pod
 labels:
 name: secret-test
spec:
 volumes:
 - name: secret-volume
 secret:
 secretName: ssh-key-secret
 containers:
 - name: ssh-test-container
 image: mySshImage
 volumeMounts:
 - name: secret-volume
 readOnly: true
 mountPath: "/etc/secret-volume"
   When the container's command runs, the pieces of the key will be available in:  /etc/secret-volume/ssh-publickey
/etc/secret-volume/ssh-privatekey
  The container is then free to use the secret data to establish an SSH connection. Use case: Pods with prod / test credentials This example illustrates a Pod which consumes a secret containing production credentials and
another Pod which consumes a secret with test environment credentials. You can create a kustomization.yaml with a secretGenerator field or run
kubectl create secret.   kubectl create secret generic prod-db-secret --from-literal=username=produser --from-literal=password=Y4nys7f11
   The output is similar to:  secret "prod-db-secret" created
  You can also create a secret for test environment credentials.   kubectl create secret generic test-db-secret --from-literal=username=testuser --from-literal=password=iluvtests
   The output is similar to:  secret "test-db-secret" created
  Now make the Pods:   cat &lt;&lt;EOF &gt; pod.yaml
apiVersion: v1
kind: List
items:
- kind: Pod
 apiVersion: v1
 metadata:
 name: prod-db-client-pod
 labels:
 name: prod-db-client
 spec:
 volumes:
 - name: secret-volume
 secret:
 secretName: prod-db-secret
 containers:
 - name: db-client-container
 image: myClientImage
 volumeMounts:
 - name: secret-volume
 readOnly: true
 mountPath: "/etc/secret-volume"
- kind: Pod
 apiVersion: v1
 metadata:
 name: test-db-client-pod
 labels:
 name: test-db-client
 spec:
 volumes:
 - name: secret-volume
 secret:
 secretName: test-db-secret
 containers:
 - name: db-client-container
 image: myClientImage
 volumeMounts:
 - name: secret-volume
 readOnly: true
 mountPath: "/etc/secret-volume"
EOF
   Add the pods to the same kustomization.yaml:   cat &lt;&lt;EOF &gt;&gt; kustomization.yaml
resources:
- pod.yaml
EOF
   Apply all those objects on the API server by running: Both containers will have the following files present on their filesystems with the values
for each container's environment:  /etc/secret-volume/username
/etc/secret-volume/password
  Note how the specs for the two Pods differ only in one field; this facilitates
creating Pods with different capabilities from a common Pod template. You could further simplify the base Pod specification by using two service accounts:   prod-user with the prod-db-secret   test-user with the test-db-secret   The Pod specification is shortened to:   apiVersion: v1
kind: Pod
metadata:
 name: prod-db-client-pod
 labels:
 name: prod-db-client
spec:
 serviceAccount: prod-db-client
 containers:
 - name: db-client-container
 image: myClientImage
   Use case: dotfiles in a secret volume You can make your data "hidden" by defining a key that begins with a dot.
This key represents a dotfile or "hidden" file. For example, when the following secret
is mounted into a volume, secret-volume:   apiVersion: v1
kind: Secret
metadata:
 name: dotfile-secret
data:
 .secret-file: dmFsdWUtMg0KDQo=
---
apiVersion: v1
kind: Pod
metadata:
 name: secret-dotfiles-pod
spec:
 volumes:
 - name: secret-volume
 secret:
 secretName: dotfile-secret
 containers:
 - name: dotfile-test-container
 image: registry.k8s.io/busybox
 command:
 - ls
 - "-l"
 - "/etc/secret-volume"
 volumeMounts:
 - name: secret-volume
 readOnly: true
 mountPath: "/etc/secret-volume"
   The volume will contain a single file, called .secret-file, and
the dotfile-test-container will have this file present at the path
/etc/secret-volume/.secret-file. Use case: Secret visible to one container in a Pod Consider a program that needs to handle HTTP requests, do some complex business
logic, and then sign some messages with an HMAC. Because it has complex
application logic, there might be an unnoticed remote file reading exploit in
the server, which could expose the private key to an attacker. This could be divided into two processes in two containers: a frontend container
which handles user interaction and business logic, but which cannot see the
private key; and a signer container that can see the private key, and responds
to simple signing requests from the frontend (for example, over localhost networking). With this partitioned approach, an attacker now has to trick the application
server into doing something rather arbitrary, which may be harder than getting
it to read a file. Types of Secret When creating a Secret, you can specify its type using the type field of
the Secret
resource, or certain equivalent kubectl command line flags (if available).
The Secret type is used to facilitate programmatic handling of the Secret data. Kubernetes provides several built-in types for some common usage scenarios.
These types vary in terms of the validations performed and the constraints
Kubernetes imposes on them.    Built-in Type Usage      Opaque  arbitrary user-defined data    kubernetes.io/service-account-token  ServiceAccount token    kubernetes.io/dockercfg  serialized ~/.dockercfg file    kubernetes.io/dockerconfigjson  serialized ~/.docker/config.json file    kubernetes.io/basic-auth  credentials for basic authentication    kubernetes.io/ssh-auth  credentials for SSH authentication    kubernetes.io/tls  data for a TLS client or server    bootstrap.kubernetes.io/token  bootstrap token data    You can define and use your own Secret type by assigning a non-empty string as the
type value for a Secret object (an empty string is treated as an Opaque type). Kubernetes doesn't impose any constraints on the type name. However, if you
are using one of the built-in types, you must meet all the requirements defined
for that type. If you are defining a type of secret that's for public use, follow the convention
and structure the secret type to have your domain name before the name, separated
by a /. For example: cloud-hosting.example.net/cloud-api-credentials. Opaque secrets  Opaque is the default Secret type if omitted from a Secret configuration file.
When you create a Secret using kubectl, you will use the generic
subcommand to indicate an Opaque Secret type. For example, the following
command creates an empty Secret of type Opaque.   kubectl create secret generic empty-secret
kubectl get secret empty-secret
   The output looks like:  NAME TYPE DATA AGE
empty-secret Opaque 0 2m6s
  The DATA column shows the number of data items stored in the Secret.
In this case, 0 means you have created an empty Secret. Service account token Secrets A kubernetes.io/service-account-token type of Secret is used to store a
token credential that identifies a
service account. Since 1.22, this type of Secret is no longer used to mount credentials into Pods,
and obtaining tokens via the TokenRequest
API is recommended instead of using service account token Secret objects.
Tokens obtained from the TokenRequest API are more secure than ones stored in Secret objects,
because they have a bounded lifetime and are not readable by other API clients.
You can use the  kubectl create token 
command to obtain a token from the TokenRequest API. You should only create a service account token Secret object
if you can't use the TokenRequest API to obtain a token,
and the security exposure of persisting a non-expiring token credential
in a readable API object is acceptable to you. When using this Secret type, you need to ensure that the
kubernetes.io/service-account.name annotation is set to an existing
service account name. If you are creating both the ServiceAccount and
the Secret objects, you should create the ServiceAccount object first. After the Secret is created, a Kubernetes controller
fills in some other fields such as the kubernetes.io/service-account.uid annotation, and the
token key in the data field, which is populated with an authentication token. The following example configuration declares a service account token Secret:   apiVersion: v1
kind: Secret
metadata:
 name: secret-sa-sample
 annotations:
 kubernetes.io/service-account.name: "sa-name"
type: kubernetes.io/service-account-token
data:
 # You can include additional key value pairs as you do with Opaque Secrets
 extra: YmFyCg==
   After creating the Secret, wait for Kubernetes to populate the token key in the data field. See the ServiceAccount
documentation for more information on how service accounts work.
You can also check the automountServiceAccountToken field and the
serviceAccountName field of the
 Pod 
for information on referencing service account credentials from within Pods. Docker config Secrets You can use one of the following type values to create a Secret to
store the credentials for accessing a container image registry:   kubernetes.io/dockercfg   kubernetes.io/dockerconfigjson   The kubernetes.io/dockercfg type is reserved to store a serialized
~/.dockercfg which is the legacy format for configuring Docker command line.
When using this Secret type, you have to ensure the Secret data field
contains a .dockercfg key whose value is content of a ~/.dockercfg file
encoded in the base64 format. The kubernetes.io/dockerconfigjson type is designed for storing a serialized
JSON that follows the same format rules as the ~/.docker/config.json file
which is a new format for ~/.dockercfg.
When using this Secret type, the data field of the Secret object must
contain a .dockerconfigjson key, in which the content for the
~/.docker/config.json file is provided as a base64 encoded string. Below is an example for a kubernetes.io/dockercfg type of Secret:   apiVersion: v1
kind: Secret
metadata:
 name: secret-dockercfg
type: kubernetes.io/dockercfg
data:
 .dockercfg: |
 "&lt;base64 encoded ~/.dockercfg file&gt;"
   When you create these types of Secrets using a manifest, the API
server checks whether the expected key exists in the data field, and
it verifies if the value provided can be parsed as a valid JSON. The API
server doesn't validate if the JSON actually is a Docker config file. When you do not have a Docker config file, or you want to use kubectl
to create a Secret for accessing a container registry, you can do:   kubectl create secret docker-registry secret-tiger-docker \
 --docker-email=tiger@acme.example \
 --docker-username=tiger \
 --docker-password=pass1234 \
 --docker-server=my-registry.example:5000
   That command creates a Secret of type kubernetes.io/dockerconfigjson.
If you dump the .data.dockerconfigjson field from that new Secret and then
decode it from base64:   kubectl get secret secret-tiger-docker -o jsonpath='{.data.*}' | base64 -d
   then the output is equivalent to this JSON document (which is also a valid
Docker configuration file):   {
 "auths": {
 "my-registry.example:5000": {
 "username": "tiger",
 "password": "pass1234",
 "email": "tiger@acme.example",
 "auth": "dGlnZXI6cGFzczEyMzQ="
 }
 }
}
   Basic authentication Secret The kubernetes.io/basic-auth type is provided for storing credentials needed
for basic authentication. When using this Secret type, the data field of the
Secret must contain one of the following two keys:   username: the user name for authentication  password: the password or token for authentication  Both values for the above two keys are base64 encoded strings. You can, of
course, provide the clear text content using the stringData for Secret
creation. The following manifest is an example of a basic authentication Secret:   apiVersion: v1
kind: Secret
metadata:
 name: secret-basic-auth
type: kubernetes.io/basic-auth
stringData:
 username: admin # required field for kubernetes.io/basic-auth
 password: t0p-Secret # required field for kubernetes.io/basic-auth
   The basic authentication Secret type is provided only for convenience.
You can create an Opaque type for credentials used for basic authentication.
However, using the defined and public Secret type (kubernetes.io/basic-auth) helps other
people to understand the purpose of your Secret, and sets a convention for what key names
to expect.
The Kubernetes API verifies that the required keys are set for a Secret of this type. SSH authentication secrets The builtin type kubernetes.io/ssh-auth is provided for storing data used in
SSH authentication. When using this Secret type, you will have to specify a
ssh-privatekey key-value pair in the data (or stringData) field
as the SSH credential to use. The following manifest is an example of a Secret used for SSH public/private
key authentication:   apiVersion: v1
kind: Secret
metadata:
 name: secret-ssh-auth
type: kubernetes.io/ssh-auth
data:
 # the data is abbreviated in this example
 ssh-privatekey: |
 MIIEpQIBAAKCAQEAulqb/Y ...
   The SSH authentication Secret type is provided only for user's convenience.
You could instead create an Opaque type Secret for credentials used for SSH authentication.
However, using the defined and public Secret type (kubernetes.io/ssh-auth) helps other
people to understand the purpose of your Secret, and sets a convention for what key names
to expect.
and the API server does verify if the required keys are provided in a Secret configuration. TLS secrets Kubernetes provides a builtin Secret type kubernetes.io/tls for storing
a certificate and its associated key that are typically used for TLS. One common use for TLS secrets is to configure encryption in transit for
an Ingress, but you can also use it
with other resources or directly in your workload.
When using this type of Secret, the tls.key and the tls.crt key must be provided
in the data (or stringData) field of the Secret configuration, although the API
server doesn't actually validate the values for each key. The following YAML contains an example config for a TLS Secret:   apiVersion: v1
kind: Secret
metadata:
 name: secret-tls
type: kubernetes.io/tls
data:
 # the data is abbreviated in this example
 tls.crt: |
 MIIC2DCCAcCgAwIBAgIBATANBgkqh ...
 tls.key: |
 MIIEpgIBAAKCAQEA7yn3bRHQ5FHMQ ...
   The TLS Secret type is provided for user's convenience. You can create an Opaque
for credentials used for TLS server and/or client. However, using the builtin Secret
type helps ensure the consistency of Secret format in your project; the API server
does verify if the required keys are provided in a Secret configuration. When creating a TLS Secret using kubectl, you can use the tls subcommand
as shown in the following example:   kubectl create secret tls my-tls-secret \
 --cert=path/to/cert/file \
 --key=path/to/key/file
   The public/private key pair must exist before hand. The public key certificate
for --cert must be DER format as per
Section 5.1 of RFC 7468,
and must match the given private key for --key (PKCS #8 in DER format;
Section 11 of RFC 7468). Bootstrap token Secrets A bootstrap token Secret can be created by explicitly specifying the Secret
type to bootstrap.kubernetes.io/token. This type of Secret is designed for
tokens used during the node bootstrap process. It stores tokens used to sign
well-known ConfigMaps. A bootstrap token Secret is usually created in the kube-system namespace and
named in the form bootstrap-token-&lt;token-id&gt; where &lt;token-id&gt; is a 6 character
string of the token ID. As a Kubernetes manifest, a bootstrap token Secret might look like the
following:   apiVersion: v1
kind: Secret
metadata:
 name: bootstrap-token-5emitj
 namespace: kube-system
type: bootstrap.kubernetes.io/token
data:
 auth-extra-groups: c3lzdGVtOmJvb3RzdHJhcHBlcnM6a3ViZWFkbTpkZWZhdWx0LW5vZGUtdG9rZW4=
 expiration: MjAyMC0wOS0xM1QwNDozOToxMFo=
 token-id: NWVtaXRq
 token-secret: a3E0Z2lodnN6emduMXAwcg==
 usage-bootstrap-authentication: dHJ1ZQ==
 usage-bootstrap-signing: dHJ1ZQ==
   A bootstrap type Secret has the following keys specified under data:   token-id: A random 6 character string as the token identifier. Required.  token-secret: A random 16 character string as the actual token secret. Required.  description: A human-readable string that describes what the token is
used for. Optional.  expiration: An absolute UTC time using RFC3339 specifying when the token
should be expired. Optional.  usage-bootstrap-&lt;usage&gt;: A boolean flag indicating additional usage for
the bootstrap token.  auth-extra-groups: A comma-separated list of group names that will be
authenticated as in addition to the system:bootstrappers group.  The above YAML may look confusing because the values are all in base64 encoded
strings. In fact, you can create an identical Secret using the following YAML:   apiVersion: v1
kind: Secret
metadata:
 # Note how the Secret is named
 name: bootstrap-token-5emitj
 # A bootstrap token Secret usually resides in the kube-system namespace
 namespace: kube-system
type: bootstrap.kubernetes.io/token
stringData:
 auth-extra-groups: "system:bootstrappers:kubeadm:default-node-token"
 expiration: "2020-09-13T04:39:10Z"
 # This token ID is used in the name
 token-id: "5emitj"
 token-secret: "kq4gihvszzgn1p0r"
 # This token can be used for authentication
 usage-bootstrap-authentication: "true"
 # and it can be used for signing
 usage-bootstrap-signing: "true"
   Immutable Secrets  FEATURE STATE: Kubernetes v1.21 [stable]  Kubernetes lets you mark specific Secrets (and ConfigMaps) as immutable.
Preventing changes to the data of an existing Secret has the following benefits:  protects you from accidental (or unwanted) updates that could cause applications outages (for clusters that extensively use Secrets - at least tens of thousands of unique Secret
to Pod mounts), switching to immutable Secrets improves the performance of your cluster
by significantly reducing load on kube-apiserver. The kubelet does not need to maintain
a [watch] on any Secrets that are marked as immutable.  Marking a Secret as immutable You can create an immutable Secret by setting the immutable field to true. For example,   apiVersion: v1
kind: Secret
metadata:
 ...
data:
 ...
immutable: true
   You can also update any existing mutable Secret to make it immutable. Information security for Secrets Although ConfigMap and Secret work similarly, Kubernetes applies some additional
protection for Secret objects. Secrets often hold values that span a spectrum of importance, many of which can
cause escalations within Kubernetes (e.g. service account tokens) and to
external systems. Even if an individual app can reason about the power of the
Secrets it expects to interact with, other apps within the same namespace can
render those assumptions invalid. A Secret is only sent to a node if a Pod on that node requires it.
For mounting secrets into Pods, the kubelet stores a copy of the data into a tmpfs
so that the confidential data is not written to durable storage.
Once the Pod that depends on the Secret is deleted, the kubelet deletes its local copy
of the confidential data from the Secret. There may be several containers in a Pod. By default, containers you define
only have access to the default ServiceAccount and its related Secret.
You must explicitly define environment variables or map a volume into a
container in order to provide access to any other Secret. There may be Secrets for several Pods on the same node. However, only the
Secrets that a Pod requests are potentially visible within its containers.
Therefore, one Pod does not have access to the Secrets of another Pod. What's next  For guidelines to manage and improve the security of your Secrets, refer to
Good practices for Kubernetes Secrets. Learn how to manage Secrets using kubectl   Learn how to manage Secrets using config file  Learn how to manage Secrets using kustomize  Read the API reference for Secret
Secrets
https://kubernetes.io/docs/concepts/configuration/secret/#:~:text=Size%20limit,API%20server%20and%20kubelet%20memory.
https://stackoverflow.com/questions/53012798/kubernetes-configmap-size-limitation
Kubernetes ConfigMap size limitation
2019-08-01
Ijaz Ahmad Ijaz Ahmad
<div><div>
 
<div>
 
 <div>
 
<p>Though <code>resourceQuotas</code> may limit the number of configmaps in a namespace, is there any such option to limit the size of the individual configmap?
I will not like some user to start uploading large text files as configmaps.</p>
<p>What is the max size of ConfigMap etcd support? If there is a reasonable limit on the etcd side, should be fine then.</p>
 </div>
 
 <div>
 
 <div>
 
 <div>
 <a href="/users/2884309/ivan-aracki"><p></p></a>
 </div>
 <div>
 <p><a href="/users/2884309/ivan-aracki">Ivan Aracki</a></p><p>4,61311 gold badges58 silver badges68 bronze badges
 </p>
 </div>
</div>
 <div>
 <p>
 asked Oct 26, 2018 at 16:23
 </p>
 <div>
 <a href="/users/4550110/ijaz-ahmad"><p></p></a>
 </div>
 
