From 4b5c53fddf3d5ca27a2a4ad92b911b4eb41e8139 Mon Sep 17 00:00:00 2001 From: Josh Berkus Date: Thu, 13 Jan 2022 17:45:40 -0800 Subject: [PATCH 001/763] Fix link to dev@kubernetes mailing list. Signed-off-by: Josh Berkus --- content/ru/docs/setup/learning-environment/minikube.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/content/ru/docs/setup/learning-environment/minikube.md b/content/ru/docs/setup/learning-environment/minikube.md index 500d171abe..fea7e14252 100644 --- a/content/ru/docs/setup/learning-environment/minikube.md +++ b/content/ru/docs/setup/learning-environment/minikube.md @@ -525,6 +525,4 @@ Minikube использует [libmachine](https://github.com/docker/machine/tre ## Сообщество -Помощь, вопросы и комментарии приветствуются и поощряются! Разработчики Minikube проводят время на [Slack](https://kubernetes.slack.com) в канале #minikube (получить приглашение можно [здесь](http://slack.kubernetes.io/)). У нас также есть [список рассылки kubernetes-dev на Google Groups](https://groups.google.com/forum/#!forum/kubernetes-dev). Если вы отправляете сообщение в список, пожалуйста, начните вашу тему с "minikube: ". - - +Помощь, вопросы и комментарии приветствуются и поощряются! Разработчики Minikube проводят время на [Slack](https://kubernetes.slack.com) в канале #minikube (получить приглашение можно [здесь](http://slack.kubernetes.io/)). У нас также есть [список рассылки dev@kubernetes на Google Groups](https://groups.google.com/a/kubernetes.io/g/dev/). Если вы отправляете сообщение в список, пожалуйста, начните вашу тему с "minikube: ". From 9581abbe2e3c5ff6755dd2f4cb4ce372c7d90f1f Mon Sep 17 00:00:00 2001 From: chrismetz09 Date: Mon, 7 Feb 2022 11:16:05 -0800 Subject: [PATCH 002/763] Add Figure to text and caption method described in [How to use captions](https://kubernetes.io/docs/contribute/style/diagram-guide/#how-to-use-captions) --- .../en/docs/contribute/new-content/open-a-pr.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/content/en/docs/contribute/new-content/open-a-pr.md b/content/en/docs/contribute/new-content/open-a-pr.md index 548dbac5d0..d50d9a1629 100644 --- a/content/en/docs/contribute/new-content/open-a-pr.md +++ b/content/en/docs/contribute/new-content/open-a-pr.md @@ -28,7 +28,7 @@ If your changes are large, read [Work from a local fork](#fork-the-repo) to lear ## Changes using GitHub If you're less experienced with git workflows, here's an easier method of -opening a pull request. The figure below outlines the steps and the details follow. +opening a pull request. Figure 1 outlines the steps and the details follow. @@ -61,7 +61,7 @@ class tasks,tasks2 white class id1 k8s {{}} -***Figure - Steps for opening a PR using GitHub*** +Figure 1. Steps for opening a PR using GitHub*** 1. On the page where you see the issue, select the pencil icon at the top right. You can also scroll to the bottom of the page and select **Edit this page**. @@ -122,7 +122,7 @@ work from a local fork. Make sure you have [git](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git) installed on your computer. You can also use a git UI application. -The figure below shows the steps to follow when you work from a local fork. The details for each step follow. +Figure 2 shows the steps to follow when you work from a local fork. The details for each step follow. @@ -151,7 +151,8 @@ class 1,2,3,3a,4,5,6 grey class S,T spacewhite class changes,changes2 white {{}} -***Figure - Working from a local fork to make your changes*** + +Figure 2. Working from a local fork to make your changes*** ### Fork the kubernetes/website repository @@ -353,7 +354,7 @@ Alternately, install and use the `hugo` command on your computer: ### Open a pull request from your fork to kubernetes/website {#open-a-pr} -The figure below shows the steps to open a PR from your fork to the K8s/website. The details follow. +Figure 3 shows the steps to open a PR from your fork to the K8s/website. The details follow. @@ -379,7 +380,8 @@ classDef white fill:#ffffff,stroke:#000,stroke-width:px,color:#000,font-weight:b class 1,2,3,4,5,6,7,8 grey class first,second white {{}} -***Figure - Steps to open a PR from your fork to the K8s/website*** + +Figure 3. Steps to open a PR from your fork to the K8s/website*** 1. In a web browser, go to the [`kubernetes/website`](https://github.com/kubernetes/website/) repository. 2. Select **New Pull Request**. From b66faef3f98e909e466722b60f31d9b85cf654ce Mon Sep 17 00:00:00 2001 From: chrismetz09 Date: Mon, 7 Feb 2022 13:15:19 -0800 Subject: [PATCH 003/763] removed *** at end of caption text --- content/en/docs/contribute/new-content/open-a-pr.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/en/docs/contribute/new-content/open-a-pr.md b/content/en/docs/contribute/new-content/open-a-pr.md index d50d9a1629..5cec9164c4 100644 --- a/content/en/docs/contribute/new-content/open-a-pr.md +++ b/content/en/docs/contribute/new-content/open-a-pr.md @@ -61,7 +61,7 @@ class tasks,tasks2 white class id1 k8s {{}} -Figure 1. Steps for opening a PR using GitHub*** +Figure 1. Steps for opening a PR using GitHub 1. On the page where you see the issue, select the pencil icon at the top right. You can also scroll to the bottom of the page and select **Edit this page**. @@ -152,7 +152,7 @@ class S,T spacewhite class changes,changes2 white {{}} -Figure 2. Working from a local fork to make your changes*** +Figure 2. Working from a local fork to make your changes ### Fork the kubernetes/website repository @@ -381,7 +381,7 @@ class 1,2,3,4,5,6,7,8 grey class first,second white {{}} -Figure 3. Steps to open a PR from your fork to the K8s/website*** +Figure 3. Steps to open a PR from your fork to the K8s/website 1. In a web browser, go to the [`kubernetes/website`](https://github.com/kubernetes/website/) repository. 2. Select **New Pull Request**. From 809ce2f54a8cc18cec66b34057910b27b3d33667 Mon Sep 17 00:00:00 2001 From: chrismetz09 Date: Mon, 7 Feb 2022 14:58:33 -0800 Subject: [PATCH 004/763] Add figure to text/caption _index.md Change file: ../docs/contribute/_index.md Method described in [How to use captions](https://kubernetes.io/docs/contribute/style/diagram-guide/#how-to-use-captions) Contributes to common method for referencing and labeling figures in docs. --- content/en/docs/contribute/_index.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/en/docs/contribute/_index.md b/content/en/docs/contribute/_index.md index 9c48566ccd..7aec439fec 100644 --- a/content/en/docs/contribute/_index.md +++ b/content/en/docs/contribute/_index.md @@ -95,9 +95,9 @@ class A,B,C,D,E,F,G,H,M,Q,N,O,P,V grey class S,T,U spacewhite class first,second,third white {{}} -***Figure - Getting started for a new contributor*** +Figure 1. Getting started for a new contributor -The figure above outlines a roadmap for new contributors. You can follow some or all of the steps for `Sign up` and `Review`. Now you are ready to open PRs that achieve your contribution objectives with some listed under `Open PR`. Again, questions are always welcome! +Figure 1 outlines a roadmap for new contributors. You can follow some or all of the steps for `Sign up` and `Review`. Now you are ready to open PRs that achieve your contribution objectives with some listed under `Open PR`. Again, questions are always welcome! Some tasks require more trust and more access in the Kubernetes organization. See [Participating in SIG Docs](/docs/contribute/participate/) for more details about @@ -105,7 +105,7 @@ roles and permissions. ## Your first contribution -You can prepare for your first contribution by reviewing several steps beforehand. The figure below outlines the steps and the details follow. +You can prepare for your first contribution by reviewing several steps beforehand. Figure 2 outlines the steps and the details follow. @@ -136,7 +136,7 @@ class A,B,D,E,F,G grey class S,T spacewhite class first,second white {{}} -***Figure - Preparation for your first contribution*** +Figure 2. Preparation for your first contribution - Read the [Contribution overview](/docs/contribute/new-content/overview/) to learn about the different ways you can contribute. From 37a47f2a94f99de261cb58718ce7a8956e63470c Mon Sep 17 00:00:00 2001 From: chrismetz09 Date: Mon, 7 Feb 2022 15:09:12 -0800 Subject: [PATCH 005/763] Add period after caption text --- content/en/docs/contribute/new-content/open-a-pr.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/en/docs/contribute/new-content/open-a-pr.md b/content/en/docs/contribute/new-content/open-a-pr.md index 5cec9164c4..b974e3a0f0 100644 --- a/content/en/docs/contribute/new-content/open-a-pr.md +++ b/content/en/docs/contribute/new-content/open-a-pr.md @@ -61,7 +61,7 @@ class tasks,tasks2 white class id1 k8s {{}} -Figure 1. Steps for opening a PR using GitHub +Figure 1. Steps for opening a PR using GitHub. 1. On the page where you see the issue, select the pencil icon at the top right. You can also scroll to the bottom of the page and select **Edit this page**. @@ -152,7 +152,7 @@ class S,T spacewhite class changes,changes2 white {{}} -Figure 2. Working from a local fork to make your changes +Figure 2. Working from a local fork to make your changes. ### Fork the kubernetes/website repository @@ -381,7 +381,7 @@ class 1,2,3,4,5,6,7,8 grey class first,second white {{}} -Figure 3. Steps to open a PR from your fork to the K8s/website +Figure 3. Steps to open a PR from your fork to the K8s/website. 1. In a web browser, go to the [`kubernetes/website`](https://github.com/kubernetes/website/) repository. 2. Select **New Pull Request**. From 72d99dfae643b3ae7cafb573d7f516d8cbb86bca Mon Sep 17 00:00:00 2001 From: chrismetz09 Date: Mon, 7 Feb 2022 15:16:37 -0800 Subject: [PATCH 006/763] add period to caption text --- content/en/docs/contribute/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/contribute/_index.md b/content/en/docs/contribute/_index.md index 7aec439fec..61a4e0a118 100644 --- a/content/en/docs/contribute/_index.md +++ b/content/en/docs/contribute/_index.md @@ -95,7 +95,7 @@ class A,B,C,D,E,F,G,H,M,Q,N,O,P,V grey class S,T,U spacewhite class first,second,third white {{}} -Figure 1. Getting started for a new contributor +Figure 1. Getting started for a new contributor. Figure 1 outlines a roadmap for new contributors. You can follow some or all of the steps for `Sign up` and `Review`. Now you are ready to open PRs that achieve your contribution objectives with some listed under `Open PR`. Again, questions are always welcome! @@ -136,7 +136,7 @@ class A,B,D,E,F,G grey class S,T spacewhite class first,second white {{}} -Figure 2. Preparation for your first contribution +Figure 2. Preparation for your first contribution. - Read the [Contribution overview](/docs/contribute/new-content/overview/) to learn about the different ways you can contribute. From 7f96d8b3577f4a8e26b7dd23faeb142f26ade9f4 Mon Sep 17 00:00:00 2001 From: Kazuhiko Yamashita Date: Mon, 14 Feb 2022 16:59:07 +0900 Subject: [PATCH 007/763] fix example ip address --- content/ja/docs/tasks/administer-cluster/nodelocaldns.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/ja/docs/tasks/administer-cluster/nodelocaldns.md b/content/ja/docs/tasks/administer-cluster/nodelocaldns.md index 4a5e59a2ca..6ee255ac0b 100644 --- a/content/ja/docs/tasks/administer-cluster/nodelocaldns.md +++ b/content/ja/docs/tasks/administer-cluster/nodelocaldns.md @@ -45,7 +45,7 @@ NodeLocal DNSキャッシュは、クラスターノード上でDNSキャッシ {{< figure src="/images/docs/nodelocaldns.svg" alt="NodeLocal DNSCache flow" title="Nodelocal DNSCacheのフロー" caption="この図は、NodeLocal DNSキャッシュがDNSクエリーをどう扱うかを表したものです。" >}} ## 設定 -{{< note >}} NodeLocal DNSキャッシュ用のローカルに待ち受けているIPアドレスは、169.254.20.0/16の範囲のIPか、既存のIPと衝突しないことが保証されている他のIPとなります。このドキュメントでは例として169.254.10を使用します。 +{{< note >}} NodeLocal DNSキャッシュ用のローカルに待ち受けているIPアドレスは、169.254.20.0/16の範囲のIPか、既存のIPと衝突しないことが保証されている他のIPとなります。このドキュメントでは例として169.254.20.10を使用します。 {{< /note >}} この機能は、下記の手順により有効化できます。 From 228b0f9d3e74c92b9b5ffbd0b1eced00e7c848ad Mon Sep 17 00:00:00 2001 From: Vedant Koditkar Date: Tue, 15 Feb 2022 12:24:55 +0530 Subject: [PATCH 008/763] Update hyperlinks to point to main branch --- content/id/docs/contribute/participate/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/id/docs/contribute/participate/_index.md b/content/id/docs/contribute/participate/_index.md index 72c561432b..cd47d62309 100644 --- a/content/id/docs/contribute/participate/_index.md +++ b/content/id/docs/contribute/participate/_index.md @@ -71,8 +71,8 @@ dua buah [prow _plugin_](https://github.com/kubernetes/test-infra/tree/master/pr - approve Kedua _plugin_ menggunakan berkas -[OWNERS](https://github.com/kubernetes/website/blob/master/OWNERS) dan -[OWNERS_ALIASES](https://github.com/kubernetes/website/blob/master/OWNERS_ALIASES) +[OWNERS](https://github.com/kubernetes/website/blob/main/OWNERS) dan +[OWNERS_ALIASES](https://github.com/kubernetes/website/blob/main/OWNERS_ALIASES) dalam level teratas dari repositori GitHub `kubernetes/website` untuk mengontrol bagaimana prow bekerja di dalam repositori. From bb948ff03fc8b682ad11a176c19af69aeefb1bc2 Mon Sep 17 00:00:00 2001 From: Kazuhiko Yamashita Date: Fri, 4 Mar 2022 11:26:30 +0900 Subject: [PATCH 009/763] update configuration note --- content/ja/docs/tasks/administer-cluster/nodelocaldns.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/ja/docs/tasks/administer-cluster/nodelocaldns.md b/content/ja/docs/tasks/administer-cluster/nodelocaldns.md index 6ee255ac0b..9f08ac3a7e 100644 --- a/content/ja/docs/tasks/administer-cluster/nodelocaldns.md +++ b/content/ja/docs/tasks/administer-cluster/nodelocaldns.md @@ -45,7 +45,7 @@ NodeLocal DNSキャッシュは、クラスターノード上でDNSキャッシ {{< figure src="/images/docs/nodelocaldns.svg" alt="NodeLocal DNSCache flow" title="Nodelocal DNSCacheのフロー" caption="この図は、NodeLocal DNSキャッシュがDNSクエリーをどう扱うかを表したものです。" >}} ## 設定 -{{< note >}} NodeLocal DNSキャッシュ用のローカルに待ち受けているIPアドレスは、169.254.20.0/16の範囲のIPか、既存のIPと衝突しないことが保証されている他のIPとなります。このドキュメントでは例として169.254.20.10を使用します。 +{{< note >}} NodeLocalDNSキャッシュのローカルリッスン用のIPアドレスは、クラスタ内の既存のIPと衝突しないことが保証できるものであれば、どのようなアドレスでもかまいません。例えば、IPv4のリンクローカル範囲169.254.0.0/16やIPv6のユニークローカルアドレス範囲fd00::/8から、ローカルスコープのアドレスを使用することが推奨されています。 {{< /note >}} この機能は、下記の手順により有効化できます。 From ee7f9f51ca1ac9575b55508ccb8c81a999d7ffcf Mon Sep 17 00:00:00 2001 From: Kazuhiko Yamashita Date: Sun, 6 Mar 2022 16:16:59 +0900 Subject: [PATCH 010/763] Update content/ja/docs/tasks/administer-cluster/nodelocaldns.md Co-authored-by: Wang --- content/ja/docs/tasks/administer-cluster/nodelocaldns.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/ja/docs/tasks/administer-cluster/nodelocaldns.md b/content/ja/docs/tasks/administer-cluster/nodelocaldns.md index 9f08ac3a7e..e7f97ea7f6 100644 --- a/content/ja/docs/tasks/administer-cluster/nodelocaldns.md +++ b/content/ja/docs/tasks/administer-cluster/nodelocaldns.md @@ -45,7 +45,7 @@ NodeLocal DNSキャッシュは、クラスターノード上でDNSキャッシ {{< figure src="/images/docs/nodelocaldns.svg" alt="NodeLocal DNSCache flow" title="Nodelocal DNSCacheのフロー" caption="この図は、NodeLocal DNSキャッシュがDNSクエリーをどう扱うかを表したものです。" >}} ## 設定 -{{< note >}} NodeLocalDNSキャッシュのローカルリッスン用のIPアドレスは、クラスタ内の既存のIPと衝突しないことが保証できるものであれば、どのようなアドレスでもかまいません。例えば、IPv4のリンクローカル範囲169.254.0.0/16やIPv6のユニークローカルアドレス範囲fd00::/8から、ローカルスコープのアドレスを使用することが推奨されています。 +{{< note >}} NodeLocal DNSキャッシュのローカルリッスン用のIPアドレスは、クラスタ内の既存のIPと衝突しないことが保証できるものであれば、どのようなアドレスでもかまいません。例えば、IPv4のリンクローカル範囲169.254.0.0/16やIPv6のユニークローカルアドレス範囲fd00::/8から、ローカルスコープのアドレスを使用することが推奨されています。 {{< /note >}} この機能は、下記の手順により有効化できます。 From d05fb625f4e0f70279456eb2cbf50b73daf31f43 Mon Sep 17 00:00:00 2001 From: Martin Tovmassian Date: Tue, 8 Mar 2022 16:54:48 +0100 Subject: [PATCH 011/763] [en] Update Bash alias auto-completion --- content/en/docs/reference/kubectl/cheatsheet.md | 2 +- .../tasks/tools/included/optional-kubectl-configs-bash-linux.md | 2 +- .../tasks/tools/included/optional-kubectl-configs-bash-mac.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/content/en/docs/reference/kubectl/cheatsheet.md b/content/en/docs/reference/kubectl/cheatsheet.md index 8d995efb49..8be170b5f2 100644 --- a/content/en/docs/reference/kubectl/cheatsheet.md +++ b/content/en/docs/reference/kubectl/cheatsheet.md @@ -30,7 +30,7 @@ You can also use a shorthand alias for `kubectl` that also works with completion ```bash alias k=kubectl -complete -F __start_kubectl k +complete -o default -F __start_kubectl k ``` ### ZSH diff --git a/content/en/docs/tasks/tools/included/optional-kubectl-configs-bash-linux.md b/content/en/docs/tasks/tools/included/optional-kubectl-configs-bash-linux.md index 0024ff8bbc..8a5889b813 100644 --- a/content/en/docs/tasks/tools/included/optional-kubectl-configs-bash-linux.md +++ b/content/en/docs/tasks/tools/included/optional-kubectl-configs-bash-linux.md @@ -43,7 +43,7 @@ If you have an alias for kubectl, you can extend shell completion to work with t ```bash echo 'alias k=kubectl' >>~/.bashrc -echo 'complete -F __start_kubectl k' >>~/.bashrc +echo 'complete -o default -F __start_kubectl k' >>~/.bashrc ``` {{< note >}} diff --git a/content/en/docs/tasks/tools/included/optional-kubectl-configs-bash-mac.md b/content/en/docs/tasks/tools/included/optional-kubectl-configs-bash-mac.md index 9854540649..47243c575a 100644 --- a/content/en/docs/tasks/tools/included/optional-kubectl-configs-bash-mac.md +++ b/content/en/docs/tasks/tools/included/optional-kubectl-configs-bash-mac.md @@ -77,7 +77,7 @@ You now have to ensure that the kubectl completion script gets sourced in all yo ```bash echo 'alias k=kubectl' >>~/.bash_profile - echo 'complete -F __start_kubectl k' >>~/.bash_profile + echo 'complete -o default -F __start_kubectl k' >>~/.bash_profile ``` - If you installed kubectl with Homebrew (as explained [here](/docs/tasks/tools/install-kubectl-macos/#install-with-homebrew-on-macos)), then the kubectl completion script should already be in `/usr/local/etc/bash_completion.d/kubectl`. In that case, you don't need to do anything. From 4492fc5766822789344411e1deb64a9e54aef216 Mon Sep 17 00:00:00 2001 From: Geoffrey Cline Date: Fri, 18 Mar 2022 16:48:17 -0500 Subject: [PATCH 012/763] add steps for coredns permissions --- .../dns-debugging-resolution.md | 48 +++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/content/en/docs/tasks/administer-cluster/dns-debugging-resolution.md b/content/en/docs/tasks/administer-cluster/dns-debugging-resolution.md index e9dd545955..2fb9a07a49 100644 --- a/content/en/docs/tasks/administer-cluster/dns-debugging-resolution.md +++ b/content/en/docs/tasks/administer-cluster/dns-debugging-resolution.md @@ -252,6 +252,54 @@ linux/amd64, go1.10.3, 2e322f6 2018/09/07 15:29:04 [INFO] Reloading complete 172.17.0.18:41675 - [07/Sep/2018:15:29:11 +0000] 59925 "A IN kubernetes.default.svc.cluster.local. udp 54 false 512" NOERROR qr,aa,rd,ra 106 0.000066649s ``` +### Does CoreDNS have sufficient permissions? + +CoreDNS must be able to list {{< glossary_tooltip text="service" +term_id="service" >}} and {{< glossary_tooltip text="endpoint" +term_id="endpoint" >}} related resources to properly resolve service names. + +Sample Error Message: +``` +2022-03-18T07:12:15.699431183Z [INFO] 10.96.144.227:52299 - 3686 "A IN serverproxy.contoso.net.cluster.local. udp 52 false 512" SERVFAIL qr,aa,rd 145 0.000091221s +``` + +First, get the current ClusterRole of `system:coredns`: + +``` +kubectl describe clusterrole system:coredns -n kube-system +``` + +Expected Output: +``` +PolicyRule: + Resources Non-Resource URLs Resource Names Verbs + --------- ----------------- -------------- ----- + nodes [] [] [get] + endpoints [] [] [list watch] + namespaces [] [] [list watch] + pods [] [] [list watch] + services [] [] [list watch] + endpointslices.discovery.k8s.io [] [] [list watch] +``` + +If any permissions are missing, edit the ClusterRole to add them: + +``` +kubectl edit clusterrole system:coredns -n kube-system +``` + +Example Insertion of EndpointSlices Permissions: +``` +... +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - list + - watch +... +``` ### Are you in the right namespace for the service? From fdfc64e861e36fbe6e28f3801bca84c2b54d6ab6 Mon Sep 17 00:00:00 2001 From: sgpinkus Date: Sat, 19 Mar 2022 13:17:50 +1100 Subject: [PATCH 013/763] Update _index.md Make 100% clear, that according to the k8s networking model pods are supposed to get their own unique IP address. I always thought this was the case. But then faced debugging issue where some pods are being assigned the same IP addresses. Came here to review my understanding of it, and confirm this is expected behaviour or not. But it was not stated unequivocally. This change makes it so. --- .../docs/concepts/services-networking/_index.md | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/content/en/docs/concepts/services-networking/_index.md b/content/en/docs/concepts/services-networking/_index.md index ab1b784658..2e443d4744 100644 --- a/content/en/docs/concepts/services-networking/_index.md +++ b/content/en/docs/concepts/services-networking/_index.md @@ -7,26 +7,25 @@ description: > ## The Kubernetes network model -Every [`Pod`](/docs/concepts/workloads/pods/) gets its own IP address. +Every [`Pod`](/docs/concepts/workloads/pods/) in a cluster gets its own unique cluster wide IP address. This means you do not need to explicitly create links between `Pods` and you almost never need to deal with mapping container ports to host ports. This creates a clean, backwards-compatible model where `Pods` can be treated much like VMs or physical hosts from the perspectives of port allocation, -naming, service discovery, [load balancing](/docs/concepts/services-networking/ingress/#load-balancing), application configuration, -and migration. +naming, service discovery, [load balancing](/docs/concepts/services-networking/ingress/#load-balancing), +application configuration, and migration. Kubernetes imposes the following fundamental requirements on any networking implementation (barring any intentional network segmentation policies): - * pods on a [node](/docs/concepts/architecture/nodes/) can communicate with all pods on all nodes without NAT + * pods can communicate with all other pods on any other [node](/docs/concepts/architecture/nodes/) + without NAT * agents on a node (e.g. system daemons, kubelet) can communicate with all pods on that node Note: For those platforms that support `Pods` running in the host network (e.g. -Linux): - - * pods in the host network of a node can communicate with all pods on all - nodes without NAT +Linux), when pods are attached to the host network of a node they can still communicate +with all pods on all nodes without NAT. This model is not only less complex overall, but it is principally compatible with the desire for Kubernetes to enable low-friction porting of apps from VMs From 417eede9858a94fc8f2dec5cf03b7e7cd7566229 Mon Sep 17 00:00:00 2001 From: sgpinkus Date: Mon, 21 Mar 2022 21:01:49 +1100 Subject: [PATCH 014/763] Update content/en/docs/concepts/services-networking/_index.md Co-authored-by: divya-mohan0209 --- content/en/docs/concepts/services-networking/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/services-networking/_index.md b/content/en/docs/concepts/services-networking/_index.md index 2e443d4744..b4f7861075 100644 --- a/content/en/docs/concepts/services-networking/_index.md +++ b/content/en/docs/concepts/services-networking/_index.md @@ -7,7 +7,7 @@ description: > ## The Kubernetes network model -Every [`Pod`](/docs/concepts/workloads/pods/) in a cluster gets its own unique cluster wide IP address. +Every [`Pod`](/docs/concepts/workloads/pods/) in a cluster gets its own unique cluster-wide IP address. This means you do not need to explicitly create links between `Pods` and you almost never need to deal with mapping container ports to host ports. This creates a clean, backwards-compatible model where `Pods` can be treated From 67c5034165036c99366d5b7ed586ce6aada9b5a8 Mon Sep 17 00:00:00 2001 From: Geoffrey Cline Date: Mon, 28 Mar 2022 12:27:33 -0500 Subject: [PATCH 015/763] Apply suggestions from code review Co-authored-by: Qiming Teng --- .../administer-cluster/dns-debugging-resolution.