package runtime.v1alpha2
Get desktop application:
View/edit binary Protocol Buffers messages
service ImageService
criapi.proto:102ImageService defines the public APIs for managing images.
rpc ListImages (, )
criapi.proto:104ListImages lists existing images.
message
criapi.proto:1038optional filter = 1
Filter to list images.
message
criapi.proto:1064repeated images = 1
List of images.
rpc ImageStatus (, )
criapi.proto:108ImageStatus returns the status of the image. If the image is not present, returns a response with ImageStatusResponse.Image set to nil.
message
criapi.proto:1069optional image = 1
Spec of the image.
bool verbose = 2
Verbose indicates whether to return extra information about the image.
message
criapi.proto:1076optional image = 1
Status of the image.
map<string, string> info = 2
Info is extra information of the Image. The key could be arbitrary string, and value should be in json format. The information could include anything useful for debug, e.g. image config for oci image based container runtime. It should only be returned non-empty when Verbose is true.
rpc PullImage (, )
criapi.proto:110PullImage pulls an image with authentication config.
message
criapi.proto:1099optional image = 1
Spec of the image.
optional auth = 2
Authentication configuration for pulling the image.
optional sandbox_config = 3
Config of the PodSandbox, which is used to pull image in PodSandbox context.
message
criapi.proto:1108string image_ref = 1
Reference to the image in use. For most runtimes, this should be an image ID or digest.
rpc RemoveImage (, )
criapi.proto:114RemoveImage removes the image. This call is idempotent, and must not return an error if the image has already been removed.
message
criapi.proto:1114optional image = 1
Spec of the image to remove.
message
criapi.proto:1119(message has no fields)
rpc ImageFsInfo (, )
criapi.proto:116ImageFSInfo returns information of the filesystem that is used to store images.
message
criapi.proto:1182(message has no fields)
message
criapi.proto:1212repeated image_filesystems = 1
Information of image filesystem(s).
service RuntimeService
criapi.proto:23Runtime service defines the public APIs for remote container runtimes
rpc Version (, )
criapi.proto:25Version returns the runtime name, runtime version, and runtime API version.
message
criapi.proto:119string version = 1
Version of the kubelet runtime API.
message
criapi.proto:124string version = 1
Version of the kubelet runtime API.
string runtime_name = 2
Name of the container runtime.
string runtime_version = 3
Version of the container runtime. The string must be semver-compatible.
string runtime_api_version = 4
API version of the container runtime. The string must be semver-compatible.
rpc RunPodSandbox (, )
criapi.proto:29RunPodSandbox creates and starts a pod-level sandbox. Runtimes must ensure the sandbox is in the ready state on success.
message
criapi.proto:362optional config = 1
Configuration for creating a PodSandbox.
string runtime_handler = 2
Named runtime configuration to use for this PodSandbox. If the runtime handler is unknown, this request should be rejected. An empty string should select the default handler, equivalent to the behavior before this feature was added. See https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md
message
criapi.proto:373string pod_sandbox_id = 1
ID of the PodSandbox to run.
rpc StopPodSandbox (, )
criapi.proto:39StopPodSandbox stops any running process that is part of the sandbox and reclaims network resources (e.g., IP addresses) allocated to the sandbox. If there are any running containers in the sandbox, they must be forcibly terminated. This call is idempotent, and must not return an error if all relevant resources have already been reclaimed. kubelet will call StopPodSandbox at least once before calling RemovePodSandbox. It will also attempt to reclaim resources eagerly, as soon as a sandbox is not needed. Hence, multiple StopPodSandbox calls are expected.
message
criapi.proto:378string pod_sandbox_id = 1
ID of the PodSandbox to stop.
message
criapi.proto:383(message has no fields)
rpc RemovePodSandbox (, )
criapi.proto:44RemovePodSandbox removes the sandbox. If there are any running containers in the sandbox, they must be forcibly terminated and removed. This call is idempotent, and must not return an error if the sandbox has already been removed.
message
criapi.proto:385string pod_sandbox_id = 1
ID of the PodSandbox to remove.
message
criapi.proto:390(message has no fields)
rpc PodSandboxStatus (, )
criapi.proto:47PodSandboxStatus returns the status of the PodSandbox. If the PodSandbox is not present, returns an error.
message
criapi.proto:392string pod_sandbox_id = 1
ID of the PodSandbox for which to retrieve status.
bool verbose = 2
Verbose indicates whether to return extra information about the pod sandbox.
message
criapi.proto:454optional status = 1
Status of the PodSandbox.
map<string, string> info = 2
Info is extra information of the PodSandbox. The key could be arbitrary string, and value should be in json format. The information could include anything useful for debug, e.g. network namespace for linux container based container runtime. It should only be returned non-empty when Verbose is true.
rpc ListPodSandbox (, )
criapi.proto:49ListPodSandbox returns a list of PodSandboxes.
message
criapi.proto:483optional filter = 1
PodSandboxFilter to filter a list of PodSandboxes.
message
criapi.proto:510repeated items = 1
List of PodSandboxes.