</div>
 </div>
 
</div>
 <div>
 
 
<div>
 
 
<div>
 
 <div>
<p>There are no <a href="https://github.com/kubernetes/kubernetes/issues/19969">hard-limits</a> on either the ConfigMap or Secret objects as of this writing. </p>
<p>There's, however, a 1MB limit from the <a href="https://github.com/kubernetes/kubernetes/issues/19781">etcd</a> side which is where Kubernetes stores its objects.</p>
<p>From the API side, if you actually see the API <a href="https://github.com/kubernetes/api/blob/master/core/v1/types.go#L5027">code</a> and the ConfigMap type, you'll see that its <a href="https://github.com/kubernetes/api/blob/master/core/v1/types.go#L5040">data</a> field is Golang map of strings so this appears memory bound and managed at runtime unless somewhere else it gets defined with <code>make()</code>. Technically the max size for the number of keys on hashmap is the map length which is an <code>int</code> and the max value is explained here: <a href="https://stackoverflow.com/questions/32600763/maximum-number-of-elements-in-map">Maximum number of elements in map</a>. That would also be the theoretical limit for the value of data as the maximum value for <code>len(string)</code>.</p>
<p>If you actually want to get more insights from the API side where the kube-apiserver receives protobufs (or JSON for that matter) you can take a look at the <a href="https://stackoverflow.com/questions/34128872/google-protobuf-maximum-size">google protobuf maximum size</a>. That will give you some measure as to the limitation of sending the <code>data</code> field through the wire. There may be other limitation from the kube-apiserver itself when it comes to processing any large message.</p>
 </div>
 <div>
 <p>
 answered Oct 26, 2018 at 20:15
 </p>
 <div>
 <a href="/users/2989261/rico"><p></p></a>
 </div>
 <div>
 <p><a href="/users/2989261/rico">Rico</a>Rico</p><p>56.9k12 gold badges107 silver badges138 bronze badges
 </p>
 </div>
</div>
 
</div>
 <p>4</p>
 </div>
 
<div>
 
 <div>
<p>The size of the individual configmap is limited to 1mb, according to kubernetes.io:</p>
<blockquote>
<p>A ConfigMap is not designed to hold large chunks of data. The data stored in a ConfigMap cannot exceed 1 MiB. If you need to store settings that are larger than this limit, you may want to consider mounting a volume or use a separate database or file service.</p>
</blockquote>
<p>The quote is taken from here - <a href="https://kubernetes.io/docs/concepts/configuration/configmap/#motivation">https://kubernetes.io/docs/concepts/configuration/configmap/#motivation</a></p>
 </div>
 <div>
 <p>
 answered Apr 20, 2021 at 9:47
 </p>
 <div>
 <a href="/users/680032/victorm1710"><p></p></a>
 </div>
 <div>
 <p><a href="/users/680032/victorm1710">victorm1710</a>victorm1710</p><p>1,10511 silver badges11 bronze badges
 </p>
 </div>
</div>
 
</div>
 
<div>
 
 
<div>
 
 <div>
<p>Till date config maps come under object count quota. You can enforce a maximum on number of configmaps. You cant put limits on size of individual config map. As they are not yet included under Storage Resource Quota. </p>
<p><a href="https://kubernetes.io/docs/concepts/policy/resource-quotas/">https://kubernetes.io/docs/concepts/policy/resource-quotas/</a></p>
 </div>
 <div>
 <p>
 answered Oct 26, 2018 at 18:17
 </p>
 <div>
 <a href="/users/8856029/shane-warne"><p></p></a>
 </div>
 <div>
 <p><a href="/users/8856029/shane-warne">Shane Warne</a>Shane Warne</p><p>1,1869 silver badges19 bronze badges
 </p>
 </div>
</div>
 
</div>
 <p>4</p>
 </div>
 
 <h2>
 
 </h2>
 </div>
 </div>||||I|||| Stack Overflow
 1. About
 2. Products
 3. For Teams
 1. Stack Overflow Public questions & answers
 2. Stack Overflow for Teams Where developers & technologists share private knowledge with coworkers
 3. Talent Build your employer brand
 4. Advertising Reach developers & technologists worldwide
 5. About the company
 Loading…

 1. current community

 + Stack Overflow
 help chat
 + Meta Stack Overflow

 your communities

 Sign up or log in to customize your list.

 more stack exchange communities

 company blog
 2. 
 3. Log in
 4. Sign up
 1. Home
 2. 
 1. Public
 2. Questions
 3. Tags
 4. Users
 5. Companies
 6. Collectives
 7. Explore Collectives
 3. 
 1. Teams
 Stack Overflow for Teams – Start collaborating and sharing organizational knowledge. Create a free Team Why Teams?
 2. Teams
 3. Create free Team

 Collectives™ on Stack Overflow

 Find centralized, trusted content and collaborate around the technologies you use most.

 Learn more about Collectives

 Teams

 Q&A for work

 Connect and share knowledge within a single location that is structured and easy to search.

 Learn more about Teams

 Kubernetes ConfigMap size limitation

 Ask Question
 Asked 4 years, 3 months ago
 Modified 1 year, 9 months ago
 Viewed 29k times
 23

 Though resourceQuotas may limit the number of configmaps in a namespace, is there any such option to limit the size of the individual configmap? I will not like some user to start uploading large text files as configmaps.

 What is the max size of ConfigMap etcd support? If there is a reasonable limit on the etcd side, should be fine then.

 * kubernetes
 * openshift
 Share
 Improve this question
 Follow
 edited Aug 1, 2019 at 7:06
 Ivan Aracki
 4,613 11 11 gold badges 58 58 silver badges 68 68 bronze badges
 asked Oct 26, 2018 at 16:23
 Ijaz Ahmad Ijaz Ahmad
 10.7k 8 8 gold badges 48 48 silver badges 69 69 bronze badges
 Add a comment |

 3 Answers

 Sorted by: Reset to default
 Highest score (default) Trending (recent votes count more) Date modified (newest first) Date created (oldest first)
 35

 There are no hard-limits on either the ConfigMap or Secret objects as of this writing.

 There's, however, a 1MB limit from the etcd side which is where Kubernetes stores its objects.

 From the API side, if you actually see the API code and the ConfigMap type, you'll see that its data field is Golang map of strings so this appears memory bound and managed at runtime unless somewhere else it gets defined with make(). Technically the max size for the number of keys on hashmap is the map length which is an int and the max value is explained here: Maximum number of elements in map. That would also be the theoretical limit for the value of data as the maximum value for len(string).

 If you actually want to get more insights from the API side where the kube-apiserver receives protobufs (or JSON for that matter) you can take a look at the google protobuf maximum size. That will give you some measure as to the limitation of sending the data field through the wire. There may be other limitation from the kube-apiserver itself when it comes to processing any large message.

 Share
 Improve this answer
 Follow
 edited Oct 26, 2018 at 20:43
 answered Oct 26, 2018 at 20:15
 Rico Rico
 56.9k 12 12 gold badges 107 107 silver badges 138 138 bronze badges
 4
 * 2
 Reading this: github.com/helm/helm/issues/1413 suggests there's a limit of 1mb
 – Lev Kuznetsov
 Oct 26, 2018 at 20:37
 * 1
 Yeah, there's a 1MB limitation from the etcd side, added more details. Thx!
 – Rico
 Oct 26, 2018 at 20:44
 * 1
 thanks , 1 MB limit seems pretty reasonbale , i am thinking of some custom addmission controller to reject a config map request of size larger than X
 – Ijaz Ahmad
 Oct 27, 2018 at 16:26
 * @IjazAhmadKhan no need to as at least from kubectl 1.18, you get an error if cm is larger than 1 MB
 – Oliver
 Jan 3, 2021 at 4:02
 Add a comment |
 4

 The size of the individual configmap is limited to 1mb, according to kubernetes.io:

 A ConfigMap is not designed to hold large chunks of data. The data stored in a ConfigMap cannot exceed 1 MiB. If you need to store settings that are larger than this limit, you may want to consider mounting a volume or use a separate database or file service.

 The quote is taken from here - https://kubernetes.io/docs/concepts/configuration/configmap/#motivation

 Share
 Improve this answer
 Follow
 answered Apr 20, 2021 at 9:47
 victorm1710 victorm1710
 1,105 11 11 silver badges 11 11 bronze badges
 Add a comment |
 -2

 Till date config maps come under object count quota. You can enforce a maximum on number of configmaps. You cant put limits on size of individual config map. As they are not yet included under Storage Resource Quota.

 https://kubernetes.io/docs/concepts/policy/resource-quotas/

 Share
 Improve this answer
 Follow
 edited Oct 26, 2018 at 18:30
 answered Oct 26, 2018 at 18:17
 Shane Warne Shane Warne
 1,186 9 9 silver badges 19 19 bronze badges
 4
 * 1
 I believe his question is about the limit on the ConfigMap size itself not on the number of ConfigMaps you can have on a cluster
 – Rico
 Oct 26, 2018 at 18:23
 * yes @Rico i have mentioned you cant put limits on size of a configmap. I will edit it if it is not clear.
 – Shane Warne
 Oct 26, 2018 at 18:29
 * Thanks , for the size limit I can do maybe custom admission controller for configmap
 – Ijaz Ahmad
 Oct 27, 2018 at 16:27
 * Cool.Let us know how you do it.
 – Shane Warne
 Oct 27, 2018 at 16:44
 Add a comment |

 Your Answer

 Thanks for contributing an answer to Stack Overflow!

 * Please be sure to answer the question. Provide details and share your research!

 But avoid …

 * Asking for help, clarification, or responding to other answers.
 * Making statements based on opinion; back them up with references or personal experience.

 To learn more, see our tips on writing great answers.

 Sign up or log in

 Sign up using Google
 Sign up using Facebook
 Sign up using Email and Password
 Submit

 Post as a guest

 Name
 Email

 Required, but never shown

 Post as a guest

 Name
 Email

 Required, but never shown

 Post Your Answer Discard

 By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

 Not the answer you're looking for? Browse other questions tagged
 * kubernetes
 * openshift
 or ask your own question.

 * The Overflow Blog
 * Why developer experience is the key to better software, straight from the...
 * The frontier of computing: Q&A with IBM quantum computing research
 * Featured on Meta
 * Accessibility Update: Colors
 * 2022: a year in moderation
 * Should we burninate the [balance] tag?
 * Collectives: The next iteration
 * Temporary policy: ChatGPT is banned
 Visit chat

 Linked

 36
 google protobuf maximum size
 15
 How to import custom dashboards to grafana using helm
 3
 Maximum number of elements in map
 0
 How to run binary using kuberneates config-map
 2
 Error from server (RequestEntityTooLarge): Request entity too large: limit is 3145728 while creating a configMap
 1
 What is the max number of ingress objects that can be created in nginx-ingress for kubernetes
 0
 Why do comments in the yaml for Kubernetes ConfigMap count towards the unofficial 1 MB size limit?
 0
 Kubernetes: What is the maximum value of env's count in pod?
 1
 adding common-library files into a configmap, when used with libraries

 Related

 420
 What's the difference between Apache's Mesos and Google's Kubernetes
 217
 Restart pods when configmap updates in Kubernetes?
 132
 Update k8s ConfigMap or Secret without deleting the existing one
 486
 What's the difference between ClusterIP, NodePort and LoadBalancer service types in Kubernetes?
 448
 What's the difference between Docker Compose and Kubernetes?
 3
 Terraform Kubernetes provider with EKS fails on configmap
 1
 Kubernetes HA Setup with External Nginx Loadbalancer or F5 Loadbalancer User "system:anonymous" cannot create nodes at the cluster scope
 1
 Persistence of Configmap in kubernetes
 1
 Can't run Flink in Standalone Kubernetes mode with JobManager HA
 1
 Auto reload configuration changes without restarting pod/container using Kubernetes ConfigMap for application with large number of configuration files

 Hot Network Questions

 * Addition and multiplication are commutative but exponentiation and tetration are not. Do we know why?
 * Why is appending different streams to a file safe?
 * Circuitikz question on how to Let the voltage label go to the left？
 * Determining the optimize lambda in Multi-Objective Optimization
 * Can an aircraft use ram air to generate power while flying?
 * Did JK Rowling ever describe Harry Potter goblins as "hook-nosed"?
 * LWC datatable with custom picklist alignment
 * How to download only certain columns of a binary file using wget?
 * What would be the next logical step after crossbows?
 * DisplayPort downstream limited to 1920×1080
 * Psalm 7:9 and meaning of the word "reins" within the context
 * Sum of Consecutive Squares
 * Can someone choose to not use their “get out of jail free” card?
 * What did Paul McCartney mean by "Oh, yesterday came suddenly"?
 * Why are there 23 members of the grand jury?
 * Why does faster cooling produce smaller grains?
 * Don't repeat yourself
 * Computers lose power, lights dim. I suspect the mains power supply; is there anything I can do?
 * Smallest square that can pack thin digits
 * How to find the safest place to cross a frozen river from a map?
 * Brake Fluid Bleeding Procedure
 * What is the point of Feinting from a distance?
 * Both "fēmina" and "mulier" mean "woman": what's the difference?
 * Compute "negative" version of vector of vectors
 more hot questions
 Question feed

 Subscribe to RSS

 Question feed

 To subscribe to this RSS feed, copy and paste this URL into your RSS reader.

 Stack Overflow

 * Questions
 * Help

 Products

 * Teams
 * Advertising
 * Collectives
 * Talent

 Company

 * About
 * Press
 * Work Here
 * Legal
 * Privacy Policy
 * Terms of Service
 * Contact Us
 * Cookie Settings
 * Cookie Policy

 Stack Exchange Network

 * Technology
 * Culture & recreation
 * Life & arts
 * Science
 * Professional
 * Business
 * API
 * Data
 * Blog
 * Facebook
 * Twitter
 * LinkedIn
 * Instagram

 Site design / logo © 2023 Stack Exchange Inc; user contributions licensed under CC BY-SA. rev 2023.2.6.43222

 Your privacy

 By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.

 Accept all cookies Customize settings
Though resourceQuotas may limit the number of configmaps in a namespace, is there any such option to limit the size of the individual configmap?
I will not like some user to start uploading large text files as configmaps.
What is the max size of ConfigMap etcd support? If there is a reasonable limit on the etcd side, should be fine then.
 
 
 
 
 
 
 
    
 
 
  Ivan Aracki  4,61311 gold badges58 silver badges68 bronze badges
 
 
 
 
 asked Oct 26, 2018 at 16:23
 
 
    
 
 
 
 
 
 
 
 
 
 
 
There are no hard-limits on either the ConfigMap or Secret objects as of this writing. 
There's, however, a 1MB limit from the etcd side which is where Kubernetes stores its objects.
From the API side, if you actually see the API code and the ConfigMap type, you'll see that its data field is Golang map of strings so this appears memory bound and managed at runtime unless somewhere else it gets defined with make(). Technically the max size for the number of keys on hashmap is the map length which is an int and the max value is explained here: Maximum number of elements in map. That would also be the theoretical limit for the value of data as the maximum value for len(string).
If you actually want to get more insights from the API side where the kube-apiserver receives protobufs (or JSON for that matter) you can take a look at the google protobuf maximum size. That will give you some measure as to the limitation of sending the data field through the wire. There may be other limitation from the kube-apiserver itself when it comes to processing any large message.
 
 
 
 answered Oct 26, 2018 at 20:15
 
 
    
 
 
  RicoRico 56.9k12 gold badges107 silver badges138 bronze badges
 
 
 
 4
 
 
 
 
The size of the individual configmap is limited to 1mb, according to kubernetes.io:
A ConfigMap is not designed to hold large chunks of data. The data stored in a ConfigMap cannot exceed 1 MiB. If you need to store settings that are larger than this limit, you may want to consider mounting a volume or use a separate database or file service.
The quote is taken from here - https://kubernetes.io/docs/concepts/configuration/configmap/#motivation 
 
 
 
 answered Apr 20, 2021 at 9:47
 
 
    
 
 
  victorm1710victorm1710 1,10511 silver badges11 bronze badges
 
 
 
 
 
 
 
 
Till date config maps come under object count quota. You can enforce a maximum on number of configmaps. You cant put limits on size of individual config map. As they are not yet included under Storage Resource Quota. 
 https://kubernetes.io/docs/concepts/policy/resource-quotas/ 
 
 
 
 answered Oct 26, 2018 at 18:17
 
 
    
 
 
  Shane WarneShane Warne 1,1869 silver badges19 bronze badges
 
 
 
 4
Kubernetes ConfigMap size limitation
https://stackoverflow.com/questions/53012798/kubernetes-configmap-size-limitation
https://stackoverflow.com/questions/50412837/kubernetes-label-name-63-character-limit
kubernetes label name 63 character limit
2018-05-18
Prateek Jain Prateek Jain 2
<div><div>
 
<div>
 <div>
 <nav>
 <ol>
 
<li>
 <a href="/">
 
 </a>
</li>
 <li>
 <ol>
 <li>Public</li>
 
<li>
 <a href="/questions">
 Questions
 </a>
</li>
 
<li>
 <a href="/tags">
 
 </a>
</li>
 
<li>
 <a href="/users">
 
 </a>
</li>
 
<li>
 <a href="https://stackoverflow.com/jobs/companies?so_medium=stackoverflow&amp;so_source=SiteNav">
 
 </a>
</li>
 <li>
 
 </li>
 
<li>
 <a href="/collectives">
 Explore Collectives
 </a>
</li>
 </ol>
 </li>
 
<li>
 <ol>
 
<li>
 <p>Teams</p>
 <p><strong>Stack Overflow for Teams</strong>
 – Start collaborating and sharing organizational knowledge.
 
