package runtime.v1
Get desktop application:
View/edit binary Protocol Buffers messages
service ImageService
api.proto:143ImageService defines the public APIs for managing images.
rpc ImageFsInfo (, )
api.proto:157ImageFSInfo returns information of the filesystem that is used to store images.
message
api.proto:1751(message has no fields)
message
api.proto:1793repeated image_filesystems = 1
Information of image filesystem(s).
repeated container_filesystems = 2
Information of container filesystem(s). This is an optional field, may be used for example if container and image storage are separated. Default will be to return this as empty.
rpc ImageStatus (, )
api.proto:149ImageStatus returns the status of the image. If the image is not present, returns a response with ImageStatusResponse.Image set to nil.
message
api.proto:1604optional image = 1
Spec of the image.
bool verbose = 2
Verbose indicates whether to return extra information about the image.
message
api.proto:1611optional image = 1
Status of the image.
map<string, string> info = 2
Info is extra information of the Image. The key could be arbitrary string, and value should be in json format. The information could include anything useful for debug, e.g. image config for oci image based container runtime. It should only be returned non-empty when Verbose is true.
rpc ListImages (, )
api.proto:145ListImages lists existing images.
message
api.proto:1569optional filter = 1
Filter to list images.
message
api.proto:1599repeated images = 1
List of images.
rpc PullImage (, )
api.proto:151PullImage pulls an image with authentication config.
message
api.proto:1634optional image = 1
Spec of the image.
optional auth = 2
Authentication configuration for pulling the image.
optional sandbox_config = 3
Config of the PodSandbox, which is used to pull image in PodSandbox context.
message
api.proto:1643string image_ref = 1
Reference to the image in use. For most runtimes, this should be an image ID or digest.
rpc RemoveImage (, )
api.proto:155RemoveImage removes the image. This call is idempotent, and must not return an error if the image has already been removed.
message
api.proto:1649optional image = 1
Spec of the image to remove.
message
api.proto:1654(message has no fields)
service RuntimeService
api.proto:24Runtime service defines the public APIs for remote container runtimes
rpc Attach (, )
api.proto:87Attach prepares a streaming endpoint to attach to a running container.
message
api.proto:1527string container_id = 1
ID of the container to which to attach.
bool stdin = 2
Whether to stream stdin. One of `stdin`, `stdout`, and `stderr` MUST be true.
bool tty = 3
Whether the process being attached is running in a TTY. This must match the TTY setting in the ContainerConfig.
bool stdout = 4
Whether to stream stdout. One of `stdin`, `stdout`, and `stderr` MUST be true.
bool stderr = 5
Whether to stream stderr. One of `stdin`, `stdout`, and `stderr` MUST be true. If `tty` is true, `stderr` MUST be false. Multiplexing is not supported in this case. The output of stdout and stderr will be combined to a single stream.
message
api.proto:1547string url = 1
Fully qualified URL of the attach streaming server.
rpc CheckpointContainer (, )
api.proto:110CheckpointContainer checkpoints a container
message
api.proto:1982string container_id = 1
ID of the container to be checkpointed.
string location = 2
Location of the checkpoint archive used for export
int64 timeout = 3
Timeout in seconds for the checkpoint to complete. Timeout of zero means to use the CRI default. Timeout > 0 means to use the user specified timeout.
message
api.proto:1993(message has no fields)
rpc ContainerStats (, )
api.proto:93ContainerStats returns stats of the container. If the container does not exist, the call returns an error.
message
api.proto:1803string container_id = 1
ID of the container for which to retrieve stats.
message
api.proto:1808optional stats = 1
Stats of the container.
rpc ContainerStatus (, )
api.proto:71ContainerStatus returns status of the container. If the container is not present, returns an error.
message
api.proto:1370string container_id = 1
ID of the container for which to retrieve status.
bool verbose = 2
Verbose indicates whether to return extra information about the container.
message
api.proto:1431optional status = 1
Status of the container.
map<string, string> info = 2
Info is extra information of the Container. The key could be arbitrary string, and value should be in json format. The information could include anything useful for debug, e.g. pid for linux container based container runtime. It should only be returned non-empty when Verbose is true.
rpc CreateContainer (, )
api.proto:53CreateContainer creates a new container in specified PodSandbox
message
api.proto:1255string pod_sandbox_id = 1
ID of the PodSandbox in which the container should be created.
optional config = 2
Config of the container.
optional sandbox_config = 3
Config of the PodSandbox. This is the same config that was passed to RunPodSandboxRequest to create the PodSandbox. It is passed again here just for easy reference. The PodSandboxConfig is immutable and remains the same throughout the lifetime of the pod.
message
api.proto:1267string container_id = 1
ID of the created container.
rpc Exec (, )
api.proto:85Exec prepares a streaming endpoint to execute a command in the container.
message
api.proto:1501string container_id = 1
ID of the container in which to execute the command.
repeated string cmd = 2
Command to execute.
bool tty = 3
Whether to exec the command in a TTY.
bool stdin = 4
Whether to stream stdin. One of `stdin`, `stdout`, and `stderr` MUST be true.
bool stdout = 5
Whether to stream stdout. One of `stdin`, `stdout`, and `stderr` MUST be true.
bool stderr = 6
Whether to stream stderr. One of `stdin`, `stdout`, and `stderr` MUST be true. If `tty` is true, `stderr` MUST be false. Multiplexing is not supported in this case. The output of stdout and stderr will be combined to a single stream.
message
api.proto:1522string url = 1
Fully qualified URL of the exec streaming server.
rpc ExecSync (, )
api.proto:83ExecSync runs a command in a container synchronously.
message
api.proto:1475string container_id = 1
ID of the container.
repeated string cmd = 2
Command to execute.
int64 timeout = 3
Timeout in seconds to stop the command. Default: 0 (run forever).
message
api.proto:1484bytes stdout = 1
Captured command stdout output. The runtime should cap the output of this response to 16MB. If the stdout of the command produces more than 16MB, the remaining output should be discarded, and the command should proceed with no error. See CVE-2022-1708 and CVE-2022-31030 for more information.
bytes stderr = 2
Captured command stderr output. The runtime should cap the output of this response to 16MB. If the stderr of the command produces more than 16MB, the remaining output should be discarded, and the command should proceed with no error. See CVE-2022-1708 and CVE-2022-31030 for more information.
int32 exit_code = 3
Exit code the command finished with. Default: 0 (success).
rpc GetContainerEvents (, stream )
api.proto:113GetContainerEvents gets container events from the CRI runtime
message
api.proto:1995(message has no fields)
message
api.proto:1997string container_id = 1
ID of the container
ContainerEventType container_event_type = 2
Type of the container event
int64 created_at = 3
Creation timestamp in nanoseconds of this event
optional pod_sandbox_status = 4
Sandbox status
repeated containers_statuses = 5
Container statuses
rpc ListContainerStats (, )
api.proto:95ListContainerStats returns stats of all running containers.
message
api.proto:1813optional filter = 1
Filter for the list request.
message
api.proto:1831repeated stats = 1
Stats of the container.
rpc ListContainers (, )
api.proto:68ListContainers lists all containers by filters.
message
api.proto:1324optional filter = 1
message
api.proto:1365repeated containers = 1
List of containers.
rpc ListMetricDescriptors (, )
api.proto:120ListMetricDescriptors gets the descriptors for the metrics that will be returned in ListPodSandboxMetrics. This list should be static at startup: either the client and server restart together when adding or removing metrics descriptors, or they should not change. Put differently, if ListPodSandboxMetrics references a name that is not described in the initial ListMetricDescriptors call, then the metric will not be broadcasted.
message
api.proto:2028(message has no fields)
message
api.proto:2030repeated descriptors = 1
rpc ListPodSandbox (, )
api.proto:50ListPodSandbox returns a list of PodSandboxes.
message
api.proto:641optional filter = 1
PodSandboxFilter to filter a list of PodSandboxes.
message
api.proto:668repeated items = 1
List of PodSandboxes.
rpc ListPodSandboxMetrics (, )
api.proto:123ListPodSandboxMetrics gets pod sandbox metrics from CRI Runtime
message
api.proto:2046(message has no fields)
message
api.proto:2048repeated pod_metrics = 1
rpc ListPodSandboxStats (, )
api.proto:101ListPodSandboxStats returns stats of the pod sandboxes matching a filter.