rpc CreateContainer (, )
criapi.proto:52CreateContainer creates a new container in specified PodSandbox
message
criapi.proto:781string pod_sandbox_id = 1
ID of the PodSandbox in which the container should be created.
optional config = 2
Config of the container.
optional sandbox_config = 3
Config of the PodSandbox. This is the same config that was passed to RunPodSandboxRequest to create the PodSandbox. It is passed again here just for easy reference. The PodSandboxConfig is immutable and remains the same throughout the lifetime of the pod.
message
criapi.proto:793string container_id = 1
ID of the created container.
rpc StartContainer (, )
criapi.proto:54StartContainer starts the container.
message
criapi.proto:798string container_id = 1
ID of the container to start.
message
criapi.proto:803(message has no fields)
rpc StopContainer (, )
criapi.proto:59StopContainer stops a running container with a grace period (i.e., timeout). This call is idempotent, and must not return an error if the container has already been stopped. TODO: what must the runtime do after the grace period is reached?
message
criapi.proto:805string container_id = 1
ID of the container to stop.
int64 timeout = 2
Timeout in seconds to wait for the container to stop before forcibly terminating it. Default: 0 (forcibly terminate the container immediately)
message
criapi.proto:813(message has no fields)
rpc RemoveContainer (, )
criapi.proto:64RemoveContainer removes the container. If the container is running, the container must be forcibly removed. This call is idempotent, and must not return an error if the container has already been removed.
message
criapi.proto:815string container_id = 1
ID of the container to remove.
message
criapi.proto:820(message has no fields)
rpc ListContainers (, )
criapi.proto:66ListContainers lists all containers by filters.
message
criapi.proto:850optional filter = 1
message
criapi.proto:882repeated containers = 1
List of containers.
rpc ContainerStatus (, )
criapi.proto:69ContainerStatus returns status of the container. If the container is not present, returns an error.
message
criapi.proto:887string container_id = 1
ID of the container for which to retrieve status.
bool verbose = 2
Verbose indicates whether to return extra information about the container.
message
criapi.proto:933optional status = 1
Status of the container.
map<string, string> info = 2
Info is extra information of the Container. The key could be arbitrary string, and value should be in json format. The information could include anything useful for debug, e.g. pid for linux container based container runtime. It should only be returned non-empty when Verbose is true.
UpdateContainerResources updates ContainerConfig of the container.
message
criapi.proto:943string container_id = 1
ID of the container to update.
optional linux = 2
Resource configuration specific to Linux containers.
message
criapi.proto:950(message has no fields)
rpc ReopenContainerLog (, )
criapi.proto:77ReopenContainerLog asks runtime to reopen the stdout/stderr log file for the container. This is often called after the log file has been rotated. If the container is not running, container runtime can choose to either create a new log file and return nil, or return an error. Once it returns error, new container log file MUST NOT be created.
message
criapi.proto:1293string container_id = 1
ID of the container for which to reopen the log.
message
criapi.proto:1298(message has no fields)
rpc ExecSync (, )
criapi.proto:80ExecSync runs a command in a container synchronously.
message
criapi.proto:952string container_id = 1
ID of the container.
repeated string cmd = 2
Command to execute.
int64 timeout = 3
Timeout in seconds to stop the command. Default: 0 (run forever).
message
criapi.proto:961bytes stdout = 1
Captured command stdout output.
bytes stderr = 2
Captured command stderr output.
int32 exit_code = 3
Exit code the command finished with. Default: 0 (success).
rpc Exec (, )
criapi.proto:82Exec prepares a streaming endpoint to execute a command in the container.
message
criapi.proto:970string container_id = 1
ID of the container in which to execute the command.
repeated string cmd = 2
Command to execute.
bool tty = 3
Whether to exec the command in a TTY.
bool stdin = 4
Whether to stream stdin. One of `stdin`, `stdout`, and `stderr` MUST be true.
bool stdout = 5
Whether to stream stdout. One of `stdin`, `stdout`, and `stderr` MUST be true.
bool stderr = 6
Whether to stream stderr. One of `stdin`, `stdout`, and `stderr` MUST be true. If `tty` is true, `stderr` MUST be false. Multiplexing is not supported in this case. The output of stdout and stderr will be combined to a single stream.
message
criapi.proto:991string url = 1
Fully qualified URL of the exec streaming server.
rpc Attach (, )
criapi.proto:84Attach prepares a streaming endpoint to attach to a running container.
message
criapi.proto:996string container_id = 1
ID of the container to which to attach.
bool stdin = 2
Whether to stream stdin. One of `stdin`, `stdout`, and `stderr` MUST be true.
bool tty = 3
Whether the process being attached is running in a TTY. This must match the TTY setting in the ContainerConfig.
bool stdout = 4
Whether to stream stdout. One of `stdin`, `stdout`, and `stderr` MUST be true.
bool stderr = 5
Whether to stream stderr. One of `stdin`, `stdout`, and `stderr` MUST be true. If `tty` is true, `stderr` MUST be false. Multiplexing is not supported in this case. The output of stdout and stderr will be combined to a single stream.
