You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As an alternative to `kubectl delete`, you can use `kubectl apply` to identify objects to be deleted after
377
373
their manifests have been removed from a directory in the local filesystem.
378
374
379
375
In Kubernetes {{< skew currentVersion >}}, there are two pruning modes available in kubectl apply:
380
-
- Allowlist-based pruning: This mode has existed since kubectl v1.5 but is still in alpha due to usability, correctness and performance issues with its design. The ApplySet-based mode is designed to replace it.
381
-
- ApplySet-based pruning: An _apply set_ is a server-side object (by default, a Secret) that kubectl can use to accurately and efficiently track set membership across **apply** operations. This mode was introduced in alpha in kubectl v1.27 as a replacement for allowlist-based pruning.
376
+
377
+
- Allowlist-based pruning: This mode has existed since kubectl v1.5 but is still
378
+
in alpha due to usability, correctness and performance issues with its design.
379
+
The ApplySet-based mode is designed to replace it.
380
+
- ApplySet-based pruning: An _apply set_ is a server-side object (by default, a Secret)
381
+
that kubectl can use to accurately and efficiently track set membership across **apply**
382
+
operations. This mode was introduced in alpha in kubectl v1.27 as a replacement for allowlist-based pruning.
Take care when using `--prune` with `kubectl apply` in allow list mode. Which objects are pruned depends on the values of the `--prune-allowlist`, `--selector` and `--namespace` flags, and relies on dynamic discovery of the objects in scope. Especially if flag values are changed between invocations, this can lead to objects being unexpectedly deleted or retained.
390
+
Take care when using `--prune` with `kubectl apply` in allow list mode. Which
391
+
objects are pruned depends on the values of the `--prune-allowlist`, `--selector`
392
+
and `--namespace` flags, and relies on dynamic discovery of the objects in scope.
393
+
Especially if flag values are changed between invocations, this can lead to objects
394
+
being unexpectedly deleted or retained.
390
395
{{< /warning >}}
391
396
392
397
To use allowlist-based pruning, add the following flags to your `kubectl apply` invocation:
398
+
393
399
-`--prune`: Delete previously applied objects that are not in the set passed to the current invocation.
394
-
-`--prune-allowlist`: A list of group-version-kinds (GVKs) to consider for pruning. This flag is optional but strongly encouraged, as its default value is a partial list of both namespaced and cluster-scoped types, which can lead to surprising results.
395
-
-`--selector/-l`: Use a label selector to constrain the set of objects selected for pruning. This flag is optional but strongly encouraged.
396
-
-`--all`: use instead of `--selector/-l` to explicitly select all previously applied objects of the allowlisted types.
400
+
-`--prune-allowlist`: A list of group-version-kinds (GVKs) to consider for pruning.
401
+
This flag is optional but strongly encouraged, as its default value is a partial
402
+
list of both namespaced and cluster-scoped types, which can lead to surprising results.
403
+
-`--selector/-l`: Use a label selector to constrain the set of objects selected
404
+
for pruning. This flag is optional but strongly encouraged.
405
+
-`--all`: use instead of `--selector/-l` to explicitly select all previously
406
+
applied objects of the allowlisted types.
397
407
398
408
Allowlist-based pruning queries the API server for all objects of the allowlisted GVKs that match the given labels (if any), and attempts to match the returned live object configurations against the object
399
409
manifest files. If an object matches the query, and it does not have a
400
410
manifest in the directory, and it has a `kubectl.kubernetes.io/last-applied-configuration` annotation,
By default, the type of the ApplySet parent object used is a Secret. However, ConfigMaps can also be used in the format: `--applyset=configmaps/<name>`. When using a Secret or ConfigMap, kubectl will create the object if it does not already exist.
435
-
436
-
It is also possible to use custom resources as ApplySet parent objects. To enable this, label the Custom Resource Definition (CRD) that defines the resource you want to use with the following: `applyset.kubernetes.io/is-parent-type: true`. Then, create the object you want to use as an ApplySet parent (kubectl does not do this automatically for custom resources). Finally, refer to that object in the applyset flag as follows: `--applyset=<resource>.<group>/<name>` (for example, `widgets.custom.example.com/widget-name`).
437
-
438
-
With ApplySet-based pruning, kubectl adds the `applyset.kubernetes.io/part-of=<parentID>` label to each object in the set before they are sent to the server. For performance reasons, it also collects the list of resource types and namespaces that the set contains and adds these in annotations on the live parent object. Finally, at the end of the apply operation, it queries the API server for objects of those types in those namespaces (or in the cluster scope, as applicable) that belong to the set, as defined by the `applyset.kubernetes.io/part-of=<parentID>` label.
446
+
By default, the type of the ApplySet parent object used is a Secret. However,
447
+
ConfigMaps can also be used in the format: `--applyset=configmaps/<name>`.
