Add blog article about zpages #53030

richabanker · 2025-10-31T18:39:43Z

Description

Adds a blog for Kubernetes component zpages

Issues

kubernetes/enhancements#4827
kubernetes/enhancements#4828

netlify · 2025-10-31T18:49:31Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`a32bd1f`
🔍 Latest deploy log	https://app.netlify.com/projects/kubernetes-io-main-staging/deploys/690502725efac30008715b00
😎 Deploy Preview	https://deploy-preview-53030--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

netlify · 2025-10-31T18:59:25Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`58efab3`
🔍 Latest deploy log	https://app.netlify.com/projects/kubernetes-io-main-staging/deploys/6917e32bcc4c850008a7ea2c
😎 Deploy Preview	https://deploy-preview-53030--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

lmktfy · 2025-11-04T23:16:56Z

Not yet ready for review, so:
/retitle [WIP] Add blog article about zpages

richabanker · 2025-11-14T00:19:04Z

Ready for a first pass now @sftim , thanks!

lmktfy

Thanks. I do have quite a lot of feedback on it I'm afraid.

lmktfy · 2025-11-14T07:19:59Z

content/en/blog/_posts/2025-11-13-zpages-for-kubernetes.md

+The new structured responses are opt-in. Without specifying an `Accept` header, the endpoints continue to return the familiar plain text format:
+
+```
+$ curl -k --cert /etc/kubernetes/pki/apiserver-kubelet-client.crt \


Even in a blog article, I strongly don't recommend teaching / tacitly endorsing curl -k.

Either suggest an example using a plain HTTP port, or give the example without the security bypass and then mention the *long" flag name in a comment. In other words, make people think before they bypass the check.

sounds good, updated examples to not use the -k flag and added a note regarding bypassing cert authn

content/en/blog/_posts/2025-11-13-zpages-for-kubernetes.md

lmktfy · 2025-11-14T07:21:32Z

content/en/blog/_posts/2025-11-13-zpages-for-kubernetes.md

+
+```bash
+# Get structured statusz response
+curl -k \


See earlier comment about the security check bypass.

lmktfy · 2025-11-14T07:21:42Z

content/en/blog/_posts/2025-11-13-zpages-for-kubernetes.md

+  https://localhost:6443/statusz | jq .
+
+# Get structured flagz response
+curl -k \


See earlier comment about the security check bypass.

lmktfy · 2025-11-14T07:22:14Z

content/en/blog/_posts/2025-11-13-zpages-for-kubernetes.md

+
+z-pages expose internal component information and require proper access controls. Here are the key security considerations:
+
+**RBAC authorization**: Access to z-page endpoints is restricted to members of the `system:monitoring` group, which follows the same authorization model as other debugging endpoints like `/healthz`, `/livez`, and `/readyz`. This ensures that only authorized users and service accounts can access debugging information.


nit: not all clusters use RBAC for authz

Clarified to say - "if you use RBAC ..."

lmktfy · 2025-11-14T07:26:38Z

content/en/blog/_posts/2025-11-13-zpages-for-kubernetes.md

+
+## What are z-pages?
+
+z-pages are special debugging endpoints exposed by Kubernetes control plane components. Introduced as an alpha feature in Kubernetes 1.32, these endpoints provide runtime diagnostics for components like kube-apiserver, kube-controller-manager, kube-scheduler, kubelet and kube-proxy. The name "z-pages" comes from the convention of using `/z*` paths for debugging endpoints.


nit: The wildcard doesn't look quite right here.

lmktfy · 2025-11-14T07:27:12Z

content/en/blog/_posts/2025-11-13-zpages-for-kubernetes.md

+
+Currently, Kubernetes supports two primary z-page endpoints:
+
+- **`/statusz`**: Displays high-level component information including version information, start time, uptime, and available debug paths


nit: this could be a Markdown description list (and I recommend using one)

lmktfy · 2025-11-14T07:30:38Z

content/en/blog/_posts/2025-11-13-zpages-for-kubernetes.md

+Currently, Kubernetes supports two primary z-page endpoints:
+
+- **`/statusz`**: Displays high-level component information including version information, start time, uptime, and available debug paths
+- **`/flagz`**: Shows all command-line flags and their values used to start the component (with confidential values redacted for security)


Suggested change

- **`/flagz`**: Shows all command-line flags and their values used to start the component (with confidential values redacted for security)