 
 <a href="https://try.stackoverflow.co/why-teams/?utm_source=so-owned&amp;utm_medium=side-bar&amp;utm_campaign=campaign-38&amp;utm_content=cta">Create a free Team</a>
 <a href="https://stackoverflow.co/teams">Why Teams?</a>
 </p>
</li>
 <li>
 <p>Teams</p>
 
 </li>
 <li>
 <a href="https://stackoverflowteams.com/teams/create/free?utm_source=so-owned&amp;utm_medium=side-bar&amp;utm_campaign=campaign-38&amp;utm_content=cta">
 
 </a>
 </li>
 </ol>
</li>
 </ol>
 </nav>
 </div>
 <div>
 
 <h5>Collectives™ on Stack Overflow</h5>
 <p>Find centralized, trusted content and collaborate around the technologies you use most.</p>
 <p><a href="/collectives">
 Learn more about Collectives
 </a>
 </p></div>
 
</div>
 <div>
 
 
 <div>
 <p>Asked
 <time>4 years, 8 months ago</time>
 </p>
 
 <p>Viewed
 29k times
 </p>
 </div>
 <div>
 
<div>
 
 
<div>
 
 
 <div>
 <ul><li><a href="/questions/tagged/kubernetes">kubernetes</a></li></ul>
 </div>
 <div>
 <p>
 asked May 18, 2018 at 13:50
 </p>
 <div>
 <a href="/users/2853439/prateek-jain"><p></p></a>
 </div>
 <div>
 <p><a href="/users/2853439/prateek-jain">Prateek Jain</a>Prateek Jain</p><p>2,5934 gold badges30 silver badges40 bronze badges
 </p>
 </div>
</div>
 
</div>
 <p>7</p><div>
 <ul>
 <li>
 
 <div>
 
 <p>Hi, They are just following the requirement of <a href="https://tools.ietf.org/html/rfc1123">RFC-1123</a>. In Simple words, it means that they can’t be more than 63 characters in length or include anything other than lower case letters, numbers, and hyphens.</p>
 <p>May 18, 2018 at 14:11
 </p></div>
 </li>
 <li>
 
 <div>
 
 <p>@SureshVishnoi then I would like to know why this number was chosen in RFC-1123</p>
 <p>May 18, 2018 at 15:09
 </p></div>
 </li>
 <li>
 
 <div>
 
 <p>@SureshVishnoi, I just had a quick glance at it but couldn't find any reason mentioned. right now, reading entire paper is not possible for me. I would try to piggy back on community knowledge.</p>
 <p>May 18, 2018 at 15:18
 </p></div>
 </li>
 <li>
 
 
 </li>
 <li>
 
 
 </li>
 </ul>
	 </div>
 </div>
 <div>
 <div>
 <p>
 </p><h2>
 2 Answers
 
 </h2>
 <p></p>
 
 </div>
 
<div>
 
 
<div>
<p>As <a href="https://stackoverflow.com/users/8803619/suresh-vishnoi">Suresh Vishnoi</a> wrote, it is a global restriction based on <a href="https://www.rfc-editor.org/rfc/rfc1123">RFC-1123</a>.</p>
<p><a href="https://stackoverflow.com/questions/32290167/what-is-the-maximum-length-of-a-dns-name#32294443">Here</a> is a simple explanation of this restriction.</p>
<p><a href="https://github.com/kubernetes/kubernetes/pull/1830">There is</a> a commit in Kubernetes which provides the validation of labels' length.</p>
 </div>
 <p>3</p><div>
 <ul>
 <li>
 
 <div>
 
 <p>This still doesn't explain the reason. <i>Why</i> do labels need to comply with RFC-1123?</p>
 <p>Jul 27, 2020 at 19:07
 </p></div>
 </li>
 <li>
 
 
 </li>
 <li>
 
 <div>
 
 <p>@KarlKFI no questions to pod, service and namespace names: why have <b>labels</b> be so short? As per <a href="https://github.com/kubernetes/kubernetes/issues/1297">github.com/kubernetes/kubernetes/issues/1297</a> there was no <i>technical</i> reason for that, kubernetes dev team just decided to have it.</p>
 <p>Jun 16, 2022 at 6:52
 
 
 
 </p></div>
 </li>
 </ul>
	 </div>
 </div>
 
<div>
 
 
<div>
 
 <div>
<p>Here is design documentation of the kubernetes. The following link provides detail information. </p>
<blockquote>
 <p>rfc1035/rfc1123 label (DNS_LABEL): An alphanumeric (a-z, and 0-9) string, with a maximum length of 63 characters, with the '-' character allowed anywhere except the first or last character, suitable for use as a hostname or segment in a domain name.</p>
</blockquote>
<p><a href="https://github.com/kubernetes/community/blob/master/contributors/design-proposals/architecture/identifiers.md#identifiers-and-names-in-kubernetes">identifiers-and-names-in-kubernetes</a></p>
 </div>
 <div>
 <p>
 answered May 25, 2018 at 12:43
 </p>
 <div>
 <a href="/users/8803619/suresh-vishnoi"><p></p></a>
 </div>
 <div>
 <p><a href="/users/8803619/suresh-vishnoi">Suresh Vishnoi</a>Suresh Vishnoi</p><p>16.5k8 gold badges47 silver badges53 bronze badges
 </p>
 </div>
</div>
 
</div>
 <p>2</p><div>
 <ul>
 <li>
 
 <div>
 
 <p>That means, we cannot have '.' in the hostnames? But I am sure this is allowed: ip-192-168-144-98.ap-southeast-2.compute.internal</p>
 <p>Jul 14, 2022 at 12:31
 </p></div>
 </li>
 <li>
 
 
 </li>
 </ul>
	 </div>
 </div>
 
 <h2>
 
 </h2>
 </div>
 </div>
 
<div>
 
 
 <div>
 <ul>
 <li>
 The Overflow Blog
 </li>
 <li>
 
 
 </li>
 <li>
 
 
 </li>
 <li>
 Featured on Meta
 </li>
 <li>
 
 
 </li>
 <li>
 
 
 </li>
 <li>
 
 
 </li>
 <li>
 
 
 </li>
 <li>
 
 
 </li>
 </ul>
 </div>
 
 
 <div>
	<h4>Linked</h4>
	
</div>
 
 <div>
 <h4>Related</h4>
 
 </div>
 <div>
 <h4>
 <a href="https://stackexchange.com/questions?tab=hot">
 Hot Network Questions
 </a>
 </h4>
 <ul>
 <li>
 <a href="https://stats.stackexchange.com/questions/604400/in-an-underdetermined-linear-regression-setup-why-does-the-residual-sum-of-squa">
 In an underdetermined linear regression setup, why does the residual sum of squares equal 0?
 </a>
 </li>
 <li>
 <a href="https://mathoverflow.net/questions/440157/books-containing-new-results">
 Books containing new results
 </a>
 </li>
 <li>
 <a href="https://mathematica.stackexchange.com/questions/279614/how-do-i-erase-sets-of-solutions-from-solve-based-on-criteria">
 How do I erase sets of solutions from Solve based on criteria?
 </a>
 </li>
 <li>
 <a href="https://diy.stackexchange.com/questions/266260/computers-lose-power-lights-dim-i-suspect-the-mains-power-supply-is-there-any">
 Computers lose power, lights dim. I suspect the mains power supply; is there anything I can do?
 </a>
 </li>
 <li>
 <a href="https://music.stackexchange.com/questions/127277/fingering-dont-stop-me-now-peter-bence">
 Fingering - Don't Stop Me Now - Peter Bence
 </a>
 </li>
 <li>
 <a href="https://space.stackexchange.com/questions/61739/what-changes-to-voyager-could-have-been-made">
 What changes to Voyager could have been made?
 </a>
 </li>
 <li>
 <a href="https://or.stackexchange.com/questions/9872/determining-the-optimize-lambda-in-multi-objective-optimization">
 Determining the optimize lambda in Multi-Objective Optimization
 </a>
 </li>
 <li>
 <a href="https://rpg.stackexchange.com/questions/204536/anydice-highest-1-of-3d6-1d12-function-is-this-correct">
 Anydice: "highest 1 of 3d6 1d12" function. Is this correct?
 </a>
 </li>
 <li>
 <a href="https://diy.stackexchange.com/questions/266230/how-to-modify-a-wooden-fence-to-keep-nubian-goats-from-extending-their-heads-ove">
 how to modify a wooden fence to keep nubian goats from extending their heads over and eating dwarf tree on other side
 </a>
 </li>
 <li>
 <a href="https://scifi.stackexchange.com/questions/271841/the-word-decant-for-clone-generation">
 The word "decant" for clone generation
 </a>
 </li>
 <li>
 <a href="https://puzzling.stackexchange.com/questions/119633/find-the-perimeter-seemingly-unsolvable-problem">
 Find the perimeter (seemingly unsolvable problem)
 </a>
 </li>
 <li>
 <a href="https://physics.stackexchange.com/questions/748823/understanding-how-to-terminate-recurrence-relations-in-quantum-sho">
 Understanding how to terminate recurrence relations in quantum SHO
 </a>
 </li>
 <li>
 <a href="https://japanese.stackexchange.com/questions/98490/what-is-the-difference-between-%e5%86%b7%e3%81%88%e3%82%8b-and-%e5%86%b7%e3%81%88%e3%81%a6%e3%81%84%e3%82%8b">
 What is the difference between 冷える and 冷えている?
 </a>
 </li>
 <li>
 <a href="https://aviation.stackexchange.com/questions/97391/can-a-helicopters-main-rotor-mince-a-human">
 Can a helicopter's main rotor mince a human?
 </a>
 </li>
 <li>
 <a href="https://ell.stackexchange.com/questions/332327/what-did-paul-mccartney-mean-by-oh-yesterday-came-suddenly">
 What did Paul McCartney mean by "Oh, yesterday came suddenly"?
 </a>
 </li>
 <li>
 <a href="https://philosophy.stackexchange.com/questions/96658/do-distinctions-and-concepts-exist">
 Do distinctions and concepts exist?
 </a>
 </li>
 <li>
 <a href="https://unix.stackexchange.com/questions/734449/how-to-download-only-certain-columns-of-a-binary-file-using-wget">
 How to download only certain columns of a binary file using wget?
 </a>
 </li>
 <li>
 <a href="https://astronomy.stackexchange.com/questions/51810/why-is-the-solstice-the-first-day-of-summer-and-not-the-central-day">
 Why is the solstice the first day of summer, and not the central day?
 </a>
 </li>
 <li>
 <a href="https://philosophy.stackexchange.com/questions/96697/what-does-it-mean-for-two-properties-of-objects-to-be-of-the-same-class-or-even">
 What does it mean for two properties of objects to be of the same class (or even identical)?
 </a>
 </li>
 <li>
 <a href="https://security.stackexchange.com/questions/268218/crashing-the-sha1-function-in-php">
 Crashing the sha1() function in PHP?
 </a>
 </li>
 <li>
 <a href="https://history.stackexchange.com/questions/70896/when-did-kievan-rus-rulers-become-culturally-slavic">
 When did Kievan Rus' rulers become culturally Slavic?
 </a>
 </li>
 <li>
 <a href="https://academia.stackexchange.com/questions/193204/is-this-stanford-certificate-real">
 Is this Stanford certificate real?
 </a>
 </li>
 <li>
 <a href="https://diy.stackexchange.com/questions/266305/what-is-the-use-of-alumium-profile-with-led-strip-lighting">
 What is the use of alumium profile with LED strip lighting?
 </a>
 </li>
 <li>
 <a href="https://gaming.stackexchange.com/questions/401503/why-do-pokemon-sometimes-have-dark-stripes-in-pokemon-go">
 Why do Pokemon sometimes have dark stripes in Pokemon Go?
 </a>
 </li>
 </ul>
 <p><a href="#">
 more hot questions
 </a>
</p></div>
 <p>
 <a href="/feeds/question/50412837">
 
 Question feed
 </a>
 </p>
 
</div>
 </div>
 </div><div>
 
 <p>
 Your privacy
 </p>
 <p>
 By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our <a href="https://stackoverflow.com/legal/cookie-policy">Cookie Policy</a>.
 </p>
 
 </div>||||I|||| Stack Overflow
 1. About
 2. Products
 3. For Teams
 1. Stack Overflow Public questions & answers
 2. Stack Overflow for Teams Where developers & technologists share private knowledge with coworkers
 3. Talent Build your employer brand
 4. Advertising Reach developers & technologists worldwide
 5. About the company
 Loading…

 1. current community

 + Stack Overflow
 help chat
 + Meta Stack Overflow

 your communities

 Sign up or log in to customize your list.

 more stack exchange communities

 company blog
 2. 
 3. Log in
 4. Sign up
 1. Home
 2. 
 1. Public
 2. Questions
 3. Tags
 4. Users
 5. Companies
 6. Collectives
 7. Explore Collectives
 3. 
 1. Teams
 Stack Overflow for Teams – Start collaborating and sharing organizational knowledge. Create a free Team Why Teams?
 2. Teams
 3. Create free Team

 Collectives™ on Stack Overflow

 Find centralized, trusted content and collaborate around the technologies you use most.

 Learn more about Collectives

 Teams

 Q&A for work

 Connect and share knowledge within a single location that is structured and easy to search.

 Learn more about Teams

 kubernetes label name 63 character limit

 Ask Question
 Asked 4 years, 8 months ago
 Modified 4 years, 8 months ago
 Viewed 29k times
 22

 As explained at https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ labels name and value have limit of 63 characters. Does anyone know what drives this limit? I am not looking for code condition but the real reason behind choosing this value.

 * kubernetes
 Share
 Improve this question
 Follow
 asked May 18, 2018 at 13:50
 Prateek Jain Prateek Jain
 2,593 4 4 gold badges 30 30 silver badges 40 40 bronze badges
 7
 * 2
 Hi, They are just following the requirement of RFC-1123 . In Simple words, it means that they can’t be more than 63 characters in length or include anything other than lower case letters, numbers, and hyphens.
 – Suresh Vishnoi
 May 18, 2018 at 14:11
 * @SureshVishnoi then I would like to know why this number was chosen in RFC-1123
 – Prateek Jain
 May 18, 2018 at 15:09
 * 1
 @SureshVishnoi, I just had a quick glance at it but couldn't find any reason mentioned. right now, reading entire paper is not possible for me. I would try to piggy back on community knowledge.
 – Prateek Jain
 May 18, 2018 at 15:18
 * 2
 hi, stackoverflow.com/questions/32290167/… Here you can see explanation.
 – Suresh Vishnoi
 May 18, 2018 at 15:26
 * 1
 And Here you can see the commit which changed kubernetes to have 63 characters github.com/kubernetes/kubernetes/pull/1830
 – Suresh Vishnoi
 May 18, 2018 at 15:27
 | Show 2 more comments

 2 Answers

 Sorted by: Reset to default
 Highest score (default) Trending (recent votes count more) Date modified (newest first) Date created (oldest first)
 17

 As Suresh Vishnoi wrote, it is a global restriction based on RFC-1123.

 Here is a simple explanation of this restriction.

 There is a commit in Kubernetes which provides the validation of labels' length.

 Share
 Improve this answer
 Follow
 edited Oct 7, 2021 at 8:14
 community wiki

 2 revs
 Nick Rak
 3
 * This still doesn't explain the reason. Why do labels need to comply with RFC-1123?
 – Andrés Mejía
 Jul 27, 2020 at 19:07
 * 7
 Because Kubernets pod, service, and namespace names are used by kube-dns to create DNS records. kubernetes.io/docs/concepts/services-networking/dns-pod-service
 – KarlKFI
 Dec 10, 2020 at 22:52
 * 1
 @KarlKFI no questions to pod, service and namespace names: why have labels be so short? As per github.com/kubernetes/kubernetes/issues/1297 there was no technical reason for that, kubernetes dev team just decided to have it.
 – zerkms
 Jun 16, 2022 at 6:52
 Add a comment |
 5

 Here is design documentation of the kubernetes. The following link provides detail information.

 rfc1035/rfc1123 label (DNS_LABEL): An alphanumeric (a-z, and 0-9) string, with a maximum length of 63 characters, with the '-' character allowed anywhere except the first or last character, suitable for use as a hostname or segment in a domain name.

 identifiers-and-names-in-kubernetes

 Share
 Improve this answer
 Follow
 answered May 25, 2018 at 12:43
 Suresh Vishnoi Suresh Vishnoi
 16.5k 8 8 gold badges 47 47 silver badges 53 53 bronze badges
 2
 * That means, we cannot have '.' in the hostnames? But I am sure this is allowed: ip-192-168-144-98.ap-southeast-2.compute.internal
 – Muzammil
 Jul 14, 2022 at 12:31
 * I think Dot is special character in the domain name, its allowed to use, check it out here datatracker.ietf.org/doc/html/rfc1035
 – Suresh Vishnoi
 Jul 15, 2022 at 5:55
 Add a comment |

 Your Answer

 Thanks for contributing an answer to Stack Overflow!

 * Please be sure to answer the question. Provide details and share your research!

 But avoid …

 * Asking for help, clarification, or responding to other answers.
 * Making statements based on opinion; back them up with references or personal experience.

 To learn more, see our tips on writing great answers.

 Sign up or log in

 Sign up using Google
 Sign up using Facebook
 Sign up using Email and Password
 Submit

 Post as a guest

 Name
 Email

 Required, but never shown

 Post as a guest

 Name
 Email

 Required, but never shown

 Post Your Answer Discard

 By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

 Not the answer you're looking for? Browse other questions tagged
 * kubernetes
 or ask your own question.

 * The Overflow Blog
 * Announcing more ways to learn and grow your skills
 * Why developer experience is the key to better software, straight from the...
 * Featured on Meta
 * Accessibility Update: Colors
 * 2022: a year in moderation
 * Collectives: The next iteration
 * We’re bringing advertisements for technology courses to Stack Overflow
 * Temporary policy: ChatGPT is banned
 Visit chat

 Linked

 50
 What is the maximum length of a DNS name
 1
 Maximum number of labels created for pods in kubernetes
 0
 Is in the kubernetes API a function to fetch all services by annotations

 Related

 8
 How could I add a new host to the existing Ingress in kubernetes?
 2
 Make pod DNS name resolvable in Kubernetes cluster
 0
 what is the difference in memory pressure and disk pressure in kubernetes
 1
 Getting pod or deployment annotations from Kube-State-Metrics
 7
 What happens if a Kubernetes pod exceeds its memory resources 'limit'?
 1
 How to set pid limit in Kubernetes pod?
 29
 How to list all namespaces in a cluster?
 1
 traefik v2.0 labels with rancher 2.2.8 not allowed
 6
 kubernetes azure nodes exceed max volume count

 Hot Network Questions

 * In an underdetermined linear regression setup, why does the residual sum of squares equal 0?
 * Books containing new results
 * How do I erase sets of solutions from Solve based on criteria?
 * Computers lose power, lights dim. I suspect the mains power supply; is there anything I can do?
 * Fingering - Don't Stop Me Now - Peter Bence
 * What changes to Voyager could have been made?
 * Determining the optimize lambda in Multi-Objective Optimization
 * Anydice: "highest 1 of 3d6 1d12" function. Is this correct?
 * how to modify a wooden fence to keep nubian goats from extending their heads over and eating dwarf tree on other side
 * The word "decant" for clone generation
 * Find the perimeter (seemingly unsolvable problem)
 * Understanding how to terminate recurrence relations in quantum SHO
 * What is the difference between 冷える and 冷えている?
 * Can a helicopter's main rotor mince a human?
 * What did Paul McCartney mean by "Oh, yesterday came suddenly"?
 * Do distinctions and concepts exist?
 * How to download only certain columns of a binary file using wget?
 * Why is the solstice the first day of summer, and not the central day?
 * What does it mean for two properties of objects to be of the same class (or even identical)?
 * Crashing the sha1() function in PHP?
 * When did Kievan Rus' rulers become culturally Slavic?
 * Is this Stanford certificate real?
 * What is the use of alumium profile with LED strip lighting?
 * Why do Pokemon sometimes have dark stripes in Pokemon Go?
 more hot questions
 Question feed

 Subscribe to RSS

 Question feed

 To subscribe to this RSS feed, copy and paste this URL into your RSS reader.

 Stack Overflow

 * Questions
 * Help

 Products

 * Teams
 * Advertising
 * Collectives
 * Talent

 Company

 * About
 * Press
 * Work Here
 * Legal
 * Privacy Policy
 * Terms of Service
 * Contact Us
 * Cookie Settings
 * Cookie Policy

 Stack Exchange Network

 * Technology
 * Culture & recreation
 * Life & arts
 * Science
 * Professional
 * Business
 * API
 * Data
 * Blog
 * Facebook
 * Twitter
 * LinkedIn
 * Instagram

 Site design / logo © 2023 Stack Exchange Inc; user contributions licensed under CC BY-SA. rev 2023.2.3.43216

 Your privacy

 By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.

 Accept all cookies Customize settings
Public
 
 
 Questions
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 Explore Collectives
 
 
 
 
 
 
 Teams
  Stack Overflow for Teams
 – Start collaborating and sharing organizational knowledge.
 