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/en/docs/tasks/administer-cluster/dns-debugging-resolution.md b/content/en/docs/tasks/administer-cluster/dns-debugging-resolution.md index 2fb9a07a49..7dbe5f2f74 100644 --- a/content/en/docs/tasks/administer-cluster/dns-debugging-resolution.md +++ b/content/en/docs/tasks/administer-cluster/dns-debugging-resolution.md @@ -258,18 +258,18 @@ CoreDNS must be able to list {{< glossary_tooltip text="service" term_id="service" >}} and {{< glossary_tooltip text="endpoint" term_id="endpoint" >}} related resources to properly resolve service names. -Sample Error Message: +Sample error message: ``` 2022-03-18T07:12:15.699431183Z [INFO] 10.96.144.227:52299 - 3686 "A IN serverproxy.contoso.net.cluster.local. udp 52 false 512" SERVFAIL qr,aa,rd 145 0.000091221s ``` First, get the current ClusterRole of `system:coredns`: -``` +```shell kubectl describe clusterrole system:coredns -n kube-system ``` -Expected Output: +Expected output: ``` PolicyRule: Resources Non-Resource URLs Resource Names Verbs @@ -284,11 +284,11 @@ PolicyRule: If any permissions are missing, edit the ClusterRole to add them: -``` +```shell kubectl edit clusterrole system:coredns -n kube-system ``` -Example Insertion of EndpointSlices Permissions: +Example insertion of EndpointSlices permissions: ``` ... - apiGroups: From 81ffc6536d7093abd17c2b2368dc4b689533e390 Mon Sep 17 00:00:00 2001 From: Ali Mukadam Date: Fri, 1 Apr 2022 22:42:05 +1100 Subject: [PATCH 016/763] docs: added internal load balancer service annotations for Oracle Cloud Reviewed-by: Avi Miller Signed-off-by: Ali Mukadam --- .../en/docs/concepts/services-networking/service.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/content/en/docs/concepts/services-networking/service.md b/content/en/docs/concepts/services-networking/service.md index 85c222498e..e778f937c1 100644 --- a/content/en/docs/concepts/services-networking/service.md +++ b/content/en/docs/concepts/services-networking/service.md @@ -859,6 +859,17 @@ metadata: [...] ``` +{{% /tab %}} +{{% tab name="OCI" %}} + +```yaml +[...] +metadata: + name: my-service + annotations: + service.beta.kubernetes.io/oci-load-balancer-internal: true +[...] +``` {{% /tab %}} {{< /tabs >}} From 86cbafe75925a1aa725a5c1bf0089a8327df24ba Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Tue, 22 Mar 2022 22:19:40 +0530 Subject: [PATCH 017/763] Placeholder for unauthorised volume mode conversion blog --- ...4-19-prevent-unauthorised-volume-mode-conversion.md | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md diff --git a/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md new file mode 100644 index 0000000000..0436d056bd --- /dev/null +++ b/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md @@ -0,0 +1,10 @@ +--- +layout: blog +title: 'Kubernetes 1.24: Prevent unauthorised volume mode conversion' +date: 2022-04-19 +slug: prevent-unauthorised-volume-mode-conversion-alpha + --- + +**Author:** Raunak Shah (Mirantis) + +Prevention of unauthorised volume mode conversion is introduce as an Alpha feature in 1.24. \ No newline at end of file From 7c2b6da8a71c7c39fb06e0a29bd501541e804417 Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Wed, 6 Apr 2022 00:04:19 +0530 Subject: [PATCH 018/763] add newline --- .../2022-04-19-prevent-unauthorised-volume-mode-conversion.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md index 0436d056bd..d019ce628d 100644 --- a/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md @@ -7,4 +7,4 @@ slug: prevent-unauthorised-volume-mode-conversion-alpha **Author:** Raunak Shah (Mirantis) -Prevention of unauthorised volume mode conversion is introduce as an Alpha feature in 1.24. \ No newline at end of file +Prevention of unauthorised volume mode conversion is introduce as an Alpha feature in 1.24. From 51038193fb12c4c8b45f01eb549282dfbd2ff4d6 Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Wed, 6 Apr 2022 00:06:54 +0530 Subject: [PATCH 019/763] Indentation --- .../2022-04-19-prevent-unauthorised-volume-mode-conversion.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md index d019ce628d..d641f28ee6 100644 --- a/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md @@ -3,7 +3,7 @@ layout: blog title: 'Kubernetes 1.24: Prevent unauthorised volume mode conversion' date: 2022-04-19 slug: prevent-unauthorised-volume-mode-conversion-alpha - --- +--- **Author:** Raunak Shah (Mirantis) From 0134c3306afba1abd8fd0df919a2bf241a4ea2dd Mon Sep 17 00:00:00 2001 From: Rey Lejano Date: Wed, 6 Apr 2022 13:54:32 -0700 Subject: [PATCH 020/763] update link to updated dockershim removal page --- content/pt-br/blog/_posts/2022-02-17-updated-dockershim-faq.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/pt-br/blog/_posts/2022-02-17-updated-dockershim-faq.md b/content/pt-br/blog/_posts/2022-02-17-updated-dockershim-faq.md index bf92c1fedc..f783edfa43 100644 --- a/content/pt-br/blog/_posts/2022-02-17-updated-dockershim-faq.md +++ b/content/pt-br/blog/_posts/2022-02-17-updated-dockershim-faq.md @@ -15,7 +15,7 @@ como parte do lançamento do Kubernetes v1.20. Para obter mais detalhes sobre o que isso significa, confira a postagem do blog [Não entre em pânico: Kubernetes e Docker](/pt-br/blog/2020/12/02/dont-panic-kubernetes-and-docker/). -Além disso, você pode ler [verifique se a remoção do dockershim afeta você](/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you/) +Além disso, você pode ler [verifique se a remoção do dockershim afeta você](/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-removal-affects-you/) para determinar qual impacto a remoção do _dockershim_ teria para você ou para sua organização. From 19283fa38c103cb661fd5f236d0eb53596caacf6 Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Tue, 12 Apr 2022 11:45:44 +0530 Subject: [PATCH 021/763] Blog for feature to prevent unauthorised volume mode conversion --- ...ent-unauthorised-volume-mode-conversion.md | 83 +++++++++++++++++++ ...ent-unauthorised-volume-mode-conversion.md | 10 --- 2 files changed, 83 insertions(+), 10 deletions(-) create mode 100644 content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md delete mode 100644 content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md diff --git a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md new file mode 100644 index 0000000000..0e171b13e9 --- /dev/null +++ b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md @@ -0,0 +1,83 @@ +--- +layout: blog +title: 'Prevent unauthorised volume mode conversion' +date: 2022-04-12 +slug: prevent-unauthorised-volume-mode-conversion-alpha +--- + +**Author:** Raunak Shah (Mirantis) + +Kubernetes v1.24 introduces a new alpha-level feature that prevents unauthorised users from modifying the volume mode of a [`PeristentVolumeClaim`](/docs/concepts/storage/persistent-volumes.md). This feature requires [`VolumeSnapshot`](/docs/concepts/storage/volume-snapshots.md) APIs with version `v6.0.0` onwards and `external-provisioner` version `v3.2.0` onwards. + +### The problem + +As of Kubernetes 1.23, users can leverage the `VolumeSnapshot` feature, which GA'd in Kubernetes 1.20, to create a `PersistentVolumeClaim` (or `PVC`) from a previously taken `VolumeSnapshot`. This is done by pointing the `Spec.dataSource` parameter of the `PVC` to an existing `VolumeSnapshot` instance. +There is no logic that validates whether the original volume mode of the `PVC`, whose snapshot was taken, matches the volume mode of the newly created `PVC`, that is being created from the existing `VolumeSnapshot`. + +There is logic in allowing this, as many popular storage backup vendors convert the volume mode, during the course of a backup operation, for efficiency purposes. + +However this also presents a security gap that allows malicious users to potentially exploit an as-yet-unknown CVE in the kernel. + +### Preventing unauthorised users from converting the volume mode + +If the alpha feature is enabled in `snapshot-controller` and `external-provisioner`, then unauthorised users will not be allowed to modify the volume mode of a `PVC` when it is being created from a `VolumeSnapshot`. +An unauthorised user is defined as one who does not have existing permissions to alter the cluster-scoped `VolumeSnapshotContent` resource. +Backup vendors normally have this permission on clusters where a backup is to be performed. + +To convert the volume mode, an authorised user must do the following: + +1. Identify the `VolumeSnapshot` that is to be used as the data source for a newly created `PVC`. +2. Identify the `VolumeSnapshotContent` bound to the above `VolumeSnapshot`. +3. Add a new annotation `snapshot.storage.kubernetes.io/allowVolumeModeChange` to the `VolumeSnapshotContent`. +This annotation can be added either via software or manually by the backup vendor. The VolumeSnapshotContent must look like below after this change: + +```yaml +kind: VolumeSnapshotContent +metadata: + annotations: + - snapshot.storage.kubernetes.io/allowVolumeModeChange: "true" +... +``` +NOTE: For pre-provisioned `VolumeSnapshotContents`, the user has an additional step of setting `Spec.SourceVolumeMode` field to either `Filesystem` or `Block`, depending on the volume from which this snapshot was taken. +An example is shown below: + +```yaml +apiVersion: snapshot.storage.k8s.io/v1 +kind: VolumeSnapshotContent +metadata: + name: new-snapshot-content-test +spec: + deletionPolicy: Delete + driver: hostpath.csi.k8s.io + source: + snapshotHandle: 7bdd0de3-aaeb-11e8-9aae-0242ac110002 + sourceVolumeMode: Filesystem + volumeSnapshotRef: + name: new-snapshot-test + namespace: default +``` + +Repeat (1)-(3) for all `VolumeSnapshotContent`s whose volume mode needs to be converted during a backup or restore operation. + +If the above annotation is present on a `VolumeSnapshotContent` object, Kubernetes will not prevent the volume mode from being converted. +Users should keep this in mind before they attempt to add the annotation to any `VolumeSnapshotContent`. + + +### How to enable the feature + +This feature can be enabled by setting `prevent-volume-mode-conversion` flag to `true` in the `snapshot-controller` and `external-provisioner` spec, as shown below: + +```yaml +apiVersion: apps/v1 +kind: Deployment +... +spec: + containers: + - args: + - --leader-election=true + - --prevent-volume-mode-conversion=true + image: snapshot-controller:v6.0.0 +... +``` + + diff --git a/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md deleted file mode 100644 index d641f28ee6..0000000000 --- a/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -layout: blog -title: 'Kubernetes 1.24: Prevent unauthorised volume mode conversion' -date: 2022-04-19 -slug: prevent-unauthorised-volume-mode-conversion-alpha ---- - -**Author:** Raunak Shah (Mirantis) - -Prevention of unauthorised volume mode conversion is introduce as an Alpha feature in 1.24. From 6893daac2617b72f9c037e85b7b4d71f48878c70 Mon Sep 17 00:00:00 2001 From: Chris Burgess Date: Wed, 13 Apr 2022 21:05:08 +1200 Subject: [PATCH 022/763] Docs fix for kubectl proxy configuration Follow-up to https://github.com/kubernetes/website/pull/32245 --- .../configuration/organize-cluster-access-kubeconfig.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/content/en/docs/concepts/configuration/organize-cluster-access-kubeconfig.md b/content/en/docs/concepts/configuration/organize-cluster-access-kubeconfig.md index 713592cf98..b2b3870e86 100644 --- a/content/en/docs/concepts/configuration/organize-cluster-access-kubeconfig.md +++ b/content/en/docs/concepts/configuration/organize-cluster-access-kubeconfig.md @@ -150,16 +150,16 @@ are stored absolutely. ## Proxy -You can configure `kubectl` to use proxy by setting `proxy-url` in the kubeconfig file, like: +You can configure `kubectl` to use a proxy per cluster using `proxy-url` in your kubeconfig file, like this: ```yaml apiVersion: v1 kind: Config -proxy-url: https://proxy.host:3128 - clusters: - cluster: + proxy-url: http://proxy.example.org:3128 + server: https://k8s.example.org/k8s/clusters/c-xxyyzz name: development users: @@ -167,8 +167,7 @@ users: contexts: - context: - name: development - + name: development ``` From 699c711de8b50de2dfd1493cfc9d35cfd86f1c74 Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Wed, 13 Apr 2022 16:53:37 -0700 Subject: [PATCH 023/763] [en] Clean up various broken links --- .../_posts/2016-04-00-Kubernetes-Network-Policy-APIs.md | 2 +- ...6-09-00-High-Performance-Network-Policies-Kubernetes.md | 4 ++-- .../2017-08-00-High-Performance-Networking-With-Ec2.md | 7 ++----- 3 files changed, 5 insertions(+), 8 deletions(-) diff --git a/content/en/blog/_posts/2016-04-00-Kubernetes-Network-Policy-APIs.md b/content/en/blog/_posts/2016-04-00-Kubernetes-Network-Policy-APIs.md index 7289f57669..16fec78e4b 100644 --- a/content/en/blog/_posts/2016-04-00-Kubernetes-Network-Policy-APIs.md +++ b/content/en/blog/_posts/2016-04-00-Kubernetes-Network-Policy-APIs.md @@ -131,7 +131,7 @@ In this example, the ‘ **tenant-a** ’ namespace would get policy ‘ **pol1* -Today, [Romana](http://romana.io/), [OpenShift](https://www.openshift.com/), [OpenContrail](http://www.opencontrail.org/) and [Calico](http://projectcalico.org/) support network policies applied to namespaces and pods. Cisco and VMware are working on implementations as well. Both Romana and Calico demonstrated these capabilities with Kubernetes 1.2 recently at KubeCon. You can watch their presentations here: [Romana](https://www.youtube.com/watch?v=f-dLKtK6qCs) ([slides](http://www.slideshare.net/RomanaProject/kubecon-london-2016-ronana-cloud-native-sdn)), [Calico](https://www.youtube.com/watch?v=p1zfh4N4SX0) ([slides](http://www.slideshare.net/kubecon/kubecon-eu-2016-secure-cloudnative-networking-with-project-calico)).  +Today, [Romana](https://github.com/romana/romana), [OpenShift](https://www.openshift.com/), [OpenContrail](http://www.opencontrail.org/) and [Calico](http://projectcalico.org/) support network policies applied to namespaces and pods. Cisco and VMware are working on implementations as well. Both Romana and Calico demonstrated these capabilities with Kubernetes 1.2 recently at KubeCon. You can watch their presentations here: [Romana](https://www.youtube.com/watch?v=f-dLKtK6qCs) ([slides](http://www.slideshare.net/RomanaProject/kubecon-london-2016-ronana-cloud-native-sdn)), [Calico](https://www.youtube.com/watch?v=p1zfh4N4SX0) ([slides](http://www.slideshare.net/kubecon/kubecon-eu-2016-secure-cloudnative-networking-with-project-calico)).  diff --git a/content/en/blog/_posts/2016-09-00-High-Performance-Network-Policies-Kubernetes.md b/content/en/blog/_posts/2016-09-00-High-Performance-Network-Policies-Kubernetes.md index bc21d1edaa..59fdd5a708 100644 --- a/content/en/blog/_posts/2016-09-00-High-Performance-Network-Policies-Kubernetes.md +++ b/content/en/blog/_posts/2016-09-00-High-Performance-Network-Policies-Kubernetes.md @@ -65,7 +65,7 @@ Network policies are an exciting feature, which the Kubernetes community has wor -There are only a few policy-capable networking backends available for Kubernetes today: [Romana](http://romana.io/), [Calico](http://projectcalico.org/), and [Canal](https://github.com/tigera/canal); with [Weave](http://www.weave.works/) indicating support in the near future. Red Hat’s OpenShift includes network policy features as well. +There are only a few policy-capable networking backends available for Kubernetes today: [Romana](https://github.com/romana/romana), [Calico](http://projectcalico.org/), and [Canal](https://github.com/tigera/canal); with [Weave](http://www.weave.works/) indicating support in the near future. Red Hat’s OpenShift includes network policy features as well. @@ -189,4 +189,4 @@ These tests were performed using Romana as the backend policy provider and other -If you wish to try it for yourself, we invite you to check out [Romana](http://romana.io/). In our [GitHub repo](https://github.com/romana/romana) you can find an easy to use installer, which works with AWS, Vagrant VMs or any other servers. You can use it to quickly get you started with a Romana powered Kubernetes or OpenStack cluster. +If you wish to try it for yourself, we invite you to check out [Romana](https://github.com/romana/romana). In our [GitHub repo](https://github.com/romana/romana) you can find an easy to use installer, which works with AWS, Vagrant VMs or any other servers. You can use it to quickly get you started with a Romana powered Kubernetes or OpenStack cluster. diff --git a/content/en/blog/_posts/2017-08-00-High-Performance-Networking-With-Ec2.md b/content/en/blog/_posts/2017-08-00-High-Performance-Networking-With-Ec2.md index b735c501e7..44853d2567 100644 --- a/content/en/blog/_posts/2017-08-00-High-Performance-Networking-With-Ec2.md +++ b/content/en/blog/_posts/2017-08-00-High-Performance-Networking-With-Ec2.md @@ -9,7 +9,7 @@ url: /blog/2017/08/High-Performance-Networking-With-Ec2 One of the most popular platforms for running Kubernetes is Amazon Web Services’ Elastic Compute Cloud (AWS EC2). With more than a decade of experience delivering IaaS, and expanding over time to include a rich set of services with easy to consume APIs, EC2 has captured developer mindshare and loyalty worldwide. -When it comes to networking, however, EC2 has some limits that hinder performance and make deploying Kubernetes clusters to production unnecessarily complex. The preview release of [Romana v2.0](http://romana.io/), a network and security automation solution for Cloud Native applications, includes features that address some well known network issues when running Kubernetes in EC2. +When it comes to networking, however, EC2 has some limits that hinder performance and make deploying Kubernetes clusters to production unnecessarily complex. The preview release of [Romana v2.0](https://github.com/romana/romana), a network and security automation solution for Cloud Native applications, includes features that address some well known network issues when running Kubernetes in EC2. ## Traditional VPC Networking Performance Roadblocks @@ -40,7 +40,7 @@ Whether you were interested in advanced networking for traffic isolation or runn The way to avoid running out of VPC routes is to use them sparingly by making them forward pod traffic for multiple instances. From a networking perspective, what that means is that the VPC route needs to forward to a router, which can then forward traffic on to the final destination instance. -[Romana](http://romana.io/) is a CNI network provider that configures routes on the host to forward pod network traffic without an overlay. Since inter-node routes are installed on hosts, no VPC routes are necessary at all. However, when the VPC is split into subnets for an HA deployment across zones, VPC routes are necessary. +[Romana](https://github.com/romana/romana) is a CNI network provider that configures routes on the host to forward pod network traffic without an overlay. Since inter-node routes are installed on hosts, no VPC routes are necessary at all. However, when the VPC is split into subnets for an HA deployment across zones, VPC routes are necessary. Fortunately, inter-node routes on hosts allows them to act as a network router and forward traffic inbound from another zone just as it would for traffic from local pods. This makes any Kubernetes node configured by Romana able to accept inbound pod traffic from other zones and forward it to the proper destination node on the subnet. @@ -73,8 +73,5 @@ When using Romana v2.0, native VPC networking is now available for clusters of a ![](https://archive.org/download/hpc-ec2-vpc-2/hpc-ec2-vpc-2.png) -The preview release of Romana v2.0 is available [here](http://romana.io/preview). We welcome comments and feedback so we can make EC2 deployments of Kubernetes as fast and reliable as possible. - - -- _Juergen Brendel and Chris Marino, co-founders of Pani Networks, sponsor of the Romana project_ From c9ef193727559aef2a12f17d815af9dd47bc14cb Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Wed, 13 Apr 2022 17:06:54 -0700 Subject: [PATCH 024/763] [pt-br] Clean up various broken links --- content/pt-br/docs/concepts/cluster-administration/addons.