message
api.proto:693optional filter = 1
Filter for the list request.
message
api.proto:698repeated stats = 1
Stats of the pod sandbox.
rpc PodSandboxStats (, )
api.proto:99PodSandboxStats returns stats of the pod sandbox. If the pod sandbox does not exist, the call returns an error.
message
api.proto:673string pod_sandbox_id = 1
ID of the pod sandbox for which to retrieve stats.
message
api.proto:678optional stats = 1
rpc PodSandboxStatus (, )
api.proto:48PodSandboxStatus returns the status of the PodSandbox. If the PodSandbox is not present, returns an error.
message
api.proto:545string pod_sandbox_id = 1
ID of the PodSandbox for which to retrieve status.
bool verbose = 2
Verbose indicates whether to return extra information about the pod sandbox.
message
api.proto:608optional status = 1
Status of the PodSandbox.
map<string, string> info = 2
Info is extra information of the PodSandbox. The key could be arbitrary string, and value should be in json format. The information could include anything useful for debug, e.g. network namespace for linux container based container runtime. It should only be returned non-empty when Verbose is true.
repeated containers_statuses = 3
Container statuses
int64 timestamp = 4
Timestamp in nanoseconds at which container and pod statuses were recorded
rpc PortForward (, )
api.proto:89PortForward prepares a streaming endpoint to forward ports from a PodSandbox.
message
api.proto:1552string pod_sandbox_id = 1
ID of the container to which to forward the port.
repeated int32 port = 2
Port to forward.
message
api.proto:1559string url = 1
Fully qualified URL of the port-forward streaming server.
rpc RemoveContainer (, )
api.proto:66RemoveContainer removes the container. If the container is running, the container must be forcibly removed. This call is idempotent, and must not return an error if the container has already been removed.
message
api.proto:1289string container_id = 1
ID of the container to remove.
message
api.proto:1294(message has no fields)
rpc RemovePodSandbox (, )
api.proto:45RemovePodSandbox removes the sandbox. If there are any running containers in the sandbox, they must be forcibly terminated and removed. This call is idempotent, and must not return an error if the sandbox has already been removed.
message
api.proto:538string pod_sandbox_id = 1
ID of the PodSandbox to remove.
message
api.proto:543(message has no fields)
rpc ReopenContainerLog (, )
api.proto:80ReopenContainerLog asks runtime to reopen the stdout/stderr log file for the container. This is often called after the log file has been rotated. If the container is not running, container runtime can choose to either create a new log file and return nil, or return an error. Once it returns error, new container log file MUST NOT be created.
message
api.proto:1974string container_id = 1
ID of the container for which to reopen the log.
message
api.proto:1979(message has no fields)
rpc RunPodSandbox (, )
api.proto:30RunPodSandbox creates and starts a pod-level sandbox. Runtimes must ensure the sandbox is in the ready state on success.
message
api.proto:515optional config = 1
Configuration for creating a PodSandbox.
string runtime_handler = 2
Named runtime configuration to use for this PodSandbox. If the runtime handler is unknown, this request should be rejected. An empty string should select the default handler, equivalent to the behavior before this feature was added. See https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class
message
api.proto:526string pod_sandbox_id = 1
ID of the PodSandbox to run.
rpc RuntimeConfig (, )
api.proto:132RuntimeConfig returns configuration information of the runtime. A couple of notes: - The RuntimeConfigRequest object is not to be confused with the contents of UpdateRuntimeConfigRequest. The former is for having runtime tell Kubelet what to do, the latter vice versa. - It is the expectation of the Kubelet that these fields are static for the lifecycle of the Kubelet. The Kubelet will not re-request the RuntimeConfiguration after startup, and CRI implementations should avoid updating them without a full node reboot.
message
api.proto:2083(message has no fields)
message
api.proto:2085optional linux = 1
Configuration information for Linux-based runtimes. This field contains global runtime configuration options that are not specific to runtime handlers.
rpc StartContainer (, )
api.proto:55StartContainer starts the container.
message
api.proto:1272string container_id = 1
ID of the container to start.
message
api.proto:1277(message has no fields)
rpc Status (, )
api.proto:107Status returns the status of the runtime.
message
api.proto:1702bool verbose = 1
Verbose indicates whether to return extra information about the runtime.
message
api.proto:1736optional status = 1
Status of the Runtime.
map<string, string> info = 2
Info is extra information of the Runtime. The key could be arbitrary string, and value should be in json format. The information could include anything useful for debug, e.g. plugins used by the container runtime. It should only be returned non-empty when Verbose is true.
repeated runtime_handlers = 3
Runtime handlers.
optional features = 4
features describes the set of features implemented by the CRI implementation. This field is supposed to propagate to NodeFeatures in Kubernetes API.
rpc StopContainer (, )
api.proto:61StopContainer stops a running container with a grace period (i.e., timeout). This call is idempotent, and must not return an error if the container has already been stopped. The runtime must forcibly kill the container after the grace period is reached.
message
api.proto:1279string container_id = 1
ID of the container to stop.
int64 timeout = 2
Timeout in seconds to wait for the container to stop before forcibly terminating it. Default: 0 (forcibly terminate the container immediately)
message
api.proto:1287(message has no fields)
rpc StopPodSandbox (, )
api.proto:40StopPodSandbox stops any running process that is part of the sandbox and reclaims network resources (e.g., IP addresses) allocated to the sandbox. If there are any running containers in the sandbox, they must be forcibly terminated. This call is idempotent, and must not return an error if all relevant resources have already been reclaimed. kubelet will call StopPodSandbox at least once before calling RemovePodSandbox. It will also attempt to reclaim resources eagerly, as soon as a sandbox is not needed. Hence, multiple StopPodSandbox calls are expected.
message
api.proto:531string pod_sandbox_id = 1
ID of the PodSandbox to stop.
message
api.proto:536(message has no fields)
rpc UpdateContainerResources (, )
api.proto:74UpdateContainerResources updates ContainerConfig of the container synchronously. If runtime fails to transactionally update the requested resources, an error is returned.
message
api.proto:1460string container_id = 1
ID of the container to update.
optional linux = 2
Resource configuration specific to Linux containers.
optional windows = 3
Resource configuration specific to Windows containers.
map<string, string> annotations = 4
Unstructured key-value map holding arbitrary additional information for container resources updating. This can be used for specifying experimental resources to update or other options to use when updating the container.
message
api.proto:1473(message has no fields)
UpdatePodSandboxResources synchronously updates the PodSandboxConfig with the pod-level resource configuration. This method is called _after_ the Kubelet reconfigures the pod-level cgroups. This request is treated as best effort, and failure will not block the Kubelet with proceeding with a resize.
message
api.proto:2108string pod_sandbox_id = 1
ID of the PodSandbox to update.
optional overhead = 2
Optional overhead represents the overheads associated with this sandbox
optional resources = 3
Optional resources represents the sum of container resources for this sandbox
message
api.proto:2118(message has no fields)
rpc UpdateRuntimeConfig (, )
api.proto:104UpdateRuntimeConfig updates the runtime configuration based on the given request.
message
api.proto:1666optional runtime_config = 1
message
api.proto:1670(message has no fields)
rpc Version (, )
api.proto:26Version returns the runtime name, runtime version, and runtime API version.
message
api.proto:160string version = 1
Version of the kubelet runtime API.
message
api.proto:165string version = 1
Version of the kubelet runtime API.
string runtime_name = 2
Name of the container runtime.
string runtime_version = 3
Version of the container runtime. The string must be semver-compatible.
string runtime_api_version = 4
API version of the container runtime. The string must be semver-compatible.
message
api.proto:1622AuthConfig contains authorization information for connecting to a registry.
Used in:
string username = 1
string password = 2
string auth = 3
string server_address = 4
string identity_token = 5
IdentityToken is used to authenticate the user and get an access token for the registry.
string registry_token = 6
RegistryToken is a bearer token to be sent to a registry
message
api.proto:1113CDIDevice specifies a CDI device information.