 
 Create a free Team
 Why Teams?
 
 
 Teams
 
 
 
 
 
 
 
 
 
 
 
 
 
 Collectives™ on Stack Overflow
 Find centralized, trusted content and collaborate around the technologies you use most.
  
 Learn more about Collectives
 
  
 
 
 
 
 
 Asked
 4 years, 8 months ago
 
 
 Viewed
 29k times
 
 
 
 
 
 
 
 
 
   kubernetes  
 
 
 
 asked May 18, 2018 at 13:50
 
 
    
 
 
  Prateek JainPrateek Jain 2,5934 gold badges30 silver badges40 bronze badges
 
 
 
 7 
 
 
 
 
 
 Hi, They are just following the requirement of RFC-1123. In Simple words, it means that they can’t be more than 63 characters in length or include anything other than lower case letters, numbers, and hyphens.
 May 18, 2018 at 14:11
  
 
 
 
 
 
 @SureshVishnoi then I would like to know why this number was chosen in RFC-1123
 May 18, 2018 at 15:09
  
 
 
 
 
 
 @SureshVishnoi, I just had a quick glance at it but couldn't find any reason mentioned. right now, reading entire paper is not possible for me. I would try to piggy back on community knowledge.
 May 18, 2018 at 15:18
  
 
 
 
 
 
 
 
 
 
 
	 
 
 
 
 
  
 2 Answers
 
 
  
 
 
 
 
 
As Suresh Vishnoi wrote, it is a global restriction based on RFC-1123.
 Here is a simple explanation of this restriction.
 There is a commit in Kubernetes which provides the validation of labels' length.
 
 3 
 
 
 
 
 
 This still doesn't explain the reason. Why do labels need to comply with RFC-1123?
 Jul 27, 2020 at 19:07
  
 
 
 
 
 
 
 
 
 
 @KarlKFI no questions to pod, service and namespace names: why have labels be so short? As per github.com/kubernetes/kubernetes/issues/1297 there was no technical reason for that, kubernetes dev team just decided to have it.
 Jun 16, 2022 at 6:52
 
 
 
  
 
 
	 
 
 
 
 
 
 
Here is design documentation of the kubernetes. The following link provides detail information. 
 rfc1035/rfc1123 label (DNS_LABEL): An alphanumeric (a-z, and 0-9) string, with a maximum length of 63 characters, with the '-' character allowed anywhere except the first or last character, suitable for use as a hostname or segment in a domain name.
 identifiers-and-names-in-kubernetes 
 
 
 
 answered May 25, 2018 at 12:43
 
 
    
 
 
  Suresh VishnoiSuresh Vishnoi 16.5k8 gold badges47 silver badges53 bronze badges
 
 
 
 2 
 
 
 
 
 
 That means, we cannot have '.' in the hostnames? But I am sure this is allowed: ip-192-168-144-98.ap-southeast-2.compute.internal
 Jul 14, 2022 at 12:31
  
 
 
 
 
 
 
	 
 
 
 
 
 
 
 
 
 
 
 
 
 
 The Overflow Blog
 
 
 
 
 
 
 
 
 
 
 Featured on Meta
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
	Linked
	
 
 
 Related
 
 
 
 
 
 Hot Network Questions
 
 
 
 
 
 In an underdetermined linear regression setup, why does the residual sum of squares equal 0?
 
 
 
 
 Books containing new results
 
 
 
 
 How do I erase sets of solutions from Solve based on criteria?
 
 
 
 
 Computers lose power, lights dim. I suspect the mains power supply; is there anything I can do?
 
 
 
 
 Fingering - Don't Stop Me Now - Peter Bence
 
 
 
 
 What changes to Voyager could have been made?
 
 
 
 
 Determining the optimize lambda in Multi-Objective Optimization
 
 
 
 
 Anydice: "highest 1 of 3d6 1d12" function. Is this correct?
 
 
 
 
 how to modify a wooden fence to keep nubian goats from extending their heads over and eating dwarf tree on other side
 
 
 
 
 The word "decant" for clone generation
 
 
 
 
 Find the perimeter (seemingly unsolvable problem)
 
 
 
 
 Understanding how to terminate recurrence relations in quantum SHO
 
 
 
 
 What is the difference between 冷える and 冷えている?
 
 
 
 
 Can a helicopter's main rotor mince a human?
 
 
 
 
 What did Paul McCartney mean by "Oh, yesterday came suddenly"?
 
 
 
 
 Do distinctions and concepts exist?
 
 
 
 
 How to download only certain columns of a binary file using wget?
 
 
 
 
 Why is the solstice the first day of summer, and not the central day?
 
 
 
 
 What does it mean for two properties of objects to be of the same class (or even identical)?
 
 
 
 
 Crashing the sha1() function in PHP?
 
 
 
 
 When did Kievan Rus' rulers become culturally Slavic?
 
 
 
 
 Is this Stanford certificate real?
 
 
 
 
 What is the use of alumium profile with LED strip lighting?
 
 
 
 
 Why do Pokemon sometimes have dark stripes in Pokemon Go?
 
 
 
  
 more hot questions
 
 
 
 
 
 Question feed
 
 
 
 
  
 
 
 Your privacy
 
 
 By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.
kubernetes label name 63 character limit
https://stackoverflow.com/questions/50412837/kubernetes-label-name-63-character-limit
https://stackoverflow.com/questions/53842574/max-size-of-environment-variables-in-kubernetes
Max size of Environment variables in kubernetes
2018-12-18
AdmiralThrawn AdmiralThrawn
<div><div>
<p>So at bare minimum there is some 1,048,576 byte limitation imposed:</p>
<blockquote>
 <p>The ConfigMap "too-big" is invalid: []: Too long: must have at most 1048576 characters</p>
</blockquote>
<p>which I generated as:</p>
<pre><code>cat &gt; too-big.yml&lt;&lt;FOO
apiVersion: v1
kind: ConfigMap
metadata:
 name: too-big
data:
 kaboom.txt: |
 $(python -c 'print("x" * 1024 * 1024)')
FOO
</code></pre>
<p>And when I try that same stunt with a Pod, I'm met with a very similar outcome:</p>
<pre><code>containers:
- image: ubuntu:18.10
 env:
 - name: TOO_BIG
 value: |
 $(python -c the same print)
</code></pre>
<blockquote>
 <p>standard_init_linux.go:178: exec user process caused "argument list too long"</p>
</blockquote>
<p>So I would guess it's somewhere in between those two numbers: 0 and 1048576</p>
<p>That said, as the <a href="https://stackoverflow.com/questions/1078031/what-is-the-maximum-size-of-an-environment-variable-value">practically duplicate question</a> answered, you are very, very likely solving the wrong problem. The very fact that you have to come to a community site to ask such a question means you are brining risk to your project that it will work one way on Linux, another way on docker, another way on kubernetes, and a different way on macOS.</p>
 </div>||||I|||| Stack Overflow
 1. About
 2. Products
 3. For Teams
 1. Stack Overflow Public questions & answers
 2. Stack Overflow for Teams Where developers & technologists share private knowledge with coworkers
 3. Talent Build your employer brand
 4. Advertising Reach developers & technologists worldwide
 5. About the company
 Loading…

 1. current community

 + Stack Overflow
 help chat
 + Meta Stack Overflow

 your communities

 Sign up or log in to customize your list.

 more stack exchange communities

 company blog
 2. 
 3. Log in
 4. Sign up
 1. Home
 2. 
 1. Public
 2. Questions
 3. Tags
 4. Users
 5. Companies
 6. Collectives
 7. Explore Collectives
 3. 
 1. Teams
 Stack Overflow for Teams – Start collaborating and sharing organizational knowledge. Create a free Team Why Teams?
 2. Teams
 3. Create free Team

 Collectives™ on Stack Overflow

 Find centralized, trusted content and collaborate around the technologies you use most.

 Learn more about Collectives

 Teams

 Q&A for work

 Connect and share knowledge within a single location that is structured and easy to search.

 Learn more about Teams

 Max size of Environment variables in kubernetes

 Ask Question
 Asked 4 years, 1 month ago
 Modified 4 years, 1 month ago
 Viewed 7k times
 4

 What is the max size allowed for Environment variable (pod->container->Env) in kubernetes, assuming base ubuntu containers? I am unable to find the relevant documentation. Question might seem stupid, but, I do need the info to make my design robust.

 * kubernetes
 Share
 Improve this question
 Follow
 asked Dec 18, 2018 at 23:27
 AdmiralThrawn AdmiralThrawn
 374 5 5 silver badges 15 15 bronze badges
 Add a comment |

 1 Answer

 Sorted by: Reset to default
 Highest score (default) Trending (recent votes count more) Date modified (newest first) Date created (oldest first)
 4

 So at bare minimum there is some 1,048,576 byte limitation imposed:

 The ConfigMap "too-big" is invalid: []: Too long: must have at most 1048576 characters

 which I generated as:

 cat > too-big.yml<<FOO
 apiVersion: v1
 kind: ConfigMap
 metadata:
 name: too-big
 data:
 kaboom.txt: |
 $(python -c 'print("x" * 1024 * 1024)')
 FOO
 

 And when I try that same stunt with a Pod, I'm met with a very similar outcome:

 containers:
 - image: ubuntu:18.10
 env:
 - name: TOO_BIG
 value: |
 $(python -c the same print)
 

 standard_init_linux.go:178: exec user process caused "argument list too long"

 So I would guess it's somewhere in between those two numbers: 0 and 1048576

 That said, as the practically duplicate question answered, you are very, very likely solving the wrong problem. The very fact that you have to come to a community site to ask such a question means you are brining risk to your project that it will work one way on Linux, another way on docker, another way on kubernetes, and a different way on macOS.

 Share
 Improve this answer
 Follow
 answered Dec 19, 2018 at 7:17
 mdaniel mdaniel
 29.8k 5 5 gold badges 53 53 silver badges 54 54 bronze badges
 1
 * 1
 Thanks for the response. I do believe 1mb could be the limit - as that is what is getting imposed for secrets and is documented. As far as the problem being solved, it is just a matter of trade-offs of design complexity to reusing existing infrastructure(after knowing their limits - which are currently not documented). I came to stack over flow as that is what k8s troubleshooting guide suggested.
 – AdmiralThrawn
 Dec 19, 2018 at 17:37
 Add a comment |

 Your Answer

 Thanks for contributing an answer to Stack Overflow!

 * Please be sure to answer the question. Provide details and share your research!

 But avoid …

 * Asking for help, clarification, or responding to other answers.
 * Making statements based on opinion; back them up with references or personal experience.

 To learn more, see our tips on writing great answers.

 Sign up or log in

 Sign up using Google
 Sign up using Facebook
 Sign up using Email and Password
 Submit

 Post as a guest

 Name
 Email

 Required, but never shown

 Post as a guest

 Name
 Email

 Required, but never shown

 Post Your Answer Discard

 By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

 Not the answer you're looking for? Browse other questions tagged
 * kubernetes
 or ask your own question.

 * The Overflow Blog
 * Why developer experience is the key to better software, straight from the...
 * The frontier of computing: Q&A with IBM quantum computing research
 * Featured on Meta
 * Accessibility Update: Colors
 * 2022: a year in moderation
 * Should we burninate the [balance] tag?
 * Collectives: The next iteration
 * Temporary policy: ChatGPT is banned

 Linked

 112
 What is the maximum size of a Linux environment variable value?

 Related

 18
 Specify the order Dockers run on Kubernetes pod
 58
 Start kubernetes container with specific command
 21
 How to Send Kubernetes Logs to AWS CloudWatch?
 4
 Environment variables not being resolved in Kubernetes Java deployment
 2
 How to create an environment variable in kubernetes container
 4
 How can I temporarily change an environment variable of a kubernetes pod?
 0
 Kubernetes Pod's containers not running when using sh commands
 5
 How to access Kubernetes container environment variables from React.js application?
 6
 Should we set -Xmx (max java heap size) in a kubernetes container
 0
 Dockerized Spring Boot App Ignoring K8s/Kubernetes Environment Variables

 Hot Network Questions

 * How has the resolution of astronomical spectrographs improved over time?
 * Why is the solstice the first day of summer, and not the central day?
 * Can a helicopter's main rotor mince a human?
 * If a balloon lies within gun range, why would a 21st century warplane shoot it with a missile, instead of rotary guns?
 * Does the iPad Pro M2 (4th generation) support 6Ghz Wi-Fi?
 * The word "decant" for clone generation
 * Find the perimeter (seemingly unsolvable problem)
 * Understanding how to terminate recurrence relations in quantum SHO
 * Some conjectures about prime gaps
 * Don't repeat yourself
 * What did Paul McCartney mean by "Oh, yesterday came suddenly"?
 * Other than looking cooll, what is the reason behind the TSR-2's anhedral wingtips?
 * We don't own the land so is our house nearly worthless?
 * Better midi playback on mac
 * Can poor grades in a bachelor's affect working in academia?
 * What is the point of Feinting from a distance?
 * Is Metapost still relevant in the age of Lua etc.?
 * How to adapt a spoke salvaged from a 26" wheel to a 24" one?
 * What is the use of alumium profile with LED strip lighting?
 * How big of an explosion can you make with a fusion reactor?
 * A journal editor has pretended my referee report actually came from two separate referees
 * Why is witness data downloaded during IBD in prune mode?
 * 2 tabulars with supposed same size aren't actually the same size
 * Why are ordinary spheres not strictly invertible?
 more hot questions
 Question feed

 Subscribe to RSS

 Question feed

 To subscribe to this RSS feed, copy and paste this URL into your RSS reader.

 Stack Overflow

 * Questions
 * Help

 Products

 * Teams
 * Advertising
 * Collectives
 * Talent

 Company

 * About
 * Press
 * Work Here
 * Legal
 * Privacy Policy
 * Terms of Service
 * Contact Us
 * Cookie Settings
 * Cookie Policy

 Stack Exchange Network

 * Technology
 * Culture & recreation
 * Life & arts
 * Science
 * Professional
 * Business
 * API
 * Data
 * Blog
 * Facebook
 * Twitter
 * LinkedIn
 * Instagram

 Site design / logo © 2023 Stack Exchange Inc; user contributions licensed under CC BY-SA. rev 2023.2.6.43221

 Your privacy

 By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.

 Accept all cookies Customize settings
So at bare minimum there is some 1,048,576 byte limitation imposed:
 The ConfigMap "too-big" is invalid: []: Too long: must have at most 1048576 characters
which I generated as:
 cat &gt; too-big.yml&lt;&lt;FOO
apiVersion: v1
kind: ConfigMap
metadata:
 name: too-big
data:
 kaboom.txt: |
 $(python -c 'print("x" * 1024 * 1024)')
FOO
 
And when I try that same stunt with a Pod, I'm met with a very similar outcome:
 containers:
- image: ubuntu:18.10
 env:
 - name: TOO_BIG
 value: |
 $(python -c the same print)
 
 standard_init_linux.go:178: exec user process caused "argument list too long"
So I would guess it's somewhere in between those two numbers: 0 and 1048576
That said, as the practically duplicate question answered, you are very, very likely solving the wrong problem. The very fact that you have to come to a community site to ask such a question means you are brining risk to your project that it will work one way on Linux, another way on docker, another way on kubernetes, and a different way on macOS.
Max size of Environment variables in kubernetes
https://stackoverflow.com/questions/53842574/max-size-of-environment-variables-in-kubernetes
https://stackoverflow.com/questions/65729884/kubernetes-what-is-the-maximum-value-of-envs-count-in-pod
Kubernetes: What is the maximum value of env's count in pod?
2021-01-15
Y Thomas Y Thomas
<div><div>
<p>There is no limits for env's count in pod. You are not limited by count/numbet/etc - you are limited by memory itself.</p>
<p>What you have in any linux os, is <a href="https://linux.die.net/man/2/execve">execve</a>. There are no shortcuts for different sections, your one is <strong>Limits on size of arguments and environment</strong></p>
<blockquote>
<p><strong>Most UNIX implementations impose some limit on the total size of the
command-line argument (argv) and environment (envp) strings that may
be passed to a new program.</strong> POSIX.1 allows an implementation to
advertise this limit using the <strong>ARG_MAX constant</strong> (either defined in
&lt;limits.h&gt; or available at run time using the call
sysconf(_SC_ARG_MAX)). <strong>On Linux prior to kernel 2.6.23, the memory
used to store the environment and argument strings was limited to 32
pages (defined by the kernel constant MAX_ARG_PAGES). On architectures
with a 4-kB page size, this yields a maximum size of 128 kB.</strong></p>
<p><strong>On kernel 2.6.23 and later, most architectures support a size limit
derived from the soft RLIMIT_STACK resource limit</strong> (see getrlimit(2))
that is in force at the time of the execve() call. (Architectures with
no memory management unit are excepted: they maintain the limit that
was in effect before kernel 2.6.23.) This change allows programs to
have a much larger argument and/or environment list. For these
architectures, the total size is limited to 1/4 of the allowed stack
size. (Imposing the 1/4-limit ensures that the new program always has
some stack space.) Since Linux 2.6.25, the kernel places a floor of 32
pages on this size limit, so that, even when RLIMIT_STACK is set very
low, applications are guaranteed to have at least as much argument and
environment space as was provided by Linux 2.6.23 and earlier. (This
guarantee was not provided in Linux 2.6.23 and 2.6.24.) Additionally,
the limit per string is 32 pages (the kernel constant MAX_ARG_STRLEN),
and the maximum number of strings is 0x7FFFFFFF.</p>
</blockquote>
<p>So, in 2 words,</p>
<ul>
<li><p>On Linux prior to kernel 2.6.23: maximum size of 128 kB</p>
</li>
<li><p>On kernel 2.6.23 and later: most architectures support a size limit derived from the soft <code>RLIMIT_STACK</code> resource</p>
</li>
</ul>
<p>What I also think - there is a limit in 1MB of etcd(this is a place where kubernetes keeps all objects). So in case you use configmaps - you have to remember about this limitation. Limit 1MB is etcd limit itself.</p>
<p>Urls to check:</p>
<ol>
<li><p><a href="https://github.com/kubernetes/kubernetes/issues/19781">Size limit for ConfigMap</a></p>
</li>
<li><p>@Rico answer on stack: <a href="https://stackoverflow.com/a/53015758/9929015">Kubernetes ConfigMap size limitation</a></p>
</li>
</ol>
 </div>||||I|||| Stack Overflow
 1. About
 2. Products
 3. For Teams
 1. Stack Overflow Public questions & answers
 2. Stack Overflow for Teams Where developers & technologists share private knowledge with coworkers
 3. Talent Build your employer brand
 4. Advertising Reach developers & technologists worldwide
 5. About the company
 Loading…

 1. current community

 + Stack Overflow
 help chat
 + Meta Stack Overflow

 your communities

 Sign up or log in to customize your list.

 more stack exchange communities

 company blog
 2. 
 3. Log in
 4. Sign up
 1. Home
 2. 
 1. Public
 2. Questions
 3. Tags
 4. Users
 5. Companies
 6. Collectives
 7. Explore Collectives
 3. 
 1. Teams
 Stack Overflow for Teams – Start collaborating and sharing organizational knowledge. Create a free Team Why Teams?
 2. Teams
 3. Create free Team

 Collectives™ on Stack Overflow

 Find centralized, trusted content and collaborate around the technologies you use most.