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/pt-br/docs/concepts/cluster-administration/addons.md b/content/pt-br/docs/concepts/cluster-administration/addons.md index f3a00ae26d..0e0175cace 100644 --- a/content/pt-br/docs/concepts/cluster-administration/addons.md +++ b/content/pt-br/docs/concepts/cluster-administration/addons.md @@ -21,7 +21,7 @@ Esta página lista alguns dos complementos disponíveis e links com suas respect * [Canal](https://github.com/tigera/canal/tree/master/k8s-install) une Flannel e Calico, fornecendo rede e política de rede. * [Cilium](https://github.com/cilium/cilium) é um plug-in de rede de camada 3 e de políticas de rede que pode aplicar políticas HTTP/API/camada 7 de forma transparente. Tanto o modo de roteamento quanto o de sobreposição/encapsulamento são suportados. Este plug-in também consegue operar no topo de outros plug-ins CNI. * [CNI-Genie](https://github.com/Huawei-PaaS/CNI-Genie) permite que o Kubernetes se conecte facilmente a uma variedade de plug-ins CNI, como Calico, Canal, Flannel, Romana ou Weave. -* [Contiv](http://contiv.github.io) oferece serviços de rede configuráveis para diferentes casos de uso (camada 3 nativa usando BGP, _overlay_ (sobreposição) usando vxlan, camada 2 clássica e Cisco-SDN/ACI) e também um _framework_ rico de políticas de rede. O projeto Contiv é totalmente [open source](http://github.com/contiv). O [instalador](http://github.com/contiv/install) fornece opções de instalação com ou sem kubeadm. +* [Contiv](https://contivpp.io/) oferece serviços de rede configuráveis para diferentes casos de uso (camada 3 nativa usando BGP, _overlay_ (sobreposição) usando vxlan, camada 2 clássica e Cisco-SDN/ACI) e também um _framework_ rico de políticas de rede. O projeto Contiv é totalmente [open source](http://github.com/contiv). O [instalador](http://github.com/contiv/install) fornece opções de instalação com ou sem kubeadm. * [Contrail](http://www.juniper.net/us/en/products-services/sdn/contrail/contrail-networking/) é uma plataforma open source baseada no [Tungsten Fabric](https://tungsten.io) que oferece virtualização de rede multi-nuvem e gerenciamento de políticas de rede. O Contrail e o Tungsten Fabric são integrados a sistemas de orquestração de contêineres, como Kubernetes, OpenShift, OpenStack e Mesos, e fornecem modos de isolamento para cargas de trabalho executando em máquinas virtuais, contêineres/pods e servidores físicos. * [Flannel](https://github.com/flannel-io/flannel#deploying-flannel-manually) é um provedor de redes _overlay_ (sobrepostas) que pode ser usado com o Kubernetes. * [Knitter](https://github.com/ZTE/Knitter/) é um plug-in para suporte de múltiplas interfaces de rede em Pods do Kubernetes. @@ -30,7 +30,7 @@ Esta página lista alguns dos complementos disponíveis e links com suas respect * [Nuage](https://github.com/nuagenetworks/nuage-kubernetes/blob/v5.1.1-1/docs/kubernetes-1-installation.rst) é uma plataforma de rede definida por software que fornece serviços de rede baseados em políticas entre os Pods do Kubernetes e os ambientes não-Kubernetes, com visibilidade e monitoramento de segurança. * [OVN-Kubernetes](https://github.com/ovn-org/ovn-kubernetes/) é um provedor de rede para o Kubernetes baseado no [OVN (Open Virtual Network)](https://github.com/ovn-org/ovn/), uma implementação de redes virtuais que surgiu através do projeto Open vSwitch (OVS). O OVN-Kubernetes fornece uma implementação de rede baseada em _overlay_ (sobreposição) para o Kubernetes, incluindo uma implementação baseada em OVS para serviços de balanceamento de carga e políticas de rede. * [OVN4NFV-K8S-Plugin](https://github.com/opnfv/ovn4nfv-k8s-plugin) é um plug-in controlador CNI baseado no OVN (Open Virtual Network) que fornece serviços de rede _cloud native_, como _Service Function Chaining_ (SFC), redes _overlay_ (sobrepostas) OVN múltiplas, criação dinâmica de subredes, criação dinâmica de redes virtuais, provedor de rede VLAN e provedor de rede direto, e é plugável a outros plug-ins multi-rede. Ideal para cargas de trabalho que utilizam computação de borda _cloud native_ em redes multi-cluster. -* [Romana](http://romana.io) é uma solução de rede de camada 3 para redes de pods que também suporta a [API NetworkPolicy](/docs/concepts/services-networking/network-policies/). Detalhes da instalação do complemento Kubeadm disponíveis [aqui](https://github.com/romana/romana/tree/master/containerize). +* [Romana](https://github.com/romana/romana) é uma solução de rede de camada 3 para redes de pods que também suporta a [API NetworkPolicy](/docs/concepts/services-networking/network-policies/). Detalhes da instalação do complemento Kubeadm disponíveis [aqui](https://github.com/romana/romana/tree/master/containerize). * [Weave Net](https://www.weave.works/docs/net/latest/kube-addon/) fornece rede e política de rede, funciona em ambos os lados de uma partição de rede e não requer um banco de dados externo. ## Descoberta de Serviço From 2d553512632884df94fbb00d744d4f1c7bbee0ec Mon Sep 17 00:00:00 2001 From: Abigail McCarthy Date: Thu, 14 Apr 2022 11:18:39 -0400 Subject: [PATCH 025/763] Update config.toml for language name standardization Update langiagenamelatinscript varibale Fix languageNameLatinScript update localization standards examples --- config.toml | 43 +++++++++++++++------- content/en/docs/contribute/localization.md | 7 ++-- 2 files changed, 33 insertions(+), 17 deletions(-) diff --git a/config.toml b/config.toml index c71f4fcdea..f2f90e2c05 100644 --- a/config.toml +++ b/config.toml @@ -303,7 +303,8 @@ languagedirection = "ltr" [languages.zh] title = "Kubernetes" description = "生产级别的容器编排系统" -languageName = "中文 Chinese" +languageName = "中文 (Chinese)" +languageNameLatinScript = "Chinese" weight = 2 contentDir = "content/zh" languagedirection = "ltr" @@ -315,7 +316,8 @@ language_alternatives = ["en"] [languages.ko] title = "Kubernetes" description = "운영 수준의 컨테이너 오케스트레이션" -languageName = "한국어 Korean" +languageName = "한국어 (Korean)" +languageNameLatinScript = "Korean" weight = 3 contentDir = "content/ko" languagedirection = "ltr" @@ -327,7 +329,8 @@ language_alternatives = ["en"] [languages.ja] title = "Kubernetes" description = "プロダクショングレードのコンテナ管理基盤" -languageName = "日本語 Japanese" +languageName = "日本語 (Japanese)" +languageNameLatinScript = "Japanese" weight = 4 contentDir = "content/ja" languagedirection = "ltr" @@ -339,7 +342,8 @@ language_alternatives = ["en"] [languages.fr] title = "Kubernetes" description = "Solution professionnelle d’orchestration de conteneurs" -languageName ="Français" +languageName ="Français (French)" +languageNameLatinScript = "Français" weight = 5 contentDir = "content/fr" languagedirection = "ltr" @@ -352,7 +356,8 @@ language_alternatives = ["en"] [languages.it] title = "Kubernetes" description = "Orchestrazione di Container in produzione" -languageName = "Italiano" +languageName = "Italiano (Italian)" +languageNameLatinScript = "Italiano" weight = 6 contentDir = "content/it" languagedirection = "ltr" @@ -365,7 +370,8 @@ language_alternatives = ["en"] [languages.no] title = "Kubernetes" description = "Production-Grade Container Orchestration" -languageName ="Norsk" +languageName ="Norsk (Norwegian)" +languageNameLatinScript = "Norsk" weight = 7 contentDir = "content/no" languagedirection = "ltr" @@ -378,7 +384,8 @@ language_alternatives = ["en"] [languages.de] title = "Kubernetes" description = "Produktionsreife Container-Orchestrierung" -languageName ="Deutsch" +languageName ="Deutsch (German)" +languageNameLatinScript = "Deutsch" weight = 8 contentDir = "content/de" languagedirection = "ltr" @@ -391,7 +398,8 @@ language_alternatives = ["en"] [languages.es] title = "Kubernetes" description = "Orquestación de contenedores para producción" -languageName ="Español" +languageName ="Español (Spanish)" +languageNameLatinScript = "Español" weight = 9 contentDir = "content/es" languagedirection = "ltr" @@ -404,7 +412,8 @@ language_alternatives = ["en"] [languages.pt-br] title = "Kubernetes" description = "Orquestração de contêineres em nível de produção" -languageName ="Português" +languageName ="Português (Portuguese)" +languageNameLatinScript = "Português" weight = 9 contentDir = "content/pt-br" languagedirection = "ltr" @@ -418,6 +427,7 @@ language_alternatives = ["en"] title = "Kubernetes" description = "Orkestrasi Kontainer dengan Skala Produksi" languageName ="Bahasa Indonesia" +languageNameLatinScript = "Bahasa Indonesia" weight = 10 contentDir = "content/id" languagedirection = "ltr" @@ -430,7 +440,8 @@ language_alternatives = ["en"] [languages.hi] title = "Kubernetes" description = "Production-Grade Container Orchestration" -languageName = "Hindi" +languageName = "हिन्दी (Hindi)" +languageNameLatinScript = "Hindi" weight = 11 contentDir = "content/hi" languagedirection = "ltr" @@ -442,7 +453,8 @@ language_alternatives = ["en"] [languages.vi] title = "Kubernetes" description = "Giải pháp điều phối container trong môi trường production" -languageName = "Tiếng Việt" +languageName = "Tiếng Việt (Vietnamese)" +languageNameLatinScript = "Tiếng Việt" contentDir = "content/vi" weight = 12 languagedirection = "ltr" @@ -450,7 +462,8 @@ languagedirection = "ltr" [languages.ru] title = "Kubernetes" description = "Первоклассная оркестрация контейнеров" -languageName = "Русский" +languageName = "Русский (Russian)" +languageNameLatinScript = "Russian" weight = 12 contentDir = "content/ru" languagedirection = "ltr" @@ -463,7 +476,8 @@ language_alternatives = ["en"] [languages.pl] title = "Kubernetes" description = "Produkcyjny system zarządzania kontenerami" -languageName = "Polski" +languageName = "Polski (Polish)" +languageNameLatinScript = "Polski" weight = 13 contentDir = "content/pl" languagedirection = "ltr" @@ -476,7 +490,8 @@ language_alternatives = ["en"] [languages.uk] title = "Kubernetes" description = "Довершена система оркестрації контейнерів" -languageName = "Українська" +languageName = "Українська (Ukrainian)" +languageNameLatinScript = "Ukrainian" weight = 14 contentDir = "content/uk" languagedirection = "ltr" diff --git a/content/en/docs/contribute/localization.md b/content/en/docs/contribute/localization.md index 7630bdc7d9..97b15541f1 100644 --- a/content/en/docs/contribute/localization.md +++ b/content/en/docs/contribute/localization.md @@ -126,12 +126,14 @@ Add a configuration block for the new language to `config.toml`, under the exist title = "Kubernetes" description = "Produktionsreife Container-Verwaltung" languageName = "Deutsch (German)" -languageNameLatinScript = "German" +languageNameLatinScript = "Deutsch" contentDir = "content/de" weight = 8 ``` -The value for `languageName` will be listed in language selection bar. Assign "language name in native script (language name in latin script)" to `languageName`, for example, `languageName = "한국어 (Korean)"`. `languageNameLatinScript` can be used to access the language name in latin script and use it in the theme. Assign "language name in latin script" to `languageNameLatinScript`, for example, `languageNameLatinScript ="Korean"`. +The value for `languageName` will be listed in language selection bar. Assign "language name in native script and language (English language name in latin script)" to `languageName`. For example, `languageName = "한국어 (Korean)"` or `languageName = "Deutsch (German)"`. + +`languageNameLatinScript` can be used to access the language name in latin script and use it in the theme. Assign "language name in latin script" to `languageNameLatinScript`. For example, `languageNameLatinScript ="Korean"` or `languageNameLatinScript = "Deutsch"`. When assigning a `weight` parameter for your block, find the language block with the highest weight and add 1 to that value. @@ -365,4 +367,3 @@ For more information about working from forks or directly from the repository, s ## Upstream contributions SIG Docs welcomes upstream contributions and corrections to the English source. - From 01efbac56fd917a80be576f4d74db23dd7c6d3ec Mon Sep 17 00:00:00 2001 From: Jai Govindani Date: Sun, 17 Apr 2022 08:32:38 +0700 Subject: [PATCH 026/763] fix: Well-Known Annotations/Labels/Taints examples --- .../labels-annotations-taints/_index.md | 82 +++++++++---------- 1 file changed, 41 insertions(+), 41 deletions(-) diff --git a/content/en/docs/reference/labels-annotations-taints/_index.md b/content/en/docs/reference/labels-annotations-taints/_index.md index d08c6ca90c..9bb4ab12d8 100644 --- a/content/en/docs/reference/labels-annotations-taints/_index.md +++ b/content/en/docs/reference/labels-annotations-taints/_index.md @@ -17,7 +17,7 @@ This document serves both as a reference to the values and as a coordination poi ### app.kubernetes.io/component -Example: `app.kubernetes.io/component=database` +Example: `app.kubernetes.io/component: "database"` Used on: All Objects @@ -27,7 +27,7 @@ One of the [recommended labels](/docs/concepts/overview/working-with-objects/com ### app.kubernetes.io/created-by -Example: `app.kubernetes.io/created-by=controller-manager` +Example: `app.kubernetes.io/created-by: "controller-manager"` Used on: All Objects @@ -37,7 +37,7 @@ One of the [recommended labels](/docs/concepts/overview/working-with-objects/com ### app.kubernetes.io/instance -Example: `app.kubernetes.io/instance=mysql-abcxzy` +Example: `app.kubernetes.io/instance: "mysql-abcxzy"` Used on: All Objects @@ -47,7 +47,7 @@ One of the [recommended labels](/docs/concepts/overview/working-with-objects/com ### app.kubernetes.io/managed-by -Example: `app.kubernetes.io/managed-by=helm` +Example: `app.kubernetes.io/managed-by: "helm"` Used on: All Objects @@ -57,7 +57,7 @@ One of the [recommended labels](/docs/concepts/overview/working-with-objects/com ### app.kubernetes.io/name -Example: `app.kubernetes.io/name=mysql` +Example: `app.kubernetes.io/name: "mysql"` Used on: All Objects @@ -67,7 +67,7 @@ One of the [recommended labels](/docs/concepts/overview/working-with-objects/com ### app.kubernetes.io/part-of -Example: `app.kubernetes.io/part-of=wordpress` +Example: `app.kubernetes.io/part-of: "wordpress"` Used on: All Objects @@ -77,7 +77,7 @@ One of the [recommended labels](/docs/concepts/overview/working-with-objects/com ### app.kubernetes.io/version -Example: `app.kubernetes.io/version="5.7.21"` +Example: `app.kubernetes.io/version: "5.7.21"` Used on: All Objects @@ -87,7 +87,7 @@ One of the [recommended labels](/docs/concepts/overview/working-with-objects/com ### kubernetes.io/arch -Example: `kubernetes.io/arch=amd64` +Example: `kubernetes.io/arch: "amd64"` Used on: Node @@ -95,7 +95,7 @@ The Kubelet populates this with `runtime.GOARCH` as defined by Go. This can be h ### kubernetes.io/os -Example: `kubernetes.io/os=linux` +Example: `kubernetes.io/os: "linux"` Used on: Node @@ -103,7 +103,7 @@ The Kubelet populates this with `runtime.GOOS` as defined by Go. This can be han ### kubernetes.io/metadata.name -Example: `kubernetes.io/metadata.name=mynamespace` +Example: `kubernetes.io/metadata.name: "mynamespace"` Used on: Namespaces @@ -124,7 +124,7 @@ This label has been deprecated. Please use `kubernetes.io/os` instead. ### kubernetes.io/hostname {#kubernetesiohostname} -Example: `kubernetes.io/hostname=ip-172-20-114-199.ec2.internal` +Example: `kubernetes.io/hostname: "ip-172-20-114-199.ec2.internal"` Used on: Node @@ -135,7 +135,7 @@ This label is also used as part of the topology hierarchy. See [topology.kubern ### kubernetes.io/change-cause {#change-cause} -Example: `kubernetes.io/change-cause=kubectl edit --record deployment foo` +Example: `kubernetes.io/change-cause: "kubectl edit --record deployment foo"` Used on: All Objects @@ -161,7 +161,7 @@ The value for this annotation must be **true** to take effect. This annotation i ### controller.kubernetes.io/pod-deletion-cost {#pod-deletion-cost} -Example: `controller.kubernetes.io/pod-deletion-cost=10` +Example: `controller.kubernetes.io/pod-deletion-cost: "10"` Used on: Pod @@ -174,7 +174,7 @@ which allows users to influence ReplicaSet downscaling order. The annotation par ### node.kubernetes.io/instance-type {#nodekubernetesioinstance-type} -Example: `node.kubernetes.io/instance-type=m3.medium` +Example: `node.kubernetes.io/instance-type: "m3.medium"` Used on: Node @@ -199,7 +199,7 @@ See [topology.kubernetes.io/zone](#topologykubernetesiozone). Example: -`statefulset.kubernetes.io/pod-name=mystatefulset-7` +`statefulset.kubernetes.io/pod-name: "mystatefulset-7"` When a StatefulSet controller creates a Pod for the StatefulSet, the control plane sets this label on that Pod. The value of the label is the name of the Pod being created. @@ -211,7 +211,7 @@ StatefulSet topic for more details. Example: -`topology.kubernetes.io/region=us-east-1` +`topology.kubernetes.io/region: "us-east-1"` See [topology.kubernetes.io/zone](#topologykubernetesiozone). @@ -219,7 +219,7 @@ See [topology.kubernetes.io/zone](#topologykubernetesiozone). Example: -`topology.kubernetes.io/zone=us-east-1c` +`topology.kubernetes.io/zone: "us-east-1c"` Used on: Node, PersistentVolume @@ -248,7 +248,7 @@ adding the labels manually (or adding support for `PersistentVolumeLabel`). With ### volume.beta.kubernetes.io/storage-provisioner (deprecated) -Example: `volume.beta.kubernetes.io/storage-provisioner: k8s.io/minikube-hostpath` +Example: `volume.beta.kubernetes.io/storage-provisioner: "k8s.io/minikube-hostpath"` Used on: PersistentVolumeClaim @@ -272,7 +272,7 @@ This annotation will be added to dynamic provisioning required PVC. ### node.kubernetes.io/windows-build {#nodekubernetesiowindows-build} -Example: `node.kubernetes.io/windows-build=10.0.17763` +Example: `node.kubernetes.io/windows-build: "10.0.17763"` Used on: Node @@ -282,7 +282,7 @@ The label's value is in the format "MajorVersion.MinorVersion.BuildNumber". ### service.kubernetes.io/headless {#servicekubernetesioheadless} -Example: `service.kubernetes.io/headless=""` +Example: `service.kubernetes.io/headless: ""` Used on: Service @@ -290,7 +290,7 @@ The control plane adds this label to an Endpoints object when the owning Service ### kubernetes.io/service-name {#kubernetesioservice-name} -Example: `kubernetes.io/service-name="nginx"` +Example: `kubernetes.io/service-name: "nginx"` Used on: Service @@ -298,7 +298,7 @@ Kubernetes uses this label to differentiate multiple Services. Used currently fo ### endpointslice.kubernetes.io/managed-by {#endpointslicekubernetesiomanaged-by} -Example: `endpointslice.kubernetes.io/managed-by="controller"` +Example: `endpointslice.kubernetes.io/managed-by: "controller"` Used on: EndpointSlices @@ -306,7 +306,7 @@ The label is used to indicate the controller or entity that manages an EndpointS ### endpointslice.kubernetes.io/skip-mirror {#endpointslicekubernetesioskip-mirror} -Example: `endpointslice.kubernetes.io/skip-mirror="true"` +Example: `endpointslice.kubernetes.io/skip-mirror: "true"` Used on: Endpoints @@ -314,7 +314,7 @@ The label can be set to `"true"` on an Endpoints resource to indicate that the E ### service.kubernetes.io/service-proxy-name {#servicekubernetesioservice-proxy-name} -Example: `service.kubernetes.io/service-proxy-name="foo-bar"` +Example: `service.kubernetes.io/service-proxy-name: "foo-bar"` Used on: Service @@ -326,7 +326,7 @@ Example: `experimental.windows.kubernetes.io/isolation-type: "hyperv"` Used on: Pod -The annotation is used to run Windows containers with Hyper-V isolation. To use Hyper-V isolation feature and create a Hyper-V isolated container, the kubelet should be started with feature gates HyperVContainer=true and the Pod should include the annotation experimental.windows.kubernetes.io/isolation-type=hyperv. +The annotation is used to run Windows containers with Hyper-V isolation. To use Hyper-V isolation feature and create a Hyper-V isolated container, the kubelet should be started with feature gates HyperVContainer=true and the Pod should include the annotation `experimental.windows.kubernetes.io/isolation-type: hyperv`. {{< note >}} You can only set this annotation on Pods that have a single container. @@ -349,7 +349,7 @@ Starting in v1.18, this annotation is deprecated in favor of `spec.ingressClassN ### storageclass.kubernetes.io/is-default-class -Example: `storageclass.kubernetes.io/is-default-class=true` +Example: `storageclass.kubernetes.io/is-default-class: true` Used on: StorageClass @@ -411,61 +411,61 @@ Use [Taints and Tolerations](/docs/concepts/scheduling-eviction/taint-and-tolera ### node.kubernetes.io/not-ready -Example: `node.kubernetes.io/not-ready:NoExecute` +Example: `node.kubernetes.io/not-ready: "NoExecute"` The node controller detects whether a node is ready by monitoring its health and adds or removes this taint accordingly. ### node.kubernetes.io/unreachable -Example: `node.kubernetes.io/unreachable:NoExecute` +Example: `node.kubernetes.io/unreachable: "NoExecute"` The node controller adds the taint to a node corresponding to the [NodeCondition](/docs/concepts/architecture/nodes/#condition) `Ready` being `Unknown`. ### node.kubernetes.io/unschedulable -Example: `node.kubernetes.io/unschedulable:NoSchedule` +Example: `node.kubernetes.io/unschedulable: "NoSchedule"` The taint will be added to a node when initializing the node to avoid race condition. ### node.kubernetes.io/memory-pressure -Example: `node.kubernetes.io/memory-pressure:NoSchedule` +Example: `node.kubernetes.io/memory-pressure: "NoSchedule"` The kubelet detects memory pressure based on `memory.available` and `allocatableMemory.available` observed on a Node. The observed values are then compared to the corresponding thresholds that can be set on the kubelet to determine if the Node condition and taint should be added/removed. ### node.kubernetes.io/disk-pressure -Example: `node.kubernetes.io/disk-pressure:NoSchedule` +Example: `node.kubernetes.io/disk-pressure :"NoSchedule"` The kubelet detects disk pressure based on `imagefs.available`, `imagefs.inodesFree`, `nodefs.available` and `nodefs.inodesFree`(Linux only) observed on a Node. The observed values are then compared to the corresponding thresholds that can be set on the kubelet to determine if the Node condition and taint should be added/removed. ### node.kubernetes.io/network-unavailable -Example: `node.kubernetes.io/network-unavailable:NoSchedule` +Example: `node.kubernetes.io/network-unavailable: "NoSchedule"` This is initially set by the kubelet when the cloud provider used indicates a requirement for additional network configuration. Only when the route on the cloud is configured properly will the taint be removed by the cloud provider. ### node.kubernetes.io/pid-pressure -Example: `node.kubernetes.io/pid-pressure:NoSchedule` +Example: `node.kubernetes.io/pid-pressure: "NoSchedule"` The kubelet checks D-value of the size of `/proc/sys/kernel/pid_max` and the PIDs consumed by Kubernetes on a node to get the number of available PIDs that referred to as the `pid.available` metric. The metric is then compared to the corresponding threshold that can be set on the kubelet to determine if the node condition and taint should be added/removed. ### node.cloudprovider.kubernetes.io/uninitialized -Example: `node.cloudprovider.kubernetes.io/uninitialized:NoSchedule` +Example: `node.cloudprovider.kubernetes.io/uninitialized: "NoSchedule"` Sets this taint on a node to mark it as unusable, when kubelet is started with the "external" cloud provider, until a controller from the cloud-controller-manager initializes this node, and then removes the taint. ### node.cloudprovider.kubernetes.io/shutdown -Example: `node.cloudprovider.kubernetes.io/shutdown:NoSchedule` +Example: `node.cloudprovider.kubernetes.io/shutdown: "NoSchedule"` If a Node is in a cloud provider specified shutdown state, the Node gets tainted accordingly with `node.cloudprovider.kubernetes.io/shutdown` and the taint effect of `NoSchedule`. ### pod-security.kubernetes.io/enforce -Example: `pod-security.kubernetes.io/enforce: baseline` +Example: `pod-security.kubernetes.io/enforce: "baseline"` Used on: Namespace @@ -479,7 +479,7 @@ for more information. ### pod-security.kubernetes.io/enforce-version -Example: `pod-security.kubernetes.io/enforce-version: {{< skew latestVersion >}}` +Example: `pod-security.kubernetes.io/enforce-version: "{{< skew latestVersion >}}"` Used on: Namespace @@ -492,7 +492,7 @@ for more information. ### pod-security.kubernetes.io/audit -Example: `pod-security.kubernetes.io/audit: baseline` +Example: `pod-security.kubernetes.io/audit: "baseline"` Used on: Namespace @@ -506,7 +506,7 @@ for more information. ### pod-security.kubernetes.io/audit-version -Example: `pod-security.kubernetes.io/audit-version: {{< skew latestVersion >}}` +Example: `pod-security.kubernetes.io/audit-version: "{{< skew latestVersion >}}"` Used on: Namespace @@ -519,7 +519,7 @@ for more information. ### pod-security.kubernetes.io/warn -Example: `pod-security.kubernetes.io/warn: baseline` +Example: `pod-security.kubernetes.io/warn: "baseline"` Used on: Namespace @@ -535,7 +535,7 @@ for more information. ### pod-security.kubernetes.io/warn-version -Example: `pod-security.kubernetes.io/warn-version: {{< skew latestVersion >}}` +Example: `pod-security.kubernetes.io/warn-version: "{{< skew latestVersion >}}"` Used on: Namespace From a28f1897164148085c3a763f6eb3ce421cb905dc Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Mon, 18 Apr 2022 14:27:43 +0530 Subject: [PATCH 027/763] Update blog with links to external documentation and reshuffle some points --- ...ent-unauthorised-volume-mode-conversion.md | 92 ++++++++++++------- 1 file changed, 61 insertions(+), 31 deletions(-) diff --git a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md index 0e171b13e9..471e263245 100644 --- a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md @@ -5,31 +5,63 @@ date: 2022-04-12 slug: prevent-unauthorised-volume-mode-conversion-alpha --- -**Author:** Raunak Shah (Mirantis) +**Author:** Raunak Pradip Shah (Mirantis) + +Kubernetes v1.24 introduces a new alpha-level feature that prevents unauthorised users +from modifying the volume mode of a [`PersistentVolumeClaim`](/docs/concepts/storage/persistent-volumes/) created from an +existing [`VolumeSnapshot`](/docs/concepts/storage/volumesnapshots/) in the Kubernetes cluster. + -Kubernetes v1.24 introduces a new alpha-level feature that prevents unauthorised users from modifying the volume mode of a [`PeristentVolumeClaim`](/docs/concepts/storage/persistent-volumes.md). This feature requires [`VolumeSnapshot`](/docs/concepts/storage/volume-snapshots.md) APIs with version `v6.0.0` onwards and `external-provisioner` version `v3.2.0` onwards. ### The problem -As of Kubernetes 1.23, users can leverage the `VolumeSnapshot` feature, which GA'd in Kubernetes 1.20, to create a `PersistentVolumeClaim` (or `PVC`) from a previously taken `VolumeSnapshot`. This is done by pointing the `Spec.dataSource` parameter of the `PVC` to an existing `VolumeSnapshot` instance. -There is no logic that validates whether the original volume mode of the `PVC`, whose snapshot was taken, matches the volume mode of the newly created `PVC`, that is being created from the existing `VolumeSnapshot`. +The [Volume Mode](/docs/concepts/storage/persistent-volumes/#volume-mode) determines whether a volume +is formatted into a filesystem or presented as a raw block device. -There is logic in allowing this, as many popular storage backup vendors convert the volume mode, during the course of a backup operation, for efficiency purposes. +Users can leverage the `VolumeSnapshot` feature, which has been stable since Kubernetes v1.20, +to create a `PersistentVolumeClaim` (shortened as PVC) from an existing `VolumeSnapshot` in +the Kubernetes cluster. The PVC spec includes a `dataSource` field, which can point to an +existing `VolumeSnapshot` instance. +Visit [Create a PersistentVolumeClaim from a Volume Snapshot](/docs/concepts/storage/persistent-volumes/#create-persistent-volume-claim-from-volume-snapshot) for more details. -However this also presents a security gap that allows malicious users to potentially exploit an as-yet-unknown CVE in the kernel. +When leveraging the above capability, there is no logic that validates whether the mode of the +original volume, whose snapshot was taken, matches the mode of the newly created volume. + +This presents a security gap that allows malicious users to potentially exploit an +as-yet-unknown vulnerability in the host operating system. + +Many popular storage backup vendors convert the volume mode during the course of a +backup operation, for efficiency purposes, which prevents Kubernetes from blocking +the operation completely and presents a challenge in distinguishing trusted +users from malicious ones. ### Preventing unauthorised users from converting the volume mode -If the alpha feature is enabled in `snapshot-controller` and `external-provisioner`, then unauthorised users will not be allowed to modify the volume mode of a `PVC` when it is being created from a `VolumeSnapshot`. -An unauthorised user is defined as one who does not have existing permissions to alter the cluster-scoped `VolumeSnapshotContent` resource. -Backup vendors normally have this permission on clusters where a backup is to be performed. +In this context, an authorised user is one who has access rights to perform `Update` +or `Patch` operations on `VolumeSnapshotContents`, which is a cluster-level resource. +It is upto the cluster administrator to provide these rights only to trusted users +or applications, like backup vendors. + +If the alpha feature is [enabled](https://kubernetes-csi.github.io/docs/) in +`snapshot-controller` and `external-provisioner`, then unauthorised users will +not be allowed to modify the volume mode of a PVC when it is being created from +a `VolumeSnapshot`. To convert the volume mode, an authorised user must do the following: -1. Identify the `VolumeSnapshot` that is to be used as the data source for a newly created `PVC`. +1. Identify the `VolumeSnapshot` that is to be used as the data source for a newly +created PVC in the given namespace. 2. Identify the `VolumeSnapshotContent` bound to the above `VolumeSnapshot`. -3. Add a new annotation `snapshot.storage.kubernetes.io/allowVolumeModeChange` to the `VolumeSnapshotContent`. -This annotation can be added either via software or manually by the backup vendor. The VolumeSnapshotContent must look like below after this change: + +```yaml +$ kubectl get volumesnapshot -n +``` + +3. Add the annotation [`snapshot.storage.kubernetes.io/allowVolumeModeChange`](/content/en/docs/reference/labels-annotations-taints/_index.md) +to the `VolumeSnapshotContent`. + +4. This annotation can be added either via software or manually by the authorised +user. The `VolumeSnapshotContent` must look like below after this change: ```yaml kind: VolumeSnapshotContent @@ -38,13 +70,19 @@ metadata: - snapshot.storage.kubernetes.io/allowVolumeModeChange: "true" ... ``` -NOTE: For pre-provisioned `VolumeSnapshotContents`, the user has an additional step of setting `Spec.SourceVolumeMode` field to either `Filesystem` or `Block`, depending on the volume from which this snapshot was taken. + +NOTE: For pre-provisioned `VolumeSnapshotContents`, the user has an additional +step of setting `spec.SourceVolumeMode` field to either `Filesystem` or `Block`, +depending on the volume from which this snapshot was taken. + An example is shown below: ```yaml apiVersion: snapshot.storage.k8s.io/v1 kind: VolumeSnapshotContent metadata: + annotations: + - snapshot.storage.kubernetes.io/allowVolumeModeChange: "true" name: new-snapshot-content-test spec: deletionPolicy: Delete @@ -57,27 +95,19 @@ spec: namespace: default ``` -Repeat (1)-(3) for all `VolumeSnapshotContent`s whose volume mode needs to be converted during a backup or restore operation. +Repeat (1)-(3) for all `VolumeSnapshotContents` whose volume mode needs to be +converted during a backup or restore operation. -If the above annotation is present on a `VolumeSnapshotContent` object, Kubernetes will not prevent the volume mode from being converted. -Users should keep this in mind before they attempt to add the annotation to any `VolumeSnapshotContent`. +If the above annotation is present on a `VolumeSnapshotContent` object, +Kubernetes will not prevent the volume mode from being converted. +Users should keep this in mind before they attempt to add the annotation +to any `VolumeSnapshotContent`. -### How to enable the feature +### What's next -This feature can be enabled by setting `prevent-volume-mode-conversion` flag to `true` in the `snapshot-controller` and `external-provisioner` spec, as shown below: - -```yaml -apiVersion: apps/v1 -kind: Deployment -... -spec: - containers: - - args: - - --leader-election=true - - --prevent-volume-mode-conversion=true - image: snapshot-controller:v6.0.0 -... -``` +[Enable this feature](https://kubernetes-csi.github.io/docs/) and let us know what you think! +We hope this feature causes no disruption to existing workflows while preventing malicious users from exploiting security vulnerabilities in their clusters. +For any issues, create a thread in the #sig-storage slack channel or an issue in the CSI external-snapshotter sidecar [repository](https://github.com/kubernetes-csi/external-snapshotter) and assign it to [@RaunakShah](https://github.com/RaunakShah). \ No newline at end of file From 2cc8fb4d7b2268c7a756b57d50130661cf587e04 Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Mon, 18 Apr 2022 14:29:25 +0530 Subject: [PATCH 028/763] Use spaces instead of tabs --- .../2022-04-12-prevent-unauthorised-volume-mode-conversion.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md index 471e263245..feb9d33708 100644 --- a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md @@ -66,8 +66,8 @@ user. The `VolumeSnapshotContent` must look like below after this change: ```yaml kind: VolumeSnapshotContent metadata: - annotations: - - snapshot.storage.kubernetes.io/allowVolumeModeChange: "true" + annotations: + - snapshot.storage.kubernetes.io/allowVolumeModeChange: "true" ... ``` From 47b201deedac907a0ee657c9c6bbd6127e733f1c Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Mon, 18 Apr 2022 15:04:01 +0530 Subject: [PATCH 029/763] fix links --- ...-prevent-unauthorised-volume-mode-conversion.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md index feb9d33708..485566a5a8 100644 --- a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md @@ -9,7 +9,7 @@ slug: prevent-unauthorised-volume-mode-conversion-alpha Kubernetes v1.24 introduces a new alpha-level feature that prevents unauthorised users from modifying the volume mode of a [`PersistentVolumeClaim`](/docs/concepts/storage/persistent-volumes/) created from an -existing [`VolumeSnapshot`](/docs/concepts/storage/volumesnapshots/) in the Kubernetes cluster. +existing [`VolumeSnapshot`](/docs/concepts/storage/volume-snapshots/) in the Kubernetes cluster. @@ -57,7 +57,7 @@ created PVC in the given namespace. $ kubectl get volumesnapshot -n ``` -3. Add the annotation [`snapshot.storage.kubernetes.io/allowVolumeModeChange`](/content/en/docs/reference/labels-annotations-taints/_index.md) +3. Add the annotation [`snapshot.storage.kubernetes.io/allowVolumeModeChange`](/content/en/docs/reference/labels-annotations-taints/) to the `VolumeSnapshotContent`. 4. This annotation can be added either via software or manually by the authorised @@ -106,8 +106,12 @@ to any `VolumeSnapshotContent`. ### What's next -[Enable this feature](https://kubernetes-csi.github.io/docs/) and let us know what you think! +[Enable this feature](https://kubernetes-csi.github.io/docs/) and let us know +what you think! -We hope this feature causes no disruption to existing workflows while preventing malicious users from exploiting security vulnerabilities in their clusters. +We hope this feature causes no disruption to existing workflows while preventing +malicious users from exploiting security vulnerabilities in their clusters. -For any issues, create a thread in the #sig-storage slack channel or an issue in the CSI external-snapshotter sidecar [repository](https://github.com/kubernetes-csi/external-snapshotter) and assign it to [@RaunakShah](https://github.com/RaunakShah). \ No newline at end of file +For any issues, create a thread in the #sig-storage slack channel or an issue +in the CSI external-snapshotter sidecar [repository](https://github.com/kubernetes-csi/external-snapshotter) +and assign it to [@RaunakShah](https://github.com/RaunakShah). \ No newline at end of file From f26337fadc73cbc4dbe37c376919e89f63801b8f Mon Sep 17 00:00:00 2001 From: s-kawamura-w664 Date: Fri, 25 Feb 2022 09:11:00 +0000 Subject: [PATCH 030/763] Add that pv's access modes are not constraints on the volume. --- content/en/docs/concepts/storage/persistent-volumes.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/content/en/docs/concepts/storage/persistent-volumes.md b/content/en/docs/concepts/storage/persistent-volumes.md index 7a11939507..e7f4f52ce3 100644 --- a/content/en/docs/concepts/storage/persistent-volumes.md +++ b/content/en/docs/concepts/storage/persistent-volumes.md @@ -477,6 +477,15 @@ In the CLI, the access modes are abbreviated to: * RWX - ReadWriteMany * RWOP - ReadWriteOncePod +{{< note >}} +Kubernetes uses volume access modes to match PersistentVolumeClaims and PersistentVolumes. +In some cases, the volume access modes also constrain where the PersistentVolume can be mounted. +Volume access modes do **not** enforce write protection once the storage has been mounted. +Even if the access modes are specified as ReadWriteOnce, ReadOnlyMany, or ReadWriteMany, they don't set any constraints on the volume. +For example, even if a PersistentVolume is created as ReadOnlyMany, it is no guarantee that it will be read-only. +If the access modes are specified as ReadWriteOncePod, the volume is constrained and can be mounted on only a single Pod. +{{< /note >}} + > __Important!__ A volume can only be mounted using one access mode at a time, even if it supports many. For example, a GCEPersistentDisk can be mounted as ReadWriteOnce by a single node or ReadOnlyMany by many nodes, but not at the same time. From 1999f87c886c68527fe6f711e019a1a2e80095bf Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Tue, 19 Apr 2022 09:00:22 +0530 Subject: [PATCH 031/763] Minor updates to whats next section --- .../2022-04-12-prevent-unauthorised-volume-mode-conversion.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md index 485566a5a8..a36f5c465e 100644 --- a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md @@ -113,5 +113,4 @@ We hope this feature causes no disruption to existing workflows while preventing malicious users from exploiting security vulnerabilities in their clusters. For any issues, create a thread in the #sig-storage slack channel or an issue -in the CSI external-snapshotter sidecar [repository](https://github.com/kubernetes-csi/external-snapshotter) -and assign it to [@RaunakShah](https://github.com/RaunakShah). \ No newline at end of file +in the CSI external-snapshotter [repository](https://github.com/kubernetes-csi/external-snapshotter). \ No newline at end of file From ad638a809252a7a22098fe2c9ecfb4149775fa5b Mon Sep 17 00:00:00 2001 From: 0xff-dev Date: Tue, 19 Apr 2022 20:26:08 +0800 Subject: [PATCH 032/763] [zh] sync horizontal-pod-autoscale-walkthrough.md --- .../horizontal-pod-autoscale-walkthrough.md | 356 +++++++++++------- 1 file changed, 222 insertions(+), 134 deletions(-) diff --git a/content/zh/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md b/content/zh/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md index d11843826c..2dd70c6a2f 100644 --- a/content/zh/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md +++ b/content/zh/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md @@ -1,7 +1,8 @@ --- -title: Horizontal Pod Autoscaler 演练 +title: HorizontalPodAutoscaler 演练 content_type: task weight: 100 +min-kubernetes-server-version: 1.23 --- -Horizontal Pod Autoscaler 可以根据 CPU 利用率自动扩缩 ReplicationController、 -Deployment、ReplicaSet 或 StatefulSet 中的 Pod 数量 -（也可以基于其他应用程序提供的度量指标，目前这一功能处于 beta 版本）。 +[HorizontalPodAutoscaler](/zh/docs/tasks/run-application/horizontal-pod-autoscale/) （简称 HPA ） +自动更新工作负载资源（例如 {{< glossary_tooltip text="Deployment" term_id="deployment" >}} 或者 +{{< glossary_tooltip text="StatefulSet" term_id="statefulset" >}}）， +目的是自动扩缩工作负载以满足需求。 + +水平扩缩意味着对增加的负载的响应是部署更多的 {{< glossary_tooltip text="Pods" term_id="pod" >}}。 +这与 “垂直（Vertical）” 扩缩不同，对于 Kubernetes， +垂直扩缩意味着将更多资源（例如：内存或 CPU）分配给已经为工作负载运行的 Pod。 -本文将引领你了解如何为 php-apache 服务器配置和使用 Horizontal Pod Autoscaler。 -与 Horizontal Pod Autoscaler 相关的更多信息请参阅 -[Horizontal Pod Autoscaler 用户指南](/zh/docs/tasks/run-application/horizontal-pod-autoscale/)。 +如果负载减少，并且 Pod 的数量高于配置的最小值， +HorizontalPodAutoscaler 会指示工作负载资源（ Deployment、StatefulSet 或其他类似资源）缩减。 + +本文档将引导你完成启用 HorizontalPodAutoscaler 以自动管理示例 Web 应用程序的扩缩的示例。 +此示例工作负载是运行一些 PHP 代码的 Apache httpd。 ## {{% heading "prerequisites" %}} - -本文示例需要一个运行中的 Kubernetes 集群以及 kubectl，版本为 1.2 或更高。 -[Metrics 服务器](https://github.com/kubernetes-incubator/metrics-server/) -需要被部署到集群中，以便通过 [Metrics API](https://github.com/kubernetes/metrics) -提供度量数据。 -Horizontal Pod Autoscaler 根据此 API 来获取度量数据。 -要了解如何部署 metrics-server，请参考 -[metrics-server 文档](https://github.com/kubernetes-incubator/metrics-server/) 。 +{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} -如果需要为 Horizontal Pod Autoscaler 指定多种资源度量指标，你的 Kubernetes -集群以及 kubectl 至少需要达到 1.6 版本。 -此外，如果要使用自定义度量指标，你的 Kubernetes 集群还必须能够与提供这些自定义指标 -的 API 服务器通信。 -最后，如果要使用与 Kubernetes 对象无关的度量指标，则 Kubernetes 集群版本至少需要 -达到 1.10 版本，同样，需要保证集群能够与提供这些外部指标的 API 服务器通信。 -更多详细信息，请参阅 -[Horizontal Pod Autoscaler 用户指南](/zh/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics)。 +如果你运行的是旧版本的 Kubernetes，请参阅该版本的文档版本 +（[可用的文档版本](/zh/docs/home/supported-doc-versions/)）。 + + +按照本演练进行操作，你需要一个部署并配置了 +[Metrics Server](https://github.com/kubernetes-sigs/metrics-server#readme) 的集群。 +Kubernetes Metrics Server 从集群中的 {{}} 收集资源指标， +并通过 [Kubernetes API](/zh/docs/concepts/overview/kubernetes-api/) 公开这些指标， +使用 [APIService](/zh/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/) 添加代表指标读数的新资源。 + +要了解如何部署 Metrics Server，请参阅 +[metrics-server 文档](https://github.com/kubernetes-sigs/metrics-server#deployment)。 -## 运行 php-apache 服务器并暴露服务 +## 运行 php-apache 服务器并暴露服务 {#run-and-expose-php-apache-server} -为了演示 Horizontal Pod Autoscaler，我们将使用一个基于 php-apache 镜像的 -定制 Docker 镜像。Dockerfile 内容如下： +为了演示 HorizontalPodAutoscaler，你将首先制作一个自定义容器镜像， +该镜像使用来自 Docker Hub 的 `php-apache` 镜像作为其起点。 +`Dockerfile` 已经为你准备好了，内容如下： -``` +```dockerfile FROM php:5-apache COPY index.php /var/www/html/index.php RUN chmod a+rx index.php ``` -该文件定义了一个 index.php 页面来执行一些 CPU 密集型计算： +代码定义了一个简单的 `index.php` 页面，该页面执行一些 CPU 密集型计算， +以模拟集群中的负载。 -``` +```php }} +using the following manifest: --> -首先，我们使用下面的配置启动一个 Deployment 来运行这个镜像并暴露一个服务： +制作完该容器镜像后，使用你制作的镜像启动运行一个容器的 Deployment， +并使用以下清单将其公开为{{< glossary_tooltip term_id="service" text="服务" >}}： {{< codenew file="application/php-apache.yaml" >}} -运行下面的命令： +为此，运行下面的命令： ```shell kubectl apply -f https://k8s.io/examples/application/php-apache.yaml @@ -128,28 +153,46 @@ service/php-apache created ``` -## 创建 Horizontal Pod Autoscaler {#create-horizontal-pod-autoscaler} +## 创建 HorizontalPodAutoscaler {#create-horizontal-pod-autoscaler} -现在，php-apache 服务器已经运行，我们将通过 -[kubectl autoscale](/docs/reference/generated/kubectl/kubectl-commands#autoscale) -命令创建 Horizontal Pod Autoscaler。 -以下命令将创建一个 Horizontal Pod Autoscaler 用于控制我们上一步骤中创建的 -Deployment，使 Pod 的副本数量维持在 1 到 10 之间。 -大致来说，HPA 将（通过 Deployment）增加或者减少 Pod 副本的数量以保持所有 Pod -的平均 CPU 利用率在 50% 左右。由于每个 Pod 请求 200 毫核的 CPU，这意味着平均 -CPU 用量为 100 毫核。 -算法的详情请参阅[相关文档](/zh/docs/tasks/run-application/horizontal-pod-autoscale/#algorithm-details)。 +现在服务器正在运行，使用 `kubectl` 创建自动扩缩器。 +[`kubectl autoscale`](/zh/docs/reference/generated/kubectl/kubectl-commands#autoscale) 子命令是 `kubectl` 的一部分， +可以帮助你执行此操作。 + +你将很快运行一个创建 HorizontalPodAutoscaler 的命令， +该 HorizontalPodAutoscaler 维护由你在这些说明的第一步中创建的 php-apache Deployment 控制的 Pod 存在 1 到 10 个副本。 + +粗略地说，HPA {{}}将增加和减少副本的数量 +（通过更新 Deployment）以保持所有 Pod 的平均 CPU 利用率为 50%。 +Deployment 然后更新 ReplicaSet —— 这是所有 Deployment 在 Kubernetes 中工作方式的一部分 —— +然后 ReplicaSet 根据其 `.spec` 的更改添加或删除 Pod。 + +由于每个 Pod 通过 `kubectl run` 请求 200 milli-cores，这意味着平均 CPU 使用率为 100 milli-cores。 +有关算法的更多详细信息， +请参阅[算法详细信息](/zh/docs/tasks/run-application/horizontal-pod-autoscale/#algorithm-details)。 + + + +创建 HorizontalPodAutoscaler： ```shell kubectl autoscale deployment php-apache --cpu-percent=50 --min=1 --max=10 @@ -160,14 +203,19 @@ horizontalpodautoscaler.autoscaling/php-apache autoscaled ``` -我们可以通过以下命令查看 Autoscaler 的状态： +你可以通过运行以下命令检查新制作的 HorizontalPodAutoscaler 的当前状态： + ```shell +# 你可以使用 “hap” 或 “horizontalpodautoscaler”；任何一个名字都可以。 kubectl get hpa ``` + +输出类似于： + ``` NAME REFERENCE TARGET MINPODS MAXPODS REPLICAS AGE php-apache Deployment/php-apache/scale 0% / 50% 1 10 1 18s @@ -175,42 +223,71 @@ php-apache Deployment/php-apache/scale 0% / 50% 1 10 1 ``` -请注意当前的 CPU 利用率是 0%，这是由于我们尚未发送任何请求到服务器 -（``CURRENT`` 列显示了相应 Deployment 所控制的所有 Pod 的平均 CPU 利用率）。 +（如果你看到其他具有不同名称的 HorizontalPodAutoscalers，这意味着它们已经存在，这通常不是问题）。 +请注意当前的 CPU 利用率是 0%，这是由于我们尚未发送任何请求到服务器 +（``TARGET`` 列显示了相应 Deployment 所控制的所有 Pod 的平均 CPU 利用率）。 -Now, we will see how the autoscaler reacts to increased load. -We will start a container, and send an infinite loop of queries to the php-apache service (please run it in a different terminal): + ## 增加负载 {#increase-load} -现在，我们将看到 Autoscaler 如何对增加负载作出反应。 -我们将启动一个容器，并通过一个循环向 php-apache 服务器发送无限的查询请求 -（请在另一个终端中运行以下命令）： +接下来，看看自动扩缩器如何对增加的负载做出反应。 +为此，你将启动一个不同的 Pod 作为客户端。 +客户端 Pod 中的容器在无限循环中运行，向 php-apache 服务发送查询。 + ```shell -kubectl run -i --tty load-generator --rm --image=busybox --restart=Never -- /bin/sh -c "while sleep 0.01; do wget -q -O- http://php-apache; done" +# 在单独的终端中运行它 +# 以便负载生成继续，你可以继续执行其余步骤 +kubectl run -i --tty load-generator --rm --image=busybox:1.28 --restart=Never -- /bin/sh -c "while sleep 0.01; do wget -q -O- http://php-apache; done" ``` -一分钟时间左右之后，通过以下命令，我们可以看到 CPU 负载升高了： +Now run: +Within a minute or so, you should see the higher CPU load; for example: +--> +现在执行： + + ```shell -kubectl get hpa +# 准备好后按 Ctrl+C 结束观察 +kubectl get hpa php-apache --watch ``` +一分钟时间左右之后，通过以下命令，我们可以看到 CPU 负载升高了；例如： + ``` NAME REFERENCE TARGET MINPODS MAXPODS REPLICAS AGE php-apache Deployment/php-apache/scale 305% / 50% 1 10 1 3m ``` + +然后，更多的副本被创建。