Used in:
string name = 1
Fully qualified CDI device name for example: vendor.com/gpu=gpudevice1 see more details in the CDI specification: https://github.com/container-orchestrated-devices/container-device-interface/blob/main/SPEC.md
message
api.proto:899Capability contains the container capabilities to add or drop Dropping a capability will drop it from all sets. If a capability is added to only the add_capabilities list then it gets added to permitted, inheritable, effective and bounding sets, i.e. all sets except the ambient set. If a capability is added to only the add_ambient_capabilities list then it gets added to all sets, i.e permitted inheritable, effective, bounding and ambient sets. If a capability is added to add_capabilities and add_ambient_capabilities lists then it gets added to all sets, i.e. permitted, inheritable, effective, bounding and ambient sets.
Used in:
repeated string add_capabilities = 1
List of capabilities to add.
repeated string drop_capabilities = 2
List of capabilities to drop.
repeated string add_ambient_capabilities = 3
List of ambient capabilities to add.
Used in:
SYSTEMD = 0
CGROUPFS = 1
message
api.proto:1330Container provides the runtime information for a container, such as ID, hash, state of the container.
Used in:
string id = 1
ID of the container, used by the container runtime to identify a container.
string pod_sandbox_id = 2
ID of the sandbox to which this container belongs.
optional metadata = 3
Metadata of the container.
optional image = 4
Spec of the image.
string image_ref = 5
Digested reference to the image in use.
ContainerState state = 6
State of the container.
int64 created_at = 7
Creation time of the container in nanoseconds.
map<string, string> labels = 8
Key-value pairs that may be used to scope and select individual resources.
map<string, string> annotations = 9
Unstructured key-value map holding arbitrary metadata. Annotations MUST NOT be altered by the runtime; the value of this field MUST be identical to that of the corresponding ContainerConfig used to instantiate this Container.
string image_id = 10
Reference to the unique identifier of the image, on the node, as returned in the image service apis. Note: The image_ref above has been historically used by container runtimes to reference images by digest. The image_ref has been also used in the kubelet image garbage collection, which does not work with digests at all. To separate and avoid possible misusage, we now introduce the image_id field, which should always refer to a unique image identifier on the node.
message
api.proto:1837ContainerAttributes provides basic information of the container.
Used in: ,
string id = 1
ID of the container.
optional metadata = 2
Metadata of the container.
map<string, string> labels = 3
Key-value pairs that may be used to scope and select individual resources.
map<string, string> annotations = 4
Unstructured key-value map holding arbitrary metadata. Annotations MUST NOT be altered by the runtime; the value of this field MUST be identical to that of the corresponding ContainerConfig used to instantiate the Container this status represents.
message
api.proto:1123ContainerConfig holds all the required and optional fields for creating a container.
Used in:
optional metadata = 1
Metadata of the container. This information will uniquely identify the container, and the runtime should leverage this to ensure correct operation. The runtime may also use this information to improve UX, such as by constructing a readable name.
optional image = 2
Image to use.
repeated string command = 3
Command to execute (i.e., entrypoint for docker)
repeated string args = 4
Args for the Command (i.e., command for docker)
string working_dir = 5
Current working directory of the command.
repeated envs = 6
List of environment variable to set in the container.
repeated mounts = 7
Mounts for the container.
repeated devices = 8
Devices for the container.
map<string, string> labels = 9
Key-value pairs that may be used to scope and select individual resources. Label keys are of the form: label-key ::= prefixed-name | name prefixed-name ::= prefix '/' name prefix ::= DNS_SUBDOMAIN name ::= DNS_LABEL
map<string, string> annotations = 10
Unstructured key-value map that may be used by the kubelet to store and retrieve arbitrary metadata. Annotations MUST NOT be altered by the runtime; the annotations stored here MUST be returned in the ContainerStatus associated with the container this ContainerConfig creates. In general, in order to preserve a well-defined interface between the kubelet and the container runtime, annotations SHOULD NOT influence runtime behaviour.
string log_path = 11
Path relative to PodSandboxConfig.LogDirectory for container to store the log (STDOUT and STDERR) on the host. E.g., PodSandboxConfig.LogDirectory = `/var/log/pods/<NAMESPACE>_<NAME>_<UID>/` ContainerConfig.LogPath = `containerName/Instance#.log`
bool stdin = 12
Variables for interactive containers, these have very specialized use-cases (e.g. debugging).
bool stdin_once = 13
bool tty = 14
optional linux = 15
Configuration specific to Linux containers.
optional windows = 16
Configuration specific to Windows containers.
repeated CDI_devices = 17
CDI devices for the container.
Signal stop_signal = 18
The custom stop signal for the container
Used in:
CONTAINER_CREATED_EVENT = 0
Container created
CONTAINER_STARTED_EVENT = 1
Container started
CONTAINER_STOPPED_EVENT = 2
Container stopped
CONTAINER_DELETED_EVENT = 3
Container deleted
message
api.proto:1311ContainerFilter is used to filter containers. All those fields are combined with 'AND'
Used in:
string id = 1
ID of the container.
optional state = 2
State of the container.
string pod_sandbox_id = 3
ID of the PodSandbox.
map<string, string> label_selector = 4
LabelSelector to select matches. Only api.MatchLabels is supported for now and the requirements are ANDed. MatchExpressions is not supported yet.
message
api.proto:1092ContainerMetadata holds all necessary information for building the container name. The container runtime is encouraged to expose the metadata in its user interface for better user experience. E.g., runtime can construct a unique container name based on the metadata. Note that (name, attempt) is unique within a sandbox for the entire lifetime of the sandbox.
Used in: , , ,
string name = 1
Name of the container. Same as the container name in the PodSpec.
uint32 attempt = 2
Attempt number of creating the container. Default: 0.
message
api.proto:2058Used in:
string container_id = 1
repeated metrics = 2
message
api.proto:1442ContainerResources holds resource limits configuration for a container.
Used in:
optional linux = 1
Resource limits configuration specific to Linux container.
optional windows = 2
Resource limits configuration specific to Windows container.
Used in: , ,
CONTAINER_CREATED = 0
CONTAINER_RUNNING = 1
CONTAINER_EXITED = 2
CONTAINER_UNKNOWN = 3
message
api.proto:1304ContainerStateValue is the wrapper of ContainerState.
Used in:
ContainerState state = 1
State of the container.
message
api.proto:1852ContainerStats provides the resource usage statistics for a container.
Used in: , ,
optional attributes = 1
Information of the container.
optional cpu = 2
CPU usage gathered from the container.
optional memory = 3
Memory usage gathered from the container.
optional writable_layer = 4
Usage of the writable layer.
optional swap = 5
Swap usage gathered from the container.
optional io = 6
IO usage gathered from the container.
message
api.proto:1820ContainerStatsFilter is used to filter containers. All those fields are combined with 'AND'
Used in:
string id = 1
ID of the container.
string pod_sandbox_id = 2
ID of the PodSandbox.
map<string, string> label_selector = 3
LabelSelector to select matches. Only api.MatchLabels is supported for now and the requirements are ANDed. MatchExpressions is not supported yet.
message
api.proto:1378ContainerStatus represents the status of a container.
Used in: , ,
string id = 1
ID of the container.
optional metadata = 2
Metadata of the container.
ContainerState state = 3
Status of the container.
int64 created_at = 4
Creation time of the container in nanoseconds.
int64 started_at = 5
Start time of the container in nanoseconds. Default: 0 (not specified).
int64 finished_at = 6
Finish time of the container in nanoseconds. Default: 0 (not specified).
int32 exit_code = 7
Exit code of the container. Only required when finished_at != 0. Default: 0.
optional image = 8
Spec of the image.
string image_ref = 9
Digested reference to the image in use.
string reason = 10
Brief CamelCase string explaining why container is in its current state. Must be set to "OOMKilled" for containers terminated by cgroup-based Out-of-Memory killer.
string message = 11
Human-readable message indicating details about why container is in its current state.
map<string, string> labels = 12
Key-value pairs that may be used to scope and select individual resources.
map<string, string> annotations = 13
Unstructured key-value map holding arbitrary metadata. Annotations MUST NOT be altered by the runtime; the value of this field MUST be identical to that of the corresponding ContainerConfig used to instantiate the Container this status represents.
repeated mounts = 14
Mounts for the container.
string log_path = 15
Log path of container.
optional resources = 16
Resource limits configuration of the container.
string image_id = 17
Reference to the unique identifier of the image, on the node, as returned in the image service apis. Note: The image_ref above has been historically used by container runtimes to reference images by digest. To separate and avoid possible misusage, we now introduce the image_id field, which should always refer to a unique image identifier on the node.
optional user = 18
User identities initially attached to the container
Signal stop_signal = 19
Returns the stop signal used by the container runtime to terminate the container
message
api.proto:1449Used in:
optional linux = 1
User identities initially attached to first process in the Linux container. Note that the actual running identity can be changed if the process has enough privilege to do so.
message
api.proto:1901CpuUsage provides the CPU usage information.