 Learn more about Collectives

 Teams

 Q&A for work

 Connect and share knowledge within a single location that is structured and easy to search.

 Learn more about Teams

 Kubernetes: What is the maximum value of env's count in pod?

 Ask Question
 Asked 2 years ago
 Modified 2 years ago
 Viewed 936 times
 0

 Kubernetes: What is the maximum value of env's count in pod? I found a option in pod.Spec 'enableServiceLinks' which default true, but the pod has more envs when enableServiceLinks=true. So I set it to false, things get better. I want to know, how much envs can exist in a pod?

 * kubernetes
 * kubernetes-pod
 Share
 Follow
 asked Jan 15, 2021 at 3:00
 Y.Thomas Y.Thomas
 5 3 3 bronze badges
 2
 * can you please add more information and clarify the question. To be honest i didnt understood in the end what exactly you want: max size of one env or total count? I feel this is about total count, but better to double check. also provide pods yaml and what you have for now
 – Vit
 Jan 15, 2021 at 9:47
 * provide example
 – Vit
 Jan 15, 2021 at 10:05
 Add a comment |

 1 Answer

 Sorted by: Reset to default
 Highest score (default) Trending (recent votes count more) Date modified (newest first) Date created (oldest first)
 0

 There is no limits for env's count in pod. You are not limited by count/numbet/etc - you are limited by memory itself.

 What you have in any linux os, is execve. There are no shortcuts for different sections, your one is Limits on size of arguments and environment

 Most UNIX implementations impose some limit on the total size of the command-line argument (argv) and environment (envp) strings that may be passed to a new program. POSIX.1 allows an implementation to advertise this limit using the ARG_MAX constant (either defined in <limits.h> or available at run time using the call sysconf(_SC_ARG_MAX)). On Linux prior to kernel 2.6.23, the memory used to store the environment and argument strings was limited to 32 pages (defined by the kernel constant MAX_ARG_PAGES). On architectures with a 4-kB page size, this yields a maximum size of 128 kB.

 On kernel 2.6.23 and later, most architectures support a size limit derived from the soft RLIMIT_STACK resource limit (see getrlimit(2)) that is in force at the time of the execve() call. (Architectures with no memory management unit are excepted: they maintain the limit that was in effect before kernel 2.6.23.) This change allows programs to have a much larger argument and/or environment list. For these architectures, the total size is limited to 1/4 of the allowed stack size. (Imposing the 1/4-limit ensures that the new program always has some stack space.) Since Linux 2.6.25, the kernel places a floor of 32 pages on this size limit, so that, even when RLIMIT_STACK is set very low, applications are guaranteed to have at least as much argument and environment space as was provided by Linux 2.6.23 and earlier. (This guarantee was not provided in Linux 2.6.23 and 2.6.24.) Additionally, the limit per string is 32 pages (the kernel constant MAX_ARG_STRLEN), and the maximum number of strings is 0x7FFFFFFF.

 So, in 2 words,

 * On Linux prior to kernel 2.6.23: maximum size of 128 kB

 * On kernel 2.6.23 and later: most architectures support a size limit derived from the soft RLIMIT_STACK resource

 What I also think - there is a limit in 1MB of etcd(this is a place where kubernetes keeps all objects). So in case you use configmaps - you have to remember about this limitation. Limit 1MB is etcd limit itself.

 Urls to check:

 1. Size limit for ConfigMap

 2. @Rico answer on stack: Kubernetes ConfigMap size limitation

 Share
 Follow
 answered Jan 26, 2021 at 17:19
 Vit Vit
 7,367 14 14 silver badges 39 39 bronze badges
 Add a comment |

 Your Answer

 Thanks for contributing an answer to Stack Overflow!

 * Please be sure to answer the question. Provide details and share your research!

 But avoid …

 * Asking for help, clarification, or responding to other answers.
 * Making statements based on opinion; back them up with references or personal experience.

 To learn more, see our tips on writing great answers.

 Sign up or log in

 Sign up using Google
 Sign up using Facebook
 Sign up using Email and Password
 Submit

 Post as a guest

 Name
 Email

 Required, but never shown

 Post as a guest

 Name
 Email

 Required, but never shown

 Post Your Answer Discard

 By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

 Not the answer you're looking for? Browse other questions tagged
 * kubernetes
 * kubernetes-pod
 or ask your own question.

 * The Overflow Blog
 * Announcing more ways to learn and grow your skills
 * Why developer experience is the key to better software, straight from the...
 * Featured on Meta
 * Accessibility Update: Colors
 * 2022: a year in moderation
 * Collectives: The next iteration
 * We’re bringing advertisements for technology courses to Stack Overflow
 * Temporary policy: ChatGPT is banned

 Linked

 23
 Kubernetes ConfigMap size limitation

 Related

 52
 How do I run curl command from within a Kubernetes pod
 370
 What is the difference between a pod and a deployment?
 25
 How can I determine the current ephemeral-storage usage of a running Kubernetes pod?
 171
 Checking kubernetes pod CPU and memory
 2
 Kubernetes Pod Security Policy Default Privileged Value
 156
 Decoding Kubernetes secret
 6
 What is the default memory allocated for a pod
 8
 Editing Kubernetes pod on-the-fly
 1
 Kubernetes pod priority
 0
 Kubernetes scheduling ignores pod count per worker node

 Hot Network Questions

 * Can an aircraft use ram air to generate power while flying?
 * Why did Harry and the others think they could rescue Sirius?
 * How do we use lowercase `\mathcal` or `\mathscr` in latex overleaf?
 * Agile Principles: What does it mean sustainable development?
 * Can a vampire rest in a coffin in a bag of holding?
 * Do distinctions and concepts exist?
 * Juvenile SF Novel With Conflict between Earth Humans and Colonists
 * Intel 80188 & 8087 clock frequency differences
 * If a balloon lies within gun range, why would a 21st century warplane shoot it with a missile, instead of rotary guns?
 * Yakko's New World Order
 * Grant number and acknowledgment
 * Are some emergent properties non-falsifiable by science?
 * At what point does combining integrated circuits yield something patentable?
 * Does a creature with natural attacks need Improved Unarmed Strike to get Improved Grapple?
 * What is the mechanical advantage of a Beast Barbarian's form?
 * What changes to Voyager could have been made?
 * How to download only certain columns of a binary file using wget?
 * Table of unequal sequence
 * Two questions about the 4th verse of "The Star-Spangled Banner"
 * EAS Build iOS Failure: Authentication with Apple Developer Portal failed
 * adjust horizontal spacing in array environment
 * Addition and multiplication are commutative but exponentiation and tetration are not. Do we know why?
 * Sum of Consecutive Squares
 * Inconsistent interline spacing in enumitem
 more hot questions
 Question feed

 Subscribe to RSS

 Question feed

 To subscribe to this RSS feed, copy and paste this URL into your RSS reader.

 Stack Overflow

 * Questions
 * Help

 Products

 * Teams
 * Advertising
 * Collectives
 * Talent

 Company

 * About
 * Press
 * Work Here
 * Legal
 * Privacy Policy
 * Terms of Service
 * Contact Us
 * Cookie Settings
 * Cookie Policy

 Stack Exchange Network

 * Technology
 * Culture & recreation
 * Life & arts
 * Science
 * Professional
 * Business
 * API
 * Data
 * Blog
 * Facebook
 * Twitter
 * LinkedIn
 * Instagram

 Site design / logo © 2023 Stack Exchange Inc; user contributions licensed under CC BY-SA. rev 2023.2.3.43216

 Your privacy

 By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.

 Accept all cookies Customize settings
There is no limits for env's count in pod. You are not limited by count/numbet/etc - you are limited by memory itself.
What you have in any linux os, is execve. There are no shortcuts for different sections, your one is Limits on size of arguments and environment 
 Most UNIX implementations impose some limit on the total size of the
command-line argument (argv) and environment (envp) strings that may
be passed to a new program. POSIX.1 allows an implementation to
advertise this limit using the ARG_MAX constant (either defined in
&lt;limits.h&gt; or available at run time using the call
sysconf(_SC_ARG_MAX)). On Linux prior to kernel 2.6.23, the memory
used to store the environment and argument strings was limited to 32
pages (defined by the kernel constant MAX_ARG_PAGES). On architectures
with a 4-kB page size, this yields a maximum size of 128 kB. 
 On kernel 2.6.23 and later, most architectures support a size limit
derived from the soft RLIMIT_STACK resource limit (see getrlimit(2))
that is in force at the time of the execve() call. (Architectures with
no memory management unit are excepted: they maintain the limit that
was in effect before kernel 2.6.23.) This change allows programs to
have a much larger argument and/or environment list. For these
architectures, the total size is limited to 1/4 of the allowed stack
size. (Imposing the 1/4-limit ensures that the new program always has
some stack space.) Since Linux 2.6.25, the kernel places a floor of 32
pages on this size limit, so that, even when RLIMIT_STACK is set very
low, applications are guaranteed to have at least as much argument and
environment space as was provided by Linux 2.6.23 and earlier. (This
guarantee was not provided in Linux 2.6.23 and 2.6.24.) Additionally,
the limit per string is 32 pages (the kernel constant MAX_ARG_STRLEN),
and the maximum number of strings is 0x7FFFFFFF.
So, in 2 words,
 On Linux prior to kernel 2.6.23: maximum size of 128 kB
 On kernel 2.6.23 and later: most architectures support a size limit derived from the soft RLIMIT_STACK resource
What I also think - there is a limit in 1MB of etcd(this is a place where kubernetes keeps all objects). So in case you use configmaps - you have to remember about this limitation. Limit 1MB is etcd limit itself.
Urls to check:
  Size limit for ConfigMap 
 @Rico answer on stack: Kubernetes ConfigMap size limitation
Kubernetes: What is the maximum value of env's count in pod?
https://stackoverflow.com/questions/65729884/kubernetes-what-is-the-maximum-value-of-envs-count-in-pod
https://stackoverflow.com/questions/53012798/kubernetes-configmap-size-limitation
Kubernetes ConfigMap size limitation
2019-08-01
Ijaz Ahmad Ijaz Ahmad
<div><div>
 
<div>
 
 <div>
 
<p>Though <code>resourceQuotas</code> may limit the number of configmaps in a namespace, is there any such option to limit the size of the individual configmap?
I will not like some user to start uploading large text files as configmaps.</p>
<p>What is the max size of ConfigMap etcd support? If there is a reasonable limit on the etcd side, should be fine then.</p>
 </div>
 
 <div>
 
 <div>
 
 <div>
 <a href="/users/2884309/ivan-aracki"><p></p></a>
 </div>
 <div>
 <p><a href="/users/2884309/ivan-aracki">Ivan Aracki</a></p><p>4,61311 gold badges58 silver badges68 bronze badges
 </p>
 </div>
</div>
 <div>
 <p>
 asked Oct 26, 2018 at 16:23
 </p>
 <div>
 <a href="/users/4550110/ijaz-ahmad"><p></p></a>
 </div>
 
</div>
 </div>
 
</div>
 <div>
 
 
<div>
 
 
<div>
 
 <div>
<p>There are no <a href="https://github.com/kubernetes/kubernetes/issues/19969">hard-limits</a> on either the ConfigMap or Secret objects as of this writing. </p>
<p>There's, however, a 1MB limit from the <a href="https://github.com/kubernetes/kubernetes/issues/19781">etcd</a> side which is where Kubernetes stores its objects.</p>
<p>From the API side, if you actually see the API <a href="https://github.com/kubernetes/api/blob/master/core/v1/types.go#L5027">code</a> and the ConfigMap type, you'll see that its <a href="https://github.com/kubernetes/api/blob/master/core/v1/types.go#L5040">data</a> field is Golang map of strings so this appears memory bound and managed at runtime unless somewhere else it gets defined with <code>make()</code>. Technically the max size for the number of keys on hashmap is the map length which is an <code>int</code> and the max value is explained here: <a href="https://stackoverflow.com/questions/32600763/maximum-number-of-elements-in-map">Maximum number of elements in map</a>. That would also be the theoretical limit for the value of data as the maximum value for <code>len(string)</code>.</p>
<p>If you actually want to get more insights from the API side where the kube-apiserver receives protobufs (or JSON for that matter) you can take a look at the <a href="https://stackoverflow.com/questions/34128872/google-protobuf-maximum-size">google protobuf maximum size</a>. That will give you some measure as to the limitation of sending the <code>data</code> field through the wire. There may be other limitation from the kube-apiserver itself when it comes to processing any large message.</p>
 </div>
 <div>
 <p>
 answered Oct 26, 2018 at 20:15
 </p>
 <div>
 <a href="/users/2989261/rico"><p></p></a>
 </div>
 <div>
 <p><a href="/users/2989261/rico">Rico</a>Rico</p><p>56.9k12 gold badges107 silver badges138 bronze badges
 </p>
 </div>
</div>
 
</div>
 <p>4</p>
 </div>
 
<div>
 
 <div>
<p>The size of the individual configmap is limited to 1mb, according to kubernetes.io:</p>
<blockquote>
<p>A ConfigMap is not designed to hold large chunks of data. The data stored in a ConfigMap cannot exceed 1 MiB. If you need to store settings that are larger than this limit, you may want to consider mounting a volume or use a separate database or file service.</p>
</blockquote>
<p>The quote is taken from here - <a href="https://kubernetes.io/docs/concepts/configuration/configmap/#motivation">https://kubernetes.io/docs/concepts/configuration/configmap/#motivation</a></p>
 </div>
 <div>
 <p>
 answered Apr 20, 2021 at 9:47
 </p>
 <div>
 <a href="/users/680032/victorm1710"><p></p></a>
 </div>
 <div>
 <p><a href="/users/680032/victorm1710">victorm1710</a>victorm1710</p><p>1,10511 silver badges11 bronze badges
 </p>
 </div>
</div>
 
</div>
 
<div>
 
 
<div>
 
 <div>
<p>Till date config maps come under object count quota. You can enforce a maximum on number of configmaps. You cant put limits on size of individual config map. As they are not yet included under Storage Resource Quota. </p>
<p><a href="https://kubernetes.io/docs/concepts/policy/resource-quotas/">https://kubernetes.io/docs/concepts/policy/resource-quotas/</a></p>
 </div>
 <div>
 <p>
 answered Oct 26, 2018 at 18:17
 </p>
 <div>
 <a href="/users/8856029/shane-warne"><p></p></a>
 </div>
 <div>
 <p><a href="/users/8856029/shane-warne">Shane Warne</a>Shane Warne</p><p>1,1869 silver badges19 bronze badges
 </p>
 </div>
</div>
 
</div>
 <p>4</p>
 </div>
 
 <h2>
 
 </h2>
 </div>
 </div>||||I|||| Stack Overflow
 1. About
 2. Products
 3. For Teams
 1. Stack Overflow Public questions & answers
 2. Stack Overflow for Teams Where developers & technologists share private knowledge with coworkers
 3. Talent Build your employer brand
 4. Advertising Reach developers & technologists worldwide
 5. About the company
 Loading…

 1. current community

 + Stack Overflow
 help chat
 + Meta Stack Overflow

 your communities

 Sign up or log in to customize your list.

 more stack exchange communities

 company blog
 2. 
 3. Log in
 4. Sign up
 1. Home
 2. 
 1. Public
 2. Questions
 3. Tags
 4. Users
 5. Companies
 6. Collectives
 7. Explore Collectives
 3. 
 1. Teams
 Stack Overflow for Teams – Start collaborating and sharing organizational knowledge. Create a free Team Why Teams?
 2. Teams
 3. Create free Team

 Collectives™ on Stack Overflow

 Find centralized, trusted content and collaborate around the technologies you use most.

 Learn more about Collectives

 Teams

 Q&A for work

 Connect and share knowledge within a single location that is structured and easy to search.

 Learn more about Teams

 Kubernetes ConfigMap size limitation

 Ask Question
 Asked 4 years, 3 months ago
 Modified 1 year, 9 months ago
 Viewed 29k times
 23

 Though resourceQuotas may limit the number of configmaps in a namespace, is there any such option to limit the size of the individual configmap? I will not like some user to start uploading large text files as configmaps.

 What is the max size of ConfigMap etcd support? If there is a reasonable limit on the etcd side, should be fine then.

 * kubernetes
 * openshift
 Share
 Improve this question
 Follow
 edited Aug 1, 2019 at 7:06
 Ivan Aracki
 4,613 11 11 gold badges 58 58 silver badges 68 68 bronze badges
 asked Oct 26, 2018 at 16:23
 Ijaz Ahmad Ijaz Ahmad
 10.7k 8 8 gold badges 48 48 silver badges 69 69 bronze badges
 Add a comment |

 3 Answers

 Sorted by: Reset to default
 Highest score (default) Trending (recent votes count more) Date modified (newest first) Date created (oldest first)
 35

 There are no hard-limits on either the ConfigMap or Secret objects as of this writing.

 There's, however, a 1MB limit from the etcd side which is where Kubernetes stores its objects.

 From the API side, if you actually see the API code and the ConfigMap type, you'll see that its data field is Golang map of strings so this appears memory bound and managed at runtime unless somewhere else it gets defined with make(). Technically the max size for the number of keys on hashmap is the map length which is an int and the max value is explained here: Maximum number of elements in map. That would also be the theoretical limit for the value of data as the maximum value for len(string).

 If you actually want to get more insights from the API side where the kube-apiserver receives protobufs (or JSON for that matter) you can take a look at the google protobuf maximum size. That will give you some measure as to the limitation of sending the data field through the wire. There may be other limitation from the kube-apiserver itself when it comes to processing any large message.

 Share
 Improve this answer
 Follow
 edited Oct 26, 2018 at 20:43
 answered Oct 26, 2018 at 20:15
 Rico Rico
 56.9k 12 12 gold badges 107 107 silver badges 138 138 bronze badges
 4
 * 2
 Reading this: github.com/helm/helm/issues/1413 suggests there's a limit of 1mb
 – Lev Kuznetsov
 Oct 26, 2018 at 20:37
 * 1
 Yeah, there's a 1MB limitation from the etcd side, added more details. Thx!
 – Rico
 Oct 26, 2018 at 20:44
 * 1
 thanks , 1 MB limit seems pretty reasonbale , i am thinking of some custom addmission controller to reject a config map request of size larger than X
 – Ijaz Ahmad
 Oct 27, 2018 at 16:26
 * @IjazAhmadKhan no need to as at least from kubectl 1.18, you get an error if cm is larger than 1 MB
 – Oliver
 Jan 3, 2021 at 4:02
 Add a comment |
 4

 The size of the individual configmap is limited to 1mb, according to kubernetes.io:

 A ConfigMap is not designed to hold large chunks of data. The data stored in a ConfigMap cannot exceed 1 MiB. If you need to store settings that are larger than this limit, you may want to consider mounting a volume or use a separate database or file service.