例如： + +``` +NAME REFERENCE TARGET MINPODS MAXPODS REPLICAS AGE +php-apache Deployment/php-apache/scale 305% / 50% 1 10 7 3m +``` + +你应该会看到与 HorizontalPodAutoscaler 中的数字与副本数匹配 + ``` NAME READY UP-TO-DATE AVAILABLE AGE php-apache 7/7 7 7 19m @@ -238,32 +320,40 @@ will differ from this example. {{< /note >}} -## 停止负载 +## 停止产生负载 {#stop-load} -我们将通过停止负载来结束我们的示例。 +要完成该示例，请停止发送负载。 -在我们创建 busybox 容器的终端中，输入` + C` 来终止负载的产生。 +在我们创建 `busybox` 容器的终端中，输入 ` + C` 来终止负载的产生。 -然后我们可以再次检查负载状态（等待几分钟时间）： +然后验证结果状态（大约一分钟后）： + ```shell -kubectl get hpa +# 准备好后按 Ctrl+C 结束观察 +kubectl get hpa php-apache --watch ``` + +输出类似于： + ``` NAME REFERENCE TARGET MINPODS MAXPODS REPLICAS AGE php-apache Deployment/php-apache/scale 0% / 50% 1 10 1 11m ``` + +Deployment 也显示它已经缩小了： + ```shell kubectl get deployment php-apache ``` @@ -274,16 +364,14 @@ php-apache 1/1 1 1 27m ``` -这时，CPU 利用率已经降到 0，所以 HPA 将自动缩减副本数量至 1。 +一旦 CPU 利用率降至 0，HPA 会自动将副本数缩减为 1。 -{{< note >}} 自动扩缩完成副本数量的改变可能需要几分钟的时间。 -{{< /note >}} @@ -291,17 +379,17 @@ Autoscaling the replicas may take a few minutes. ## Autoscaling on multiple metrics and custom metrics You can introduce additional metrics to use when autoscaling the `php-apache` Deployment -by making use of the `autoscaling/v2beta2` API version. +by making use of the `autoscaling/v2` API version. --> ## 基于多项度量指标和自定义度量指标自动扩缩 {#autoscaling-on-multiple-metrics-and-custom-metrics} -利用 `autoscaling/v2beta2` API 版本，你可以在自动扩缩 php-apache 这个 +利用 `autoscaling/v2` API 版本，你可以在自动扩缩 php-apache 这个 Deployment 时使用其他度量指标。 -首先，将 HorizontalPodAutoscaler 的 YAML 文件改为 `autoscaling/v2beta2` 格式： +首先，将 HorizontalPodAutoscaler 的 YAML 文件改为 `autoscaling/v2` 格式： ```shell kubectl get hpa php-apache -o yaml > /tmp/hpa-v2.yaml @@ -313,7 +401,7 @@ Open the `/tmp/hpa-v2.yaml` file in an editor, and you should see YAML which loo 在编辑器中打开 `/tmp/hpa-v2.yaml`： ```yaml -apiVersion: autoscaling/v2beta2 +apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: name: php-apache @@ -376,13 +464,13 @@ advanced cluster monitoring setup. 这些度量指标可能具有特定于集群的名称，并且需要更高级的集群监控设置。 -第一种可选的度量指标类型是 Pod 度量指标。这些指标从某一方面描述了 Pod， +第一种可选的度量指标类型是 **Pod 度量指标**。这些指标从某一方面描述了 Pod， 在不同 Pod 之间进行平均，并通过与一个目标值比对来确定副本的数量。 -它们的工作方式与资源度量指标非常相像，只是它们仅支持 `target` 类型为 `AverageValue`。 +它们的工作方式与资源度量指标非常相像，只是它们 **仅** 支持 `target` 类型为 `AverageValue`。 -第二种可选的度量指标类型是对象（Object）度量指标。这些度量指标用于描述 +第二种可选的度量指标类型是对象 **（Object）度量指标**。这些度量指标用于描述 在相同名字空间中的别的对象，而非 Pods。 请注意这些度量指标不一定来自某对象，它们仅用于描述这些对象。 对象度量指标支持的 `target` 类型包括 `Value` 和 `AverageValue`。 @@ -447,7 +535,7 @@ you could update the definition above using `kubectl edit` to look like this: 将上述 Horizontal Pod Autoscaler 的定义更改为： ```yaml -apiVersion: autoscaling/v2beta1 +apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: name: php-apache @@ -463,7 +551,7 @@ spec: resource: name: cpu target: - type: AverageUtilization + type: Utilization averageUtilization: 50 - type: Pods pods: @@ -477,11 +565,11 @@ spec: metric: name: requests-per-second describedObject: - apiVersion: networking.k8s.io/v1beta1 + apiVersion: networking.k8s.io/v1 kind: Ingress name: main-route target: - kind: Value + type: Value value: 10k status: observedGeneration: 1 @@ -500,7 +588,7 @@ status: metric: name: requests-per-second describedObject: - apiVersion: networking.k8s.io/v1beta1 + apiVersion: networking.k8s.io/v1 kind: Ingress name: main-route current: @@ -537,8 +625,8 @@ GET 请求执行： type: Object object: metric: - name: `http_requests` - selector: `verb=GET` + name: http_requests + selector: {matchLabels: {verb: GET}} ``` ## 附录：Horizontal Pod Autoscaler 状态条件 -使用 `autoscaling/v2beta2` 格式的 HorizontalPodAutoscaler 时，你将可以看到 +使用 `autoscaling/v2` 格式的 HorizontalPodAutoscaler 时，你将可以看到 Kubernetes 为 HorizongtalPodAutoscaler 设置的状态条件（Status Conditions）。 这些状态条件可以显示当前 HorizontalPodAutoscaler 是否能够执行扩缩以及是否受到一定的限制。 @@ -662,7 +750,7 @@ Events: ``` -## 附录：量纲 {#appendix-quantities} +## 量纲 {#quantities} HorizontalPodAutoscaler 和 度量指标 API 中的所有的度量指标使用 Kubernetes 中称为 {{< glossary_tooltip term_id="quantity" text="量纲（Quantity）">}} @@ -701,24 +789,24 @@ HorizontalPodAutoscaler 和 度量指标 API 中的所有的度量指标使用 K 这意味着你可能会看到你的度量指标在 `1` 和 `1500m` （也就是在十进制记数法中的 `1` 和 `1.5`）之间波动。 -## 附录：其他可能的情况 {#appendix-other-possible-scenarios} +## 其他可能的情况 {#other-possible-scenarios} ### 以声明式方式创建 Autoscaler {#creating-the-autoscaler-declaratively} -除了使用 `kubectl autoscale` 命令，也可以文件创建 HorizontalPodAutoscaler： +除了使用 `kubectl autoscale` 命令，也可以使用以下清单以声明方式创建 HorizontalPodAutoscaler： {{< codenew file="application/hpa/php-apache.yaml" >}} 使用如下命令创建 autoscaler： From 0322a37d80bc7e5e1b4e1a77cc38ee474fc6a4a1 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Thu, 14 Apr 2022 17:44:25 +0100 Subject: [PATCH 033/763] Update Romana details - omit it as an example from CNI-Genie - update the hyperlink --- content/en/docs/concepts/cluster-administration/addons.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/content/en/docs/concepts/cluster-administration/addons.md b/content/en/docs/concepts/cluster-administration/addons.md index 20626f2ff4..3e9cd31643 100644 --- a/content/en/docs/concepts/cluster-administration/addons.md +++ b/content/en/docs/concepts/cluster-administration/addons.md @@ -20,8 +20,7 @@ This page lists some of the available add-ons and links to their respective inst * [Calico](https://docs.projectcalico.org/latest/introduction/) is a networking and network policy provider. Calico supports a flexible set of networking options so you can choose the most efficient option for your situation, including non-overlay and overlay networks, with or without BGP. Calico uses the same engine to enforce network policy for hosts, pods, and (if using Istio & Envoy) applications at the service mesh layer. * [Canal](https://github.com/tigera/canal/tree/master/k8s-install) unites Flannel and Calico, providing networking and network policy. * [Cilium](https://github.com/cilium/cilium) is a L3 network and network policy plugin that can enforce HTTP/API/L7 policies transparently. Both routing and overlay/encapsulation mode are supported, and it can work on top of other CNI plugins. -* [CNI-Genie](https://github.com/Huawei-PaaS/CNI-Genie) enables Kubernetes to seamlessly connect to a choice of CNI plugins, such as Calico, Canal, Flannel, Romana, or Weave. -* [Contiv](https://contivpp.io/) provides configurable networking (native L3 using BGP, overlay using vxlan, classic L2, and Cisco-SDN/ACI) for various use cases and a rich policy framework. Contiv project is fully [open sourced](https://github.com/contiv). The [installer](https://github.com/contiv/install) provides both kubeadm and non-kubeadm based installation options. +* [CNI-Genie](https://github.com/Huawei-PaaS/CNI-Genie) enables Kubernetes to seamlessly connect to a choice of CNI plugins, such as Calico, Canal, Flannel, or Weave. * [Contrail](https://www.juniper.net/us/en/products-services/sdn/contrail/contrail-networking/), based on [Tungsten Fabric](https://tungsten.io), is an open source, multi-cloud network virtualization and policy management platform. Contrail and Tungsten Fabric are integrated with orchestration systems such as Kubernetes, OpenShift, OpenStack and Mesos, and provide isolation modes for virtual machines, containers/pods and bare metal workloads. * [Flannel](https://github.com/flannel-io/flannel#deploying-flannel-manually) is an overlay network provider that can be used with Kubernetes. * [Knitter](https://github.com/ZTE/Knitter/) is a plugin to support multiple network interfaces in a Kubernetes pod. @@ -30,7 +29,7 @@ This page lists some of the available add-ons and links to their respective inst * [OVN4NFV-K8S-Plugin](https://github.com/opnfv/ovn4nfv-k8s-plugin) is OVN based CNI controller plugin to provide cloud native based Service function chaining(SFC), Multiple OVN overlay networking, dynamic subnet creation, dynamic creation of virtual networks, VLAN Provider network, Direct provider network and pluggable with other Multi-network plugins, ideal for edge based cloud native workloads in Multi-cluster networking * [NSX-T](https://docs.vmware.com/en/VMware-NSX-T/2.0/nsxt_20_ncp_kubernetes.pdf) Container Plug-in (NCP) provides integration between VMware NSX-T and container orchestrators such as Kubernetes, as well as integration between NSX-T and container-based CaaS/PaaS platforms such as Pivotal Container Service (PKS) and OpenShift. * [Nuage](https://github.com/nuagenetworks/nuage-kubernetes/blob/v5.1.1-1/docs/kubernetes-1-installation.rst) is an SDN platform that provides policy-based networking between Kubernetes Pods and non-Kubernetes environments with visibility and security monitoring. -* **Romana** is a Layer 3 networking solution for pod networks that also supports the [NetworkPolicy API](/docs/concepts/services-networking/network-policies/). Kubeadm add-on installation details available [here](https://github.com/romana/romana/tree/master/containerize). +* [Romana](https://github.com/romana) is a Layer 3 networking solution for pod networks that also supports the [NetworkPolicy](/docs/concepts/services-networking/network-policies/) API. * [Weave Net](https://www.weave.works/docs/net/latest/kubernetes/kube-addon/) provides networking and network policy, will carry on working on both sides of a network partition, and does not require an external database. ## Service Discovery From bf0c2cfcf7f55b4571aef80fd6bd8d54330f8b1e Mon Sep 17 00:00:00 2001 From: Joel Gerber Date: Thu, 21 Apr 2022 11:35:46 -0400 Subject: [PATCH 034/763] Fix a minor typo in the 2nd paragraph of overview --- content/en/docs/reference/using-api/api-concepts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/using-api/api-concepts.md b/content/en/docs/reference/using-api/api-concepts.md index 2e4fb85df2..a458cdff2d 100644 --- a/content/en/docs/reference/using-api/api-concepts.md +++ b/content/en/docs/reference/using-api/api-concepts.md @@ -15,7 +15,7 @@ primary resources via the standard HTTP verbs (POST, PUT, PATCH, DELETE, GET). For some resources, the API includes additional subresources that allow -fine grained authorization (such as a separating viewing details for a Pod from +fine grained authorization (such as separating viewing details for a Pod from retrieving its logs), and can accept and serve those resources in different representations for convenience or efficiency. From f22d7fa961b4ac229d83f769f2acf670c542ea53 Mon Sep 17 00:00:00 2001 From: "Mr. Erlison" Date: Thu, 21 Apr 2022 13:32:11 -0300 Subject: [PATCH 035/763] Add content/pt-br/docs/reference/glossary/applications.md --- .../pt-br/docs/reference/glossary/applications.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 content/pt-br/docs/reference/glossary/applications.md diff --git a/content/pt-br/docs/reference/glossary/applications.md b/content/pt-br/docs/reference/glossary/applications.md new file mode 100644 index 0000000000..a00ca0ec6c --- /dev/null +++ b/content/pt-br/docs/reference/glossary/applications.md @@ -0,0 +1,12 @@ +--- +title: Aplicações +id: applications +date: 2019-05-12 +full_link: +short_description: > + A camada onde vários aplicativos em contêiner são executados. +aka: +tags: +- fundamental +--- + A camada onde vários aplicativos em contêiner são executados. From aaeaddba63bcbde54893b87c36c795e73b6d34dd Mon Sep 17 00:00:00 2001 From: "Mr. Erlison" Date: Thu, 21 Apr 2022 13:38:19 -0300 Subject: [PATCH 036/763] Add content/pt-br/docs/reference/glossary/certificate.md --- .../docs/reference/glossary/certificate.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 content/pt-br/docs/reference/glossary/certificate.md diff --git a/content/pt-br/docs/reference/glossary/certificate.md b/content/pt-br/docs/reference/glossary/certificate.md new file mode 100644 index 0000000000..d43ead1f32 --- /dev/null +++ b/content/pt-br/docs/reference/glossary/certificate.md @@ -0,0 +1,17 @@ +--- +title: Certificado +id: certificate +date: 2018-04-12 +full_link: /docs/tasks/tls/managing-tls-in-a-cluster/ +short_description: > + Um arquivo criptograficamente seguro usado para validar o acesso ao cluster Kubernetes. + +aka: +tags: +- security +--- + Um arquivo criptograficamente seguro usado para validar o acesso ao cluster Kubernetes. + + + +Os certificados permitem que aplicativos dentro de um cluster Kubernetes acessem a API do Kubernetes com segurança. Os certificados validam que os clientes têm permissão para acessar a API. \ No newline at end of file From d9043dd29b5920fd4ec91a7c3a733fc538a3de48 Mon Sep 17 00:00:00 2001 From: "Mr. Erlison" Date: Thu, 21 Apr 2022 13:44:17 -0300 Subject: [PATCH 037/763] content/pt-br/docs/reference/glossary/cidr.md --- content/pt-br/docs/reference/glossary/cidr.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 content/pt-br/docs/reference/glossary/cidr.md diff --git a/content/pt-br/docs/reference/glossary/cidr.md b/content/pt-br/docs/reference/glossary/cidr.md new file mode 100644 index 0000000000..3073e6560c --- /dev/null +++ b/content/pt-br/docs/reference/glossary/cidr.md @@ -0,0 +1,17 @@ +--- +title: CIDR +id: cidr +date: 2019-11-12 +full_link: +short_description: > + CIDR é uma notação para descrever blocos de endereços IP e é muito usada em várias configurações de rede. + +aka: +tags: +- networking +--- +CIDR (em inglês - Classless Inter-Domain Routing) é uma notação para descrever blocos de endereços IP e é muito usada em várias configurações de rede. + + + +No contexto do Kubernetes, cada {{< glossary_tooltip text="Nó" term_id="node" >}} recebe um intervalo de endereços IP através do endereço inicial e uma máscara de sub-rede usando CIDR. Isso permite que os Nodes atribuam a cada {{< glossary_tooltip text="Pod" term_id="pod" >}} um endereço IP exclusivo. Embora originalmente seja um conceito para IPv4, o CIDR também foi expandido para incluir IPv6. \ No newline at end of file From 688060dcc9c67f932d8fde43db51213e4d0277f6 Mon Sep 17 00:00:00 2001 From: "Mr. Erlison" Date: Thu, 21 Apr 2022 13:55:23 -0300 Subject: [PATCH 038/763] Add content/pt-br/docs/reference/glossary/cluster-architect.md --- .../reference/glossary/cluster-architect.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 content/pt-br/docs/reference/glossary/cluster-architect.md diff --git a/content/pt-br/docs/reference/glossary/cluster-architect.md b/content/pt-br/docs/reference/glossary/cluster-architect.md new file mode 100644 index 0000000000..3aeb95e084 --- /dev/null +++ b/content/pt-br/docs/reference/glossary/cluster-architect.md @@ -0,0 +1,17 @@ +--- +title: Arquiteto de Cluster +id: cluster-architect +date: 2018-04-12 +full_link: +short_description: > + Uma pessoa que projeta infraestrutura que envolve um ou mais clusters Kubernetes. + +aka: +tags: +- user-type +--- + Uma pessoa que projeta infraestrutura que envolve um ou mais clusters Kubernetes. + + + +Os arquitetos de clusters estão preocupados com as melhores práticas para sistemas distribuídos, por exemplo: alta disponibilidade e segurança. \ No newline at end of file From 317f1e6eb90d7d5f04973cf847eabe90fc2e2e6f Mon Sep 17 00:00:00 2001 From: "Mr. Erlison" Date: Thu, 21 Apr 2022 14:01:13 -0300 Subject: [PATCH 039/763] Add content/pt-br/docs/reference/glossary/volume-plugin.md --- .../docs/reference/glossary/volume-plugin.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 content/pt-br/docs/reference/glossary/volume-plugin.md diff --git a/content/pt-br/docs/reference/glossary/volume-plugin.md b/content/pt-br/docs/reference/glossary/volume-plugin.md new file mode 100644 index 0000000000..1936fdf3f2 --- /dev/null +++ b/content/pt-br/docs/reference/glossary/volume-plugin.md @@ -0,0 +1,18 @@ +--- +title: Plugin de Volume +id: volumeplugin +date: 2018-04-12 +full_link: +short_description: > + Um plugin de volume permite a integração do armazenamento dentro de um Pod. + +aka: +tags: +- core-object +- storage +--- + Um plugin de volume permite a integração do armazenamento dentro de um {{< glossary_tooltip text="Pod" term_id="pod" >}}. + + + +Um plugin de volume permite anexar e montar volumes de armazenamento para uso por um {{< glossary_tooltip text="Pod" term_id="pod" >}}. Os plugins de volume podem estar _dentro_ ou _fora da árvore_. _Na árvore_, os plugins fazem parte do repositório de código Kubernetes e seguem seu ciclo de lançamento. Os plugins _fora da árvore_ são desenvolvidos de forma independente. \ No newline at end of file From cc961533dedd08fd6b7ed5f9e1b30124f39210fe Mon Sep 17 00:00:00 2001 From: "Mr. Erlison" Date: Thu, 21 Apr 2022 14:29:33 -0300 Subject: [PATCH 040/763] Add content/pt-br/docs/reference/glossary/sysctl.md --- .../pt-br/docs/reference/glossary/sysctl.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 content/pt-br/docs/reference/glossary/sysctl.md diff --git a/content/pt-br/docs/reference/glossary/sysctl.md b/content/pt-br/docs/reference/glossary/sysctl.md new file mode 100644 index 0000000000..060c2e2698 --- /dev/null +++ b/content/pt-br/docs/reference/glossary/sysctl.md @@ -0,0 +1,19 @@ +--- +title: sysctl +id: sysctl +date: 2019-02-12 +full_link: /docs/tasks/administer-cluster/sysctl-cluster/ +short_description: > + Uma interface para obter e definir parâmetros do kernel Unix. + +aka: +tags: +- tool +--- + `sysctl` é uma interface semi-padronizada para ler ou alterar os atributos do kernel Unix em execução. + + + +Em sistemas do tipo Unix-like, `sysctl` é tanto o nome da ferramenta que os administradores usam para visualizar e modificar essas configurações, quanto a chamada do sistema que a ferramenta usa. + +Os {{< glossary_tooltip text="Contêiner" term_id="container" >}} em execução e os plugins de rede podem depender dos valores definidos do `sysctl`. \ No newline at end of file From 69a3fc37750e7d72712fcbd09a42dcbb694cc62f Mon Sep 17 00:00:00 2001 From: "Mr. Erlison" Date: Thu, 21 Apr 2022 14:47:45 -0300 Subject: [PATCH 041/763] Add content/pt-br/docs/reference/glossary/reviewer.md --- .../pt-br/docs/reference/glossary/reviewer.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 content/pt-br/docs/reference/glossary/reviewer.md diff --git a/content/pt-br/docs/reference/glossary/reviewer.md b/content/pt-br/docs/reference/glossary/reviewer.md new file mode 100644 index 0000000000..ff367087ee --- /dev/null +++ b/content/pt-br/docs/reference/glossary/reviewer.md @@ -0,0 +1,17 @@ +--- +title: Revisor +id: reviewer +date: 2018-04-12 +full_link: +short_description: > + Uma pessoa que revisa o código quanto à qualidade e correção em alguma parte do projeto. + +aka: +tags: +- community +--- + Uma pessoa que revisa o código quanto à qualidade e correção em alguma parte do projeto. + + + +Os revisores têm conhecimento sobre o código base e os princípios de engenharia de software. O estado do revisor é atribuído a uma parte do código. \ No newline at end of file From 400e10a832ba1cba70b81fafde1f432c44c4d3a9 Mon Sep 17 00:00:00 2001 From: Jihoon Seo Date: Thu, 21 Apr 2022 10:53:28 +0900 Subject: [PATCH 042/763] Update Hugo version --- Dockerfile | 4 ++-- netlify.toml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index a45fa4f0ac..fecd5b0503 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ # change is that the Hugo version is now an overridable argument rather than a fixed # environment variable. -FROM golang:1.16-alpine +FROM golang:1.18-alpine LABEL maintainer="Luc Perkins " @@ -24,7 +24,7 @@ RUN mkdir $HOME/src && \ cd "hugo-${HUGO_VERSION}" && \ go install --tags extended -FROM golang:1.16-alpine +FROM golang:1.18-alpine RUN apk add --no-cache \ runuser \ diff --git a/netlify.toml b/netlify.toml index 0aee361f39..dc4b3e7042 100644 --- a/netlify.toml +++ b/netlify.toml @@ -8,7 +8,7 @@ command = "git submodule update --init --recursive --depth 1 && make non-product [build.environment] NODE_VERSION = "10.20.0" -HUGO_VERSION = "0.87.0" +HUGO_VERSION = "0.97.0" RUBY_VERSION = "3.0.1" [context.production.environment] From f3adb2cd66aea0aed3d5d78f90da46409bac0ffb Mon Sep 17 00:00:00 2001 From: Joel Gerber Date: Fri, 22 Apr 2022 07:06:31 -0400 Subject: [PATCH 043/763] Update content/en/docs/reference/using-api/api-concepts.md Co-authored-by: divya-mohan0209 --- content/en/docs/reference/using-api/api-concepts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/using-api/api-concepts.md b/content/en/docs/reference/using-api/api-concepts.md index a458cdff2d..a7a8f1d059 100644 --- a/content/en/docs/reference/using-api/api-concepts.md +++ b/content/en/docs/reference/using-api/api-concepts.md @@ -15,7 +15,7 @@ primary resources via the standard HTTP verbs (POST, PUT, PATCH, DELETE, GET). For some resources, the API includes additional subresources that allow -fine grained authorization (such as separating viewing details for a Pod from +fine grained authorization (such as separate viewing details for a Pod from retrieving its logs), and can accept and serve those resources in different representations for convenience or efficiency. From 89b0b1bf8f72ab16fbdd3ad82ff9679d25b40d11 Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Sat, 23 Apr 2022 14:30:14 +0800 Subject: [PATCH 044/763] Move kubelet authentication/authorization out of CLI reference dir The `kubelet-authentication-authorization` and the `kubelet-tls-bootstrapping` pages do not belong to `reference/command-line-tools-reference` topic. This PR moves them into `reference/access-authn-authz` subdirectory which is a better fit. The `static/_redirects` file is updated to point to the new location. --- content/en/docs/reference/access-authn-authz/_index.md | 2 ++ .../kubelet-authn-authz.md} | 0 .../kubelet-tls-bootstrapping.md | 0 static/_redirects | 6 +++--- 4 files changed, 5 insertions(+), 3 deletions(-) rename content/en/docs/reference/{command-line-tools-reference/kubelet-authentication-authorization.md => access-authn-authz/kubelet-authn-authz.md} (100%) rename content/en/docs/reference/{command-line-tools-reference => access-authn-authz}/kubelet-tls-bootstrapping.md (100%) diff --git a/content/en/docs/reference/access-authn-authz/_index.md b/content/en/docs/reference/access-authn-authz/_index.md index 86d06488a8..3677f79c57 100644 --- a/content/en/docs/reference/access-authn-authz/_index.md +++ b/content/en/docs/reference/access-authn-authz/_index.md @@ -24,3 +24,5 @@ Reference documentation: - Service accounts - [Developer guide](/docs/tasks/configure-pod-container/configure-service-account/) - [Administration](/docs/reference/access-authn-authz/service-accounts-admin/) +- [Kubelet