message
criapi.proto:1016string url = 1
Fully qualified URL of the attach streaming server.
rpc PortForward (, )
criapi.proto:86PortForward prepares a streaming endpoint to forward ports from a PodSandbox.
message
criapi.proto:1021string pod_sandbox_id = 1
ID of the container to which to forward the port.
repeated int32 port = 2
Port to forward.
message
criapi.proto:1028string url = 1
Fully qualified URL of the port-forward streaming server.
rpc ContainerStats (, )
criapi.proto:90ContainerStats returns stats of the container. If the container does not exist, the call returns an error.
message
criapi.proto:1217string container_id = 1
ID of the container for which to retrieve stats.
message
criapi.proto:1222optional stats = 1
Stats of the container.
rpc ListContainerStats (, )
criapi.proto:92ListContainerStats returns stats of all running containers.
message
criapi.proto:1227optional filter = 1
Filter for the list request.
message
criapi.proto:1245repeated stats = 1
Stats of the container.
rpc UpdateRuntimeConfig (, )
criapi.proto:95UpdateRuntimeConfig updates the runtime configuration based on the given request.
message
criapi.proto:1131optional runtime_config = 1
message
criapi.proto:1135(message has no fields)
rpc Status (, )
criapi.proto:98Status returns the status of the runtime.
message
criapi.proto:1167bool verbose = 1
Verbose indicates whether to return extra information about the runtime.
message
criapi.proto:1172optional status = 1
Status of the Runtime.
map<string, string> info = 2
Info is extra information of the Runtime. The key could be arbitrary string, and value should be in json format. The information could include anything useful for debug, e.g. plugins used by the container runtime. It should only be returned non-empty when Verbose is true.
message
criapi.proto:1087AuthConfig contains authorization information for connecting to a registry.
Used in:
string username = 1
string password = 2
string auth = 3
string server_address = 4
string identity_token = 5
IdentityToken is used to authenticate the user and get an access token for the registry.
string registry_token = 6
RegistryToken is a bearer token to be sent to a registry
message
criapi.proto:573Capability contains the container capabilities to add or drop
Used in:
repeated string add_capabilities = 1
List of capabilities to add.
repeated string drop_capabilities = 2
List of capabilities to drop.
message
criapi.proto:856Container provides the runtime information for a container, such as ID, hash, state of the container.
Used in:
string id = 1
ID of the container, used by the container runtime to identify a container.
string pod_sandbox_id = 2
ID of the sandbox to which this container belongs.
optional metadata = 3
Metadata of the container.
optional image = 4
Spec of the image.
string image_ref = 5
Reference to the image in use. For most runtimes, this should be an image ID.
ContainerState state = 6
State of the container.
int64 created_at = 7
Creation time of the container in nanoseconds.
map<string, string> labels = 8
Key-value pairs that may be used to scope and select individual resources.
map<string, string> annotations = 9
Unstructured key-value map holding arbitrary metadata. Annotations MUST NOT be altered by the runtime; the value of this field MUST be identical to that of the corresponding ContainerConfig used to instantiate this Container.
message
criapi.proto:1251ContainerAttributes provides basic information of the container.
Used in:
string id = 1
ID of the container.
optional metadata = 2
Metadata of the container.
map<string, string> labels = 3
Key-value pairs that may be used to scope and select individual resources.
map<string, string> annotations = 4
Unstructured key-value map holding arbitrary metadata. Annotations MUST NOT be altered by the runtime; the value of this field MUST be identical to that of the corresponding ContainerConfig used to instantiate the Container this status represents.
message
criapi.proto:717ContainerConfig holds all the required and optional fields for creating a container.
Used in:
optional metadata = 1
Metadata of the container. This information will uniquely identify the container, and the runtime should leverage this to ensure correct operation. The runtime may also use this information to improve UX, such as by constructing a readable name.
optional image = 2
Image to use.
repeated string command = 3
Command to execute (i.e., entrypoint for docker)
repeated string args = 4
Args for the Command (i.e., command for docker)
string working_dir = 5
Current working directory of the command.
repeated envs = 6
List of environment variable to set in the container.
repeated mounts = 7
Mounts for the container.
repeated devices = 8
Devices for the container.
map<string, string> labels = 9
Key-value pairs that may be used to scope and select individual resources. Label keys are of the form: label-key ::= prefixed-name | name prefixed-name ::= prefix '/' name prefix ::= DNS_SUBDOMAIN name ::= DNS_LABEL
map<string, string> annotations = 10
Unstructured key-value map that may be used by the kubelet to store and retrieve arbitrary metadata. Annotations MUST NOT be altered by the runtime; the annotations stored here MUST be returned in the ContainerStatus associated with the container this ContainerConfig creates. In general, in order to preserve a well-defined interface between the kubelet and the container runtime, annotations SHOULD NOT influence runtime behaviour.