Used in: ,
int64 timestamp = 1
Timestamp in nanoseconds at which the information were collected. Must be > 0.
optional usage_core_nano_seconds = 2
Cumulative CPU usage (sum across all cores) since object creation.
optional usage_nano_cores = 3
Total CPU usage (sum of all cores) averaged over the sample window. The "core" unit can be interpreted as CPU core-nanoseconds per second.
optional psi = 4
CPU PSI statistics.
message
api.proto:179DNSConfig specifies the DNS servers and search domains of a sandbox.
Used in:
repeated string servers = 1
List of DNS servers of the cluster.
repeated string searches = 2
List of DNS search domains of the cluster.
repeated string options = 3
List of DNS options. See https://linux.die.net/man/5/resolv.conf for all available options.
message
api.proto:1100Device specifies a host device to mount into a container.
Used in:
string container_path = 1
Path of the device within the container.
string host_path = 2
Path of the device on the host.
string permissions = 3
Cgroups permissions of the device, candidates are one or more of * r - allows container to read from the specified device. * w - allows container to write to the specified device. * m - allows container to create device files that do not yet exist.
message
api.proto:1760FilesystemIdentifier uniquely identify the filesystem.
Used in: ,
string mountpoint = 1
Mountpoint of a filesystem.
message
api.proto:1766FilesystemUsage provides the filesystem usage information.
Used in: ,
int64 timestamp = 1
Timestamp in nanoseconds at which the information were collected. Must be > 0.
optional fs_id = 2
The unique identifier of the filesystem.
optional used_bytes = 3
UsedBytes represents the bytes used for images on the filesystem. This may differ from the total bytes used on the filesystem and may not equal CapacityBytes - AvailableBytes.
optional inodes_used = 4
InodesUsed represents the inodes used by the images. This may not equal InodesCapacity - InodesAvailable because the underlying filesystem may also be used for purposes other than storing images.
message
api.proto:874HugepageLimit corresponds to the file`hugetlb.<hugepagesize>.limit_in_byte` in container level cgroup. For example, `PageSize=1GB`, `Limit=1073741824` means setting `1073741824` bytes to hugetlb.1GB.limit_in_bytes.
Used in:
string page_size = 1
The value of PageSize has the format <size><unit-prefix>B (2MB, 1GB), and must match the <hugepagesize> of the corresponding control file found in `hugetlb.<hugepagesize>.limit_in_bytes`. The values of <unit-prefix> are intended to be parsed using base 1024("1KB" = 1024, "1MB" = 1048576, etc).
uint64 limit = 2
limit in bytes of hugepagesize HugeTLB usage.
message
api.proto:273IDMapping describes host to container ID mappings for a pod sandbox.
Used in: ,
uint32 host_id = 1
HostId is the id on the host.
uint32 container_id = 2
ContainerId is the id in the container.
uint32 length = 3
Length is the size of the range to map.
message
api.proto:1575Basic information about a container image.
Used in: ,
string id = 1
ID of the image.
repeated string repo_tags = 2
Other names by which this image is known.
repeated string repo_digests = 3
Digests by which this image is known.
uint64 size = 4
Size of the image in bytes. Must be > 0.
optional uid = 5
UID that will run the command(s). This is used as a default if no user is specified when creating the container. UID and the following user name are mutually exclusive.
string username = 6
User name that will run the command(s). This is used if UID is not set and no user is specified when creating container.
optional spec = 7
ImageSpec for image which includes annotations
bool pinned = 8
Recommendation on whether this image should be exempt from garbage collection. It must only be treated as a recommendation -- the client can still request that the image be deleted, and the runtime must oblige.
message
api.proto:1564Used in:
optional image = 1
Spec of the image.
message
api.proto:824ImageSpec is an internal representation of an image.
Used in: , , , , , , , ,
string image = 1
Container's Image field (e.g. imageID or imageDigest).
map<string, string> annotations = 2
Unstructured key-value map holding arbitrary metadata. ImageSpec Annotations can be used to help the runtime target specific images in multi-arch images.
string user_specified_image = 18
The container image reference specified by the user (e.g. image[:tag] or digest). Only set if available within the RPC context.
string runtime_handler = 19
Runtime handler to use for pulling the image. If the runtime handler is unknown, the request should be rejected. An empty string would select the default runtime handler.
message
api.proto:362Int64Value is the wrapper of int64.
Used in: , ,
int64 value = 1
The value.
message
api.proto:1944Used in: ,
int64 timestamp = 1
Timestamp in nanoseconds at which the information were collected. Must be > 0.
optional psi = 2
IO PSI statistics.
message
api.proto:840Used in:
string key = 1
string value = 2
message
api.proto:987LinuxContainerConfig contains platform-specific configuration for Linux-based containers.
Used in:
optional resources = 1
Resources specification for the container.
optional security_context = 2
LinuxContainerSecurityContext configuration for the container.
message
api.proto:847LinuxContainerResources specifies Linux specific configuration for resources.
Used in: , , , ,
int64 cpu_period = 1
CPU CFS (Completely Fair Scheduler) period. Default: 0 (not specified).
int64 cpu_quota = 2
CPU CFS (Completely Fair Scheduler) quota. Default: 0 (not specified).
int64 cpu_shares = 3
CPU shares (relative weight vs. other containers). Default: 0 (not specified).
int64 memory_limit_in_bytes = 4
Memory limit in bytes. Default: 0 (not specified).
int64 oom_score_adj = 5
OOMScoreAdj adjusts the oom-killer score. Default: 0 (not specified).
string cpuset_cpus = 6
CpusetCpus constrains the allowed set of logical CPUs. Default: "" (not specified).
string cpuset_mems = 7
CpusetMems constrains the allowed set of memory nodes. Default: "" (not specified).
repeated hugepage_limits = 8
List of HugepageLimits to limit the HugeTLB usage of container per page size. Default: nil (not specified).
map<string, string> unified = 9
Unified resources for cgroup v2. Default: nil (not specified). Each key/value in the map refers to the cgroup v2. e.g. "memory.max": "6937202688" or "io.weight": "default 100".
int64 memory_swap_limit_in_bytes = 10
Memory swap limit in bytes. Default 0 (not specified).
message
api.proto:909LinuxContainerSecurityContext holds linux security configuration that will be applied to a container.
Used in:
optional capabilities = 1
Capabilities to add or drop.
bool privileged = 2
If set, run container in privileged mode. Privileged mode is incompatible with the following options. If privileged is set, the following features MAY have no effect: 1. capabilities 2. selinux_options 4. seccomp 5. apparmor Privileged mode implies the following specific options are applied: 1. All capabilities are added. 2. Sensitive paths, such as kernel module paths within sysfs, are not masked. 3. Any sysfs and procfs mounts are mounted RW. 4. AppArmor confinement is not applied. 5. Seccomp restrictions are not applied. 6. The device cgroup does not restrict access to any devices. 7. All devices from the host's /dev are available within the container. 8. SELinux restrictions are not applied (e.g. label=disabled).
optional namespace_options = 3
Configurations for the container's namespaces. Only used if the container uses namespace for isolation.
optional selinux_options = 4
SELinux context to be optionally applied.
optional run_as_user = 5
UID to run the container process as. Only one of run_as_user and run_as_username can be specified at a time.
optional run_as_group = 12
GID to run the container process as. run_as_group should only be specified when run_as_user or run_as_username is specified; otherwise, the runtime MUST error.
string run_as_username = 6
User name to run the container process as. If specified, the user MUST exist in the container image (i.e. in the /etc/passwd inside the image), and be resolved there by the runtime; otherwise, the runtime MUST error.
bool readonly_rootfs = 7
If set, the root filesystem of the container is read-only.
repeated int64 supplemental_groups = 8
List of groups applied to the first process run in each container. supplemental_groups_policy can control how groups will be calculated.
