Exposing Pod Metadata with the Downward API
The downward API injects facts about the Pod into the Pod - its name, the node it landed on, its own IP, the memory limit it was given. It comes in two forms with different capabilities, and the difference is the exam question: labels and annotations are available only through a volume, and asking for them as an environment variable is rejected with a message that helpfully lists everything that is allowed.
Configuration and Security Guide 30 of 44 Intermediate
- Kubernetes1.36.4
- Runtimecontainerd 2.2.6
- CNICalico v3.32.1
- TimeAbout 14 min
- Reviewed23 August 2026
Written against the versions above. `resourceFieldRef` takes a `divisor`, which sets the unit of the value it produces: `1m` gives millicores, `1Mi` gives mebibytes. Without it the value is in bytes and cores, which is almost never what an application wants to read.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE03 | 192.168.0.178 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
Before you start
- A cluster and kubectl.
- The session creates namespace
ckad-downand a Pod that reads seven facts about itself through environment variables and two more through a volume, plus one Pod that is rejected.
-
Seven facts through environment variables
-
Two more through a volume
-
The field that is not allowed as an environment variable
-
The one that needs a container name