string log_path = 11
Path relative to PodSandboxConfig.LogDirectory for container to store the log (STDOUT and STDERR) on the host. E.g., PodSandboxConfig.LogDirectory = `/var/log/pods/<podUID>/` ContainerConfig.LogPath = `containerName/Instance#.log` WARNING: Log management and how kubelet should interface with the container logs are under active discussion in https://issues.k8s.io/24677. There *may* be future change of direction for logging as the discussion carries on.
bool stdin = 12
Variables for interactive containers, these have very specialized use-cases (e.g. debugging). TODO: Determine if we need to continue supporting these fields that are part of Kubernetes's Container Spec.
bool stdin_once = 13
bool tty = 14
optional linux = 15
Configuration specific to Linux containers.
optional windows = 16
Configuration specific to Windows containers.
message
criapi.proto:837ContainerFilter is used to filter containers. All those fields are combined with 'AND'
Used in:
string id = 1
ID of the container.
optional state = 2
State of the container.
string pod_sandbox_id = 3
ID of the PodSandbox.
map<string, string> label_selector = 4
LabelSelector to select matches. Only api.MatchLabels is supported for now and the requirements are ANDed. MatchExpressions is not supported yet.
message
criapi.proto:695ContainerMetadata holds all necessary information for building the container name. The container runtime is encouraged to expose the metadata in its user interface for better user experience. E.g., runtime can construct a unique container name based on the metadata. Note that (name, attempt) is unique within a sandbox for the entire lifetime of the sandbox.
Used in: , , ,
string name = 1
Name of the container. Same as the container name in the PodSpec.
uint32 attempt = 2
Attempt number of creating the container. Default: 0.
Used in: , ,
CONTAINER_CREATED = 0
CONTAINER_RUNNING = 1
CONTAINER_EXITED = 2
CONTAINER_UNKNOWN = 3
message
criapi.proto:830ContainerStateValue is the wrapper of ContainerState.
Used in:
ContainerState state = 1
State of the container.
message
criapi.proto:1266ContainerStats provides the resource usage statistics for a container.
Used in: ,
optional attributes = 1
Information of the container.
optional cpu = 2
CPU usage gathered from the container.
optional memory = 3
Memory usage gathered from the container.
optional writable_layer = 4
Usage of the writable layer.
message
criapi.proto:1234ContainerStatsFilter is used to filter containers. All those fields are combined with 'AND'
Used in:
string id = 1
ID of the container.
string pod_sandbox_id = 2
ID of the PodSandbox.
map<string, string> label_selector = 3
LabelSelector to select matches. Only api.MatchLabels is supported for now and the requirements are ANDed. MatchExpressions is not supported yet.
message
criapi.proto:895ContainerStatus represents the status of a container.
Used in:
string id = 1
ID of the container.
optional metadata = 2
Metadata of the container.
ContainerState state = 3
Status of the container.
int64 created_at = 4
Creation time of the container in nanoseconds.
int64 started_at = 5
Start time of the container in nanoseconds. Default: 0 (not specified).
int64 finished_at = 6
Finish time of the container in nanoseconds. Default: 0 (not specified).
int32 exit_code = 7
Exit code of the container. Only required when finished_at != 0. Default: 0.
optional image = 8
Spec of the image.
string image_ref = 9
Reference to the image in use. For most runtimes, this should be an image ID
string reason = 10
Brief CamelCase string explaining why container is in its current state.
string message = 11
Human-readable message indicating details about why container is in its current state.
map<string, string> labels = 12
Key-value pairs that may be used to scope and select individual resources.
map<string, string> annotations = 13
Unstructured key-value map holding arbitrary metadata. Annotations MUST NOT be altered by the runtime; the value of this field MUST be identical to that of the corresponding ContainerConfig used to instantiate the Container this status represents.
repeated mounts = 14
Mounts for the container.
string log_path = 15
Log path of container.
message
criapi.proto:1278CpuUsage provides the CPU usage information.
Used in:
int64 timestamp = 1
Timestamp in nanoseconds at which the information were collected. Must be > 0.
optional usage_core_nano_seconds = 2
Cumulative CPU usage (sum across all cores) since object creation.
message
criapi.proto:138DNSConfig specifies the DNS servers and search domains of a sandbox.
Used in:
repeated string servers = 1
List of DNS servers of the cluster.
repeated string searches = 2
List of DNS search domains of the cluster.
repeated string options = 3
List of DNS options. See https://linux.die.net/man/5/resolv.conf for all available options.
message
criapi.proto:703Device specifies a host device to mount into a container.
Used in:
string container_path = 1
Path of the device within the container.
string host_path = 2
Path of the device on the host.
string permissions = 3
Cgroups permissions of the device, candidates are one or more of * r - allows container to read from the specified device. * w - allows container to write to the specified device. * m - allows container to create device files that do not yet exist.
message
criapi.proto:1191FilesystemIdentifier uniquely identify the filesystem.
Used in:
string mountpoint = 1
Mountpoint of a filesystem.
message
criapi.proto:1197FilesystemUsage provides the filesystem usage information.