SupplementalGroupsPolicy supplemental_groups_policy = 17
supplemental_groups_policy defines how supplemental groups of the first container processes are calculated. Valid values are "Merge" and "Strict". If not specified, "Merge" is used.
bool no_new_privs = 11
no_new_privs defines if the flag for no_new_privs should be set on the container.
repeated string masked_paths = 13
masked_paths is a slice of paths that should be masked by the container runtime, this can be passed directly to the OCI spec.
repeated string readonly_paths = 14
readonly_paths is a slice of paths that should be set as readonly by the container runtime, this can be passed directly to the OCI spec.
optional seccomp = 15
Seccomp profile for the container.
optional apparmor = 16
AppArmor profile for the container.
string apparmor_profile = 9
AppArmor profile for the container, candidate values are: * runtime/default: equivalent to not specifying a profile. * unconfined: no profiles are loaded * localhost/<profile_name>: profile loaded on the node (localhost) by name. The possible profile names are detailed at https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference
string seccomp_profile_path = 10
Seccomp profile for the container, candidate values are: * runtime/default: the default profile for the container runtime * unconfined: unconfined profile, ie, no seccomp sandboxing * localhost/<full-path-to-profile>: the profile installed on the node. <full-path-to-profile> is the full path of the profile. Default: "", which is identical with unconfined.
message
api.proto:994Used in:
int64 uid = 1
uid is the primary uid initially attached to the first process in the container
int64 gid = 2
gid is the primary gid initially attached to the first process in the container
repeated int64 supplemental_groups = 3
supplemental_groups are the supplemental groups initially attached to the first process in the container
message
api.proto:434LinuxPodSandboxConfig holds platform-specific configurations for Linux host platforms and Linux-based containers.
Used in:
string cgroup_parent = 1
Parent cgroup of the PodSandbox. The cgroupfs style syntax will be used, but the container runtime can convert it to systemd semantics if needed.
optional security_context = 2
LinuxSandboxSecurityContext holds sandbox security attributes.
map<string, string> sysctls = 3
Sysctls holds linux sysctls config for the sandbox.
optional overhead = 4
Optional overhead represents the overheads associated with this sandbox
optional resources = 5
Optional resources represents the sum of container resources for this sandbox
message
api.proto:730LinuxPodSandboxStats provides the resource usage statistics for a pod sandbox on linux.
Used in:
optional cpu = 1
CPU usage gathered for the pod sandbox.
optional memory = 2
Memory usage gathered for the pod sandbox.
optional network = 3
Network usage gathered for the pod sandbox
optional process = 4
Stats pertaining to processes in the pod sandbox.
repeated containers = 5
Stats of containers in the measured pod sandbox.
optional io = 6
IO usage gathered for the pod sandbox.
message
api.proto:573LinuxSandboxStatus contains status specific to Linux sandboxes.
Used in:
optional namespaces = 1
Paths to the sandbox's namespaces.
message
api.proto:2092Used in:
CgroupDriver cgroup_driver = 1
Cgroup driver to use Note: this field should not change for the lifecycle of the Kubelet, or while there are running containers. The Kubelet will not re-request this after startup, and will construct the cgroup hierarchy assuming it is static. If the runtime wishes to change this value, it must be accompanied by removal of all pods, and a restart of the Kubelet. The easiest way to do this is with a full node reboot.
message
api.proto:372LinuxSandboxSecurityContext holds linux security configuration that will be applied to a sandbox. Note that: 1) It does not apply to containers in the pods. 2) It may not be applicable to a PodSandbox which does not contain any running process.
Used in:
optional namespace_options = 1
Configurations for the sandbox's namespaces. This will be used only if the PodSandbox uses namespace for isolation.
optional selinux_options = 2
Optional SELinux context to be applied.
optional run_as_user = 3
UID to run sandbox processes as, when applicable.
optional run_as_group = 8
GID to run sandbox processes as, when applicable. run_as_group should only be specified when run_as_user is specified; otherwise, the runtime MUST error.
bool readonly_rootfs = 4
If set, the root filesystem of the sandbox is read-only.
repeated int64 supplemental_groups = 5
List of groups applied to the first process run in each container. supplemental_groups_policy can control how groups will be calculated.
SupplementalGroupsPolicy supplemental_groups_policy = 11
supplemental_groups_policy defines how supplemental groups of the first container processes are calculated. Valid values are "Merge" and "Strict". If not specified, "Merge" is used.
bool privileged = 6
Indicates whether the sandbox will be asked to run a privileged container. If a privileged container is to be executed within it, this MUST be true. This allows a sandbox to take additional security precautions if no privileged containers are expected to be run.
optional seccomp = 9
Seccomp profile for the sandbox.
optional apparmor = 10
AppArmor profile for the sandbox.
string seccomp_profile_path = 7
Seccomp profile for the sandbox, candidate values are: * runtime/default: the default profile for the container runtime * unconfined: unconfined profile, ie, no seccomp sandboxing * localhost/<full-path-to-profile>: the profile installed on the node. <full-path-to-profile> is the full path of the profile. Default: "", which is identical with unconfined.
message
api.proto:1925MemoryUsage provides the memory usage information.
Used in: ,
int64 timestamp = 1
Timestamp in nanoseconds at which the information were collected. Must be > 0.
optional working_set_bytes = 2
The amount of working set memory in bytes.
optional available_bytes = 3
Available memory for use. This is defined as the memory limit - workingSetBytes.
optional usage_bytes = 4
Total memory in use. This includes all memory regardless of when it was accessed.
optional rss_bytes = 5
The amount of anonymous and swap cache memory (includes transparent hugepages).
optional page_faults = 6
Cumulative number of minor page faults.
optional major_page_faults = 7
Cumulative number of major page faults.
optional psi = 8
Memory PSI statistics.
message
api.proto:2063Used in: ,
string name = 1
Name must match a name previously returned in a MetricDescriptors call, otherwise, it will be ignored.
int64 timestamp = 2
Timestamp should be 0 if the metric was gathered live. If it was cached, the Timestamp should reflect the time in nanoseconds it was collected.
MetricType metric_type = 3
repeated string label_values = 4
The corresponding LabelValues to the LabelKeys defined in the MetricDescriptor. It is the responsibility of the runtime to correctly keep sorted the keys and values. If the two slices have different length, the behavior is undefined.
optional value = 5
message
api.proto:2034Used in:
string name = 1
The name field will be used as a unique identifier of this MetricDescriptor, and be used in conjunction with the Metric structure to populate the full Metric.
string help = 2
repeated string label_keys = 3
When a metric uses this metric descriptor, it should only define labels that have previously been declared in label_keys. It is the responsibility of the runtime to correctly keep sorted the keys and values. If the two slices have different length, the behavior is undefined.
Used in:
COUNTER = 0
GAUGE = 1
message
api.proto:227Mount specifies a host volume to mount into a container.
Used in: ,
string container_path = 1
Path of the mount within the container.
string host_path = 2
Path of the mount on the host. Has to be empty if the image field below is provided, because those fields are mutually exclusive. If the image field below is nil and the host path doesn't exist, then runtimes should report an error. If the hostpath is a symbolic link, runtimes should follow the symlink and mount the real destination to container.
bool readonly = 3
If set, the mount is read-only.
bool selinux_relabel = 4
If set, the mount needs SELinux relabeling.
MountPropagation propagation = 5
Requested propagation mode.
repeated uidMappings = 6
UidMappings specifies the runtime UID mappings for the mount.
repeated gidMappings = 7
GidMappings specifies the runtime GID mappings for the mount.
bool recursive_read_only = 8
If set to true, the mount is made recursive read-only. In this CRI API, recursive_read_only is a plain true/false boolean, although its equivalent in the Kubernetes core API is a quaternary that can be nil, "Enabled", "IfPossible", or "Disabled". kubelet translates that quaternary value in the core API into a boolean in this CRI API. Remarks: - nil is just treated as false - when set to true, readonly must be explicitly set to true, and propagation must be PRIVATE (0). - (readonly == false && recursive_read_only == false) does not make the mount read-only.
optional image = 9
Mount an image reference (image ID, with or without digest), which is a special use case for image volume mounts. If this field is set, then host_path should be unset. All image mounts are per feature definition readonly (noexec). The kubelet does an PullImage RPC and evaluates the returned PullImageResponse.image_ref value, which is then set to the ImageSpec.image field. Runtimes are expected to mount the image as required. Introduced in the Image Volume Source KEP: https://kep.k8s.io/4639
string image_sub_path = 10
Specific image sub path to be used from inside the image instead of its root, only necessary if the above image field is set. If the sub path is not empty and does not exist in the image, then runtimes should fail and return an error. Introduced in the Image Volume Source KEP beta graduation: https://kep.k8s.io/4639
Used in:
PROPAGATION_PRIVATE = 0
No mount propagation ("rprivate" in Linux terminology).