Authentication & Authorization](/docs/reference/access-authn-authz/kubelet-authn-authz/) + - including kubelet [TLS bootstrapping](/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/) diff --git a/content/en/docs/reference/command-line-tools-reference/kubelet-authentication-authorization.md b/content/en/docs/reference/access-authn-authz/kubelet-authn-authz.md similarity index 100% rename from content/en/docs/reference/command-line-tools-reference/kubelet-authentication-authorization.md rename to content/en/docs/reference/access-authn-authz/kubelet-authn-authz.md diff --git a/content/en/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping.md b/content/en/docs/reference/access-authn-authz/kubelet-tls-bootstrapping.md similarity index 100% rename from content/en/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping.md rename to content/en/docs/reference/access-authn-authz/kubelet-tls-bootstrapping.md diff --git a/static/_redirects b/static/_redirects index bb17b4d01a..c0feadd2bd 100644 --- a/static/_redirects +++ b/static/_redirects @@ -41,8 +41,8 @@ /docs/admin/ha-master-gce/ /docs/setup/production-environment/#production-control-plane 301 /docs/admin/ha-master-gce.md/ /docs/setup/production-environment/#production-control-plane 301 /docs/admin/high-availability/ /docs/setup/production-environment/tools/kubeadm/high-availability/ 301 -/docs/admin/kubelet-authentication-authorization/ /docs/reference/command-line-tools-reference/kubelet-authentication-authorization/ 301 -/docs/admin/kubelet-tls-bootstrapping/ /docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/ 301 +/docs/admin/kubelet-authentication-authorization/ /docs/reference/access-authn-authz/kubelet-authn-authz/ 301 +/docs/admin/kubelet-tls-bootstrapping/ /docs/reference/access-authn-authz/kubelet-tls-bootstrapping/ 301 /docs/admin/limitrange/ /docs/tasks/administer-cluster/cpu-memory-limit/ 301 /docs/admin/limitrange/Limits/ /docs/tasks/administer-cluster/limit-storage-consumption/#limitrange-to-limit-requests-for-storage/ 301 /docs/admin/master-node-communication/ /docs/concepts/architecture/master-node-communication/ 301 @@ -250,7 +250,7 @@ /docs/tasks/administer-cluster/apply-resource-quota-limit/ /docs/tasks/administer-cluster/quota-api-object/ 301 /docs/tasks/administer-cluster/assign-pods-nodes/ /docs/tasks/configure-pod-container/assign-pods-nodes/ 301 /docs/tasks/administer-cluster/calico-network-policy/ /docs/tasks/administer-cluster/network-policy-provider/calico-network-policy/ 301 -/docs/tasks/administer-cluster/certificate-rotation/ /docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/ 301 +/docs/tasks/administer-cluster/certificate-rotation/ /docs/reference/access-authn-authz/kubelet-tls-bootstrapping/ 301 /docs/tasks/administer-cluster/cilium-network-policy/ /docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy/ 301 /docs/tasks/administer-cluster/configure-namespace-isolation/ /docs/concepts/services-networking/network-policies/ 301 /docs/tasks/administer-cluster/configure-multiple-schedulers/ /docs/tasks/extend-kubernetes/configure-multiple-schedulers/ 301 From a3ea9f4caf30794129ff790dced758701b0332ed Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Sat, 23 Apr 2022 14:32:19 +0800 Subject: [PATCH 045/763] Update references to the kubelet security files This commit updates all the existing references to the files move in the previous commit. --- .../architecture/control-plane-node-communication.md | 4 ++-- .../en/docs/concepts/cluster-administration/_index.md | 4 ++-- .../reference/access-authn-authz/bootstrap-tokens.md | 2 +- content/en/docs/reference/access-authn-authz/node.md | 2 +- content/en/docs/reference/access-authn-authz/rbac.md | 2 +- .../command-line-tools-reference/feature-gates.md | 4 ++-- .../setup-tools/kubeadm/implementation-details.md | 4 ++-- .../reference/setup-tools/kubeadm/kubeadm-init.md | 2 +- content/en/docs/setup/best-practices/certificates.md | 2 +- .../tasks/administer-cluster/kubeadm/kubeadm-certs.md | 2 +- .../tasks/administer-cluster/securing-a-cluster.md | 11 ++++------- content/en/docs/tasks/tls/certificate-rotation.md | 2 +- 12 files changed, 19 insertions(+), 22 deletions(-) diff --git a/content/en/docs/concepts/architecture/control-plane-node-communication.md b/content/en/docs/concepts/architecture/control-plane-node-communication.md index a4814aab4b..e2004f146c 100644 --- a/content/en/docs/concepts/architecture/control-plane-node-communication.md +++ b/content/en/docs/concepts/architecture/control-plane-node-communication.md @@ -21,7 +21,7 @@ This document catalogs the communication paths between the control plane (apiser Kubernetes has a "hub-and-spoke" API pattern. All API usage from nodes (or the pods they run) terminates at the apiserver. None of the other control plane components are designed to expose remote services. The apiserver is configured to listen for remote connections on a secure HTTPS port (typically 443) with one or more forms of client [authentication](/docs/reference/access-authn-authz/authentication/) enabled. One or more forms of [authorization](/docs/reference/access-authn-authz/authorization/) should be enabled, especially if [anonymous requests](/docs/reference/access-authn-authz/authentication/#anonymous-requests) or [service account tokens](/docs/reference/access-authn-authz/authentication/#service-account-tokens) are allowed. -Nodes should be provisioned with the public root certificate for the cluster such that they can connect securely to the apiserver along with valid client credentials. A good approach is that the client credentials provided to the kubelet are in the form of a client certificate. See [kubelet TLS bootstrapping](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/) for automated provisioning of kubelet client certificates. +Nodes should be provisioned with the public root certificate for the cluster such that they can connect securely to the apiserver along with valid client credentials. A good approach is that the client credentials provided to the kubelet are in the form of a client certificate. See [kubelet TLS bootstrapping](/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/) for automated provisioning of kubelet client certificates. Pods that wish to connect to the apiserver can do so securely by leveraging a service account so that Kubernetes will automatically inject the public root certificate and a valid bearer token into the pod when it is instantiated. The `kubernetes` service (in `default` namespace) is configured with a virtual IP address that is redirected (via kube-proxy) to the HTTPS endpoint on the apiserver. @@ -49,7 +49,7 @@ To verify this connection, use the `--kubelet-certificate-authority` flag to pro If that is not possible, use [SSH tunneling](#ssh-tunnels) between the apiserver and kubelet if required to avoid connecting over an untrusted or public network. -Finally, [Kubelet authentication and/or authorization](/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/) should be enabled to secure the kubelet API. +Finally, [Kubelet authentication and/or authorization](/docs/reference/access-authn-authz/kubelet-authn-authz/) should be enabled to secure the kubelet API. ### apiserver to nodes, pods, and services diff --git a/content/en/docs/concepts/cluster-administration/_index.md b/content/en/docs/concepts/cluster-administration/_index.md index 7d5aec5078..d8bb3e361b 100644 --- a/content/en/docs/concepts/cluster-administration/_index.md +++ b/content/en/docs/concepts/cluster-administration/_index.md @@ -63,8 +63,8 @@ Before choosing a guide, here are some considerations: ### Securing the kubelet * [Control Plane-Node communication](/docs/concepts/architecture/control-plane-node-communication/) - * [TLS bootstrapping](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/) - * [Kubelet authentication/authorization](/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/) + * [TLS bootstrapping](/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/) + * [Kubelet authentication/authorization](/docs/reference/acess-authn-authz/kubelet-authn-authz/) ## Optional Cluster Services diff --git a/content/en/docs/reference/access-authn-authz/bootstrap-tokens.md b/content/en/docs/reference/access-authn-authz/bootstrap-tokens.md index 7e743be63d..f9a6481798 100644 --- a/content/en/docs/reference/access-authn-authz/bootstrap-tokens.md +++ b/content/en/docs/reference/access-authn-authz/bootstrap-tokens.md @@ -15,7 +15,7 @@ creating new clusters or joining new nodes to an existing cluster. It was built to support [kubeadm](/docs/reference/setup-tools/kubeadm/), but can be used in other contexts for users that wish to start clusters without `kubeadm`. It is also built to work, via RBAC policy, with the -[Kubelet TLS Bootstrapping](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/) system. +[Kubelet TLS Bootstrapping](/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/) system. diff --git a/content/en/docs/reference/access-authn-authz/node.md b/content/en/docs/reference/access-authn-authz/node.md index 6e7c538eb0..bc9863219f 100644 --- a/content/en/docs/reference/access-authn-authz/node.md +++ b/content/en/docs/reference/access-authn-authz/node.md @@ -43,7 +43,7 @@ have the minimal set of permissions required to operate correctly. In order to be authorized by the Node authorizer, kubelets must use a credential that identifies them as being in the `system:nodes` group, with a username of `system:node:`. This group and user name format match the identity created for each kubelet as part of -[kubelet TLS bootstrapping](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/). +[kubelet TLS bootstrapping](/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/). The value of `` **must** match precisely the name of the node as registered by the kubelet. By default, this is the host name as provided by `hostname`, or overridden via the [kubelet option](/docs/reference/command-line-tools-reference/kubelet/) `--hostname-override`. However, when using the `--cloud-provider` kubelet option, the specific hostname may be determined by the cloud provider, ignoring the local `hostname` and the `--hostname-override` option. For specifics about how the kubelet determines the hostname, see the [kubelet options reference](/docs/reference/command-line-tools-reference/kubelet/). diff --git a/content/en/docs/reference/access-authn-authz/rbac.md b/content/en/docs/reference/access-authn-authz/rbac.md index 57a074a29a..d085251e43 100644 --- a/content/en/docs/reference/access-authn-authz/rbac.md +++ b/content/en/docs/reference/access-authn-authz/rbac.md @@ -798,7 +798,7 @@ This is commonly used by add-on API servers for unified authentication and autho system:node-bootstrapper None Allows access to the resources required to perform -kubelet TLS bootstrapping. +kubelet TLS bootstrapping. system:node-problem-detector diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index f6dbbb97a8..63e1f8fee1 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -1028,10 +1028,10 @@ Each feature gate is designed for enabling/disabling a specific feature: [Bound Service Account Tokens](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/1205-bound-service-account-tokens/README.md) for more details. - `RotateKubeletClientCertificate`: Enable the rotation of the client TLS certificate on the kubelet. - See [kubelet configuration](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#kubelet-configuration) + See [kubelet configuration](/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/#kubelet-configuration) for more details. - `RotateKubeletServerCertificate`: Enable the rotation of the server TLS certificate on the kubelet. - See [kubelet configuration](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#kubelet-configuration) + See [kubelet configuration](/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/#kubelet-configuration) for more details. - `RunAsGroup`: Enable control over the primary group ID set on the init processes of containers. diff --git a/content/en/docs/reference/setup-tools/kubeadm/implementation-details.md b/content/en/docs/reference/setup-tools/kubeadm/implementation-details.md index 137a9bcd04..bd35ce5002 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/implementation-details.md +++ b/content/en/docs/reference/setup-tools/kubeadm/implementation-details.md @@ -224,7 +224,7 @@ Other API server flags that are set unconditionally are: - `--insecure-port=0` to avoid insecure connections to the api server - `--enable-bootstrap-token-auth=true` to enable the `BootstrapTokenAuthenticator` authentication module. - See [TLS Bootstrapping](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/) for more details + See [TLS Bootstrapping](/docs/reference/access-authn-authn/kubelet-tls-bootstrapping/) for more details - `--allow-privileged` to `true` (required e.g. by kube proxy) - `--requestheader-client-ca-file` to `front-proxy-ca.crt` - `--enable-admission-plugins` to: @@ -271,7 +271,7 @@ The static Pod manifest for the controller manager is affected by following para Other flags that are set unconditionally are: - `--controllers` enabling all the default controllers plus `BootstrapSigner` and `TokenCleaner` controllers for TLS bootstrap. - See [TLS Bootstrapping](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/) for more details + See [TLS Bootstrapping](/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/) for more details - `--use-service-account-credentials` to `true` - Flags for using certificates generated in previous steps: - `--root-ca-file` to `ca.crt` diff --git a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init.md b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init.md index a8d514ad14..90de85660b 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init.md +++ b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init.md @@ -52,7 +52,7 @@ following steps: 1. Makes all the necessary configurations for allowing node joining with the [Bootstrap Tokens](/docs/reference/access-authn-authz/bootstrap-tokens/) and - [TLS Bootstrap](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/) + [TLS Bootstrap](/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/) mechanism: - Write a ConfigMap for making available all the information required diff --git a/content/en/docs/setup/best-practices/certificates.md b/content/en/docs/setup/best-practices/certificates.md index 6d6d576c39..23e4ac8df7 100644 --- a/content/en/docs/setup/best-practices/certificates.md +++ b/content/en/docs/setup/best-practices/certificates.md @@ -22,7 +22,7 @@ This page explains the certificates that your cluster requires. Kubernetes requires PKI for the following operations: * Client certificates for the kubelet to authenticate to the API server -* Kubelet [server certificates](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#client-and-serving-certificates) +* Kubelet [server certificates](/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/#client-and-serving-certificates) for the API server to talk to the kubelets * Server certificate for the API server endpoint * Client certificates for administrators of the cluster to authenticate to the API server diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md index 696a69ba82..f846f3c32d 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md @@ -276,7 +276,7 @@ By default, these serving certificate will expire after one year. Kubeadm sets t `KubeletConfiguration` field `rotateCertificates` to `true`, which means that close to expiration a new set of CSRs for the serving certificates will be created and must be approved to complete the rotation. To understand more see -[Certificate Rotation](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#certificate-rotation). +[Certificate Rotation](/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/#certificate-rotation). If you are looking for a solution for automatic approval of these CSRs it is recommended that you contact your cloud provider and ask if they have a CSR signer that verifies diff --git a/content/en/docs/tasks/administer-cluster/securing-a-cluster.md b/content/en/docs/tasks/administer-cluster/securing-a-cluster.md index cc463a86c6..5e0202ac0d 100644 --- a/content/en/docs/tasks/administer-cluster/securing-a-cluster.md +++ b/content/en/docs/tasks/administer-cluster/securing-a-cluster.md @@ -13,15 +13,10 @@ content_type: task This document covers topics related to protecting a cluster from accidental or malicious access and provides recommendations on overall security. - - ## {{% heading "prerequisites" %}} - * {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} - - ## Controlling access to the Kubernetes API @@ -77,11 +72,13 @@ Consult the [authorization reference section](/docs/reference/access-authn-authz ## Controlling access to the Kubelet -Kubelets expose HTTPS endpoints which grant powerful control over the node and containers. By default Kubelets allow unauthenticated access to this API. +Kubelets expose HTTPS endpoints which grant powerful control over the node and containers. +By default Kubelets allow unauthenticated access to this API. Production clusters should enable Kubelet authentication and authorization. -Consult the [Kubelet authentication/authorization reference](/docs/reference/command-line-tools-reference/kubelet-authentication-authorization) for more information. +Consult the [Kubelet authentication/authorization reference](/docs/reference/access-authn-authz/kubelet-authn-authz/) +for more information. ## Controlling the capabilities of a workload or user at runtime diff --git a/content/en/docs/tasks/tls/certificate-rotation.md b/content/en/docs/tasks/tls/certificate-rotation.md index 2db0c1255d..8d1992845c 100644 --- a/content/en/docs/tasks/tls/certificate-rotation.md +++ b/content/en/docs/tasks/tls/certificate-rotation.md @@ -28,7 +28,7 @@ default, these certificates are issued with one year expiration so that they do not need to be renewed too frequently. Kubernetes contains [kubelet certificate -rotation](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/), +rotation](/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/), that will automatically generate a new key and request a new certificate from the Kubernetes API as the current certificate approaches expiration. Once the new certificate is available, it will be used for authenticating connections to From 3bc5af67f9243cf6f982a241c9aca6d1088f481e Mon Sep 17 00:00:00 2001 From: Mitesh Jain <47820816+miteshskj@users.noreply.github.com> Date: Sat, 23 Apr 2022 19:29:16 +0530 Subject: [PATCH 046/763] Remove repeated, confusing information about cgroupfs. --- .../administer-cluster/kubeadm/configure-cgroup-driver.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver.md b/content/en/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver.md index 31a9ff0e33..cacfcc281c 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver.md @@ -68,9 +68,7 @@ and passing it to the local node kubelet. ## Using the `cgroupfs` driver -As this guide explains using the `cgroupfs` driver with kubeadm is not recommended. - -To continue using `cgroupfs` and to prevent `kubeadm upgrade` from modifying the +To use `cgroupfs` and to prevent `kubeadm upgrade` from modifying the `KubeletConfiguration` cgroup driver on existing setups, you must be explicit about its value. This applies to a case where you do not wish future versions of kubeadm to apply the `systemd` driver by default. From c3566e471d149118a94a29fbf422a358c0b64025 Mon Sep 17 00:00:00 2001 From: "Mr. Erlison" Date: Sat, 23 Apr 2022 12:34:14 -0300 Subject: [PATCH 047/763] Add pt-br/docs/reference/glossary/application-developer.md --- .../reference/glossary/application-developer.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 content/pt-br/docs/reference/glossary/application-developer.md diff --git a/content/pt-br/docs/reference/glossary/application-developer.md b/content/pt-br/docs/reference/glossary/application-developer.md new file mode 100644 index 0000000000..037a9413ad --- /dev/null +++ b/content/pt-br/docs/reference/glossary/application-developer.md @@ -0,0 +1,17 @@ +--- +title: Desenvolvedor de Aplicativos +id: application-developer +date: 2018-04-12 +full_link: +short_description: > + Uma pessoa que escreve um aplicativo que é executado em um cluster Kubernetes. + +aka: +tags: +- user-type +--- + Uma pessoa que escreve um aplicativo que é executado em um cluster Kubernetes. + + + +Um desenvolvedor de aplicativos se concentra em uma parte da aplicação. O seu foco pode variar significativamente em tamanho. From ebdae18bd1b88a2cbbe114601a45c48cb1a59196 Mon Sep 17 00:00:00 2001 From: "Mr. Erlison" Date: Sat, 23 Apr 2022 12:39:15 -0300 Subject: [PATCH 048/763] Add pt-br/docs/reference/glossary/data-plane.md --- content/pt-br/docs/reference/glossary/data-plane.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 content/pt-br/docs/reference/glossary/data-plane.md diff --git a/content/pt-br/docs/reference/glossary/data-plane.md b/content/pt-br/docs/reference/glossary/data-plane.md new file mode 100644 index 0000000000..2e7c9946f9 --- /dev/null +++ b/content/pt-br/docs/reference/glossary/data-plane.md @@ -0,0 +1,13 @@ +--- +title: Plano de Dados +id: data-plane +date: 2019-05-12 +full_link: +short_description: > + A camada que fornece capacidade, tais como CPU, memória, rede e armazenamento, para que os contêineres possam ser executados e conectados a uma rede. + +aka: +tags: +- fundamental +--- + A camada que fornece capacidade, tais como CPU, memória, rede e armazenamento, para que os contêineres possam ser executados e conectados a uma rede. From 2725b2aef83acce01e2bece36ff71900ab83971e Mon Sep 17 00:00:00 2001 From: "Mr. Erlison" Date: Sat, 23 Apr 2022 12:54:42 -0300 Subject: [PATCH 049/763] pt-br/docs/reference/glossary/ingress.md --- .../pt-br/docs/reference/glossary/ingress.md | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 content/pt-br/docs/reference/glossary/ingress.md diff --git a/content/pt-br/docs/reference/glossary/ingress.md b/content/pt-br/docs/reference/glossary/ingress.md new file mode 100644 index 0000000000..202752a919 --- /dev/null +++ b/content/pt-br/docs/reference/glossary/ingress.md @@ -0,0 +1,20 @@ +--- +title: Ingress +id: ingress +date: 2018-04-12 +full_link: /docs/concepts/services-networking/ingress/ +short_description: > + Um objeto API que gerencia o acesso externo aos serviços em um cluster, normalmente HTTP. + +aka: +tags: +- networking +- architecture +- extension +--- + Um objeto API que gerencia o acesso externo aos serviços em um cluster, normalmente HTTP. + + + +Ingress may provide load balancing, SSL termination and name-based virtual hosting. +O Ingress pode fornecer um balanceamento de carga, descriptografia SSL e hospedagem virtual baseada em nome. From 258499fedd11ffb6742872e8a411e3b58e52c4dc Mon Sep 17 00:00:00 2001 From: "Mr. Erlison" Date: Sat, 23 Apr 2022 12:58:10 -0300 Subject: [PATCH 050/763] Update term API and remove english sentence --- content/pt-br/docs/reference/glossary/ingress.