Used in: ,
int64 timestamp = 1
Timestamp in nanoseconds at which the information were collected. Must be > 0.
optional fs_id = 2
The unique identifier of the filesystem.
optional used_bytes = 3
UsedBytes represents the bytes used for images on the filesystem. This may differ from the total bytes used on the filesystem and may not equal CapacityBytes - AvailableBytes.
optional inodes_used = 4
InodesUsed represents the inodes used by the images. This may not equal InodesCapacity - InodesAvailable because the underlying filesystem may also be used for purposes other than storing images.
message
criapi.proto:555HugepageLimit corresponds to the file`hugetlb.<hugepagesize>.limit_in_byte` in container level cgroup. For example, `PageSize=1GB`, `Limit=1073741824` means setting `1073741824` bytes to hugetlb.1GB.limit_in_bytes.
Used in:
string page_size = 1
The value of PageSize has the format <size><unit-prefix>B (2MB, 1GB), and must match the <hugepagesize> of the corresponding control file found in `hugetlb.<hugepagesize>.limit_in_bytes`. The values of <unit-prefix> are intended to be parsed using base 1024("1KB" = 1024, "1MB" = 1048576, etc).
uint64 limit = 2
limit in bytes of hugepagesize HugeTLB usage.
message
criapi.proto:1044Basic information about a container image.
Used in: ,
string id = 1
ID of the image.
repeated string repo_tags = 2
Other names by which this image is known.
repeated string repo_digests = 3
Digests by which this image is known.
uint64 size = 4
Size of the image in bytes. Must be > 0.
optional uid = 5
UID that will run the command(s). This is used as a default if no user is specified when creating the container. UID and the following user name are mutually exclusive.
string username = 6
User name that will run the command(s). This is used if UID is not set and no user is specified when creating container.
optional spec = 7
ImageSpec for image which includes annotations
message
criapi.proto:1033Used in:
optional image = 1
Spec of the image.
message
criapi.proto:516ImageSpec is an internal representation of an image.
Used in: , , , , , , ,
string image = 1
Container's Image field (e.g. imageID or imageDigest).
map<string, string> annotations = 2
Unstructured key-value map holding arbitrary metadata. ImageSpec Annotations can be used to help the runtime target specific images in multi-arch images.
message
criapi.proto:239Int64Value is the wrapper of int64.
Used in: , ,
int64 value = 1
The value.
message
criapi.proto:525Used in:
string key = 1
string value = 2
message
criapi.proto:650LinuxContainerConfig contains platform-specific configuration for Linux-based containers.
Used in:
optional resources = 1
Resources specification for the container.
optional security_context = 2
LinuxContainerSecurityContext configuration for the container.
message
criapi.proto:534LinuxContainerResources specifies Linux specific configuration for resources. TODO: Consider using Resources from opencontainers/runtime-spec/specs-go directly.
Used in: ,
int64 cpu_period = 1
CPU CFS (Completely Fair Scheduler) period. Default: 0 (not specified).
int64 cpu_quota = 2
CPU CFS (Completely Fair Scheduler) quota. Default: 0 (not specified).
int64 cpu_shares = 3
CPU shares (relative weight vs. other containers). Default: 0 (not specified).
int64 memory_limit_in_bytes = 4
Memory limit in bytes. Default: 0 (not specified).
int64 oom_score_adj = 5
OOMScoreAdj adjusts the oom-killer score. Default: 0 (not specified).
string cpuset_cpus = 6
CpusetCpus constrains the allowed set of logical CPUs. Default: "" (not specified).
string cpuset_mems = 7
CpusetMems constrains the allowed set of memory nodes. Default: "" (not specified).
repeated hugepage_limits = 8
List of HugepageLimits to limit the HugeTLB usage of container per page size. Default: nil (not specified).
message
criapi.proto:581LinuxContainerSecurityContext holds linux security configuration that will be applied to a container.
Used in:
optional capabilities = 1
Capabilities to add or drop.
bool privileged = 2
If set, run container in privileged mode. Privileged mode is incompatible with the following options. If privileged is set, the following features MAY have no effect: 1. capabilities 2. selinux_options 4. seccomp 5. apparmor Privileged mode implies the following specific options are applied: 1. All capabilities are added. 2. Sensitive paths, such as kernel module paths within sysfs, are not masked. 3. Any sysfs and procfs mounts are mounted RW. 4. Apparmor confinement is not applied. 5. Seccomp restrictions are not applied. 6. The device cgroup does not restrict access to any devices. 7. All devices from the host's /dev are available within the container. 8. SELinux restrictions are not applied (e.g. label=disabled).
optional namespace_options = 3
Configurations for the container's namespaces. Only used if the container uses namespace for isolation.
optional selinux_options = 4
SELinux context to be optionally applied.
optional run_as_user = 5
UID to run the container process as. Only one of run_as_user and run_as_username can be specified at a time.
optional run_as_group = 12
GID to run the container process as. run_as_group should only be specified when run_as_user or run_as_username is specified; otherwise, the runtime MUST error.