PROPAGATION_HOST_TO_CONTAINER = 1
Mounts get propagated from the host to the container ("rslave" in Linux).
PROPAGATION_BIDIRECTIONAL = 2
Mounts get propagated from the host to the container and from the container to the host ("rshared" in Linux).
message
api.proto:567Namespace contains paths to the namespaces.
Used in:
optional options = 2
Namespace options for Linux namespaces.
A NamespaceMode describes the intended namespace configuration for each of the namespaces (Network, PID, IPC) in NamespaceOption. Runtimes should map these modes as appropriate for the technology underlying the runtime.
Used in: , ,
POD = 0
A POD namespace is common to all containers in a pod. For example, a container with a PID namespace of POD expects to view all of the processes in all of the containers in the pod.
CONTAINER = 1
A CONTAINER namespace is restricted to a single container. For example, a container with a PID namespace of CONTAINER expects to view only the processes in that container.
NODE = 2
A NODE namespace is the namespace of the Kubernetes node. For example, a container with a PID namespace of NODE expects to view all of the processes on the host running the kubelet.
TARGET = 3
TARGET targets the namespace of another container. When this is specified, a target_id must be specified in NamespaceOption and refer to a container previously created with NamespaceMode CONTAINER. This containers namespace will be made to match that of container target_id. For example, a container with a PID namespace of TARGET expects to view all of the processes that container target_id can view.
message
api.proto:321NamespaceOption provides options for Linux namespaces.
Used in: , ,
NamespaceMode network = 1
Network namespace for this container/sandbox. Note: There is currently no way to set CONTAINER scoped network in the Kubernetes API. Namespaces currently set by the kubelet: POD, NODE
NamespaceMode pid = 2
PID namespace for this container/sandbox. Note: The CRI default is POD, but the v1.PodSpec default is CONTAINER. The kubelet's runtime manager will set this to CONTAINER explicitly for v1 pods. Namespaces currently set by the kubelet: POD, CONTAINER, NODE, TARGET
NamespaceMode ipc = 3
IPC namespace for this container/sandbox. Note: There is currently no way to set CONTAINER scoped IPC in the Kubernetes API. Namespaces currently set by the kubelet: POD, NODE
string target_id = 4
Target Container ID for NamespaceMode of TARGET. This container must have been previously created in the same pod. It is not possible to specify different targets for each namespace.
optional userns_options = 5
UsernsOptions for this pod sandbox. The Kubelet picks the user namespace configuration to use for the pod sandbox. The mappings are specified as part of the UserNamespace struct. If the struct is nil, then the POD mode must be assumed. This is done for backward compatibility with older Kubelet versions that do not set a user namespace.
message
api.proto:1656Used in:
string pod_cidr = 1
CIDR to use for pod IP addresses. If the CIDR is empty, runtimes should omit it.
message
api.proto:780NetworkInterfaceUsage contains resource value data about a network interface.
Used in:
string name = 1
The name of the network interface.
optional rx_bytes = 2
Cumulative count of bytes received.
optional rx_errors = 3
Cumulative count of receive errors encountered.
optional tx_bytes = 4
Cumulative count of bytes transmitted.
optional tx_errors = 5
Cumulative count of transmit errors encountered.
message
api.proto:760NetworkUsage contains data about network resources.
Used in:
int64 timestamp = 1
Timestamp in nanoseconds at which the information were collected. Must be > 0.
optional default_interface = 2
Stats for the default network interface.
repeated interfaces = 3
Stats for all found network interfaces, excluding the default.
message
api.proto:553PodIP represents an ip of a Pod
Used in:
string ip = 1
an ip is a string representation of an IPv4 or an IPv6
message
api.proto:648PodSandbox contains minimal information about a sandbox.
Used in:
string id = 1
ID of the PodSandbox.
optional metadata = 2
Metadata of the PodSandbox.
PodSandboxState state = 3
State of the PodSandbox.
int64 created_at = 4
Creation timestamps of the PodSandbox in nanoseconds. Must be > 0.
map<string, string> labels = 5
Labels of the PodSandbox.
map<string, string> annotations = 6
Unstructured key-value map holding arbitrary metadata. Annotations MUST NOT be altered by the runtime; the value of this field MUST be identical to that of the corresponding PodSandboxConfig used to instantiate this PodSandbox.
string runtime_handler = 7
runtime configuration used for this PodSandbox.
message
api.proto:704PodSandboxAttributes provides basic information of the pod sandbox.
Used in:
string id = 1
ID of the pod sandbox.
optional metadata = 2
Metadata of the pod sandbox.
map<string, string> labels = 3
Key-value pairs that may be used to scope and select individual resources.
map<string, string> annotations = 4
Unstructured key-value map holding arbitrary metadata. Annotations MUST NOT be altered by the runtime; the value of this field MUST be identical to that of the corresponding PodSandboxStatus used to instantiate the PodSandbox this status represents.
message
api.proto:466PodSandboxConfig holds all the required and optional fields for creating a sandbox.
Used in: , ,
optional metadata = 1
Metadata of the sandbox. This information will uniquely identify the sandbox, and the runtime should leverage this to ensure correct operation. The runtime may also use this information to improve UX, such as by constructing a readable name.
string hostname = 2
Hostname of the sandbox. Hostname could only be empty when the pod network namespace is NODE.
string log_directory = 3
Path to the directory on the host in which container log files are stored. By default the log of a container going into the LogDirectory will be hooked up to STDOUT and STDERR. However, the LogDirectory may contain binary log files with structured logging data from the individual containers. For example, the files might be newline separated JSON structured logs, systemd-journald journal files, gRPC trace files, etc. E.g., PodSandboxConfig.LogDirectory = `/var/log/pods/<NAMESPACE>_<NAME>_<UID>/` ContainerConfig.LogPath = `containerName/Instance#.log`
optional dns_config = 4
DNS config for the sandbox.
repeated port_mappings = 5
Port mappings for the sandbox.
map<string, string> labels = 6
Key-value pairs that may be used to scope and select individual resources.
map<string, string> annotations = 7
Unstructured key-value map that may be set by the kubelet to store and retrieve arbitrary metadata. This will include any annotations set on a pod through the Kubernetes API. Annotations MUST NOT be altered by the runtime; the annotations stored here MUST be returned in the PodSandboxStatus associated with the pod this PodSandboxConfig creates. In general, in order to preserve a well-defined interface between the kubelet and the container runtime, annotations SHOULD NOT influence runtime behaviour. Annotations can also be useful for runtime authors to experiment with new features that are opaque to the Kubernetes APIs (both user-facing and the CRI). Whenever possible, however, runtime authors SHOULD consider proposing new typed fields for any new features instead.
optional linux = 8
Optional configurations specific to Linux hosts.
optional windows = 9
Optional configurations specific to Windows hosts.
message
api.proto:630PodSandboxFilter is used to filter a list of PodSandboxes. All those fields are combined with 'AND'
Used in:
string id = 1
ID of the sandbox.
optional state = 2
State of the sandbox.
map<string, string> label_selector = 3
LabelSelector to select matches. Only api.MatchLabels is supported for now and the requirements are ANDed. MatchExpressions is not supported yet.
message
api.proto:453PodSandboxMetadata holds all necessary information for building the sandbox name. The container runtime is encouraged to expose the metadata associated with the PodSandbox in its user interface for better user experience. For example, the runtime can construct a unique PodSandboxName based on the metadata.