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/pt-br/docs/reference/glossary/ingress.md b/content/pt-br/docs/reference/glossary/ingress.md index 202752a919..5f999e9541 100644 --- a/content/pt-br/docs/reference/glossary/ingress.md +++ b/content/pt-br/docs/reference/glossary/ingress.md @@ -12,9 +12,8 @@ tags: - architecture - extension --- - Um objeto API que gerencia o acesso externo aos serviços em um cluster, normalmente HTTP. + Um objeto API (do inglês "Application Programming Interface") que gerencia o acesso externo aos serviços em um cluster, normalmente HTTP. -Ingress may provide load balancing, SSL termination and name-based virtual hosting. O Ingress pode fornecer um balanceamento de carga, descriptografia SSL e hospedagem virtual baseada em nome. From 694b4db53d7b585d0617ef6777c85b8d499d86ff Mon Sep 17 00:00:00 2001 From: Alastair Firth Date: Mon, 25 Apr 2022 11:35:11 +0200 Subject: [PATCH 051/763] Update resource-quotas.md This line is about 6 years old and has been implemented for some time ;) https://github.com/kubernetes/website/blame/30e536f6100b4c6a0cebe8b0bab7ebb68fee5cf1~1/docs/admin/resourcequota/index.md#L19 https://kubernetes.slack.com/archives/C8WRR2BB9/p1635968976005100 --- content/en/docs/concepts/policy/resource-quotas.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/en/docs/concepts/policy/resource-quotas.md b/content/en/docs/concepts/policy/resource-quotas.md index d31efd09bc..9e2e904f3d 100644 --- a/content/en/docs/concepts/policy/resource-quotas.md +++ b/content/en/docs/concepts/policy/resource-quotas.md @@ -22,8 +22,7 @@ be consumed by resources in that namespace. Resource quotas work like this: -- Different teams work in different namespaces. Currently this is voluntary, but - support for making this mandatory via ACLs is planned. +- Different teams work in different namespaces. This can be enforced with [RBAC](/docs/reference/access-authn-authz/rbac/). - The administrator creates one ResourceQuota for each namespace. From c00146a3a67c216524998a7fa3c2761eba28ab86 Mon Sep 17 00:00:00 2001 From: Joel Gerber Date: Mon, 25 Apr 2022 07:41:33 -0400 Subject: [PATCH 052/763] Update content/en/docs/reference/using-api/api-concepts.md Co-authored-by: divya-mohan0209 --- content/en/docs/reference/using-api/api-concepts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/using-api/api-concepts.md b/content/en/docs/reference/using-api/api-concepts.md index a7a8f1d059..f31bfaff40 100644 --- a/content/en/docs/reference/using-api/api-concepts.md +++ b/content/en/docs/reference/using-api/api-concepts.md @@ -15,7 +15,7 @@ primary resources via the standard HTTP verbs (POST, PUT, PATCH, DELETE, GET). For some resources, the API includes additional subresources that allow -fine grained authorization (such as separate viewing details for a Pod from +fine grained authorization (such as separate views for Pod details and retrieving its logs), and can accept and serve those resources in different representations for convenience or efficiency. From 47be146d8625f1d8590ac0a1af4d8aef82644179 Mon Sep 17 00:00:00 2001 From: Joel Gerber Date: Mon, 25 Apr 2022 07:41:46 -0400 Subject: [PATCH 053/763] Update content/en/docs/reference/using-api/api-concepts.md Co-authored-by: divya-mohan0209 --- content/en/docs/reference/using-api/api-concepts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/using-api/api-concepts.md b/content/en/docs/reference/using-api/api-concepts.md index f31bfaff40..1a722acffd 100644 --- a/content/en/docs/reference/using-api/api-concepts.md +++ b/content/en/docs/reference/using-api/api-concepts.md @@ -16,7 +16,7 @@ GET). For some resources, the API includes additional subresources that allow fine grained authorization (such as separate views for Pod details and -retrieving its logs), and can accept and serve those resources in different +log retrievals), and can accept and serve those resources in different representations for convenience or efficiency. Kubernetes supports efficient change notifications on resources via *watches*. From c83e9500d240e603b5afc2b59e395adc3731dcec Mon Sep 17 00:00:00 2001 From: Shabir Mohamed Abdul Samadh <7249208+Shabirmean@users.noreply.github.com> Date: Mon, 25 Apr 2022 12:57:47 -0400 Subject: [PATCH 054/763] doc: add note about endpoint.name==service.name For Services without selectors, there is no mention of the requirement that the name of the associated Endpoint object must be the same as the Service name. Thus, I have added that note. --- content/en/docs/concepts/services-networking/service.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/en/docs/concepts/services-networking/service.md b/content/en/docs/concepts/services-networking/service.md index fa201c0e1b..7f89b14d0d 100644 --- a/content/en/docs/concepts/services-networking/service.md +++ b/content/en/docs/concepts/services-networking/service.md @@ -203,6 +203,8 @@ subsets: The name of the Endpoints object must be a valid [DNS subdomain name](/docs/concepts/overview/working-with-objects/names#dns-subdomain-names). +{{< note >}} The name of the Endpoint must be the same as the name of the Service. {{< /note >}} + {{< note >}} The endpoint IPs _must not_ be: loopback (127.0.0.0/8 for IPv4, ::1/128 for IPv6), or link-local (169.254.0.0/16 and 224.0.0.0/24 for IPv4, fe80::/64 for IPv6). From 7454622a18ae7d94380d62fc46cd41f6adff410e Mon Sep 17 00:00:00 2001 From: Shabir Mohamed Abdul Samadh <7249208+Shabirmean@users.noreply.github.com> Date: Tue, 26 Apr 2022 07:02:40 -0400 Subject: [PATCH 055/763] doc: adopt suggestion Co-authored-by: Tim Bannister --- content/en/docs/concepts/services-networking/service.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/en/docs/concepts/services-networking/service.md b/content/en/docs/concepts/services-networking/service.md index 7f89b14d0d..c04e7d6398 100644 --- a/content/en/docs/concepts/services-networking/service.md +++ b/content/en/docs/concepts/services-networking/service.md @@ -203,7 +203,9 @@ subsets: The name of the Endpoints object must be a valid [DNS subdomain name](/docs/concepts/overview/working-with-objects/names#dns-subdomain-names). -{{< note >}} The name of the Endpoint must be the same as the name of the Service. {{< /note >}} +When you create an [Endpoints](docs/reference/kubernetes-api/service-resources/endpoints-v1/) +object for a Service, you set the name of the new Endpoints to be the same as the +name of the Service. {{< note >}} The endpoint IPs _must not_ be: loopback (127.0.0.0/8 for IPv4, ::1/128 for IPv6), or From f2ef9858a38eb06e58ec55862b37215d84cb46c2 Mon Sep 17 00:00:00 2001 From: Shabir Mohamed Abdul Samadh <7249208+Shabirmean@users.noreply.github.com> Date: Tue, 26 Apr 2022 07:04:44 -0400 Subject: [PATCH 056/763] doc: add comment about the name match in the example --- content/en/docs/concepts/services-networking/service.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/en/docs/concepts/services-networking/service.md b/content/en/docs/concepts/services-networking/service.md index c04e7d6398..571d5f2a0a 100644 --- a/content/en/docs/concepts/services-networking/service.md +++ b/content/en/docs/concepts/services-networking/service.md @@ -192,6 +192,7 @@ where it's running, by adding an Endpoints object manually: apiVersion: v1 kind: Endpoints metadata: + # the name here should match the name of the Service name: my-service subsets: - addresses: From 9d6c3ffbf2cbbf12b10e4b78de746b61fcdd34c6 Mon Sep 17 00:00:00 2001 From: Toshiaki Inukai Date: Tue, 26 Apr 2022 12:03:02 +0000 Subject: [PATCH 057/763] Set heading IDs --- .../manage-resources-containers.md | 46 +++++++++---------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/content/ja/docs/concepts/configuration/manage-resources-containers.md b/content/ja/docs/concepts/configuration/manage-resources-containers.md index 6f699bb477..d9e5a13b41 100644 --- a/content/ja/docs/concepts/configuration/manage-resources-containers.md +++ b/content/ja/docs/concepts/configuration/manage-resources-containers.md @@ -17,7 +17,7 @@ Pod内のコンテナのリソース*要求*を指定すると、スケジュー -## 要求と制限 +## 要求と制限 {#requests-and-limits} Podが動作しているNodeに利用可能なリソースが十分にある場合、そのリソースの`要求`が指定するよりも多くのリソースをコンテナが使用することが許可されます ただし、コンテナはそのリソースの`制限`を超えて使用することはできません。 @@ -33,7 +33,7 @@ Podが動作しているNodeに利用可能なリソースが十分にある場 コンテナが自身のメモリー制限を指定しているが、メモリー要求を指定していない場合、Kubernetesは制限に一致するメモリー要求を自動的に割り当てます。同様に、コンテナが自身のCPU制限を指定しているが、CPU要求を指定していない場合、Kubernetesは制限に一致するCPU要求を自動的に割り当てます。 {{< /note >}} -## リソースタイプ +## リソースタイプ {#resource-types} *CPU*と*メモリー*はいずれも*リソースタイプ*です。リソースタイプには基本単位があります。 CPUは計算処理を表し、[Kubernetes CPUs](#meaning-of-cpu)の単位で指定されます。 @@ -54,7 +54,7 @@ CPUとメモリーは、まとめて*コンピュートリソース*または単 それらは[API resources](/ja/docs/concepts/overview/kubernetes-api/)とは異なります。 Podや[Services](/ja/docs/concepts/services-networking/service/)などのAPIリソースは、Kubernetes APIサーバーを介して読み取りおよび変更できるオブジェクトです。 -## Podとコンテナのリソース要求と制限 +## Podとコンテナのリソース要求と制限 {#resource-requests-and-limits-of-pod-and-container} Podの各コンテナは、次の1つ以上を指定できます。 @@ -68,9 +68,9 @@ Podの各コンテナは、次の1つ以上を指定できます。 要求と制限はそれぞれのコンテナでのみ指定できますが、このPodリソースの要求と制限の関係性について理解すると便利です。 特定のリソースタイプの*Podリソース要求/制限*は、Pod内の各コンテナに対するそのタイプのリソース要求/制限の合計です。 -## Kubernetesにおけるリソースの単位 +## Kubernetesにおけるリソースの単位 {#resource-units-in-kubernetes} -### CPUの意味 +### CPUの意味 {#meaning-of-cpu} CPUリソースの制限と要求は、*cpu*単位で測定されます。 Kuberenetesにおける1つのCPUは、クラウドプロバイダーの**1 vCPU/コア**およびベアメタルのインテルプロセッサーの**1 ハイパースレッド**に相当します。 @@ -85,7 +85,7 @@ Kuberenetesにおける1つのCPUは、クラウドプロバイダーの**1 vCPU CPUは常に相対量としてではなく、絶対量として要求されます。 0.1は、シングルコア、デュアルコア、あるいは48コアマシンのどのCPUに対してでも、同一の量を要求します。 -### メモリーの意味 +### メモリーの意味 {#meaning-of-memory} `メモリー`の制限と要求はバイト単位で測定されます。 E、P、T、G、M、Kのいずれかのサフィックスを使用して、メモリーを整数または固定小数点数として表すことができます。 @@ -128,7 +128,7 @@ spec: cpu: "500m" ``` -## リソース要求を含むPodがどのようにスケジュールされるか +## リソース要求を含むPodがどのようにスケジュールされるか {#how-pods-with-resource-requests-are-scheduled} Podを作成すると、KubernetesスケジューラーはPodを実行するNodeを選択します。 各Nodeには、リソースタイプごとに最大容量があります。それは、Podに提供できるCPUとメモリの量です。 @@ -136,7 +136,7 @@ Podを作成すると、KubernetesスケジューラーはPodを実行するNode Node上の実際のメモリーまたはCPUリソースの使用率は非常に低いですが、容量チェックが失敗した場合、スケジューラーはNodeにPodを配置しないことに注意してください。 これにより、例えば日々のリソース要求のピーク時など、リソース利用が増加したときに、Nodeのリソース不足から保護されます。 -## リソース制限のあるPodがどのように実行されるか +## リソース制限のあるPodがどのように実行されるか {#how-pods-with-resource-limits-are-run} kubeletがPodのコンテナを開始すると、CPUとメモリーの制限がコンテナランタイムに渡されます。 @@ -166,13 +166,13 @@ Dockerを使用する場合: コンテナをスケジュールできないか、リソース制限が原因で強制終了されているかどうかを確認するには、[トラブルシューティング](#troubleshooting)のセクションを参照してください。 -### コンピュートリソースとメモリーリソースの使用量を監視する +### コンピュートリソースとメモリーリソースの使用量を監視する {#monitoring-compute-memory-resource-usage} Podのリソース使用量は、Podのステータスの一部として報告されます。 オプションの[監視ツール](/docs/tasks/debug-application-cluster/resource-usage-monitoring/)がクラスターにおいて利用可能な場合、Podのリソース使用量は[メトリクスAPI](/docs/tasks/debug-application-cluster/resource-metrics-pipeline/#the-metrics-api)から直接、もしくは監視ツールから取得できます。 -## ローカルのエフェメラルストレージ +## ローカルのエフェメラルストレージ {#local-ephemeral-storage} {{< feature-state for_k8s_version="v1.10" state="beta" >}} @@ -192,7 +192,7 @@ Nodeに障害が発生すると、そのエフェメラルストレージ内の ベータ版の機能として、Kubernetesでは、Podが消費するローカルのエフェメラルストレージの量を追跡、予約、制限することができます。 -### ローカルエフェメラルストレージの設定 +### ローカルエフェメラルストレージの設定 {#configurations-for-local-ephemeral-storage} Kubernetesは、Node上のローカルエフェメラルストレージを構成する2つの方法をサポートしています。 {{< tabs name="local_storage_configurations" >}} @@ -235,7 +235,7 @@ kubeletは、ローカルストレージの使用量を測定できます。 kubeletは、`tmpfs`のemptyDirボリュームをローカルのエフェメラルストレージとしてではなく、コンテナメモリーとして追跡します。 {{< /note >}} -### ローカルのエフェメラルストレージの要求と制限設定 +### ローカルのエフェメラルストレージの要求と制限設定 {#setting-requests-and-limits-for-local-ephemeral-storage} ローカルのエフェメラルストレージを管理するためには _ephemeral-storage_ パラメーターを利用することができます。 Podの各コンテナは、次の1つ以上を指定できます。 @@ -288,7 +288,7 @@ spec: emptyDir: {} ``` -### エフェメラルストレージを要求するPodのスケジュール方法 +### エフェメラルストレージを要求するPodのスケジュール方法 {#how-pods-with-ephemeral-storage-requests-are-scheduled} Podを作成すると、KubernetesスケジューラーはPodを実行するNodeを選択します。 各Nodeには、Podに提供できるローカルのエフェメラルストレージの上限があります。 @@ -375,7 +375,7 @@ Kubernetesが使用しないようにする必要があります。 {{% /tab %}} {{< /tabs >}} -## 拡張リソース +## 拡張リソース {#extended-resources} 拡張リソースは`kubernetes.io`ドメインの外で完全に修飾されたリソース名です。 これにより、クラスタオペレータはKubernetesに組み込まれていないリソースをアドバタイズし、ユーザはそれを利用することができるようになります。 @@ -384,16 +384,16 @@ Kubernetesが使用しないようにする必要があります。 第一に、クラスタオペレーターは拡張リソースをアドバタイズする必要があります。 第二に、ユーザーはPodで拡張リソースを要求する必要があります。 -### 拡張リソースの管理 +### 拡張リソースの管理 {#managing-extended-resources} -#### Nodeレベルの拡張リソース +#### Nodeレベルの拡張リソース {#node-level-extended-resources} Nodeレベルの拡張リソースはNodeに関連付けられています。 -##### デバイスプラグイン管理のリソース +##### デバイスプラグイン管理のリソース {#device-plugin-managed-resources} 各Nodeにデバイスプラグインで管理されているリソースをアドバタイズする方法については、[デバイスプラグイン](/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/)を参照してください。 -##### その他のリソース +##### その他のリソース {#other-resources} 新しいNodeレベルの拡張リソースをアドバタイズするには、クラスタオペレータはAPIサーバに`PATCH`HTTPリクエストを送信し、クラスタ内のNodeの`status.capacity`に利用可能な量を指定します。 この操作の後、ノードの`status.capacity`には新しいリソースが含まれます。 `status.allocatable`フィールドは、kubeletによって非同期的に新しいリソースで自動的に更新されます。 @@ -416,7 +416,7 @@ JSON-Patchの操作パス値は、JSON-Pointerとして解釈されます。 詳細については、[IETF RFC 6901, section 3](https://tools.ietf.org/html/rfc6901#section-3)を参照してください。 {{< /note >}} -#### クラスターレベルの拡張リソース +#### クラスターレベルの拡張リソース {#cluster-level-extended-resources} クラスターレベルの拡張リソースはノードに関連付けられていません。 これらは通常、リソース消費とリソースクォータを処理するスケジューラー拡張機能によって管理されます。 @@ -449,7 +449,7 @@ JSON-Patchの操作パス値は、JSON-Pointerとして解釈されます。 } ``` -### 拡張リソースの消費 +### 拡張リソースの消費 {#consuming-extended-resources} ユーザーは、CPUやメモリのようにPodのスペックで拡張されたリソースを消費できます。 利用可能な量以上のリソースが同時にPodに割り当てられないように、スケジューラーがリソースアカウンティングを行います。 @@ -493,9 +493,9 @@ spec: example.com/foo: 1 ``` -## トラブルシューティング +## トラブルシューティング {#troubleshooting} -### failedSchedulingイベントメッセージが表示され、Podが保留中になる +### failedSchedulingイベントメッセージが表示され、Podが保留中になる {#my-pods-are-pending-with-event-message-failedscheduling} スケジューラーがPodが収容されるNodeを見つけられない場合、場所が見つかるまでPodはスケジュールされないままになります。 スケジューラーがPodの場所を見つけられないたびに、次のようなイベントが生成されます。 @@ -562,7 +562,7 @@ Allocated resources: [リソースクォータ](/docs/concepts/policy/resource-quotas/)機能は、消費できるリソースの総量を制限するように設定することができます。 名前空間と組み合わせて使用すると、1つのチームがすべてのリソースを占有するのを防ぐことができます。 -### コンテナが終了した +### コンテナが終了した {#my-container-is-terminated} コンテナはリソース不足のため、終了する可能性があります。 コンテナがリソース制限に達したために強制終了されているかどうかを確認するには、対象のPodで`kubectl describe pod`を呼び出します。 From ce4573404566cff0f28dbe6106afe82faa8c8a1e Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Tue, 26 Apr 2022 11:47:23 -0700 Subject: [PATCH 058/763] Remove romana links from blog posts --- .../_posts/2016-04-00-Kubernetes-Network-Policy-APIs.md | 2 +- ...16-09-00-High-Performance-Network-Policies-Kubernetes.md | 6 +++--- .../2017-08-00-High-Performance-Networking-With-Ec2.md | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/content/en/blog/_posts/2016-04-00-Kubernetes-Network-Policy-APIs.md b/content/en/blog/_posts/2016-04-00-Kubernetes-Network-Policy-APIs.md index 16fec78e4b..b2a5561dd9 100644 --- a/content/en/blog/_posts/2016-04-00-Kubernetes-Network-Policy-APIs.md +++ b/content/en/blog/_posts/2016-04-00-Kubernetes-Network-Policy-APIs.md @@ -131,7 +131,7 @@ In this example, the ‘ **tenant-a** ’ namespace would get policy ‘ **pol1* -Today, [Romana](https://github.com/romana/romana), [OpenShift](https://www.openshift.com/), [OpenContrail](http://www.opencontrail.org/) and [Calico](http://projectcalico.org/) support network policies applied to namespaces and pods. Cisco and VMware are working on implementations as well. Both Romana and Calico demonstrated these capabilities with Kubernetes 1.2 recently at KubeCon. You can watch their presentations here: [Romana](https://www.youtube.com/watch?v=f-dLKtK6qCs) ([slides](http://www.slideshare.net/RomanaProject/kubecon-london-2016-ronana-cloud-native-sdn)), [Calico](https://www.youtube.com/watch?v=p1zfh4N4SX0) ([slides](http://www.slideshare.net/kubecon/kubecon-eu-2016-secure-cloudnative-networking-with-project-calico)).  +Today, Romana, OpenShift, OpenContrail and Calico support network policies applied to namespaces and pods. Cisco and VMware are working on implementations as well. Both Romana and Calico demonstrated these capabilities with Kubernetes 1.2 recently at KubeCon. You can watch their presentations here: [Romana](https://www.youtube.com/watch?v=f-dLKtK6qCs) ([slides](http://www.slideshare.net/RomanaProject/kubecon-london-2016-ronana-cloud-native-sdn)), [Calico](https://www.youtube.com/watch?v=p1zfh4N4SX0) ([slides](http://www.slideshare.net/kubecon/kubecon-eu-2016-secure-cloudnative-networking-with-project-calico)).  diff --git a/content/en/blog/_posts/2016-09-00-High-Performance-Network-Policies-Kubernetes.md b/content/en/blog/_posts/2016-09-00-High-Performance-Network-Policies-Kubernetes.md index 59fdd5a708..c8c452bc67 100644 --- a/content/en/blog/_posts/2016-09-00-High-Performance-Network-Policies-Kubernetes.md +++ b/content/en/blog/_posts/2016-09-00-High-Performance-Network-Policies-Kubernetes.md @@ -65,7 +65,7 @@ Network policies are an exciting feature, which the Kubernetes community has wor -There are only a few policy-capable networking backends available for Kubernetes today: [Romana](https://github.com/romana/romana), [Calico](http://projectcalico.org/), and [Canal](https://github.com/tigera/canal); with [Weave](http://www.weave.works/) indicating support in the near future. Red Hat’s OpenShift includes network policy features as well. +There are only a few policy-capable networking backends available for Kubernetes today: Romana, [Calico](http://projectcalico.org/), and [Canal](https://github.com/tigera/canal); with [Weave](http://www.weave.works/) indicating support in the near future. Red Hat’s OpenShift includes network policy features as well. @@ -100,7 +100,7 @@ This is because during a typical network performance benchmark, there’s no app - Hardware: Two servers with Intel Core i5-5250U CPUs (2 core, 2 threads per core) running at 1.60GHz, 16GB RAM and 512GB SSD. NIC: Intel Ethernet Connection I218-V (rev 03) - Ubuntu 14.04.5 - Kubernetes 1.3 for data collection (verified samples on [v1.4.0-beta.5](http://v1.4.0-beta.5/)) -- [Romana v0.9.3.1](https://github.com/romana/romana) +- Romana v0.9.3.1 - Client and server load test [software](https://github.com/paninetworks/testing-tools) For the tests we had a client pod send 2,000 HTTP requests to a server pod. HTTP requests were sent by the client pod at a rate that ensured that neither the server nor network ever saturated. We also made sure each request started a new TCP session by disabling persistent connections (i.e. HTTP [keep-alive](https://en.wikipedia.org/wiki/HTTP_persistent_connection)). We ran each test with different response sizes and measured the average request duration time (how long does it take to complete a request of that size). Finally, we repeated each set of measurements with different policy configurations. @@ -189,4 +189,4 @@ These tests were performed using Romana as the backend policy provider and other -If you wish to try it for yourself, we invite you to check out [Romana](https://github.com/romana/romana). In our [GitHub repo](https://github.com/romana/romana) you can find an easy to use installer, which works with AWS, Vagrant VMs or any other servers. You can use it to quickly get you started with a Romana powered Kubernetes or OpenStack cluster. +If you wish to try it for yourself, we invite you to check out Romana. In our GitHub repo you can find an easy to use installer, which works with AWS, Vagrant VMs or any other servers. You can use it to quickly get you started with a Romana powered Kubernetes or OpenStack cluster. diff --git a/content/en/blog/_posts/2017-08-00-High-Performance-Networking-With-Ec2.md b/content/en/blog/_posts/2017-08-00-High-Performance-Networking-With-Ec2.md index 44853d2567..181af0aa58 100644 --- a/content/en/blog/_posts/2017-08-00-High-Performance-Networking-With-Ec2.md +++ b/content/en/blog/_posts/2017-08-00-High-Performance-Networking-With-Ec2.md @@ -9,7 +9,7 @@ url: /blog/2017/08/High-Performance-Networking-With-Ec2 One of the most popular platforms for running Kubernetes is Amazon Web Services’ Elastic Compute Cloud (AWS EC2). With more than a decade of experience delivering IaaS, and expanding over time to include a rich set of services with easy to consume APIs, EC2 has captured developer mindshare and loyalty worldwide. -When it comes to networking, however, EC2 has some limits that hinder performance and make deploying Kubernetes clusters to production unnecessarily complex. The preview release of [Romana v2.0](https://github.com/romana/romana), a network and security automation solution for Cloud Native applications, includes features that address some well known network issues when running Kubernetes in EC2. +When it comes to networking, however, EC2 has some limits that hinder performance and make deploying Kubernetes clusters to production unnecessarily complex. The preview release of Romana v2.0, a network and security automation solution for Cloud Native applications, includes features that address some well known network issues when running Kubernetes in EC2. ## Traditional VPC Networking Performance Roadblocks @@ -40,7 +40,7 @@ Whether you were interested in advanced networking for traffic isolation or runn The way to avoid running out of VPC routes is to use them sparingly by making them forward pod traffic for multiple instances. From a networking perspective, what that means is that the VPC route needs to forward to a router, which can then forward traffic on to the final destination instance. -[Romana](https://github.com/romana/romana) is a CNI network provider that configures routes on the host to forward pod network traffic without an overlay. Since inter-node routes are installed on hosts, no VPC routes are necessary at all. However, when the VPC is split into subnets for an HA deployment across zones, VPC routes are necessary. +Romana is a CNI network provider that configures routes on the host to forward pod network traffic without an overlay. Since inter-node routes are installed on hosts, no VPC routes are necessary at all. However, when the VPC is split into subnets for an HA deployment across zones, VPC routes are necessary. Fortunately, inter-node routes on hosts allows them to act as a network router and forward traffic inbound from another zone just as