Exposing Pod Metadata with the Downward API

Configuration and Security / Guide 30 of 44 / Intermediate

• Kubernetes1.36.4
• Cluster4 nodes
• Runtimecontainerd 2.2.6
• CNICalico v3.32.1
• TimeAbout 14 min

resourceFieldRef takes a divisor, which sets the unit of the value it produces: 1m gives millicores, 1Mi gives mebibytes. Without it the value is in bytes and cores, which is almost never what an application wants to read.

This guide includes

Use this when an application needs to know something about its own Pod. This matters because a container cannot discover its Pod name, node or labels on its own - and two of those are available only through a volume, never as an environment variable.

• injecting seven facts about the Pod as environment variables
• mounting labels and annotations as files, which environment variables cannot carry
• watching the API reject metadata.labels through fieldRef in env
• using resourceFieldRef, which needs both a container name and a divisor

Before you start

• A cluster and kubectl.
• The session creates namespace ckad-down and a Pod that reads seven facts about itself through environment variables and two more through a volume, plus one Pod that is rejected.

1. 1

   Seven facts through environment variables

2. 2

   Two more through a volume

3. 3

   The field that is not allowed as an environment variable

4. 4

   The one that needs a container name

Official sources

• Expose Pod Information to Containers Through Environment Variables
• Expose Pod Information Through Files
• Downward API