Policy APIs
Reference guide for policy APIs
Abstract
Chapter 1. Policy APIs
1.1. Eviction [policy/v1]
- Description
- Eviction evicts a pod from its node subject to certain policies and safety constraints. This is a subresource of Pod. A request to cause such an eviction is created by POSTing to …/pods/<pod name>/evictions.
- Type
-
object
1.2. PodDisruptionBudget [policy/v1]
- Description
- PodDisruptionBudget is an object to define the max disruption that can be caused to a collection of pods
- Type
-
object
Chapter 2. Eviction [policy/v1]
- Description
- Eviction evicts a pod from its node subject to certain policies and safety constraints. This is a subresource of Pod. A request to cause such an eviction is created by POSTing to …/pods/<pod name>/evictions.
- Type
-
object
2.1. Specification
| Property | Type | Description |
|---|---|---|
|
|
| APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
|
| DeleteOptions may be provided | |
|
|
| Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
|
| ObjectMeta describes the pod that is being evicted. |
2.2. API endpoints
The following API endpoints are available:
/api/v1/namespaces/{namespace}/pods/{name}/eviction-
POST: create eviction of a Pod
-
2.2.1. /api/v1/namespaces/{namespace}/pods/{name}/eviction
| Parameter | Type | Description |
|---|---|---|
|
|
| name of the Eviction |
| Parameter | Type | Description |
|---|---|---|
|
|
| When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed |
|
|
| fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered. |
- HTTP method
-
POST - Description
- create eviction of a Pod
| Parameter | Type | Description |
|---|---|---|
|
|
|
| HTTP code | Reponse body |
|---|---|
| 200 - OK |
|
| 201 - Created |
|
| 202 - Accepted |
|
| 401 - Unauthorized | Empty |
Chapter 3. PodDisruptionBudget [policy/v1]
- Description
- PodDisruptionBudget is an object to define the max disruption that can be caused to a collection of pods
- Type
-
object
3.1. Specification
| Property | Type | Description |
|---|---|---|
|
|
| APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
|
|
| Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
|
| Standard object’s metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata | |
|
|
| PodDisruptionBudgetSpec is a description of a PodDisruptionBudget. |
|
|
| PodDisruptionBudgetStatus represents information about the status of a PodDisruptionBudget. Status may trail the actual state of a system. |
3.1.1. .spec
- Description
- PodDisruptionBudgetSpec is a description of a PodDisruptionBudget.
- Type
-
object
| Property | Type | Description |
|---|---|---|
|
| An eviction is allowed if at most "maxUnavailable" pods selected by "selector" are unavailable after the eviction, i.e. even in absence of the evicted pod. For example, one can prevent all voluntary evictions by specifying 0. This is a mutually exclusive setting with "minAvailable". | |
|
| An eviction is allowed if at least "minAvailable" pods selected by "selector" will still be available after the eviction, i.e. even in the absence of the evicted pod. So for example you can prevent all voluntary evictions by specifying "100%". | |
|
| Label query over pods whose evictions are managed by the disruption budget. A null selector will match no pods, while an empty ({}) selector will select all pods within the namespace. | |
|
|
| UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods should be considered for eviction. Current implementation considers healthy pods, as pods that have status.conditions item with type="Ready",status="True". Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy. IfHealthyBudget policy means that running pods (status.phase="Running"), but not yet healthy can be evicted only if the guarded application is not disrupted (status.currentHealthy is at least equal to status.desiredHealthy). Healthy pods will be subject to the PDB for eviction. AlwaysAllow policy means that all running pods (status.phase="Running"), but not yet healthy are considered disrupted and can be evicted regardless of whether the criteria in a PDB is met. This means perspective running pods of a disrupted application might not get a chance to become healthy. Healthy pods will be subject to the PDB for eviction. Additional policies may be added in the future. Clients making eviction decisions should disallow eviction of unhealthy pods if they encounter an unrecognized policy in this field. This field is beta-level. The eviction API uses this field when the feature gate PDBUnhealthyPodEvictionPolicy is enabled (enabled by default).