string run_as_username = 6
User name to run the container process as. If specified, the user MUST exist in the container image (i.e. in the /etc/passwd inside the image), and be resolved there by the runtime; otherwise, the runtime MUST error.
bool readonly_rootfs = 7
If set, the root filesystem of the container is read-only.
repeated int64 supplemental_groups = 8
List of groups applied to the first process run in the container, in addition to the container's primary GID.
string apparmor_profile = 9
AppArmor profile for the container, candidate values are: * runtime/default: equivalent to not specifying a profile. * unconfined: no profiles are loaded * localhost/<profile_name>: profile loaded on the node (localhost) by name. The possible profile names are detailed at http://wiki.apparmor.net/index.php/AppArmor_Core_Policy_Reference
string seccomp_profile_path = 10
Seccomp profile for the container, candidate values are: * runtime/default: the default profile for the container runtime * unconfined: unconfined profile, ie, no seccomp sandboxing * localhost/<full-path-to-profile>: the profile installed on the node. <full-path-to-profile> is the full path of the profile. Default: "", which is identical with unconfined.
bool no_new_privs = 11
no_new_privs defines if the flag for no_new_privs should be set on the container.
repeated string masked_paths = 13
masked_paths is a slice of paths that should be masked by the container runtime, this can be passed directly to the OCI spec.
repeated string readonly_paths = 14
readonly_paths is a slice of paths that should be set as readonly by the container runtime, this can be passed directly to the OCI spec.
message
criapi.proto:282LinuxPodSandboxConfig holds platform-specific configurations for Linux host platforms and Linux-based containers.
Used in:
string cgroup_parent = 1
Parent cgroup of the PodSandbox. The cgroupfs style syntax will be used, but the container runtime can convert it to systemd semantics if needed.
optional security_context = 2
LinuxSandboxSecurityContext holds sandbox security attributes.
map<string, string> sysctls = 3
Sysctls holds linux sysctls config for the sandbox.
message
criapi.proto:419LinuxSandboxStatus contains status specific to Linux sandboxes.
Used in:
optional namespaces = 1
Paths to the sandbox's namespaces.
message
criapi.proto:249LinuxSandboxSecurityContext holds linux security configuration that will be applied to a sandbox. Note that: 1) It does not apply to containers in the pods. 2) It may not be applicable to a PodSandbox which does not contain any running process.
Used in:
optional namespace_options = 1
Configurations for the sandbox's namespaces. This will be used only if the PodSandbox uses namespace for isolation.
optional selinux_options = 2
Optional SELinux context to be applied.
optional run_as_user = 3
UID to run sandbox processes as, when applicable.
optional run_as_group = 8
GID to run sandbox processes as, when applicable. run_as_group should only be specified when run_as_user is specified; otherwise, the runtime MUST error.
bool readonly_rootfs = 4
If set, the root filesystem of the sandbox is read-only.
repeated int64 supplemental_groups = 5
List of groups applied to the first process run in the sandbox, in addition to the sandbox's primary GID.
bool privileged = 6
Indicates whether the sandbox will be asked to run a privileged container. If a privileged container is to be executed within it, this MUST be true. This allows a sandbox to take additional security precautions if no privileged containers are expected to be run.
string seccomp_profile_path = 7
Seccomp profile for the sandbox, candidate values are: * runtime/default: the default profile for the container runtime * unconfined: unconfined profile, ie, no seccomp sandboxing * localhost/<full-path-to-profile>: the profile installed on the node. <full-path-to-profile> is the full path of the profile. Default: "", which is identical with unconfined.
message
criapi.proto:1286MemoryUsage provides the memory usage information.
Used in:
int64 timestamp = 1
Timestamp in nanoseconds at which the information were collected. Must be > 0.
optional working_set_bytes = 2
The amount of working set memory in bytes.
message
criapi.proto:177Mount specifies a host volume to mount into a container.
Used in: ,
string container_path = 1
Path of the mount within the container.
string host_path = 2
Path of the mount on the host. If the hostPath doesn't exist, then runtimes should report error. If the hostpath is a symbolic link, runtimes should follow the symlink and mount the real destination to container.
bool readonly = 3
If set, the mount is read-only.
bool selinux_relabel = 4
If set, the mount needs SELinux relabeling.
MountPropagation propagation = 5
Requested propagation mode.
Used in:
PROPAGATION_PRIVATE = 0
No mount propagation ("private" in Linux terminology).
PROPAGATION_HOST_TO_CONTAINER = 1
Mounts get propagated from the host to the container ("rslave" in Linux).
PROPAGATION_BIDIRECTIONAL = 2
Mounts get propagated from the host to the container and from the container to the host ("rshared" in Linux).
message
criapi.proto:413Namespace contains paths to the namespaces.
Used in:
optional options = 2
Namespace options for Linux namespaces.
A NamespaceMode describes the intended namespace configuration for each of the namespaces (Network, PID, IPC) in NamespaceOption. Runtimes should map these modes as appropriate for the technology underlying the runtime.
Used in:
POD = 0
A POD namespace is common to all containers in a pod. For example, a container with a PID namespace of POD expects to view all of the processes in all of the containers in the pod.