Used in: , , ,
string name = 1
Pod name of the sandbox. Same as the pod name in the Pod ObjectMeta.
string uid = 2
Pod UID of the sandbox. Same as the pod UID in the Pod ObjectMeta.
string namespace = 3
Pod namespace of the sandbox. Same as the pod namespace in the Pod ObjectMeta.
uint32 attempt = 4
Attempt number of creating the sandbox. Default: 0.
message
api.proto:2052Used in:
string pod_sandbox_id = 1
repeated metrics = 2
repeated container_metrics = 3
message
api.proto:559PodSandboxNetworkStatus is the status of the network for a PodSandbox. Currently ignored for pods sharing the host networking namespace.
Used in:
string ip = 1
IP address of the PodSandbox.
repeated additional_ips = 2
list of additional ips (not inclusive of PodSandboxNetworkStatus.Ip) of the PodSandBoxNetworkStatus
Used in: , ,
SANDBOX_READY = 0
SANDBOX_NOTREADY = 1
message
api.proto:623PodSandboxStateValue is the wrapper of PodSandboxState.
Used in:
PodSandboxState state = 1
State of the sandbox.
message
api.proto:720PodSandboxStats provides the resource usage statistics for a pod. The linux or windows field will be populated depending on the platform.
Used in: ,
optional attributes = 1
Information of the pod.
optional linux = 2
Stats from linux.
optional windows = 3
Stats from windows.
message
api.proto:684PodSandboxStatsFilter is used to filter the list of pod sandboxes to retrieve stats for. All those fields are combined with 'AND'.
Used in:
string id = 1
ID of the pod sandbox.
map<string, string> label_selector = 2
LabelSelector to select matches. Only api.MatchLabels is supported for now and the requirements are ANDed. MatchExpressions is not supported yet.
message
api.proto:584PodSandboxStatus contains the status of the PodSandbox.
Used in: ,
string id = 1
ID of the sandbox.
optional metadata = 2
Metadata of the sandbox.
PodSandboxState state = 3
State of the sandbox.
int64 created_at = 4
Creation timestamp of the sandbox in nanoseconds. Must be > 0.
optional network = 5
Network contains network status if network is handled by the runtime.
optional linux = 6
Linux-specific status to a pod sandbox.
map<string, string> labels = 7
Labels are key-value pairs that may be used to scope and select individual resources.
map<string, string> annotations = 8
Unstructured key-value map holding arbitrary metadata. Annotations MUST NOT be altered by the runtime; the value of this field MUST be identical to that of the corresponding PodSandboxConfig used to instantiate the pod sandbox this status represents.
string runtime_handler = 9
runtime configuration used for this PodSandbox.
message
api.proto:196PortMapping specifies the port mapping configurations of a sandbox.
Used in:
Protocol protocol = 1
Protocol of the port mapping.
int32 container_port = 2
Port number within the container. Default: 0 (not specified).
int32 host_port = 3
Port number on the host to map the container port to. * Valid host port range is 1-65535. * The value 0 has explicit semantic meaning: it indicates NO host port should be allocated. * The value 0 does NOT indicate dynamic port allocation. Future implementations of dynamic allocation will use different values/semantics. * Implementations MUST handle the case where this field is explicitly set to 0, This field SHOULD be omitted when no port is required. Default: If omitted, container port will not be exposed on the host.
string host_ip = 4
Host IP.
message
api.proto:808ProcessUsage are stats pertaining to processes.
Used in:
int64 timestamp = 1
Timestamp in nanoseconds at which the information were collected. Must be > 0.
optional process_count = 2
Number of processes.
Used in:
TCP = 0
UDP = 1
SCTP = 2
message
api.proto:1888PSI data for an individual resource.
Used in:
uint64 Total = 1
Total time duration for tasks in the cgroup have waited due to congestion. Unit: nanoseconds.
double Avg10 = 2
The average (in %) tasks have waited due to congestion over a 10 second window.
double Avg60 = 3
The average (in %) tasks have waited due to congestion over a 60 second window.
double Avg300 = 4
The average (in %) tasks have waited due to congestion over a 300 second window.
message
api.proto:1880PSI statistics for an individual resource.
Used in: , ,
optional Full = 1
PSI data for all tasks in the cgroup.
optional Some = 2
PSI data for some tasks in the cgroup.
message
api.proto:1685RuntimeCondition contains condition information for the runtime. There are 2 kinds of runtime conditions: 1. Required conditions: Conditions are required for kubelet to work properly. If any required condition is unmet, the node will be not ready. The required conditions include: * RuntimeReady: RuntimeReady means the runtime is up and ready to accept basic containers e.g. container only needs host network. * NetworkReady: NetworkReady means the runtime network is up and ready to accept containers which require container network. 2. Optional conditions: Conditions are informative to the user, but kubelet will not rely on. Since condition type is an arbitrary string, all conditions not required are optional. These conditions will be exposed to users to help them understand the status of the system.
Used in:
string type = 1
Type of runtime condition.
bool status = 2
Status of the condition, one of true/false. Default: false.
string reason = 3
Brief CamelCase string containing reason for the condition's last transition.
string message = 4
Human-readable message indicating details about last transition.
message
api.proto:1662Used in:
optional network_config = 1
message
api.proto:1731RuntimeFeatures describes the set of features implemented by the CRI implementation. The features contained in the RuntimeFeatures should depend only on the cri implementation independent of runtime handlers.
Used in:
bool supplemental_groups_policy = 1
supplemental_groups_policy is set to true if the runtime supports SupplementalGroupsPolicy and ContainerUser.
message
api.proto:1720Used in:
string name = 1
Name must be unique in StatusResponse. An empty string denotes the default handler.
optional features = 2
Supported features.
message
api.proto:1708RuntimeHandlerFeatures is a set of features implemented by the runtime handler.
Used in:
bool recursive_read_only_mounts = 1
recursive_read_only_mounts is set to true if the runtime handler supports recursive read-only mounts. For runc-compatible runtimes, availability of this feature can be detected by checking whether the Linux kernel version is >= 5.12, and, `runc features | jq .mountOptions` contains "rro".
bool user_namespaces = 2
user_namespaces is set to true if the runtime handler supports user namespaces as implemented in Kubernetes. This means support for both, user namespaces and idmap mounts.
message
api.proto:1697RuntimeStatus is information about the current status of the runtime.
Used in:
repeated conditions = 1
List of current observed runtime conditions.
message
api.proto:884SELinuxOption are the labels to be applied to the container.
Used in: ,
string user = 1
string role = 2
string type = 3
string level = 4
message
api.proto:413A security profile which can be used for sandboxes and containers.
Used in: ,
SecurityProfile.ProfileType profile_type = 1
Indicator which `ProfileType` should be applied.
string localhost_ref = 2
Indicates that a pre-defined profile on the node should be used. Must only be set if `ProfileType` is `Localhost`. For seccomp, it must be an absolute path to the seccomp profile. For AppArmor, this field is the AppArmor `<profile name>/`
Available profile types.
Used in:
RuntimeDefault = 0
The container runtime default profile should be used.
Unconfined = 1
Disable the feature for the sandbox or the container.
Localhost = 2
A pre-defined profile on the node should be used.
enum Signal
api.proto:1186Used in: ,
RUNTIME_DEFAULT = 0
SIGABRT = 1
SIGALRM = 2
SIGBUS = 3
SIGCHLD = 4
SIGCLD = 5
SIGCONT = 6
SIGFPE = 7
SIGHUP = 8
SIGILL = 9
SIGINT = 10
SIGIO = 11
SIGIOT = 12
SIGKILL = 13
SIGPIPE = 14
SIGPOLL = 15
SIGPROF = 16
SIGPWR = 17
SIGQUIT = 18
SIGSEGV = 19
SIGSTKFLT = 20
SIGSTOP = 21
SIGSYS = 22
SIGTERM = 23
SIGTRAP = 24
SIGTSTP = 25
SIGTTIN = 26
SIGTTOU = 27
SIGURG = 28
SIGUSR1 = 29
SIGUSR2 = 30
SIGVTALRM = 31
SIGWINCH = 32
SIGXCPU = 33
SIGXFSZ = 34
SIGRTMIN = 35
SIGRTMINPLUS1 = 36
SIGRTMINPLUS2 = 37
SIGRTMINPLUS3 = 38
SIGRTMINPLUS4 = 39
SIGRTMINPLUS5 = 40
SIGRTMINPLUS6 = 41
SIGRTMINPLUS7 = 42
SIGRTMINPLUS8 = 43
SIGRTMINPLUS9 = 44
SIGRTMINPLUS10 = 45
SIGRTMINPLUS11 = 46
SIGRTMINPLUS12 = 47
SIGRTMINPLUS13 = 48
SIGRTMINPLUS14 = 49
SIGRTMINPLUS15 = 50
SIGRTMAXMINUS14 = 51
SIGRTMAXMINUS13 = 52
SIGRTMAXMINUS12 = 53
SIGRTMAXMINUS11 = 54
SIGRTMAXMINUS10 = 55
SIGRTMAXMINUS9 = 56
SIGRTMAXMINUS8 = 57
SIGRTMAXMINUS7 = 58
SIGRTMAXMINUS6 = 59
SIGRTMAXMINUS5 = 60
SIGRTMAXMINUS4 = 61
SIGRTMAXMINUS3 = 62
SIGRTMAXMINUS2 = 63
SIGRTMAXMINUS1 = 64
SIGRTMAX = 65
SupplementalGroupsPolicy defines how supplemental groups of the first container processes are calculated.