Possible enum values: - |
3.1.2. .status
- Description
- PodDisruptionBudgetStatus represents information about the status of a PodDisruptionBudget. Status may trail the actual state of a system.
- Type
-
object - Required
-
disruptionsAllowed -
currentHealthy -
desiredHealthy -
expectedPods
-
| Property | Type | Description |
|---|---|---|
|
| Conditions contain conditions for PDB. The disruption controller sets the DisruptionAllowed condition. The following are known values for the reason field (additional reasons could be added in the future): - SyncFailed: The controller encountered an error and wasn’t able to compute the number of allowed disruptions. Therefore no disruptions are allowed and the status of the condition will be False. - InsufficientPods: The number of pods are either at or below the number required by the PodDisruptionBudget. No disruptions are allowed and the status of the condition will be False. - SufficientPods: There are more pods than required by the PodDisruptionBudget. The condition will be True, and the number of allowed disruptions are provided by the disruptionsAllowed property. | |
|
|
| current number of healthy pods |
|
|
| minimum desired number of healthy pods |
|
| DisruptedPods contains information about pods whose eviction was processed by the API server eviction subresource handler but has not yet been observed by the PodDisruptionBudget controller. A pod will be in this map from the time when the API server processed the eviction request to the time when the pod is seen by PDB controller as having been marked for deletion (or after a timeout). The key in the map is the name of the pod and the value is the time when the API server processed the eviction request. If the deletion didn’t occur and a pod is still there it will be removed from the list automatically by PodDisruptionBudget controller after some time. If everything goes smooth this map should be empty for the most of the time. Large number of entries in the map may indicate problems with pod deletions. | |
|
|
| Number of pod disruptions that are currently allowed. |
|
|
| total number of pods counted by this disruption budget |
|
|
| Most recent generation observed when updating this PDB status. DisruptionsAllowed and other status information is valid only if observedGeneration equals to PDB’s object generation. |
3.2. API endpoints
The following API endpoints are available:
/apis/policy/v1/poddisruptionbudgets-
GET: list or watch objects of kind PodDisruptionBudget
-
/apis/policy/v1/watch/poddisruptionbudgets-
GET: watch individual changes to a list of PodDisruptionBudget. deprecated: use the 'watch' parameter with a list operation instead.
-
/apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets-
DELETE: delete collection of PodDisruptionBudget -
GET: list or watch objects of kind PodDisruptionBudget -
POST: create a PodDisruptionBudget
-
/apis/policy/v1/watch/namespaces/{namespace}/poddisruptionbudgets-
GET: watch individual changes to a list of PodDisruptionBudget. deprecated: use the 'watch' parameter with a list operation instead.
-
/apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name}-
DELETE: delete a PodDisruptionBudget -
GET: read the specified PodDisruptionBudget -
PATCH: partially update the specified PodDisruptionBudget -
PUT: replace the specified PodDisruptionBudget
-
/apis/policy/v1/watch/namespaces/{namespace}/poddisruptionbudgets/{name}-
GET: watch changes to an object of kind PodDisruptionBudget. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.
-
/apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name}/status-
GET: read status of the specified PodDisruptionBudget -
PATCH: partially update status of the specified PodDisruptionBudget -
PUT: replace status of the specified PodDisruptionBudget
-
3.2.1. /apis/policy/v1/poddisruptionbudgets
- HTTP method
-
GET - Description
- list or watch objects of kind PodDisruptionBudget
| HTTP code | Reponse body |
|---|---|
| 200 - OK |
|
| 401 - Unauthorized | Empty |
3.2.2. /apis/policy/v1/watch/poddisruptionbudgets
- HTTP method
-
GET - Description
- watch individual changes to a list of PodDisruptionBudget. deprecated: use the 'watch' parameter with a list operation instead.