 The quote is taken from here - https://kubernetes.io/docs/concepts/configuration/configmap/#motivation

 Share
 Improve this answer
 Follow
 answered Apr 20, 2021 at 9:47
 victorm1710 victorm1710
 1,105 11 11 silver badges 11 11 bronze badges
 Add a comment |
 -2

 Till date config maps come under object count quota. You can enforce a maximum on number of configmaps. You cant put limits on size of individual config map. As they are not yet included under Storage Resource Quota.

 https://kubernetes.io/docs/concepts/policy/resource-quotas/

 Share
 Improve this answer
 Follow
 edited Oct 26, 2018 at 18:30
 answered Oct 26, 2018 at 18:17
 Shane Warne Shane Warne
 1,186 9 9 silver badges 19 19 bronze badges
 4
 * 1
 I believe his question is about the limit on the ConfigMap size itself not on the number of ConfigMaps you can have on a cluster
 – Rico
 Oct 26, 2018 at 18:23
 * yes @Rico i have mentioned you cant put limits on size of a configmap. I will edit it if it is not clear.
 – Shane Warne
 Oct 26, 2018 at 18:29
 * Thanks , for the size limit I can do maybe custom admission controller for configmap
 – Ijaz Ahmad
 Oct 27, 2018 at 16:27
 * Cool.Let us know how you do it.
 – Shane Warne
 Oct 27, 2018 at 16:44
 Add a comment |

 Your Answer

 Thanks for contributing an answer to Stack Overflow!

 * Please be sure to answer the question. Provide details and share your research!

 But avoid …

 * Asking for help, clarification, or responding to other answers.
 * Making statements based on opinion; back them up with references or personal experience.

 To learn more, see our tips on writing great answers.

 Sign up or log in

 Sign up using Google
 Sign up using Facebook
 Sign up using Email and Password
 Submit

 Post as a guest

 Name
 Email

 Required, but never shown

 Post as a guest

 Name
 Email

 Required, but never shown

 Post Your Answer Discard

 By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

 Not the answer you're looking for? Browse other questions tagged
 * kubernetes
 * openshift
 or ask your own question.

 * The Overflow Blog
 * Why developer experience is the key to better software, straight from the...
 * The frontier of computing: Q&A with IBM quantum computing research
 * Featured on Meta
 * Accessibility Update: Colors
 * 2022: a year in moderation
 * Should we burninate the [balance] tag?
 * Collectives: The next iteration
 * Temporary policy: ChatGPT is banned
 Visit chat

 Linked

 36
 google protobuf maximum size
 15
 How to import custom dashboards to grafana using helm
 3
 Maximum number of elements in map
 0
 How to run binary using kuberneates config-map
 2
 Error from server (RequestEntityTooLarge): Request entity too large: limit is 3145728 while creating a configMap
 1
 What is the max number of ingress objects that can be created in nginx-ingress for kubernetes
 0
 Why do comments in the yaml for Kubernetes ConfigMap count towards the unofficial 1 MB size limit?
 0
 Kubernetes: What is the maximum value of env's count in pod?
 1
 adding common-library files into a configmap, when used with libraries

 Related

 420
 What's the difference between Apache's Mesos and Google's Kubernetes
 217
 Restart pods when configmap updates in Kubernetes?
 132
 Update k8s ConfigMap or Secret without deleting the existing one
 486
 What's the difference between ClusterIP, NodePort and LoadBalancer service types in Kubernetes?
 448
 What's the difference between Docker Compose and Kubernetes?
 3
 Terraform Kubernetes provider with EKS fails on configmap
 1
 Kubernetes HA Setup with External Nginx Loadbalancer or F5 Loadbalancer User "system:anonymous" cannot create nodes at the cluster scope
 1
 Persistence of Configmap in kubernetes
 1
 Can't run Flink in Standalone Kubernetes mode with JobManager HA
 1
 Auto reload configuration changes without restarting pod/container using Kubernetes ConfigMap for application with large number of configuration files

 Hot Network Questions

 * Addition and multiplication are commutative but exponentiation and tetration are not. Do we know why?
 * Why is appending different streams to a file safe?
 * Circuitikz question on how to Let the voltage label go to the left？
 * Determining the optimize lambda in Multi-Objective Optimization
 * Can an aircraft use ram air to generate power while flying?
 * Did JK Rowling ever describe Harry Potter goblins as "hook-nosed"?
 * LWC datatable with custom picklist alignment
 * How to download only certain columns of a binary file using wget?
 * What would be the next logical step after crossbows?
 * DisplayPort downstream limited to 1920×1080
 * Psalm 7:9 and meaning of the word "reins" within the context
 * Sum of Consecutive Squares
 * Can someone choose to not use their “get out of jail free” card?
 * What did Paul McCartney mean by "Oh, yesterday came suddenly"?
 * Why are there 23 members of the grand jury?
 * Why does faster cooling produce smaller grains?
 * Don't repeat yourself
 * Computers lose power, lights dim. I suspect the mains power supply; is there anything I can do?
 * Smallest square that can pack thin digits
 * How to find the safest place to cross a frozen river from a map?
 * Brake Fluid Bleeding Procedure
 * What is the point of Feinting from a distance?
 * Both "fēmina" and "mulier" mean "woman": what's the difference?
 * Compute "negative" version of vector of vectors
 more hot questions
 Question feed

 Subscribe to RSS

 Question feed

 To subscribe to this RSS feed, copy and paste this URL into your RSS reader.

 Stack Overflow

 * Questions
 * Help

 Products

 * Teams
 * Advertising
 * Collectives
 * Talent

 Company

 * About
 * Press
 * Work Here
 * Legal
 * Privacy Policy
 * Terms of Service
 * Contact Us
 * Cookie Settings
 * Cookie Policy

 Stack Exchange Network

 * Technology
 * Culture & recreation
 * Life & arts
 * Science
 * Professional
 * Business
 * API
 * Data
 * Blog
 * Facebook
 * Twitter
 * LinkedIn
 * Instagram

 Site design / logo © 2023 Stack Exchange Inc; user contributions licensed under CC BY-SA. rev 2023.2.6.43222

 Your privacy

 By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.

 Accept all cookies Customize settings
Though resourceQuotas may limit the number of configmaps in a namespace, is there any such option to limit the size of the individual configmap?
I will not like some user to start uploading large text files as configmaps.
What is the max size of ConfigMap etcd support? If there is a reasonable limit on the etcd side, should be fine then.
 
 
 
 
 
 
 
    
 
 
  Ivan Aracki  4,61311 gold badges58 silver badges68 bronze badges
 
 
 
 
 asked Oct 26, 2018 at 16:23
 
 
    
 
 
 
 
 
 
 
 
 
 
 
There are no hard-limits on either the ConfigMap or Secret objects as of this writing. 
There's, however, a 1MB limit from the etcd side which is where Kubernetes stores its objects.
From the API side, if you actually see the API code and the ConfigMap type, you'll see that its data field is Golang map of strings so this appears memory bound and managed at runtime unless somewhere else it gets defined with make(). Technically the max size for the number of keys on hashmap is the map length which is an int and the max value is explained here: Maximum number of elements in map. That would also be the theoretical limit for the value of data as the maximum value for len(string).
If you actually want to get more insights from the API side where the kube-apiserver receives protobufs (or JSON for that matter) you can take a look at the google protobuf maximum size. That will give you some measure as to the limitation of sending the data field through the wire. There may be other limitation from the kube-apiserver itself when it comes to processing any large message.
 
 
 
 answered Oct 26, 2018 at 20:15
 
 
    
 
 
  RicoRico 56.9k12 gold badges107 silver badges138 bronze badges
 
 
 
 4
 
 
 
 
The size of the individual configmap is limited to 1mb, according to kubernetes.io:
A ConfigMap is not designed to hold large chunks of data. The data stored in a ConfigMap cannot exceed 1 MiB. If you need to store settings that are larger than this limit, you may want to consider mounting a volume or use a separate database or file service.
The quote is taken from here - https://kubernetes.io/docs/concepts/configuration/configmap/#motivation 
 
 
 
 answered Apr 20, 2021 at 9:47
 
 
    
 
 
  victorm1710victorm1710 1,10511 silver badges11 bronze badges
 
 
 
 
 
 
 
 
Till date config maps come under object count quota. You can enforce a maximum on number of configmaps. You cant put limits on size of individual config map. As they are not yet included under Storage Resource Quota. 
 https://kubernetes.io/docs/concepts/policy/resource-quotas/ 
 
 
 
 answered Oct 26, 2018 at 18:17
 
 
    
 
 
  Shane WarneShane Warne 1,1869 silver badges19 bronze badges
 
 
 
 4
Kubernetes ConfigMap size limitation
https://stackoverflow.com/questions/53012798/kubernetes-configmap-size-limitation
https://stackoverflow.com/questions/68527576/how-to-increase-max-header-size-for-istio-1-6-8
How to increase max header size for Istio 1.6.8?
2021-07-26
Tokeiito Tokeiito
<div><div>
 
<p>Situation:</p>
<p>Service A and B. Request headers from A to B can be up to 81KiB. As of that currently it errors out with 431 response.</p>
<p>Services are in default namespace.
Istio is on istio-system namespace.
istio-config namespace was not created during installation.</p>
<p>Istio 1.6.8. Both services has sidecart istio-proxy.</p>
<p>Following envoyfilter used:</p>
<pre><code>kind: EnvoyFilter
metadata:
 name: max-request-headers
 namespace: istio-system
spec:
 configPatches:
 - applyTo: NETWORK_FILTER # http connection manager is a filter in Envoy
 match:
 listener:
 filterChain:
 filter:
 name: "envoy.filters.network.http_connection_manager"
 patch:
 operation: MERGE
 value:
 typed_config:
 "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
 max_request_headers_kb: 96
</code></pre>
<p>But it does not work.</p>
<p>There were attempts to create this filter in <code>default</code>, <code>istio-system</code> and <code>istio-config</code> namespaces. Does not help.</p>
<p>Analysis of routes for those services by <code>istioctl proxy-config routes service-a --port 8080 -o json</code> does not show that filter was applied.</p>
<p>So from all of this there are several questions:</p>
<ol>
<li>How properly adjust max_header_size_kb for envoy?</li>
<li>What is proper flow for debugging such situations especially was envoy config applied?</li>
<li>Does Istio applies EnvoyFilter on the fly or do i need to restart istio services?</li>
</ol>
 </div>||||I|||| Stack Overflow
 1. About
 2. Products
 3. For Teams
 1. Stack Overflow Public questions & answers
 2. Stack Overflow for Teams Where developers & technologists share private knowledge with coworkers
 3. Talent Build your employer brand
 4. Advertising Reach developers & technologists worldwide
 5. About the company
 Loading…

 1. current community

 + Stack Overflow
 help chat
 + Meta Stack Overflow

 your communities

 Sign up or log in to customize your list.

 more stack exchange communities

 company blog
 2. 
 3. Log in
 4. Sign up
 1. Home
 2. 
 1. Public
 2. Questions
 3. Tags
 4. Users
 5. Companies
 6. Collectives
 7. Explore Collectives
 3. 
 1. Teams
 Stack Overflow for Teams – Start collaborating and sharing organizational knowledge. Create a free Team Why Teams?
 2. Teams
 3. Create free Team

 Collectives™ on Stack Overflow

 Find centralized, trusted content and collaborate around the technologies you use most.

 Learn more about Collectives

 Teams

 Q&A for work

 Connect and share knowledge within a single location that is structured and easy to search.

 Learn more about Teams

 How to increase max header size for Istio 1.6.8?

 Ask Question
 Asked 1 year, 6 months ago
 Modified 1 year, 6 months ago
 Viewed 536 times
 0

 Situation:

 Service A and B. Request headers from A to B can be up to 81KiB. As of that currently it errors out with 431 response.

 Services are in default namespace. Istio is on istio-system namespace. istio-config namespace was not created during installation.

 Istio 1.6.8. Both services has sidecart istio-proxy.

 Following envoyfilter used:

 kind: EnvoyFilter
 metadata:
 name: max-request-headers
 namespace: istio-system
 spec:
 configPatches:
 - applyTo: NETWORK_FILTER # http connection manager is a filter in Envoy
 match:
 listener:
 filterChain:
 filter:
 name: "envoy.filters.network.http_connection_manager"
 patch:
 operation: MERGE
 value:
 typed_config:
 "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
 max_request_headers_kb: 96
 

 But it does not work.

 There were attempts to create this filter in default, istio-system and istio-config namespaces. Does not help.

 Analysis of routes for those services by istioctl proxy-config routes service-a --port 8080 -o json does not show that filter was applied.

 So from all of this there are several questions:

 1. How properly adjust max_header_size_kb for envoy?
 2. What is proper flow for debugging such situations especially was envoy config applied?
 3. Does Istio applies EnvoyFilter on the fly or do i need to restart istio services?
 * kubernetes
 * istio
 * envoyproxy
 Share
 Improve this question
 Follow
 asked Jul 26, 2021 at 9:34
 Tokeiito Tokeiito
 13 2 2 bronze badges
 Add a comment |

 1 Answer

 Sorted by: Reset to default
 Highest score (default) Trending (recent votes count more) Date modified (newest first) Date created (oldest first)
 0

 The problem with provided EnvoyFilter in example is version mismatch. Example is for Istio 1.7.x while in environment istio is at 1.6.8 version.

 Issue was solved by changing manifest to this:

 apiVersion: networking.istio.io/v1alpha3
 kind: EnvoyFilter
 metadata:
 name: max-request-headers
 namespace: istio-system
 spec:
 configPatches:
 - applyTo: NETWORK_FILTER # http connection manager is a filter in Envoy
 match:
 listener:
 filterChain:
 filter:
 name: "envoy.http_connection_manager" # istio 1.6.8
 patch:
 operation: MERGE
 value:
 typed_config:
 "@type": "type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager" # istio 1.6.8
 max_request_headers_kb: 96
 
 Share
 Improve this answer
 Follow
 answered Jul 27, 2021 at 8:05
 Tokeiito Tokeiito
 13 2 2 bronze badges
 Add a comment |

 Your Answer

 Thanks for contributing an answer to Stack Overflow!

 * Please be sure to answer the question. Provide details and share your research!

 But avoid …

 * Asking for help, clarification, or responding to other answers.
 * Making statements based on opinion; back them up with references or personal experience.

 To learn more, see our tips on writing great answers.

 Sign up or log in

 Sign up using Google
 Sign up using Facebook
 Sign up using Email and Password
 Submit

 Post as a guest

 Name
 Email

 Required, but never shown

 Post as a guest

 Name
 Email

 Required, but never shown

 Post Your Answer Discard

 By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

 Not the answer you're looking for? Browse other questions tagged
 * kubernetes
 * istio
 * envoyproxy
 or ask your own question.

 * The Overflow Blog
 * Why developer experience is the key to better software, straight from the...
 * Featured on Meta
 * Accessibility Update: Colors
 * 2022: a year in moderation
 * Collectives: The next iteration
 * Temporary policy: ChatGPT is banned

 Related

 2
 How to make secure service to service communication in istio?
 2
 Adding custom response headers using Istio's (1.6.0) envoy lua filter
 4
 Failing to establish mqtt connection to VerneMQ cluster in k8s behind Istio proxy
 0
 k8s, Istio: remove transfer-encoding header
 3
 Unable to make lua-based EnvoyFilter to work
 0
 EnvoyFilter not appending headers for Istio sidecars

 Hot Network Questions

 * Intel 80188 & 8087 clock frequency differences
 * Determining the optimize lambda in Multi-Objective Optimization
 * Is there a cutoff for Newtonian gravity?
 * Will a spark gap transmit a signal an FM receiver can "hear?"
 * Meaning of "nude" in Saxo Grammaticus
 * Is 'comme platine' an idiom
 * Why is the solstice the first day of summer, and not the central day?
 * Why are ordinary spheres not strictly invertible?
 * Better midi playback on mac
 * Execute the output of sed as a bash script that takes inputs
 * Why does faster cooling produce smaller grains?
 * Can a vampire rest in a coffin in a bag of holding?
 * If a balloon lies within gun range, why would a 21st century warplane shoot it with a missile, instead of rotary guns?
 * How has the resolution of astronomical spectrographs improved over time?
 * Juvenile SF Novel With Conflict between Earth Humans and Colonists
 * When did Kievan Rus' rulers become culturally Slavic?
 * Route from North Scotland to Stockholm with no air travel
 * Is this Stanford certificate real?
 * Can a creature be targeted by future uses of eyebite if they are immune to the initial casting?
 * What did Paul McCartney mean by "Oh, yesterday came suddenly"?
 * What is the use of alumium profile with LED strip lighting?
 * Why are there 23 members of the grand jury?
 * What does 'a reduction is tight' mean rigorously?
 * Books containing new results
 more hot questions
 Question feed

 Subscribe to RSS

 Question feed

 To subscribe to this RSS feed, copy and paste this URL into your RSS reader.

 Stack Overflow

 * Questions
 * Help

 Products

 * Teams
 * Advertising
 * Collectives
 * Talent

 Company

 * About
 * Press
 * Work Here
 * Legal
 * Privacy Policy
 * Terms of Service
 * Contact Us
 * Cookie Settings
 * Cookie Policy

 Stack Exchange Network

 * Technology
 * Culture & recreation
 * Life & arts
 * Science
 * Professional
 * Business
 * API
 * Data
 * Blog
 * Facebook
 * Twitter
 * LinkedIn
 * Instagram

 Site design / logo © 2023 Stack Exchange Inc; user contributions licensed under CC BY-SA. rev 2023.2.6.43221

 Your privacy

 By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.