- **`/flagz`**: Shows all command-line arguments and their values used to start the component (with confidential values redacted for security)

Despite the URL path, we actually list command line arguments that take non-boolean values
(the Go ecosystem uses "flag" to describe all command line options, but the wider world of IT usually doesn't; argv for example rather than flagv)

lmktfy · 2025-11-14T07:33:04Z

content/en/blog/_posts/2025-11-13-zpages-for-kubernetes.md

+  "startTime": "2025-10-29T00:30:01Z",
+  "uptimeSeconds": 856,
+  "goVersion": "go1.23.2",
+  "binaryVersion": "1.35.0-alpha.0.1595+b288caa2c26536-dirty",


nit: could make this look like a released version

lmktfy · 2025-11-14T07:35:00Z

content/en/blog/_posts/2025-11-13-zpages-for-kubernetes.md

+  "flags": {
+    "advertise-address": "192.168.8.4",
+    "allow-privileged": "true",
+    "authorization-mode": "[Node,RBAC]",


This is odd; does this mean that the string value is an embedded JSON document, or a Go literal? If we did one day serve a CBOR response, would the field value be CBOR bytes?

Maybe we should highlight this as a detail that isn't yet settled and that may change before beta?

The value is a string representation of how the authorization-mode flag was set on the command line, so for CBOR, I am guessing it would print out a string "CBOR" likely ..?

yongruilin · 2025-11-15T00:11:49Z

content/en/blog/_posts/2025-11-13-zpages-for-kubernetes.md

+
+### Example: Getting structured responses
+
+Here's an example using `curl` to retrieve structured JSON responses:


Mention that this is a curl request and JSON responses from kube-apiserver?

oh right, done thanks!

Serenity611

Reviewed from a general proofreading/style guide alignment perspective and made a few small suggestions :) Looks great!

Also wanted to note that as a non-technical person, I found this article very easy to follow and understand. It's laid out clearly and concisely, really enjoyable to read!

content/en/blog/_posts/2025-11-13-zpages-for-kubernetes.md

Co-authored-by: Susan Sica <90214772+Serenity611@users.noreply.github.com>

graz-dev · 2025-11-17T08:26:52Z

Hi @richabanker 👋 v1.35 Communications team here,

@macsko as author of #53012, I'd like you to be a writing buddy for @richabanker on this PR.

Please:

Review this PR, paying attention to the guidelines and review hints
Update your own PR based on any best practices you identify that should be applied
Remember to be compassionate with your fellow article author

graz-dev · 2025-11-17T09:39:41Z

Hi @richabanker 👋 -- this is Graziano (@graz-dev) from the v1.35 Communications Team!

Just a friendly reminder that we are approaching the feature blog "ready for review" deadline: Friday 21st November. We ask you to have the blog in non-draft state, and all write-up to be complete, so that we can start the blog review from SIG Docs Blog team.

If you have any questions or need help, please don't hesitate to reach out to me or any of the Communications Team members. We are here to help you!

graz-dev

/lgtm

I'm happy with the content and the overall readability of this blog post.
@lmktfy I saw that most of your suggestions were implemented, so if it is ok for you we can merge it 🚀

k8s-ci-robot · 2025-11-21T17:06:09Z

LGTM label has been added.

Details

Git tree hash: 69693bf934697aa198eaaff34aaff49c489c55cc

lmktfy · 2025-11-21T17:42:12Z

@graz-dev this isn't (directly) a change to the live docs, so you can approve this one yourself. Feel free to do so.

graz-dev · 2025-11-21T19:40:40Z

Nice

/lgtm
/approve

k8s-ci-robot · 2025-11-21T19:40:47Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: graz-dev

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~content/en/blog/OWNERS~~ [graz-dev]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

wenjiaswe · 2025-11-21T20:16:05Z

cc @bowei

k8s-ci-robot requested review from graz-dev and lmktfy October 31, 2025 18:39

k8s-ci-robot added area/blog Issues or PRs related to the Kubernetes Blog subproject cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. language/en Issues or PRs related to English language size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Oct 31, 2025

richabanker force-pushed the zpages branch from a32bd1f to 07a318a Compare October 31, 2025 18:40

k8s-ci-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Oct 31, 2025

This was referenced Oct 31, 2025

Statusz for Kubernetes Components kubernetes/enhancements#4827

Open

Flagz for Kubernetes Components kubernetes/enhancements#4828

Open

k8s-ci-robot changed the title ~~Add blog for zpages~~ [WIP] Add blog article about zpages Nov 4, 2025