| HTTP code | Reponse body |
|---|---|
| 200 - OK |
|
| 401 - Unauthorized | Empty |
3.2.3. /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets
- HTTP method
-
DELETE - Description
- delete collection of PodDisruptionBudget
| Parameter | Type | Description |
|---|---|---|
|
|
| When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed |
| HTTP code | Reponse body |
|---|---|
| 200 - OK |
|
| 401 - Unauthorized | Empty |
- HTTP method
-
GET - Description
- list or watch objects of kind PodDisruptionBudget
| HTTP code | Reponse body |
|---|---|
| 200 - OK |
|
| 401 - Unauthorized | Empty |
- HTTP method
-
POST - Description
- create a PodDisruptionBudget
| Parameter | Type | Description |
|---|---|---|
|
|
| When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed |
|
|
| fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered. |
| Parameter | Type | Description |
|---|---|---|
|
|
|
| HTTP code | Reponse body |
|---|---|
| 200 - OK |
|
| 201 - Created |
|
| 202 - Accepted |
|
| 401 - Unauthorized | Empty |
3.2.4. /apis/policy/v1/watch/namespaces/{namespace}/poddisruptionbudgets
- HTTP method
-
GET - Description
- watch individual changes to a list of PodDisruptionBudget. deprecated: use the 'watch' parameter with a list operation instead.
| HTTP code | Reponse body |
|---|---|
| 200 - OK |
|
| 401 - Unauthorized | Empty |
3.2.5. /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name}
| Parameter | Type | Description |
|---|---|---|
|
|
| name of the PodDisruptionBudget |
- HTTP method
-
DELETE - Description
- delete a PodDisruptionBudget
| Parameter | Type | Description |
|---|---|---|
|
|
| When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed |
| HTTP code | Reponse body |
|---|---|
| 200 - OK |
|
| 202 - Accepted |
|
| 401 - Unauthorized | Empty |
- HTTP method
-
GET - Description
- read the specified PodDisruptionBudget
| HTTP code | Reponse body |
|---|---|
| 200 - OK |
|
| 401 - Unauthorized | Empty |
- HTTP method
-
PATCH - Description
- partially update the specified PodDisruptionBudget
| Parameter | Type | Description |
|---|---|---|
|
|
| When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed |
|
|
| fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered. |
| HTTP code | Reponse body |
|---|---|
| 200 - OK |
|
| 201 - Created |
|
| 401 - Unauthorized | Empty |
- HTTP method
-
PUT - Description
- replace the specified PodDisruptionBudget
| Parameter | Type | Description |
|---|---|---|
|
|
| When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed |
|
|
| fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered. |
| Parameter | Type | Description |
|---|---|---|
|
|
|
| HTTP code | Reponse body |
|---|---|
| 200 - OK |
|
| 201 - Created |
|
| 401 - Unauthorized | Empty |
3.2.6. /apis/policy/v1/watch/namespaces/{namespace}/poddisruptionbudgets/{name}
| Parameter | Type | Description |
|---|---|---|
|
|
| name of the PodDisruptionBudget |
- HTTP method
-
GET - Description
- watch changes to an object of kind PodDisruptionBudget. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.
| HTTP code | Reponse body |
|---|---|
| 200 - OK |
|
| 401 - Unauthorized | Empty |
3.2.7. /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name}/status
| Parameter | Type | Description |
|---|---|---|
|
|
| name of the PodDisruptionBudget |
- HTTP method
-
GET - Description
- read status of the specified PodDisruptionBudget
| HTTP code | Reponse body |
|---|---|
| 200 - OK |
|
| 401 - Unauthorized | Empty |
- HTTP method
-
PATCH - Description
- partially update status of the specified PodDisruptionBudget
| Parameter | Type | Description |
|---|---|---|
|
|
| When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed |
|
|
| fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered. |
| HTTP code | Reponse body |
|---|---|
| 200 - OK |
|
| 201 - Created |
|
| 401 - Unauthorized | Empty |
- HTTP method
-
PUT - Description
- replace status of the specified PodDisruptionBudget
| Parameter | Type | Description |
|---|---|---|
|
|
| When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed |
|
|
| fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered. |
| Parameter | Type | Description |
|---|---|---|
|
|
|
| HTTP code | Reponse body |
|---|---|
| 200 - OK |
|
| 201 - Created |
|
| 401 - Unauthorized | Empty |