Used in: ,
Merge = 0
Merge means that the container's provided SupplementalGroups and FsGroup (specified in SecurityContext) will be merged with the primary user's groups as defined in the container image (in /etc/group).
Strict = 1
Strict means that the container's provided SupplementalGroups and FsGroup (specified in SecurityContext) will be used instead of any groups defined in the container image.
message
api.proto:1951Used in:
int64 timestamp = 1
Timestamp in nanoseconds at which the information were collected. Must be > 0.
optional swap_available_bytes = 2
Available swap for use. This is defined as the swap limit - swapUsageBytes.
optional swap_usage_bytes = 3
Total memory in use. This includes all memory regardless of when it was accessed.
message
api.proto:1754UInt64Value is the wrapper of uint64.
Used in: , , , , , , , , , , ,
uint64 value = 1
The value.
message
api.proto:308UserNamespace describes the intended user namespace configuration for a pod sandbox.
Used in:
NamespaceMode mode = 1
Mode is the NamespaceMode for this UserNamespace. Note: NamespaceMode for UserNamespace currently supports only POD and NODE, not CONTAINER OR TARGET.
repeated uids = 2
Uids specifies the UID mappings for the user namespace.
repeated gids = 3
Gids specifies the GID mappings for the user namespace.
message
api.proto:1052WindowsContainerConfig contains platform-specific configuration for Windows-based containers.
Used in:
optional resources = 1
Resources specification for the container.
optional security_context = 2
WindowsContainerSecurityContext configuration for the container.
message
api.proto:1061WindowsContainerResources specifies Windows specific configuration for resources.
Used in: , ,
int64 cpu_shares = 1
CPU shares (relative weight vs. other containers). Default: 0 (not specified).
int64 cpu_count = 2
Number of CPUs available to the container. Default: 0 (not specified).
int64 cpu_maximum = 3
Specifies the portion of processor cycles that this container can use as a percentage times 100.
int64 memory_limit_in_bytes = 4
Memory limit in bytes. Default: 0 (not specified).
int64 rootfs_size_in_bytes = 5
Specifies the size of the rootfs / scratch space in bytes to be configured for this container. Default: 0 (not specified).
repeated affinity_cpus = 6
Optionally specifies the set of CPUs to affinitize for this container.
message
api.proto:1037WindowsContainerSecurityContext holds windows security configuration that will be applied to a container.
Used in:
string run_as_username = 1
User name to run the container process as. If specified, the user MUST exist in the container image and be resolved there by the runtime; otherwise, the runtime MUST return error.
string credential_spec = 2
The contents of the GMSA credential spec to use to run this container.
bool host_process = 3
Indicates whether a container is to be run as a HostProcess container.
message
api.proto:1868WindowsContainerStats provides the resource usage statistics for a container specific for Windows
Used in:
optional attributes = 1
Information of the container.
optional cpu = 2
CPU usage gathered from the container.
optional memory = 3
Memory usage gathered from the container.
optional writable_layer = 4
Usage of the writable layer.
message
api.proto:1079WindowsCpuGroupAffinity specifies the CPU mask and group to affinitize. This is similar to the following _GROUP_AFFINITY structure: https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/miniport/ns-miniport-_group_affinity
Used in:
uint64 cpu_mask = 1
CPU mask relative to this CPU group.
uint32 cpu_group = 2
Processor group the mask refers to, as returned by GetLogicalProcessorInformationEx.
message
api.proto:1914WindowsCpuUsage provides the CPU usage information specific to Windows
Used in: ,
int64 timestamp = 1
Timestamp in nanoseconds at which the information were collected. Must be > 0.
optional usage_core_nano_seconds = 2
Cumulative CPU usage (sum across all cores) since object creation.
optional usage_nano_cores = 3
Total CPU usage (sum of all cores) averaged over the sample window. The "core" unit can be interpreted as CPU core-nanoseconds per second.
message
api.proto:1782WindowsFilesystemUsage provides the filesystem usage information specific to Windows.
Used in:
int64 timestamp = 1
Timestamp in nanoseconds at which the information were collected. Must be > 0.
optional fs_id = 2
The unique identifier of the filesystem.
optional used_bytes = 3
UsedBytes represents the bytes used for images on the filesystem. This may differ from the total bytes used on the filesystem and may not equal CapacityBytes - AvailableBytes.
message
api.proto:1961WindowsMemoryUsage provides the memory usage information specific to Windows
Used in: ,
int64 timestamp = 1
Timestamp in nanoseconds at which the information were collected. Must be > 0.
optional working_set_bytes = 2
The amount of working set memory in bytes.
optional available_bytes = 3
Available memory for use. This is defined as the memory limit - commit_memory_bytes.
optional page_faults = 4
Cumulative number of page faults.
optional commit_memory_bytes = 5
Total commit memory in use. Commit memory is total of physical and virtual memory in use.
message
api.proto:1004WindowsNamespaceOption provides options for Windows namespaces.
Used in:
NamespaceMode network = 1
Network namespace for this container/sandbox. This is currently never set by the kubelet
message
api.proto:794WindowsNetworkInterfaceUsage contains resource value data about a network interface specific for Windows.
Used in:
string name = 1
The name of the network interface.
optional rx_bytes = 2
Cumulative count of bytes received.
optional rx_packets_dropped = 3
Cumulative count of receive errors encountered.
optional tx_bytes = 4
Cumulative count of bytes transmitted.
optional tx_packets_dropped = 5
Cumulative count of transmit errors encountered.
message
api.proto:770WindowsNetworkUsage contains data about network resources specific to Windows.
Used in:
int64 timestamp = 1
Timestamp in nanoseconds at which the information were collected. Must be > 0.
optional default_interface = 2
Stats for the default network interface.
repeated interfaces = 3
Stats for all found network interfaces, excluding the default.
message
api.proto:1031WindowsPodSandboxConfig holds platform-specific configurations for Windows host platforms and Windows-based containers.
Used in:
optional security_context = 1
WindowsSandboxSecurityContext holds sandbox security attributes.
message
api.proto:746WindowsPodSandboxStats provides the resource usage statistics for a pod sandbox on windows
Used in:
optional cpu = 1
CPU usage gathered for the pod sandbox.
optional memory = 2
Memory usage gathered for the pod sandbox.
optional network = 3
Network usage gathered for the pod sandbox
optional process = 4
Stats pertaining to processes in the pod sandbox.
repeated containers = 5
Stats of containers in the measured pod sandbox.
message
api.proto:816WindowsProcessUsage are stats pertaining to processes specific to Windows.
Used in:
int64 timestamp = 1
Timestamp in nanoseconds at which the information were collected. Must be > 0.
optional process_count = 2
Number of processes.
message
api.proto:1013WindowsSandboxSecurityContext holds platform-specific configurations that will be applied to a sandbox. These settings will only apply to the sandbox container.
Used in:
string run_as_username = 1
User name to run the container process as. If specified, the user MUST exist in the container image and be resolved there by the runtime; otherwise, the runtime MUST return error.
string credential_spec = 2
The contents of the GMSA credential spec to use to run this container.
bool host_process = 3
Indicates whether the container requested to run as a HostProcess container.
optional namespace_options = 4
Configuration for the sandbox's namespaces