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 4, 2025

richabanker force-pushed the zpages branch from 07a318a to 57592cf Compare November 14, 2025 00:01

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Nov 14, 2025

richabanker force-pushed the zpages branch 6 times, most recently from 3e5aaa1 to 77b8c8a Compare November 14, 2025 00:18

richabanker changed the title ~~[WIP] Add blog article about zpages~~ Add blog article about zpages Nov 14, 2025

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 14, 2025

Add blog for zpages

900b5a6

richabanker force-pushed the zpages branch from 77b8c8a to 900b5a6 Compare November 14, 2025 00:19

lmktfy reviewed Nov 14, 2025

View reviewed changes

richabanker force-pushed the zpages branch 2 times, most recently from ed89867 to eea460e Compare November 14, 2025 22:02

yongruilin reviewed Nov 15, 2025

View reviewed changes

Serenity611 reviewed Nov 15, 2025

View reviewed changes

content/en/blog/_posts/2025-11-13-zpages-for-kubernetes.md Outdated Show resolved Hide resolved

content/en/blog/_posts/2025-11-13-zpages-for-kubernetes.md Outdated Show resolved Hide resolved

content/en/blog/_posts/2025-11-13-zpages-for-kubernetes.md Outdated Show resolved Hide resolved

richabanker force-pushed the zpages branch from eea460e to 57b3464 Compare November 15, 2025 02:15

address comments

58efab3

Co-authored-by: Susan Sica <90214772+Serenity611@users.noreply.github.com>

richabanker force-pushed the zpages branch from 2caae05 to 58efab3 Compare November 15, 2025 02:19

graz-dev mentioned this pull request Nov 17, 2025

KEP-4671, KEP-5598: Introducing Workload Aware Scheduling blog post #53012

Merged

graz-dev reviewed Nov 21, 2025

View reviewed changes

k8s-ci-robot assigned graz-dev Nov 21, 2025

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 21, 2025

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 21, 2025

k8s-ci-robot merged commit a960269 into kubernetes:main Nov 21, 2025
6 checks passed

graz-dev mentioned this pull request Dec 16, 2025

Publish zpages feature blog (Dec 31 2025) #53645

Merged


		z-pages expose internal component information and require proper access controls. Here are the key security considerations:

		RBAC authorization: Access to z-page endpoints is restricted to members of the `system:monitoring` group, which follows the same authorization model as other debugging endpoints like `/healthz`, `/livez`, and `/readyz`. This ensures that only authorized users and service accounts can access debugging information.


		## What are z-pages?

		z-pages are special debugging endpoints exposed by Kubernetes control plane components. Introduced as an alpha feature in Kubernetes 1.32, these endpoints provide runtime diagnostics for components like kube-apiserver, kube-controller-manager, kube-scheduler, kubelet and kube-proxy. The name "z-pages" comes from the convention of using `/z*` paths for debugging endpoints.


		Currently, Kubernetes supports two primary z-page endpoints:

		- `/statusz`: Displays high-level component information including version information, start time, uptime, and available debug paths

	- `/flagz`: Shows all command-line flags and their values used to start the component (with confidential values redacted for security)
	- `/flagz`: Shows all command-line arguments and their values used to start the component (with confidential values redacted for security)


		### Example: Getting structured responses

		Here's an example using `curl` to retrieve structured JSON responses:

Add blog article about zpages #53030

Add blog article about zpages #53030

Uh oh!

Conversation

richabanker commented Oct 31, 2025

Description

Issues

Uh oh!

netlify bot commented Oct 31, 2025

✅ Pull request preview available for checking

Uh oh!

netlify bot commented Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Pull request preview available for checking

Uh oh!

lmktfy commented Nov 4, 2025

Uh oh!

richabanker commented Nov 14, 2025

Uh oh!

lmktfy left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Serenity611 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

graz-dev commented Nov 17, 2025

Uh oh!

graz-dev commented Nov 17, 2025

Uh oh!

graz-dev left a comment

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented Nov 21, 2025

Uh oh!

lmktfy commented Nov 21, 2025

Uh oh!

netlify bot commented Oct 31, 2025 •

edited

Loading