 Accept all cookies Customize settings
Situation:
Service A and B. Request headers from A to B can be up to 81KiB. As of that currently it errors out with 431 response.
Services are in default namespace.
Istio is on istio-system namespace.
istio-config namespace was not created during installation.
Istio 1.6.8. Both services has sidecart istio-proxy.
Following envoyfilter used:
 kind: EnvoyFilter
metadata:
 name: max-request-headers
 namespace: istio-system
spec:
 configPatches:
 - applyTo: NETWORK_FILTER # http connection manager is a filter in Envoy
 match:
 listener:
 filterChain:
 filter:
 name: "envoy.filters.network.http_connection_manager"
 patch:
 operation: MERGE
 value:
 typed_config:
 "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
 max_request_headers_kb: 96
 
But it does not work.
There were attempts to create this filter in default, istio-system and istio-config namespaces. Does not help.
Analysis of routes for those services by istioctl proxy-config routes service-a --port 8080 -o json does not show that filter was applied.
So from all of this there are several questions:
How properly adjust max_header_size_kb for envoy?
What is proper flow for debugging such situations especially was envoy config applied?
Does Istio applies EnvoyFilter on the fly or do i need to restart istio services?
How to increase max header size for Istio 1.6.8?
https://stackoverflow.com/questions/68527576/how-to-increase-max-header-size-for-istio-1-6-8
https://stackoverflow.com/questions/58656768/how-to-set-limit-for-kubelet-of-kubernetes
How to set limit for kubelet of kubernetes?
2021-01-03
User
<div><div>
<p>I think you should understand what <code>kubelet</code> does. This can be found in <a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/">kubelet documentation</a>.</p>
<blockquote>
 <p>The kubelet is the primary “node agent” that runs on each node. It can register the node with the apiserver using one of: the hostname; a flag to override the hostname; or specific logic for a cloud provider.</p>
 
 <p>The kubelet works in terms of a PodSpec. A PodSpec is a YAML or JSON object that describes a pod. The kubelet takes a set of PodSpecs that are provided through various mechanisms (primarily through the apiserver) and ensures that the containers described in those PodSpecs are running and healthy. The kubelet doesn’t manage containers which were not created by Kubernetes.</p>
 
 <p>Other than from an PodSpec from the apiserver, there are three ways that a container manifest can be provided to the Kubelet.</p>
 
 <p>File: Path passed as a flag on the command line. Files under this path will be monitored periodically for updates. The monitoring period is 20s by default and is configurable via a flag.</p>
 
 <p>HTTP endpoint: HTTP endpoint passed as a parameter on the command line. This endpoint is checked every 20 seconds (also configurable with a flag).</p>
 
 <p>HTTP server: The kubelet can also listen for HTTP and respond to a simple API (underspec’d currently) to submit a new manifest.</p>
</blockquote>
<p>There is several flags that you could use with kubelet, but they mostly are <strong>DEPRECATED</strong> and parameter should be set via config file specified by Kubelet's --config flag. This is explain on <a href="https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/">Set Kubelet parameters via a config file</a>.</p>
<p>The flags that might be interesting for you are:</p>
<p><code>--application-metrics-count-limit int</code></p>
<blockquote>
 <p>Max number of application metrics to store (per container) (default 100) (DEPRECATED)</p>
</blockquote>
<p><code>--cpu-cfs-quota</code></p>
<blockquote>
 <p>Enable CPU CFS quota enforcement for containers that specify CPU limits (default true) (DEPRECATED)</p>
</blockquote>
<p><code>--event-qps int32</code></p>
<blockquote>
 <p>If &gt; 0, limit event creations per second to this value. If 0, unlimited. (default 5) (DEPRECATED)</p>
</blockquote>
<p><code>--event-storage-age-limit string</code></p>
<blockquote>
 <p>Max length of time for which to store events (per type). Value is a comma separated list of key values, where the keys are event types (e.g.: creation, oom) or "default" and the value is a duration. Default is applied to all non-specified event types (default "default=0") (DEPRECATED)</p>
</blockquote>
<p><code>--event-storage-event-limit string</code></p>
<blockquote>
 <p>Max number of events to store (per type). Value is a comma separated list of key values, where the keys are event types (e.g.: creation, oom) or "default" and the value is an integer. Default is applied to all non-specified event types (default "default=0") (DEPRECATED)</p>
</blockquote>
<p><code>--log-file-max-size uint</code></p>
<blockquote>
 <p>Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800)</p>
</blockquote>
<p><code>--pods-per-core int32</code></p>
<blockquote>
 <p>Number of Pods per core that can run on this Kubelet. The total number of Pods on this Kubelet cannot exceed max-pods, so max-pods will be used if this calculation results in a larger number of Pods allowed on the Kubelet. A value of 0 disables this limit. (DEPRECATED)</p>
</blockquote>
<p><code>--registry-qps int32</code></p>
<blockquote>
 <p>If &gt; 0, limit registry pull QPS to this value. If 0, unlimited. (default 5) (DEPRECATED)</p>
</blockquote>
 </div>||||I|||| Stack Overflow
 1. About
 2. Products
 3. For Teams
 1. Stack Overflow Public questions & answers
 2. Stack Overflow for Teams Where developers & technologists share private knowledge with coworkers
 3. Talent Build your employer brand
 4. Advertising Reach developers & technologists worldwide
 5. About the company
 Loading…

 1. current community

 + Stack Overflow
 help chat
 + Meta Stack Overflow

 your communities

 Sign up or log in to customize your list.

 more stack exchange communities

 company blog
 2. 
 3. Log in
 4. Sign up
 1. Home
 2. 
 1. Public
 2. Questions
 3. Tags
 4. Users
 5. Companies
 6. Collectives
 7. Explore Collectives
 3. 
 1. Teams
 Stack Overflow for Teams – Start collaborating and sharing organizational knowledge. Create a free Team Why Teams?
 2. Teams
 3. Create free Team

 Collectives™ on Stack Overflow

 Find centralized, trusted content and collaborate around the technologies you use most.

 Learn more about Collectives

 Teams

 Q&A for work

 Connect and share knowledge within a single location that is structured and easy to search.

 Learn more about Teams

 How to set limit for kubelet of kubernetes?

 Ask Question
 Asked 3 years, 3 months ago
 Modified 2 years, 1 month ago
 Viewed 2k times
 1

 I am using kubernetes cluster with 1 master node and 2 worker with 4 core cpu and 256mb ram. I wanted to know how much cpu and ram is needed for kubelet.

 Is there any way to set limit (cpu, memory) for kubelet?. I searched for documentation but i found only worker node requirements.

 * docker
 * kubernetes
 * kubelet
 Share
 Follow
 edited Jan 3, 2021 at 17:54
 Jonas
 117k 96 96 gold badges 305 305 silver badges 381 381 bronze badges
 asked Nov 1, 2019 at 9:20
 user11779620 user11779620
 2
 * 1
 On a linux os you could configure a user with ulimit to set a limit of various things a user can use. you could then reconfigure the upstart process to run kubelet as that user. (as opposed to running it as root)
 – Josh Beauregard
 Nov 1, 2019 at 10:08
 * Is running the kubelet process as a separate user is the only solution? Any kubernetes native approach?
 – user11779620
 Nov 1, 2019 at 15:11
 Add a comment |

 1 Answer

 Sorted by: Reset to default
 Highest score (default) Trending (recent votes count more) Date modified (newest first) Date created (oldest first)
 1

 I think you should understand what kubelet does. This can be found in kubelet documentation.

 The kubelet is the primary “node agent” that runs on each node. It can register the node with the apiserver using one of: the hostname; a flag to override the hostname; or specific logic for a cloud provider.

 The kubelet works in terms of a PodSpec. A PodSpec is a YAML or JSON object that describes a pod. The kubelet takes a set of PodSpecs that are provided through various mechanisms (primarily through the apiserver) and ensures that the containers described in those PodSpecs are running and healthy. The kubelet doesn’t manage containers which were not created by Kubernetes.

 Other than from an PodSpec from the apiserver, there are three ways that a container manifest can be provided to the Kubelet.

 File: Path passed as a flag on the command line. Files under this path will be monitored periodically for updates. The monitoring period is 20s by default and is configurable via a flag.

 HTTP endpoint: HTTP endpoint passed as a parameter on the command line. This endpoint is checked every 20 seconds (also configurable with a flag).

 HTTP server: The kubelet can also listen for HTTP and respond to a simple API (underspec’d currently) to submit a new manifest.

 There is several flags that you could use with kubelet, but they mostly are DEPRECATED and parameter should be set via config file specified by Kubelet's --config flag. This is explain on Set Kubelet parameters via a config file.

 The flags that might be interesting for you are:

 --application-metrics-count-limit int

 Max number of application metrics to store (per container) (default 100) (DEPRECATED)

 --cpu-cfs-quota

 Enable CPU CFS quota enforcement for containers that specify CPU limits (default true) (DEPRECATED)

 --event-qps int32

 If > 0, limit event creations per second to this value. If 0, unlimited. (default 5) (DEPRECATED)

 --event-storage-age-limit string

 Max length of time for which to store events (per type). Value is a comma separated list of key values, where the keys are event types (e.g.: creation, oom) or "default" and the value is a duration. Default is applied to all non-specified event types (default "default=0") (DEPRECATED)

 --event-storage-event-limit string

 Max number of events to store (per type). Value is a comma separated list of key values, where the keys are event types (e.g.: creation, oom) or "default" and the value is an integer. Default is applied to all non-specified event types (default "default=0") (DEPRECATED)

 --log-file-max-size uint

 Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800)

 --pods-per-core int32

 Number of Pods per core that can run on this Kubelet. The total number of Pods on this Kubelet cannot exceed max-pods, so max-pods will be used if this calculation results in a larger number of Pods allowed on the Kubelet. A value of 0 disables this limit. (DEPRECATED)

 --registry-qps int32

 If > 0, limit registry pull QPS to this value. If 0, unlimited. (default 5) (DEPRECATED)

 Share
 Follow
 answered Nov 1, 2019 at 13:13
 Crou Crou
 9,464 2 2 gold badges 26 26 silver badges 30 30 bronze badges
 Add a comment |

 Your Answer

 Thanks for contributing an answer to Stack Overflow!

 * Please be sure to answer the question. Provide details and share your research!

 But avoid …

 * Asking for help, clarification, or responding to other answers.
 * Making statements based on opinion; back them up with references or personal experience.

 To learn more, see our tips on writing great answers.

 Sign up or log in

 Sign up using Google
 Sign up using Facebook
 Sign up using Email and Password
 Submit

 Post as a guest

 Name
 Email

 Required, but never shown

 Post as a guest

 Name
 Email

 Required, but never shown

 Post Your Answer Discard

 By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

 * The Overflow Blog
 * Announcing more ways to learn and grow your skills
 * Why developer experience is the key to better software, straight from the...
 * Featured on Meta
 * Accessibility Update: Colors
 * 2022: a year in moderation
 * Collectives: The next iteration
 * We’re bringing advertisements for technology courses to Stack Overflow
 * Temporary policy: ChatGPT is banned

 Related

 4328
 How is Docker different from a virtual machine?
 2038
 How to get a Docker container's IP address from the host
 722
 What is the runtime performance cost of a Docker container?
 2316
 How to copy files from host to Docker container?
 2087
 How to copy Docker images from one host to another without using a repository
 2962
 From inside of a Docker container, how do I connect to the localhost of the machine?
 483
 Pods stuck in Terminating status
 1431
 How to force Docker for a clean build of an image
 0
 Why kubelet is running on kubernetes master node?

 Hot Network Questions

 * Why are there 23 members of the grand jury?
 * How many spells require expensive components for each casting?
 * Isekai manga where the main character is a healer but gets his limbs chopped off
 * Non-inverting op-amp
 * How to download only certain columns of a binary file using wget?
 * What exactly is the "clutch" doing on a Shimano M8100 rear derailleur?
 * When did Kievan Rus' rulers become culturally Slavic?
 * The word "decant" for clone generation
 * Is an exhaust pipe broken at engine connection fixable by a DIYer?
 * How do I erase sets of solutions from Solve based on criteria?
 * Can a helicopter's main rotor mince a human?
 * Why do Pokemon sometimes have dark stripes in Pokemon Go?
 * Eyes stay stationary while posing rest of the mesh
 * How would you say "mindless fun" in German
 * Do famous people really have the power to ruin the career of unrelated researchers?
 * Both "fēmina" and "mulier" mean "woman": what's the difference?
 * Gamma uncertainty set
 * Are there any Oxford Colleges which will accommodate a family including children
 * Which Deep Learning Method to use for the classification of precious stones (diamonds, sapphire, ruby etc) based on digital photo images and data set?
 * How to fill an L path with a reflected gradient?
 * Why does the Heisenberg uncertainty principle apply to particles?
 * What did Paul McCartney mean by "Oh, yesterday came suddenly"?
 * What changes to Voyager could have been made?
 * Will a spark gap transmit a signal an FM receiver can "hear?"
 more hot questions
 Question feed

 Subscribe to RSS

 Question feed

 To subscribe to this RSS feed, copy and paste this URL into your RSS reader.

 Stack Overflow

 * Questions
 * Help

 Products

 * Teams
 * Advertising
 * Collectives
 * Talent

 Company

 * About
 * Press
 * Work Here
 * Legal
 * Privacy Policy
 * Terms of Service
 * Contact Us
 * Cookie Settings
 * Cookie Policy

 Stack Exchange Network

 * Technology
 * Culture & recreation
 * Life & arts
 * Science
 * Professional
 * Business
 * API
 * Data
 * Blog
 * Facebook
 * Twitter
 * LinkedIn
 * Instagram

 Site design / logo © 2023 Stack Exchange Inc; user contributions licensed under CC BY-SA. rev 2023.2.3.43216

 Your privacy

 By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.

 Accept all cookies Customize settings
I think you should understand what kubelet does. This can be found in kubelet documentation.
 The kubelet is the primary “node agent” that runs on each node. It can register the node with the apiserver using one of: the hostname; a flag to override the hostname; or specific logic for a cloud provider.
 
 The kubelet works in terms of a PodSpec. A PodSpec is a YAML or JSON object that describes a pod. The kubelet takes a set of PodSpecs that are provided through various mechanisms (primarily through the apiserver) and ensures that the containers described in those PodSpecs are running and healthy. The kubelet doesn’t manage containers which were not created by Kubernetes.
 
 Other than from an PodSpec from the apiserver, there are three ways that a container manifest can be provided to the Kubelet.
 
 File: Path passed as a flag on the command line. Files under this path will be monitored periodically for updates. The monitoring period is 20s by default and is configurable via a flag.
 
 HTTP endpoint: HTTP endpoint passed as a parameter on the command line. This endpoint is checked every 20 seconds (also configurable with a flag).
 
 HTTP server: The kubelet can also listen for HTTP and respond to a simple API (underspec’d currently) to submit a new manifest.
There is several flags that you could use with kubelet, but they mostly are DEPRECATED and parameter should be set via config file specified by Kubelet's --config flag. This is explain on Set Kubelet parameters via a config file.
The flags that might be interesting for you are:
 --application-metrics-count-limit int 
 Max number of application metrics to store (per container) (default 100) (DEPRECATED)
 --cpu-cfs-quota 
 Enable CPU CFS quota enforcement for containers that specify CPU limits (default true) (DEPRECATED)
 --event-qps int32 
 If &gt; 0, limit event creations per second to this value. If 0, unlimited. (default 5) (DEPRECATED)
 --event-storage-age-limit string 
 Max length of time for which to store events (per type). Value is a comma separated list of key values, where the keys are event types (e.g.: creation, oom) or "default" and the value is a duration. Default is applied to all non-specified event types (default "default=0") (DEPRECATED)
 --event-storage-event-limit string 
 Max number of events to store (per type). Value is a comma separated list of key values, where the keys are event types (e.g.: creation, oom) or "default" and the value is an integer. Default is applied to all non-specified event types (default "default=0") (DEPRECATED)
 --log-file-max-size uint 
 Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800)
 --pods-per-core int32 
 Number of Pods per core that can run on this Kubelet. The total number of Pods on this Kubelet cannot exceed max-pods, so max-pods will be used if this calculation results in a larger number of Pods allowed on the Kubelet. A value of 0 disables this limit. (DEPRECATED)
 --registry-qps int32 
 If &gt; 0, limit registry pull QPS to this value. If 0, unlimited. (default 5) (DEPRECATED)
How to set limit for kubelet of kubernetes?
https://stackoverflow.com/questions/58656768/how-to-set-limit-for-kubelet-of-kubernetes
https://stackoverflow.com/questions/55247566/how-do-i-limit-container-disk-usage-without-evicting
How do I limit container disk usage without evicting?
2019-03-19
User
<div><div>
 
 
 <div>
 <p>Asked
 <time>3 years, 10 months ago</time>
 </p>
 
 <p>Viewed
 1k times
 </p>
 
 </div>
 <div>
 
<div>
 
 <div>
 
<p>I'm trying to use Kubernetes on GKE (or EKS) to create Docker containers dynamically for each user and give users shell access to these containers and I want to be able to set a maximum limit on disk space that a container can use (or at least on one of the folders within each container) but I want to implement this in such a way that the pod isn't evicted if the size is exceeded. Instead ideally a user would get an error when trying to write more data to disk than the specified limit (e.g., <code>Disk quota exceeded</code>, etc). </p>
<p>I'd rather not have to use a Kubernetes volume that's backed by a gcePersistentDisk or an EBS volume to minimize the costs. Is there a way to achieve this with Kubernetes?</p>
 </div>
 
 <div>
 <p>
 asked Mar 19, 2019 at 18:16
 </p>
 
 
</div>
 
</div>
 <div>
 
 
<div>
 
 
 <div>
<p>Assuming you're using <code>emptyDir</code> volume on Kubernetes, which is a temporary disk attached to your pod, you can set a size for that.</p>
<p>See the answer at <a href="https://stackoverflow.com/a/45565438/54929">https://stackoverflow.com/a/45565438/54929</a>, this question is likely a duplicate. </p>
 </div>
 <div>
 <p>
 answered Mar 19, 2019 at 21:24
 </p>
 <div>
 <a href="/users/54929/ahmet-alp-balkan"><p></p></a>
 </div>
 <div>
 <p><a href="/users/54929/ahmet-alp-balkan">ahmet alp balkan</a>ahmet alp balkan</p><p>41.2k37 gold badges134 silver badges208 bronze badges
 </p>
 </div>
</div>
 
</div>
 <p>3</p>
 </div>
 </div>
 
 </div>||||I|||| Stack Overflow
 1. About
 2. Products
 3. For Teams
 1. Stack Overflow Public questions & answers
 2. Stack Overflow for Teams Where developers & technologists share private knowledge with coworkers
 3. Talent Build your employer brand
 4. Advertising Reach developers & technologists worldwide
 5. About the company
 Loading…

 1. current community

 + Stack Overflow
 help chat
 + Meta Stack Overflow

 your communities

 Sign up or log in to customize your list.

 more stack exchange communities

 company blog
 2. 
 3. Log in
 4. Sign up
 1. Home
 2. 
 1. Public
 2. Questions
 3. Tags
 4. Users
 5. Companies
 6. Collectives
 7. Collectives™ on Stack Overflow – Centralized & trusted content around the technologies you use the most.
 Learn more about Collectives
 8. Explore Collectives
 3. 
 1. Teams
 2. Create free Team

 Collectives™ on Stack Overflow

 Find centralized, trusted content and collaborate around the technologies you use most.

 Learn more about Collectives

 Teams

 Q&A for work

 Connect and share knowledge within a single location that is structured and easy to search.

 Learn more about Teams

 How do I limit container disk usage without evicting?

 Ask Question
 Asked 3 years, 10 months ago
 Modified 3 years, 10 months ago
 Viewed 1k times
 Part of Google Cloud and AWS Collectives
 0

 I'm trying to use Kubernetes on GKE (or EKS) to create Docker containers dynamically for each user and give users shell access to these containers and I want to be able to set a maximum limit on disk space that a container can use (or at least on one of the folders within each container) but I want to implement this in such a way that the pod isn't evicted if the size is exceeded. Instead ideally a user would get an error when trying to write more data to disk than the specified limit (e.g., Disk quota exceeded, etc).

 I'd rather not have to use a Kubernetes volume that's backed by a gcePersistentDisk or an EBS volume to minimize the costs. Is there a way to achieve this with Kubernetes?

 * docker
 * kubernetes
 * resources
 * google-kubernetes-engine
 * amazon-eks
 Share
 Improve this question
 Follow
 asked Mar 19, 2019 at 18:16
 user8134367 user8134367
 Add a comment |

 1 Answer

 Sorted by: Reset to default
 Highest score (default) Trending (recent votes count more) Date modified (newest first) Date created (oldest first)
 0

 Assuming you're using emptyDir volume on Kubernetes, which is a temporary disk attached to your pod, you can set a size for that.

 See the answer at https://stackoverflow.com/a/45565438/54929, this question is likely a duplicate.