CONTAINER = 1
A CONTAINER namespace is restricted to a single container. For example, a container with a PID namespace of CONTAINER expects to view only the processes in that container.
NODE = 2
A NODE namespace is the namespace of the Kubernetes node. For example, a container with a PID namespace of NODE expects to view all of the processes on the host running the kubelet.
TARGET = 3
TARGET targets the namespace of another container. When this is specified, a target_id must be specified in NamespaceOption and refer to a container previously created with NamespaceMode CONTAINER. This containers namespace will be made to match that of container target_id. For example, a container with a PID namespace of TARGET expects to view all of the processes that container target_id can view.
message
criapi.proto:218NamespaceOption provides options for Linux namespaces.
Used in: , ,
NamespaceMode network = 1
Network namespace for this container/sandbox. Note: There is currently no way to set CONTAINER scoped network in the Kubernetes API. Namespaces currently set by the kubelet: POD, NODE
NamespaceMode pid = 2
PID namespace for this container/sandbox. Note: The CRI default is POD, but the v1.PodSpec default is CONTAINER. The kubelet's runtime manager will set this to CONTAINER explicitly for v1 pods. Namespaces currently set by the kubelet: POD, CONTAINER, NODE, TARGET
NamespaceMode ipc = 3
IPC namespace for this container/sandbox. Note: There is currently no way to set CONTAINER scoped IPC in the Kubernetes API. Namespaces currently set by the kubelet: POD, NODE
string target_id = 4
Target Container ID for NamespaceMode of TARGET. This container must have been previously created in the same pod. It is not possible to specify different targets for each namespace.
message
criapi.proto:1121Used in:
string pod_cidr = 1
CIDR to use for pod IP addresses. If the CIDR is empty, runtimes should omit it.
message
criapi.proto:400PodIP represents an ip of a Pod
Used in:
string ip = 1
an ip is a string representation of an IPv4 or an IPv6
message
criapi.proto:490PodSandbox contains minimal information about a sandbox.
Used in:
string id = 1
ID of the PodSandbox.
optional metadata = 2
Metadata of the PodSandbox.
PodSandboxState state = 3
State of the PodSandbox.
int64 created_at = 4
Creation timestamps of the PodSandbox in nanoseconds. Must be > 0.
map<string, string> labels = 5
Labels of the PodSandbox.
map<string, string> annotations = 6
Unstructured key-value map holding arbitrary metadata. Annotations MUST NOT be altered by the runtime; the value of this field MUST be identical to that of the corresponding PodSandboxConfig used to instantiate this PodSandbox.
string runtime_handler = 7
runtime configuration used for this PodSandbox.
message
criapi.proto:310PodSandboxConfig holds all the required and optional fields for creating a sandbox.
Used in: , ,
optional metadata = 1
Metadata of the sandbox. This information will uniquely identify the sandbox, and the runtime should leverage this to ensure correct operation. The runtime may also use this information to improve UX, such as by constructing a readable name.
string hostname = 2
Hostname of the sandbox. Hostname could only be empty when the pod network namespace is NODE.
string log_directory = 3
Path to the directory on the host in which container log files are stored. By default the log of a container going into the LogDirectory will be hooked up to STDOUT and STDERR. However, the LogDirectory may contain binary log files with structured logging data from the individual containers. For example, the files might be newline separated JSON structured logs, systemd-journald journal files, gRPC trace files, etc. E.g., PodSandboxConfig.LogDirectory = `/var/log/pods/<podUID>/` ContainerConfig.LogPath = `containerName/Instance#.log` WARNING: Log management and how kubelet should interface with the container logs are under active discussion in https://issues.k8s.io/24677. There *may* be future change of direction for logging as the discussion carries on.
optional dns_config = 4
DNS config for the sandbox.
repeated port_mappings = 5
Port mappings for the sandbox.
map<string, string> labels = 6
Key-value pairs that may be used to scope and select individual resources.
map<string, string> annotations = 7
Unstructured key-value map that may be set by the kubelet to store and retrieve arbitrary metadata. This will include any annotations set on a pod through the Kubernetes API. Annotations MUST NOT be altered by the runtime; the annotations stored here MUST be returned in the PodSandboxStatus associated with the pod this PodSandboxConfig creates. In general, in order to preserve a well-defined interface between the kubelet and the container runtime, annotations SHOULD NOT influence runtime behaviour. Annotations can also be useful for runtime authors to experiment with new features that are opaque to the Kubernetes APIs (both user-facing and the CRI). Whenever possible, however, runtime authors SHOULD consider proposing new typed fields for any new features instead.
optional linux = 8
Optional configurations specific to Linux hosts.
message
criapi.proto:472PodSandboxFilter is used to filter a list of PodSandboxes. All those fields are combined with 'AND'
Used in:
string id = 1
ID of the sandbox.
optional state = 2
State of the sandbox.
map<string, string> label_selector = 3
LabelSelector to select matches. Only api.MatchLabels is supported for now and the requirements are ANDed. MatchExpressions is not supported yet.
message
criapi.proto:297PodSandboxMetadata holds all necessary information for building the sandbox name. The container runtime is encouraged to expose the metadata associated with the PodSandbox in its user interface for better user experience. For example, the runtime can construct a unique PodSandboxName based on the metadata.
