kubernetes.io

Discover and access Kubernetes custom resources (CRDs) generically over REST

Check whether the current credential is permitted an action using SelfSubjectAccessReview

Validate a Kubernetes write before persisting it using dryRun and fieldValidation

Evict a Kubernetes pod safely through the Eviction API while respecting PodDisruptionBudgets

Scale a Kubernetes Deployment or StatefulSet through the /scale subresource

Execute a command in a running container through the Kubernetes exec subresource

Read and stream container logs through the Kubernetes pod log subresource

Read and stream container logs through the Kubernetes pod log subresource

Watch Kubernetes resources reliably with list-then-watch, bookmarks, and 410 recovery

Paginate large Kubernetes collections with limit and continue tokens

Avoid lost updates on Kubernetes writes using resourceVersion optimistic concurrency

Choose the correct Kubernetes PATCH content type (JSON Patch, merge, strategic merge, apply)

Server-Side Apply a manifest to the Kubernetes API with PATCH application/apply-patch+yaml

Grant an agent least-privilege kube-apiserver access with RBAC, including subresources

Authenticate to the Kubernetes API server from inside a Pod using the projected ServiceAccount token

Resize a running Kubernetes Pod's CPU/memory requests and limits in place without restarting it

Configure topology spread constraints with minDomains and nodeAffinityPolicy for zonal autoscaling

Configure PodDisruptionBudget unhealthyPodEvictionPolicy to unblock node drains with already-unhealthy pods

Configure Kubernetes topology spread constraints with matchLabelKeys to distribute pods across availability zones using rolling-update-aware spreading

Configure Kubernetes NetworkPolicy to implement a default-deny posture and selectively allow ingress from a specific service

Configure a Kubernetes PodDisruptionBudget to protect a stateful application during node drain and rolling upgrades

Configure securityContext and Pod Security Admission to enforce restricted pod standards

Create RBAC Role and RoleBinding to grant least-privilege access within a namespace

Implement the status subresource in a Kubernetes CRD and update it from the controller

Write a ValidatingAdmissionPolicy using CEL expressions to enforce resource limits

Define a Kubernetes CRD with OpenAPI v3 schema validation using apiextensions.k8s.io/v1

Implement a mutating admission webhook to inject a sidecar container into pods

Build and deploy a validating admission webhook for a Kubernetes CRD

Configure topology spread constraints to distribute pods evenly across availability zones

Configure HorizontalPodAutoscaler v2 with custom and external metrics

Configure a PodDisruptionBudget to protect a workload during voluntary disruptions

Implement finalizers in a Kubernetes operator for clean external resource deletion

Use owner references to enable automatic garbage collection of child resources in an operator

Configure a CRD conversion webhook to support multiple API versions

Implement a NetworkPolicy default-deny posture and selectively open traffic

Build a Kustomize component that adds a common sidecar container and shared volume across multiple overlays without duplicating the patch in each overlay

Configure VPA (Vertical Pod Autoscaler) in recommendation mode alongside HPA to gather right-sizing data without automatic eviction, and understand the conflict constraints

Configure a Kubernetes admission webhook with cert-manager for TLS provisioning and implement a ValidatingWebhookConfiguration to enforce custom policies