it would for traffic from local pods. This makes any Kubernetes node configured by Romana able to accept inbound pod traffic from other zones and forward it to the proper destination node on the subnet. From 7359d60de8ebea02c8735e1f357f8b7990d9c8c5 Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Wed, 27 Apr 2022 10:20:18 +0800 Subject: [PATCH 059/763] Tweak indentation on portforward page This PR fixes the indentation nits in the `port-forward-access-application-cluster` page. We are not supposed to indent lines by 4 spaces because such indentations may mislead the markdown parser to render them as code snippets. --- ...port-forward-access-application-cluster.md | 218 ++++++++---------- 1 file changed, 102 insertions(+), 116 deletions(-) diff --git a/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md b/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md index ba8f7b1244..3b2648f943 100644 --- a/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md +++ b/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md @@ -11,180 +11,169 @@ This page shows how to use `kubectl port-forward` to connect to a MongoDB server running in a Kubernetes cluster. This type of connection can be useful for database debugging. - - - ## {{% heading "prerequisites" %}} - * {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} - * Install [MongoDB Shell](https://www.mongodb.com/try/download/shell). - - - ## Creating MongoDB deployment and service 1. Create a Deployment that runs MongoDB: - ```shell - kubectl apply -f https://k8s.io/examples/application/mongodb/mongo-deployment.yaml - ``` + ```shell + kubectl apply -f https://k8s.io/examples/application/mongodb/mongo-deployment.yaml + ``` - The output of a successful command verifies that the deployment was created: + The output of a successful command verifies that the deployment was created: - ``` - deployment.apps/mongo created - ``` + ``` + deployment.apps/mongo created + ``` - View the pod status to check that it is ready: + View the pod status to check that it is ready: - ```shell - kubectl get pods - ``` + ```shell + kubectl get pods + ``` - The output displays the pod created: + The output displays the pod created: - ``` - NAME READY STATUS RESTARTS AGE - mongo-75f59d57f4-4nd6q 1/1 Running 0 2m4s - ``` + ``` + NAME READY STATUS RESTARTS AGE + mongo-75f59d57f4-4nd6q 1/1 Running 0 2m4s + ``` - View the Deployment's status: + View the Deployment's status: - ```shell - kubectl get deployment - ``` + ```shell + kubectl get deployment + ``` - The output displays that the Deployment was created: + The output displays that the Deployment was created: - ``` - NAME READY UP-TO-DATE AVAILABLE AGE - mongo 1/1 1 1 2m21s - ``` + ``` + NAME READY UP-TO-DATE AVAILABLE AGE + mongo 1/1 1 1 2m21s + ``` - The Deployment automatically manages a ReplicaSet. - View the ReplicaSet status using: + The Deployment automatically manages a ReplicaSet. + View the ReplicaSet status using: - ```shell - kubectl get replicaset - ``` + ```shell + kubectl get replicaset + ``` - The output displays that the ReplicaSet was created: - - ``` - NAME DESIRED CURRENT READY AGE - mongo-75f59d57f4 1 1 1 3m12s - ``` + The output displays that the ReplicaSet was created: + ``` + NAME DESIRED CURRENT READY AGE + mongo-75f59d57f4 1 1 1 3m12s + ``` 2. Create a Service to expose MongoDB on the network: - ```shell - kubectl apply -f https://k8s.io/examples/application/mongodb/mongo-service.yaml - ``` + ```shell + kubectl apply -f https://k8s.io/examples/application/mongodb/mongo-service.yaml + ``` - The output of a successful command verifies that the Service was created: + The output of a successful command verifies that the Service was created: - ``` - service/mongo created - ``` + ``` + service/mongo created + ``` - Check the Service created: + Check the Service created: - ```shell - kubectl get service mongo - ``` + ```shell + kubectl get service mongo + ``` - The output displays the service created: + The output displays the service created: - ``` - NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE - mongo ClusterIP 10.96.41.183 27017/TCP 11s - ``` + ``` + NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE + mongo ClusterIP 10.96.41.183 27017/TCP 11s + ``` 3. Verify that the MongoDB server is running in the Pod, and listening on port 27017: - ```shell - # Change mongo-75f59d57f4-4nd6q to the name of the Pod - kubectl get pod mongo-75f59d57f4-4nd6q --template='{{(index (index .spec.containers 0).ports 0).containerPort}}{{"\n"}}' - ``` + ```shell + # Change mongo-75f59d57f4-4nd6q to the name of the Pod + kubectl get pod mongo-75f59d57f4-4nd6q --template='{{(index (index .spec.containers 0).ports 0).containerPort}}{{"\n"}}' + ``` - The output displays the port for MongoDB in that Pod: + The output displays the port for MongoDB in that Pod: - ``` - 27017 - ``` + ``` + 27017 + ``` - (this is the TCP port allocated to MongoDB on the internet). + 27017 is the TCP port allocated to MongoDB on the internet. ## Forward a local port to a port on the Pod -1. `kubectl port-forward` allows using resource name, such as a pod name, to select a matching pod to port forward to. +1. `kubectl port-forward` allows using resource name, such as a pod name, to select a matching pod to port forward to. - ```shell - # Change mongo-75f59d57f4-4nd6q to the name of the Pod - kubectl port-forward mongo-75f59d57f4-4nd6q 28015:27017 - ``` + ```shell + # Change mongo-75f59d57f4-4nd6q to the name of the Pod + kubectl port-forward mongo-75f59d57f4-4nd6q 28015:27017 + ``` - which is the same as + which is the same as - ```shell - kubectl port-forward pods/mongo-75f59d57f4-4nd6q 28015:27017 - ``` + ```shell + kubectl port-forward pods/mongo-75f59d57f4-4nd6q 28015:27017 + ``` - or + or - ```shell - kubectl port-forward deployment/mongo 28015:27017 - ``` + ```shell + kubectl port-forward deployment/mongo 28015:27017 + ``` - or + or - ```shell - kubectl port-forward replicaset/mongo-75f59d57f4 28015:27017 - ``` + ```shell + kubectl port-forward replicaset/mongo-75f59d57f4 28015:27017 + ``` - or + or - ```shell - kubectl port-forward service/mongo 28015:27017 - ``` + ```shell + kubectl port-forward service/mongo 28015:27017 + ``` - Any of the above commands works. The output is similar to this: + Any of the above commands works. The output is similar to this: - ``` - Forwarding from 127.0.0.1:28015 -> 27017 - Forwarding from [::1]:28015 -> 27017 - ``` + ``` + Forwarding from 127.0.0.1:28015 -> 27017 + Forwarding from [::1]:28015 -> 27017 + ``` -{{< note >}} + {{< note >}} + `kubectl port-forward` does not return. To continue with the exercises, you will need to open another terminal. + {{< /note >}} -`kubectl port-forward` does not return. To continue with the exercises, you will need to open another terminal. +2. Start the MongoDB command line interface: -{{< /note >}} + ```shell + mongosh --port 28015 + ``` -2. Start the MongoDB command line interface: +3. At the MongoDB command line prompt, enter the `ping` command: - ```shell - mongosh --port 28015 - ``` + ``` + db.runCommand( { ping: 1 } ) + ``` -3. At the MongoDB command line prompt, enter the `ping` command: + A successful ping request returns: - ``` - db.runCommand( { ping: 1 } ) - ``` - - A successful ping request returns: - - ``` - { ok: 1 } - ``` + ``` + { ok: 1 } + ``` ### Optionally let _kubectl_ choose the local port {#let-kubectl-choose-local-port} @@ -204,7 +193,6 @@ Forwarding from 127.0.0.1:63753 -> 27017 Forwarding from [::1]:63753 -> 27017 ``` - ## Discussion @@ -219,9 +207,7 @@ The support for UDP protocol is tracked in [issue 47862](https://github.com/kubernetes/kubernetes/issues/47862). {{< /note >}} - - - ## {{% heading "whatsnext" %}} Learn more about [kubectl port-forward](/docs/reference/generated/kubectl/kubectl-commands/#port-forward). + From c311707c63691e793d4a72c5e9fec1606f282b83 Mon Sep 17 00:00:00 2001 From: Grootesque <46447538+Grootesque@users.noreply.github.com> Date: Wed, 27 Apr 2022 12:01:14 +0200 Subject: [PATCH 060/763] Update kubespray.md Grammar --- content/en/docs/setup/production-environment/tools/kubespray.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/setup/production-environment/tools/kubespray.md b/content/en/docs/setup/production-environment/tools/kubespray.md index c4a8c8f59e..fd594b92f8 100644 --- a/content/en/docs/setup/production-environment/tools/kubespray.md +++ b/content/en/docs/setup/production-environment/tools/kubespray.md @@ -39,7 +39,7 @@ Provision servers with the following [requirements](https://github.com/kubernete * The target servers are configured to allow **IPv4 forwarding** * **Your ssh key must be copied** to all the servers in your inventory * **Firewalls are not managed by kubespray**. You'll need to implement appropriate rules as needed. You should disable your firewall in order to avoid any issues during deployment -* If kubespray is ran from a non-root user account, correct privilege escalation method should be configured in the target servers and the `ansible_become` flag or command parameters `--become` or `-b` should be specified +* If kubespray is run from a non-root user account, correct privilege escalation method should be configured in the target servers and the `ansible_become` flag or command parameters `--become` or `-b` should be specified Kubespray provides the following utilities to help provision your environment: From dc7bed20cf9b35d04ce7772ddfbbf845f8eddebb Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Wed, 27 Apr 2022 16:06:06 +0800 Subject: [PATCH 061/763] Tweak kubeadm-upgrade page for indentation nits The indentation on the page is "messy". We don't encourage implicit code blocks (4-space indentations). The nesting of contents are not properly expressed either. --- .../kubeadm/kubeadm-upgrade.md | 275 ++++++++++-------- 1 file changed, 146 insertions(+), 129 deletions(-) diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md index 36e5a1a00c..f6706ea68a 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md @@ -79,83 +79,87 @@ Pick a control plane node that you wish to upgrade first. It must have the `/etc **For the first control plane node** -- Upgrade kubeadm: +- Upgrade kubeadm: -{{< tabs name="k8s_install_kubeadm_first_cp" >}} -{{% tab name="Ubuntu, Debian or HypriotOS" %}} - # replace x in {{< skew currentVersion >}}.x-00 with the latest patch version - apt-mark unhold kubeadm && \ - apt-get update && apt-get install -y kubeadm={{< skew currentVersion >}}.x-00 && \ - apt-mark hold kubeadm -{{% /tab %}} -{{% tab name="CentOS, RHEL or Fedora" %}} - # replace x in {{< skew currentVersion >}}.x-0 with the latest patch version - yum install -y kubeadm-{{< skew currentVersion >}}.x-0 --disableexcludes=kubernetes -{{% /tab %}} -{{< /tabs >}} -
+ {{< tabs name="k8s_install_kubeadm_first_cp" >}} + {{% tab name="Ubuntu, Debian or HypriotOS" %}} + ```shell + # replace x in {{< skew currentVersion >}}.x-00 with the latest patch version + apt-mark unhold kubeadm && \ + apt-get update && apt-get install -y kubeadm={{< skew currentVersion >}}.x-00 && \ + apt-mark hold kubeadm + ``` + {{% /tab %}} + {{% tab name="CentOS, RHEL or Fedora" %}} + ```shell + # replace x in {{< skew currentVersion >}}.x-0 with the latest patch version + yum install -y kubeadm-{{< skew currentVersion >}}.x-0 --disableexcludes=kubernetes + ``` + {{% /tab %}} + {{< /tabs >}} +
-- Verify that the download works and has the expected version: +- Verify that the download works and has the expected version: - ```shell - kubeadm version - ``` + ```shell + kubeadm version + ``` -- Verify the upgrade plan: +- Verify the upgrade plan: - ```shell - kubeadm upgrade plan - ``` + ```shell + kubeadm upgrade plan + ``` - This command checks that your cluster can be upgraded, and fetches the versions you can upgrade to. - It also shows a table with the component config version states. + This command checks that your cluster can be upgraded, and fetches the versions you can upgrade to. + It also shows a table with the component config version states. -{{< note >}} -`kubeadm upgrade` also automatically renews the certificates that it manages on this node. -To opt-out of certificate renewal the flag `--certificate-renewal=false` can be used. -For more information see the [certificate management guide](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs). -{{}} + {{< note >}} + `kubeadm upgrade` also automatically renews the certificates that it manages on this node. + To opt-out of certificate renewal the flag `--certificate-renewal=false` can be used. + For more information see the [certificate management guide](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs). + {{}} + + {{< note >}} + If `kubeadm upgrade plan` shows any component configs that require manual upgrade, users must provide + a config file with replacement configs to `kubeadm upgrade apply` via the `--config` command line flag. + Failing to do so will cause `kubeadm upgrade apply` to exit with an error and not perform an upgrade. + {{}} -{{< note >}} -If `kubeadm upgrade plan` shows any component configs that require manual upgrade, users must provide -a config file with replacement configs to `kubeadm upgrade apply` via the `--config` command line flag. -Failing to do so will cause `kubeadm upgrade apply` to exit with an error and not perform an upgrade. -{{}} +- Choose a version to upgrade to, and run the appropriate command. For example: -- Choose a version to upgrade to, and run the appropriate command. For example: + ```shell + # replace x with the patch version you picked for this upgrade + sudo kubeadm upgrade apply v{{< skew currentVersion >}}.x + ``` - ```shell - # replace x with the patch version you picked for this upgrade - sudo kubeadm upgrade apply v{{< skew currentVersion >}}.x - ``` + Once the command finishes you should see: - Once the command finishes you should see: + ``` + [upgrade/successful] SUCCESS! Your cluster was upgraded to "v{{< skew currentVersion >}}.x". Enjoy! - ``` - [upgrade/successful] SUCCESS! Your cluster was upgraded to "v{{< skew currentVersion >}}.x". Enjoy! + [upgrade/kubelet] Now that your control plane is upgraded, please proceed with upgrading your kubelets if you haven't already done so. + ``` - [upgrade/kubelet] Now that your control plane is upgraded, please proceed with upgrading your kubelets if you haven't already done so. - ``` +- Manually upgrade your CNI provider plugin. -- Manually upgrade your CNI provider plugin. + Your Container Network Interface (CNI) provider may have its own upgrade instructions to follow. + Check the [addons](/docs/concepts/cluster-administration/addons/) page to + find your CNI provider and see whether additional upgrade steps are required. - Your Container Network Interface (CNI) provider may have its own upgrade instructions to follow. - Check the [addons](/docs/concepts/cluster-administration/addons/) page to - find your CNI provider and see whether additional upgrade steps are required. - - This step is not required on additional control plane nodes if the CNI provider runs as a DaemonSet. + This step is not required on additional control plane nodes if the CNI provider runs as a DaemonSet. **For the other control plane nodes** Same as the first control plane node but use: -``` +```shell sudo kubeadm upgrade node ``` instead of: -``` +```shell sudo kubeadm upgrade apply ``` @@ -163,46 +167,50 @@ Also calling `kubeadm upgrade plan` and upgrading the CNI provider plugin is no ### Drain the node -- Prepare the node for maintenance by marking it unschedulable and evicting the workloads: +- Prepare the node for maintenance by marking it unschedulable and evicting the workloads: - ```shell - # replace with the name of your node you are draining - kubectl drain --ignore-daemonsets - ``` + ```shell + # replace with the name of your node you are draining + kubectl drain --ignore-daemonsets + ``` ### Upgrade kubelet and kubectl -- Upgrade the kubelet and kubectl: +- Upgrade the kubelet and kubectl: -{{< tabs name="k8s_install_kubelet" >}} -{{% tab name="Ubuntu, Debian or HypriotOS" %}} - # replace x in {{< skew currentVersion >}}.x-00 with the latest patch version - apt-mark unhold kubelet kubectl && \ - apt-get update && apt-get install -y kubelet={{< skew currentVersion >}}.x-00 kubectl={{< skew currentVersion >}}.x-00 && \ - apt-mark hold kubelet kubectl -{{% /tab %}} -{{% tab name="CentOS, RHEL or Fedora" %}} - # replace x in {{< skew currentVersion >}}.x-0 with the latest patch version - yum install -y kubelet-{{< skew currentVersion >}}.x-0 kubectl-{{< skew currentVersion >}}.x-0 --disableexcludes=kubernetes -{{% /tab %}} -{{< /tabs >}} -
+ {{< tabs name="k8s_install_kubelet" >}} + {{% tab name="Ubuntu, Debian or HypriotOS" %}} + ```shell + # replace x in {{< skew currentVersion >}}.x-00 with the latest patch version + apt-mark unhold kubelet kubectl && \ + apt-get update && apt-get install -y kubelet={{< skew currentVersion >}}.x-00 kubectl={{< skew currentVersion >}}.x-00 && \ + apt-mark hold kubelet kubectl + ``` + {{% /tab %}} + {{% tab name="CentOS, RHEL or Fedora" %}} + ```shell + # replace x in {{< skew currentVersion >}}.x-0 with the latest patch version + yum install -y kubelet-{{< skew currentVersion >}}.x-0 kubectl-{{< skew currentVersion >}}.x-0 --disableexcludes=kubernetes + ``` + {{% /tab %}} + {{< /tabs >}} +
-- Restart the kubelet: +- Restart the kubelet: - ```shell - sudo systemctl daemon-reload - sudo systemctl restart kubelet - ``` + ```shell + sudo systemctl daemon-reload + sudo systemctl restart kubelet + ``` ### Uncordon the node -- Bring the node back online by marking it schedulable: +- Bring the node back online by marking it schedulable: - ```shell - # replace with the name of your node - kubectl uncordon - ``` + ```shell + # replace with the name of your node + kubectl uncordon + ``` ## Upgrade worker nodes @@ -211,76 +219,83 @@ without compromising the minimum required capacity for running your workloads. ### Upgrade kubeadm -- Upgrade kubeadm: +- Upgrade kubeadm: -{{< tabs name="k8s_install_kubeadm_worker_nodes" >}} -{{% tab name="Ubuntu, Debian or HypriotOS" %}} - # replace x in {{< skew currentVersion >}}.x-00 with the latest patch version - apt-mark unhold kubeadm && \ - apt-get update && apt-get install -y kubeadm={{< skew currentVersion >}}.x-00 && \ - apt-mark hold kubeadm -{{% /tab %}} -{{% tab name="CentOS, RHEL or Fedora" %}} - # replace x in {{< skew currentVersion >}}.x-0 with the latest patch version - yum install -y kubeadm-{{< skew currentVersion >}}.x-0 --disableexcludes=kubernetes -{{% /tab %}} -{{< /tabs >}} + {{< tabs name="k8s_install_kubeadm_worker_nodes" >}} + {{% tab name="Ubuntu, Debian or HypriotOS" %}} + ```shell + # replace x in {{< skew currentVersion >}}.x-00 with the latest patch version + apt-mark unhold kubeadm && \ + apt-get update && apt-get install -y kubeadm={{< skew currentVersion >}}.x-00 && \ + apt-mark hold kubeadm + ``` + {{% /tab %}} + {{% tab name="CentOS, RHEL or Fedora" %}} + ```shell + # replace x in {{< skew currentVersion >}}.x-0 with the latest patch version + yum install -y kubeadm-{{< skew currentVersion >}}.x-0 --disableexcludes=kubernetes + ``` + {{% /tab %}} + {{< /tabs >}} ### Call "kubeadm upgrade" -- For worker nodes this upgrades the local kubelet configuration: +- For worker nodes this upgrades the local kubelet configuration: - ```shell - sudo kubeadm upgrade node - ``` + ```shell + sudo kubeadm upgrade node + ``` ### Drain the node -- Prepare the node for maintenance by marking it unschedulable and evicting the workloads: +- Prepare the node for maintenance by marking it unschedulable and evicting the workloads: - ```shell - # replace with the name of your node you are draining - kubectl drain --ignore-daemonsets - ``` + ```shell + # replace with the name of your node you are draining + kubectl drain --ignore-daemonsets + ``` ### Upgrade kubelet and kubectl -- Upgrade the kubelet and kubectl: +- Upgrade the kubelet and kubectl: -{{< tabs name="k8s_kubelet_and_kubectl" >}} -{{% tab name="Ubuntu, Debian or HypriotOS" %}} - # replace x in {{< skew currentVersion >}}.x-00 with the latest patch version - apt-mark unhold kubelet kubectl && \ - apt-get update && apt-get install -y kubelet={{< skew currentVersion >}}.x-00 kubectl={{< skew currentVersion >}}.x-00 && \ - apt-mark hold kubelet kubectl -{{% /tab %}} -{{% tab name="CentOS, RHEL or Fedora" %}} - # replace x in {{< skew currentVersion >}}.x-0 with the latest patch version - yum install -y kubelet-{{< skew currentVersion >}}.x-0 kubectl-{{< skew currentVersion >}}.x-0 --disableexcludes=kubernetes -{{% /tab %}} -{{< /tabs >}} -
+ {{< tabs name="k8s_kubelet_and_kubectl" >}} + {{% tab name="Ubuntu, Debian or HypriotOS" %}} + ```shell + # replace x in {{< skew currentVersion >}}.x-00 with the latest patch version + apt-mark unhold kubelet kubectl && \ + apt-get update && apt-get install -y kubelet={{< skew currentVersion >}}.x-00 kubectl={{< skew currentVersion >}}.x-00 && \ + apt-mark hold kubelet kubectl + {{% /tab %}} + {{% tab name="CentOS, RHEL or Fedora" %}} + ```shell + # replace x in {{< skew currentVersion >}}.x-0 with the latest patch version + yum install -y kubelet-{{< skew currentVersion >}}.x-0 kubectl-{{< skew currentVersion >}}.x-0 --disableexcludes=kubernetes + ``` + {{% /tab %}} + {{< /tabs >}} +
-- Restart the kubelet: +- Restart the kubelet: - ```shell - sudo systemctl daemon-reload - sudo systemctl restart kubelet - ``` + ```shell + sudo systemctl daemon-reload + sudo systemctl restart kubelet + ``` ### Uncordon the node -- Bring the node back online by marking it schedulable: +- Bring the node back online by marking it schedulable: - ```shell - # replace with the name of your node - kubectl uncordon - ``` + ```shell + # replace with the name of your node + kubectl uncordon + ``` ## Verify the status of the cluster -After the kubelet is upgraded on all nodes verify that all nodes are available again by running the following command -from anywhere kubectl can access the cluster: +After the kubelet is upgraded on all nodes verify that all nodes are available again by running +the following command from anywhere kubectl can access the cluster: ```shell kubectl get nodes @@ -296,6 +311,7 @@ This command is idempotent and eventually makes sure that the actual state is th To recover from a bad state, you can also run `kubeadm upgrade apply --force` without changing the version that your cluster is running. During upgrade kubeadm writes the following backup folders under `/etc/kubernetes/tmp`: + - `kubeadm-backup-etcd--