Used in: , ,
string name = 1
Pod name of the sandbox. Same as the pod name in the Pod ObjectMeta.
string uid = 2
Pod UID of the sandbox. Same as the pod UID in the Pod ObjectMeta.
string namespace = 3
Pod namespace of the sandbox. Same as the pod namespace in the Pod ObjectMeta.
uint32 attempt = 4
Attempt number of creating the sandbox. Default: 0.
message
criapi.proto:405PodSandboxNetworkStatus is the status of the network for a PodSandbox.
Used in:
string ip = 1
IP address of the PodSandbox.
repeated additional_ips = 2
list of additional ips (not inclusive of PodSandboxNetworkStatus.Ip) of the PodSandBoxNetworkStatus
Used in: , ,
SANDBOX_READY = 0
SANDBOX_NOTREADY = 1
message
criapi.proto:465PodSandboxStateValue is the wrapper of PodSandboxState.
Used in:
PodSandboxState state = 1
State of the sandbox.
message
criapi.proto:430PodSandboxStatus contains the status of the PodSandbox.
Used in:
string id = 1
ID of the sandbox.
optional metadata = 2
Metadata of the sandbox.
PodSandboxState state = 3
State of the sandbox.
int64 created_at = 4
Creation timestamp of the sandbox in nanoseconds. Must be > 0.
optional network = 5
Network contains network status if network is handled by the runtime.
optional linux = 6
Linux-specific status to a pod sandbox.
map<string, string> labels = 7
Labels are key-value pairs that may be used to scope and select individual resources.
map<string, string> annotations = 8
Unstructured key-value map holding arbitrary metadata. Annotations MUST NOT be altered by the runtime; the value of this field MUST be identical to that of the corresponding PodSandboxConfig used to instantiate the pod sandbox this status represents.
string runtime_handler = 9
runtime configuration used for this PodSandbox.
message
criapi.proto:155PortMapping specifies the port mapping configurations of a sandbox.
Used in:
Protocol protocol = 1
Protocol of the port mapping.
int32 container_port = 2
Port number within the container. Default: 0 (not specified).
int32 host_port = 3
Port number on the host. Default: 0 (not specified).
string host_ip = 4
Host IP.
Used in:
TCP = 0
UDP = 1
SCTP = 2
message
criapi.proto:1150RuntimeCondition contains condition information for the runtime. There are 2 kinds of runtime conditions: 1. Required conditions: Conditions are required for kubelet to work properly. If any required condition is unmet, the node will be not ready. The required conditions include: * RuntimeReady: RuntimeReady means the runtime is up and ready to accept basic containers e.g. container only needs host network. * NetworkReady: NetworkReady means the runtime network is up and ready to accept containers which require container network. 2. Optional conditions: Conditions are informative to the user, but kubelet will not rely on. Since condition type is an arbitrary string, all conditions not required are optional. These conditions will be exposed to users to help them understand the status of the system.
Used in:
string type = 1
Type of runtime condition.
bool status = 2
Status of the condition, one of true/false. Default: false.
string reason = 3
Brief CamelCase string containing reason for the condition's last transition.
string message = 4
Human-readable message indicating details about last transition.
message
criapi.proto:1127Used in:
optional network_config = 1
message
criapi.proto:1162RuntimeStatus is information about the current status of the runtime.
Used in:
repeated conditions = 1
List of current observed runtime conditions.
message
criapi.proto:565SELinuxOption are the labels to be applied to the container.
Used in: ,
string user = 1
string role = 2
string type = 3
string level = 4
message
criapi.proto:1185UInt64Value is the wrapper of uint64.
Used in: , ,
uint64 value = 1
The value.
message
criapi.proto:670WindowsContainerConfig contains platform-specific configuration for Windows-based containers.
Used in:
optional resources = 1
Resources specification for the container.
optional security_context = 2
WindowsContainerSecurityContext configuration for the container.
message
criapi.proto:679WindowsContainerResources specifies Windows specific configuration for resources.
Used in:
int64 cpu_shares = 1
CPU shares (relative weight vs. other containers). Default: 0 (not specified).
int64 cpu_count = 2
Number of CPUs available to the container. Default: 0 (not specified).
int64 cpu_maximum = 3
Specifies the portion of processor cycles that this container can use as a percentage times 100.
int64 memory_limit_in_bytes = 4
Memory limit in bytes. Default: 0 (not specified).
message
criapi.proto:658WindowsContainerSecurityContext holds windows security configuration that will be applied to a container.
Used in:
string run_as_username = 1
User name to run the container process as. If specified, the user MUST exist in the container image and be resolved there by the runtime; otherwise, the runtime MUST return error.
string credential_spec = 2
The contents of the GMSA credential spec to use to run this container.