 Share
 Improve this answer
 Follow
 answered Mar 19, 2019 at 21:24
 ahmet alp balkan ahmet alp balkan
 41.2k 37 37 gold badges 134 134 silver badges 208 208 bronze badges
 3
 * 1
 Thanks for answering! But unfortunately exceeding the sizeLimit of an emptyDir causes the pod to be evicted.
 – user8134367
 Mar 19, 2019 at 21:35
 * I think you're looking for a feature that doesn't exist. :) Also if you tried something and it didn't work, it should be part of your question, don't make us guess what you tried.
 – ahmet alp balkan
 Mar 20, 2019 at 16:41
 * 2
 I do think that feature probably doesn't exist after all. The question clearly asks for a solution where the pod isn't evicted though. So perhaps the answer should've considered that it doesn't apply :)
 – user8134367
 Mar 21, 2019 at 18:32
 Add a comment |

 Your Answer

 Thanks for contributing an answer to Stack Overflow!

 * Please be sure to answer the question. Provide details and share your research!

 But avoid …

 * Asking for help, clarification, or responding to other answers.
 * Making statements based on opinion; back them up with references or personal experience.

 To learn more, see our tips on writing great answers.

 Sign up or log in

 Sign up using Google
 Sign up using Facebook
 Sign up using Email and Password
 Submit

 Post as a guest

 Name
 Email

 Required, but never shown

 Post as a guest

 Name
 Email

 Required, but never shown

 Post Your Answer Discard

 By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

 Google Cloud Collective See more
 AWS Collective See more
 This question is in a collective: a subcommunity defined by tags with relevant content and experts.
 * The Overflow Blog
 * Announcing more ways to learn and grow your skills
 * Why developer experience is the key to better software, straight from the...
 * Featured on Meta
 * Accessibility Update: Colors
 * 2022: a year in moderation
 * Collectives: The next iteration
 * Temporary policy: ChatGPT is banned

 Linked

 12
 Setting Kubernetes emptyDir volume size

 Related

 2316
 How to copy files from host to Docker container?
 2088
 How to copy Docker images from one host to another without using a repository
 2962
 From inside of a Docker container, how do I connect to the localhost of the machine?
 41
 Limit disk size and bandwidth of a Docker container
 336
 How to analyze disk usage of a Docker container
 5
 Docker container specific disk quota
 12
 Is it possible to have ephemeral, on-disk pod storage on Google Kubernetes Engine?
 1
 Realtime monitoring of CPU usage/CPU limit in k8s container
 3
 What happens when a pod resource limit is not exceeded but a single container resource limit is?
 0
 Docker volume mount to kubernetes volume

 Hot Network Questions

 * What would be the next logical step after crossbows?
 * The word "decant" for clone generation
 * Can poor grades in the bachelor's affect working in the academia?
 * Agile Principles: What does it mean sustainable development?
 * How to adapt a spoke salvaged from a 26" wheel to a 24" one?
 * How can an Indian homemaker spouse be guaranteed a Schengen tourist visa?
 * If Sauron wins eventually without the Ring, why weren't Elrond/Gandalf in panic mode before Frodo showed up?
 * How are local varibales stored on Atmega
 * How would you say "mindless fun" in German
 * At what point does combining integrated circuits yield something patentable?
 * Better midi playback on mac
 * What is the use of alumium profile with LED strip lighting?
 * Sum of Consecutive Squares
 * Don't repeat yourself
 * Compute "negative" version of vector of vectors
 * Can an aircraft use ram air to generate power while flying?
 * Juvenile SF Novel With Conflict between Earth Humans and Colonists
 * Addition and multiplication are commutative but exponentiation and tetration are not. Do we know why?
 * Why is b.pop(0) over 200 times slower than del b[0] for bytearray?
 * Do famous people really have the power to ruin the career of unrelated researchers?
 * How to make softbody interact with an animated rigid body
 * What changes to Voyager could have been made?
 * Is an exhaust pipe broken at engine connection fixable by a DIYer?
 * How to clean bath spa nozzles?
 more hot questions
 Question feed

 Subscribe to RSS

 Question feed

 To subscribe to this RSS feed, copy and paste this URL into your RSS reader.

 Stack Overflow

 * Questions
 * Help

 Products

 * Teams
 * Advertising
 * Collectives
 * Talent

 Company

 * About
 * Press
 * Work Here
 * Legal
 * Privacy Policy
 * Terms of Service
 * Contact Us
 * Cookie Settings
 * Cookie Policy

 Stack Exchange Network

 * Technology
 * Culture & recreation
 * Life & arts
 * Science
 * Professional
 * Business
 * API
 * Data
 * Blog
 * Facebook
 * Twitter
 * LinkedIn
 * Instagram

 Site design / logo © 2023 Stack Exchange Inc; user contributions licensed under CC BY-SA. rev 2023.2.6.43220

 Your privacy

 By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.

 Accept all cookies Customize settings
Asked
 3 years, 10 months ago
 
 
 Viewed
 1k times
 
 
 
 
 
 
 
 
I'm trying to use Kubernetes on GKE (or EKS) to create Docker containers dynamically for each user and give users shell access to these containers and I want to be able to set a maximum limit on disk space that a container can use (or at least on one of the folders within each container) but I want to implement this in such a way that the pod isn't evicted if the size is exceeded. Instead ideally a user would get an error when trying to write more data to disk than the specified limit (e.g., Disk quota exceeded, etc). 
I'd rather not have to use a Kubernetes volume that's backed by a gcePersistentDisk or an EBS volume to minimize the costs. Is there a way to achieve this with Kubernetes?
 
 
 
 
 asked Mar 19, 2019 at 18:16
 
 
 
 
 
 
 
 
 
 
Assuming you're using emptyDir volume on Kubernetes, which is a temporary disk attached to your pod, you can set a size for that.
See the answer at https://stackoverflow.com/a/45565438/54929, this question is likely a duplicate. 
 
 
 
 answered Mar 19, 2019 at 21:24
 
 
    
 
 
  ahmet alp balkanahmet alp balkan 41.2k37 gold badges134 silver badges208 bronze badges
 
 
 
 3
How do I limit container disk usage without evicting?
https://stackoverflow.com/questions/55247566/how-do-i-limit-container-disk-usage-without-evicting
https://stackoverflow.com/questions/54181419/make-large-static-data-files-available-to-kubernetes-pods
Make large static data files available to kubernetes pods
2021-01-03
AntonOfTheWoods AntonOfTheWoods
<div><div>
<div>
<div>
<div>
<p>I have a few quite large UTF-8 data files that pods need to load into memory on start up - from a couple of hundred KBs to around 50 MB. </p>
<p>The project (including helm chart) is open source but some of these files are not - otherwise I would probably just include them in the images. My initial thinking was to create configmaps but my understanding is that 50 MB is more than configmaps were intended for, so that might end up being a problem in some circumstances. I think secrets would also be overkill - they aren't secret, they just shouldn't be put on the open internet.</p>
<p>For performance reasons I'd rather have a copy in memory in each pod rather than going for a shared cache but I might be wrong on that. At the very least that will likely add more complexity than it's worth.</p>
<p>Are configmaps the way to go?</p>
</div>
<div>
<div>
<div>
<a href="https://stackoverflow.com/users/213269/jonas"><p></p></a>
</div>
<div>
<p><a href="https://stackoverflow.com/users/213269/jonas">Jonas</a></p><p>
</p>
</div>
</div>
<div>
<div>
<p>
 asked 
</p>
</div>
<div>
<a href="https://stackoverflow.com/users/903966/antonofthewoods"><p></p></a>
</div>
<div>
<p><a href="https://stackoverflow.com/users/903966/antonofthewoods">AntonOfTheWoods</a></p><p>
</p>
</div>
</div>
</div>
</div>
<p></p>
</div>
<div>
<div>
<div>
<div>
<p>From my point of view, the best solution would be using <a href="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/">init container</a> to download the files from a secured storage (as it was mentioned by <a href="https://stackoverflow.com/users/284111/andrew-savinykh">Andrew Savinykh</a> in the comments), to the pod's volume and then use it in the pod's main container.</p>
<p>Please see the <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-initialization/#create-a-pod-that-has-an-init-container">example</a>:</p>
<pre><code> 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 {}
</code></pre>
</div>
<div>
<div>
<a href="https://stackoverflow.com/users/10462293/black-bacardi"><p></p></a>
</div>
<div>
<div>
<p>
 answered 
</p>
</div>
<div>
<a href="https://stackoverflow.com/users/9521610/vas"><p></p></a>
</div>
</div>
</div>
</div>
<p></p>
</div>
<h2>
</h2>
</div>
</div></div>||||I|||| Join Stack Overflow

 By clicking “Sign up”, you agree to our terms of service and acknowledge you have read our privacy policy.

 Sign up with Google
 Sign up with GitHub

 OR

 Email
 Password
 Sign up

 Already have an account? Log in
Skip to main content
 Stack Overflow
 1. About
 2. Products
 3. For Teams
 1. Stack Overflow Public questions & answers
 2. Stack Overflow for Teams Where developers & technologists share private knowledge with coworkers
 3. Talent Build your employer brand
 4. Advertising Reach developers & technologists worldwide
 5. Labs The future of collective knowledge sharing
 6. About the company
 Loading…

 1. current community

 + Stack Overflow
 help chat
 + Meta Stack Overflow

 your communities

 Sign up or log in to customize your list.

 more stack exchange communities

 company blog
 2. 
 3. Log in
 4. Sign up
 1. 
 1. Home
 2. Questions
 3. Tags
 4. 
 5. Users
 6. Companies
 7. Labs
 8. Discussions
 9. Collectives

 10. Communities for your favorite technologies. Explore all Collectives

 2. Teams

 Ask questions, find answers and collaborate at work with Stack Overflow for Teams.

 Explore Teams Create a free Team
 3. Teams

 4. Ask questions, find answers and collaborate at work with Stack Overflow for Teams. Explore Teams

 Collectives™ on Stack Overflow

 Find centralized, trusted content and collaborate around the technologies you use most.

 Learn more about Collectives

 Teams

 Q&A for work

 Connect and share knowledge within a single location that is structured and easy to search.

 Learn more about Teams

 Get early access and see previews of new features.

 Learn more about Labs

 Make large static data files available to kubernetes pods

 Ask Question
 Asked 5 years, 3 months ago
 Modified 3 years, 3 months ago
 Viewed 12k times
 This question shows research effort; it is useful and clear
 7
 Save this question.
 Show activity on this post.

 I have a few quite large UTF-8 data files that pods need to load into memory on start up - from a couple of hundred KBs to around 50 MB.

 The project (including helm chart) is open source but some of these files are not - otherwise I would probably just include them in the images. My initial thinking was to create configmaps but my understanding is that 50 MB is more than configmaps were intended for, so that might end up being a problem in some circumstances. I think secrets would also be overkill - they aren't secret, they just shouldn't be put on the open internet.

 For performance reasons I'd rather have a copy in memory in each pod rather than going for a shared cache but I might be wrong on that. At the very least that will likely add more complexity than it's worth.

 Are configmaps the way to go?

 * file
 * kubernetes
 * configmap
 Share
 Share a link to this question
 Copy linkCC BY-SA 4.0
 Improve this question
 Follow
 Follow this question to receive notifications
 edited Jan 3, 2021 at 17:59
 Jonas
 126k 97 97 gold badges 317 317 silver badges 399 399 bronze badges
 asked Jan 14, 2019 at 12:16
 AntonOfTheWoods AntonOfTheWoods
 877 1 1 gold badge 14 14 silver badges 21 21 bronze badges
 1
 * 1
 Another option that one could consider is to host them on an secured web server and download them on start up.
 – Andrew Savinykh
 Jan 15, 2019 at 3:01
 Add a comment |

 1 Answer

 Sorted by: Reset to default
 Highest score (default) Trending (recent votes count more) Date modified (newest first) Date created (oldest first)
 This answer is useful
 8
 Save this answer.
 Show activity on this post.

 From my point of view, the best solution would be using init container to download the files from a secured storage (as it was mentioned by Andrew Savinykh in the comments), to the pod's volume and then use it in the pod's main container.

 Please see the example:

 apiVersion: v1
 kind: Pod
 metadata:
 name: init-demo
 spec:
 containers:
 - name: nginx
 image: nginx
 ports:
 - containerPort: 80
 volumeMounts:
 - name: workdir
 mountPath: /usr/share/nginx/html
 # These containers are run during pod initialization
 initContainers:
 - name: install
 image: busybox
 command:
 - wget
 - "-O"
 - "/work-dir/index.html"
 - http://kubernetes.io
 volumeMounts:
 - name: workdir
 mountPath: "/work-dir"
 dnsPolicy: Default
 volumes:
 - name: workdir
 emptyDir: {}
 
 Share
 Share a link to this answer
 Copy linkCC BY-SA 4.0
 Improve this answer
 Follow
 Follow this answer to receive notifications
 edited Jan 24, 2019 at 12:21
 Black_Bacardi
 318 4 4 silver badges 10 10 bronze badges
 answered Jan 21, 2019 at 16:48
 VAS VAS
 8,801 1 1 gold badge 29 29 silver badges 40 40 bronze badges
 4
 * 1
 But when I have a big file in local, how can I mount it to the pod?
 – iamatsundere181
 Nov 28, 2020 at 9:05
 * if you mean node filesystem you can mount it directly: kubernetes.io/docs/concepts/storage/volumes/#hostpath kubernetes.io/docs/concepts/storage/volumes/#local
 – VAS
 Nov 28, 2020 at 9:09
 * no, I mean the files on the machine that deploys k8s, I think there isn't any way? Maybe I have to deploy it online then download to pod.
 – iamatsundere181
 Nov 28, 2020 at 9:21
 * Yes, exactly. its pretty convenient to use cloud object storage for that, like S3 or Google Cloud Storage.
 – VAS
 Nov 28, 2020 at 9:35
 Add a comment |

 Your Answer

 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 

 Reminder: Answers generated by artificial intelligence tools are not allowed on Stack Overflow. Learn more

 Thanks for contributing an answer to Stack Overflow!

 * Please be sure to answer the question. Provide details and share your research!

 But avoid …

 * Asking for help, clarification, or responding to other answers.
 * Making statements based on opinion; back them up with references or personal experience.

 To learn more, see our tips on writing great answers.

 Sign up or log in

 Sign up using Google
 Sign up using Facebook
 Sign up using Email and Password
 Submit

 Post as a guest

 Name
 Email

 Required, but never shown

 Post as a guest

 Name
 Email

 Required, but never shown

 Post Your Answer Discard

 By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

 Not the answer you're looking for? Browse other questions tagged
 * file
 * kubernetes
 * configmap
 or ask your own question.

 * The Overflow Blog
 * Supporting the world’s most-used database engine through 2050
 * Net neutrality is in; TikTok and noncompetes are out
 * Featured on Meta
 * Testing a new version of Stack Overflow Jobs
 * Pausing the 1-rep voting experiment on Stack Overflow: reflecting on the...
 * Temporary policy: Generative AI (e.g., ChatGPT) is banned

 Linked

 2
 Mount text file greater than 3 MB in kubernetes for locust

 Related

 46
 How can I store a binary file in a Kubernetes ConfigMap?
 5
 kubernetes configmaps for binary file
 21
 Passing long configuration file to Kubernetes
 4
 How to mount a ConfigMap as a file without using volume
 2
 Can we increase the size of configmap to store binary data of size more than 1 MB?
 4
 Is there a way to create a configMap containing multiple files for a Kubernetes Pod?
 1
 How can I mount a dynamically generated file into a pod without creating a ConfigMap?
 2
 Mounting a large file in Kubernetes
 4
 Kubernetes ConfigMap mount single file instead of directory
 4
 Separate Kubernetes ConfigMap data fields into individual files

 Hot Network Questions

 * Is the supposedly fake prophecy of Mahdi that the Bene Gesserit implanted on Arrakis actually a real prophecy?
 * How would I make text bend (as if it's being folded) but not on an isometric grid?
 * Why did XML lose out to XHTML, then HTML 5, on the web?
 * Reasonable doubt of eye witness's need for glasses in 12 Angry Men
 * Making an exoskeleton for combat
 * Having a second bite of the data-apple without p-hacking
 * How do objects move in a linear path if you can never apply a force to the center of mass of it?
 * What are the consequences or risks of signing a document with a future date?
 * jacking up a car on "grass paving block" - how to secure jack and supports?
 * Does Sola Scriptura imply that one should expect no personal spiritual experience of the Gospel?
 * Passionate about research in general but open to many fields: is academia for me?
 * Restrict User in an AD group from logging on to computers but allow them to use their windows credentials to log on to a webapp
 * How do I play this note? (Drakengard 3 Kuroi Uta)
 * Energy and Power: Power Spectral Density is units of Energy
 * Progress on Gromov's Conjecture of the bound of total Betti numbers
 * How do you correctly compile the chained comparison operators like ones that exist in Python (`a < b < c`), if `b` might have side-effects?
 * Value of describing game mechanics in a data file instead of hardcoding?
 * In a nested multicols environment, how to only set the most inner one has separation ruler?
 * King cake with shy guests
 * Dimension of fibers under continuous maps
 * Horror/Monster movie shown on TV in Basic Instinct
 * How does ls know how to output its results?
 * If microwave ovens run at 2.4 GHz, what is the long-term effect on living tissue of exposure to this frequency, but with a thousand times less energy?
 * Pattern Matching on Request Body for Routing an HTTP Request
 Question feed

 Subscribe to RSS

 Question feed

 To subscribe to this RSS feed, copy and paste this URL into your RSS reader.

 Stack Overflow

 * Questions
 * Help

 Products

 * Teams
 * Advertising
 * Collectives
 * Talent

 Company

 * About
 * Press
 * Work Here
 * Legal
 * Privacy Policy
 * Terms of Service
 * Contact Us
 * Cookie Settings
 * Cookie Policy

 Stack Exchange Network

 * Technology
 * Culture & recreation
 * Life & arts
 * Science
 * Professional
 * Business
 * API
 * Data
 * Blog
 * Facebook
 * Twitter
 * LinkedIn
 * Instagram

 Site design / logo © 2024 Stack Exchange Inc; user contributions licensed under CC BY-SA. rev 2024.4.30.8420

 By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.
 Accept all cookies Necessary cookies only
 Customize settings
I have a few quite large UTF-8 data files that pods need to load into memory on start up - from a couple of hundred KBs to around 50 MB. 
The project (including helm chart) is open source but some of these files are not - otherwise I would probably just include them in the images. My initial thinking was to create configmaps but my understanding is that 50 MB is more than configmaps were intended for, so that might end up being a problem in some circumstances. I think secrets would also be overkill - they aren't secret, they just shouldn't be put on the open internet.
For performance reasons I'd rather have a copy in memory in each pod rather than going for a shared cache but I might be wrong on that. At the very least that will likely add more complexity than it's worth.
Are configmaps the way to go?
   
 Jonas  
 asked 
   
 AntonOfTheWoods  
 
From my point of view, the best solution would be using init container to download the files from a secured storage (as it was mentioned by Andrew Savinykh in the comments), to the pod's volume and then use it in the pod's main container.
Please see the example:
  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 {}
 
   
 answered
Make large static data files available to kubernetes pods
https://stackoverflow.com/questions/54181419/make-large-static-data-files-available-to-kubernetes-pods