448
+
When using a Secret or ConfigMap, kubectl will create the object if it does not already exist.
449
+
450
+
It is also possible to use custom resources as ApplySet parent objects. To enable
451
+
this, label the Custom Resource Definition (CRD) that defines the resource you want
452
+
to use with the following: `applyset.kubernetes.io/is-parent-type: true`. Then, create
453
+
the object you want to use as an ApplySet parent (kubectl does not do this automatically
454
+
for custom resources). Finally, refer to that object in the applyset flag as follows:
455
+
`--applyset=<resource>.<group>/<name>` (for example, `widgets.custom.example.com/widget-name`).
456
+
457
+
With ApplySet-based pruning, kubectl adds the `applyset.kubernetes.io/part-of=<parentID>`
458
+
label to each object in the set before they are sent to the server. For performance reasons,
459
+
it also collects the list of resource types and namespaces that the set contains and adds
460
+
these in annotations on the live parent object. Finally, at the end of the apply operation,
461
+
it queries the API server for objects of those types in those namespaces
462
+
(or in the cluster scope, as applicable) that belong to the set, as defined by the
- The `--namespace` flag is required when using any namespaced parent, including the default Secret. This means that ApplySets spanning multiple namespaces must use a cluster-scoped custom resource as the parent object.
443
-
- To safely use ApplySet-based pruning with multiple directories, use a unique ApplySet name for each.
468
+
- The `--namespace` flag is required when using any namespaced parent, including
469
+
the default Secret. This means that ApplySets spanning multiple namespaces must
470
+
use a cluster-scoped custom resource as the parent object.
471
+
- To safely use ApplySet-based pruning with multiple directories,
472
+
use a unique ApplySet name for each.
444
473
445
474
{{% /tab %}}
446
475
447
476
{{< /tabs >}}
448
477
449
-
450
478
## How to view an object
451
479
452
480
You can use `kubectl get` with `-o yaml` to view the configuration of a live object:
@@ -478,8 +506,10 @@ is used to identify fields that have been removed from the configuration
478
506
file and need to be cleared from the live configuration. Here are the steps used
479
507
to calculate which fields should be deleted or set:
480
508
481
-
1. Calculate the fields to delete. These are the fields present in `last-applied-configuration` and missing from the configuration file.
482
-
2. Calculate the fields to add or set. These are the fields present in the configuration file whose values don't match the live configuration.
509
+
1. Calculate the fields to delete. These are the fields present in
510
+
`last-applied-configuration` and missing from the configuration file.
511
+
2. Calculate the fields to add or set. These are the fields present in
512
+
the configuration file whose values don't match the live configuration.
483
513
484
514
Here's an example. Suppose this is the configuration file for a Deployment object:
485
515
@@ -534,11 +564,11 @@ Here are the merge calculations that would be performed by `kubectl apply`:
534
564
regardless of whether they appear in the `last-applied-configuration`.
535
565
In this example, `minReadySeconds` appears in the
536
566
`last-applied-configuration` annotation, but does not appear in the configuration file.
537
-
**Action:** Clear `minReadySeconds` from the live configuration.
567
+
**Action:** Clear `minReadySeconds` from the live configuration.
538
568
2. Calculate the fields to set by reading values from the configuration
539
569
file and comparing them to values in the live configuration. In this example,
540
570
the value of `image` in the configuration file does not match
541
-
the value in the live configuration. **Action:** Set the value of `image` in the live configuration.
571
+
the value in the live configuration. **Action:** Set the value of `image` in the live configuration.
542
572
3. Set the `last-applied-configuration` annotation to match the value
543
573
of the configuration file.
544
574
4. Merge the results from 1, 2, 3 into a single patch request to the API server.
@@ -984,22 +1014,22 @@ configuration involves several manual steps:
984
1014
985
1015
1. Export the live object to a local configuration file:
986
1016
987
-
```shell
988
-
kubectl get <kind>/<name> -o yaml > <kind>_<name>.yaml
989
-
```
1017
+
```shell
1018
+
kubectl get <kind>/<name> -o yaml > <kind>_<name>.yaml
1019
+
```
990
1020
991
1021
1. Manually remove the `status` field from the configuration file.
992
1022
993
-
{{< note >}}
994
-
This step is optional, as `kubectl apply` does not update the status field
995
-
even if it is present in the configuration file.
996
-
{{< /note >}}
1023
+
{{< note >}}
1024
+
This step is optional, as `kubectl apply` does not update the status field
1025
+
even if it is present in the configuration file.
1026
+
{{< /note >}}
997
1027
998
1028
1. Set the `kubectl.kubernetes.io/last-applied-configuration` annotation on the object:
0 commit comments