kubelet [page]deterministic
##
The kubelet is the primary "node agent" that runs on each node. It can register the node with the apiserver using one of: the hostname; a flag to override the hostname; or specific logic for a cloud provider.
The kubelet works in terms of a PodSpec. A PodSpec is a YAML or JSON object that describes a pod. The kubelet takes a set of PodSpecs that are provided through various mechanisms (primarily through the apiserver) and ensures that the containers described in those PodSpecs are running and healthy. The kubelet doesn't manage containers which were not created by Kubernetes.
Other than from an PodSpec from the apiserver, there are two ways that a container manifest can be provided to the Kubelet.
File: Path passed as a flag on the command line. Files under this path will be monitored periodically for updates. The monitoring period is 20s by default and is configurable via a flag.
HTTP endpoint: HTTP endpoint passed as a parameter on the command line. This endpoint is checked every 20 seconds (also configurable with a flag).
``` kubelet [flags] ```
##
<table style="width: 100%; table-layout: fixed;"> <colgroup> <col span="1" style="width: 10px;" /> <col span="1" /> </colgroup> <tbody>
<tr> <td colspan="2">--address string Default: 0.0.0.0</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>The IP address for the Kubelet to serve on (set to '0.0.0.0' or '::' for listening on all interfaces and IP address families) (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)</p></td> </tr>
<tr> <td colspan="2">--allowed-unsafe-sysctls strings</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>Comma-separated whitelist of unsafe sysctls or unsafe sysctl patterns (ending in *). Use these at your own risk. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)</p></td> </tr>
<tr> <td colspan="2">--anonymous-auth Default: true</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>Enables anonymous requests to the Kubelet server. Requests that are not rejected by another authentication method are treated as anonymous requests. Anonymous requests have a username of system:anonymous, and a group name of system:unauthenticated. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)</p></td> </tr>
<tr> <td colspan="2">--authentication-token-webhook</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>Use the TokenReview API to determine authentication for bearer tokens. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)</p></td> </tr>
<tr> <td colspan="2">--authentication-token-webhook-cache-ttl duration Default: 2m0s</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>The duration to cache responses from the webhook token authenticator. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)</p></td> </tr>
<tr> <td colspan="2">--authorization-mode string Default: "AlwaysAllow"</td> </tr> <tr> <td></td><td style="line-height: 130%; word-wrap: break-word;"><p>Authorization mode for Kubelet server. Valid options are AlwaysAllow …(trimmed)