From a83d3b5f18db6be182b6ba04b88e5d37a2edfab5 Mon Sep 17 00:00:00 2001 From: fbsolo Date: Thu, 25 Aug 2016 12:52:10 -0700 Subject: [PATCH 01/18] Fixes the second issue in the Dead Link Report: broken URL in docs/admin/authorization --- docs/admin/authorization.md | 2 +- docs/admin/cluster-management.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/admin/authorization.md b/docs/admin/authorization.md index b1efc1202c..05b9fad0da 100644 --- a/docs/admin/authorization.md +++ b/docs/admin/authorization.md @@ -204,7 +204,7 @@ As of 1.3 RBAC mode is in alpha and considered experimental. To use RBAC, you must both enable the authorization module with `--authorization-mode=RBAC`, and [enable the API version]( -docs/admin/cluster-management.md/#Turn-on-or-off-an-api-version-for-your-cluster), +../cluster-management.md/#Turn-on-or-off-an-api-version-for-your-cluster), with a `--runtime-config=` that includes `rbac.authorization.k8s.io/v1alpha1`. ### Roles, RolesBindings, ClusterRoles, and ClusterRoleBindings diff --git a/docs/admin/cluster-management.md b/docs/admin/cluster-management.md index 1be4fc8a02..27bffefbb1 100644 --- a/docs/admin/cluster-management.md +++ b/docs/admin/cluster-management.md @@ -170,7 +170,7 @@ This is an infrequent event, but it requires careful management. There is a sequ 1. Turn off the old API version. ### Turn on or off an API version for your cluster - + Specific API versions can be turned on or off by passing --runtime-config=api/ flag while bringing up the API server. For example: to turn off v1 API, pass `--runtime-config=api/v1=false`. runtime-config also supports 2 special keys: api/all and api/legacy to control all and legacy APIs respectively. For example, for turning off all api versions except v1, pass `--runtime-config=api/all=false,api/v1=true`. From 2b42de43af08777b122fa4be58374b6c1630692f Mon Sep 17 00:00:00 2001 From: fbsolo Date: Thu, 25 Aug 2016 13:07:17 -0700 Subject: [PATCH 02/18] Fixes the second issue in the Dead Link Report: broken URL in docs/admin/authorization --- docs/admin/authorization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/authorization.md b/docs/admin/authorization.md index 05b9fad0da..b188932b5a 100644 --- a/docs/admin/authorization.md +++ b/docs/admin/authorization.md @@ -204,7 +204,7 @@ As of 1.3 RBAC mode is in alpha and considered experimental. To use RBAC, you must both enable the authorization module with `--authorization-mode=RBAC`, and [enable the API version]( -../cluster-management.md/#Turn-on-or-off-an-api-version-for-your-cluster), +cluster-management.md/#Turn-on-or-off-an-api-version-for-your-cluster), with a `--runtime-config=` that includes `rbac.authorization.k8s.io/v1alpha1`. ### Roles, RolesBindings, ClusterRoles, and ClusterRoleBindings From 664878bd6e8a2231c22be005bb3d0c0e259280a3 Mon Sep 17 00:00:00 2001 From: fbsolo Date: Thu, 25 Aug 2016 13:12:21 -0700 Subject: [PATCH 03/18] Fixes the second issue in the Dead Link Report: broken URL in docs/admin/authorization --- docs/admin/cluster-management.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/cluster-management.md b/docs/admin/cluster-management.md index 27bffefbb1..f871e80cde 100644 --- a/docs/admin/cluster-management.md +++ b/docs/admin/cluster-management.md @@ -169,8 +169,8 @@ This is an infrequent event, but it requires careful management. There is a sequ 1. Update existing objects in the storage to new version by running `cluster/update-storage-objects.sh`. 1. Turn off the old API version. -### Turn on or off an API version for your cluster +### Turn on or off an API version for your cluster Specific API versions can be turned on or off by passing --runtime-config=api/ flag while bringing up the API server. For example: to turn off v1 API, pass `--runtime-config=api/v1=false`. runtime-config also supports 2 special keys: api/all and api/legacy to control all and legacy APIs respectively. For example, for turning off all api versions except v1, pass `--runtime-config=api/all=false,api/v1=true`. From 4c504ad0afbedfc78078e9a44e51ca1a823e505a Mon Sep 17 00:00:00 2001 From: Ricky Pai Date: Thu, 25 Aug 2016 17:07:26 -0700 Subject: [PATCH 04/18] Use different anchor for better navigation the anchor `#use-case-two-containers` will jump the page where the title is not visible, so it's hard to understand the context. `#use-case-secret-visible-to-one-container-in-a-pod` is a better anchor choice since it jumps straight to the title so the context is clear. --- docs/user-guide/secrets/index.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/docs/user-guide/secrets/index.md b/docs/user-guide/secrets/index.md index 6cf073d828..9c348a07fb 100644 --- a/docs/user-guide/secrets/index.md +++ b/docs/user-guide/secrets/index.md @@ -642,8 +642,6 @@ you must use `ls -la` to see them when listing directory contents. ### Use-case: Secret visible to one container in a pod - - Consider a program that needs to handle HTTP requests, do some complex business logic, and then sign some messages with an HMAC. Because it has complex application logic, there might be an unnoticed remote file reading exploit in @@ -688,7 +686,7 @@ Therefore, one Pod does not have access to the secrets of another pod. There may be several containers in a pod. However, each container in a pod has to request the secret volume in its `volumeMounts` for it to be visible within the container. This can be used to construct useful [security partitions at the -Pod level](#use-case-two-containers). +Pod level](#use-case-secret-visible-to-one-container-in-a-pod). ### Risks From 60065a788214966e7987eae370213c847139c4f6 Mon Sep 17 00:00:00 2001 From: fbsolo Date: Sat, 27 Aug 2016 00:19:11 -0700 Subject: [PATCH 05/18] Fixed anchor target in cluster-management.md to conform to anchor HTML standards in the Kubernetes documentation repo --- docs/admin/cluster-management.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/cluster-management.md b/docs/admin/cluster-management.md index f871e80cde..1be4fc8a02 100644 --- a/docs/admin/cluster-management.md +++ b/docs/admin/cluster-management.md @@ -169,8 +169,8 @@ This is an infrequent event, but it requires careful management. There is a sequ 1. Update existing objects in the storage to new version by running `cluster/update-storage-objects.sh`. 1. Turn off the old API version. - ### Turn on or off an API version for your cluster + Specific API versions can be turned on or off by passing --runtime-config=api/ flag while bringing up the API server. For example: to turn off v1 API, pass `--runtime-config=api/v1=false`. runtime-config also supports 2 special keys: api/all and api/legacy to control all and legacy APIs respectively. For example, for turning off all api versions except v1, pass `--runtime-config=api/all=false,api/v1=true`. From e172def939d4f1509bb5a6efd8fd34d7d38c89d7 Mon Sep 17 00:00:00 2001 From: fbsolo Date: Sat, 27 Aug 2016 00:41:59 -0700 Subject: [PATCH 06/18] This sets a URL in authorization.md to point to a specific anchor in cluster-management.md --- docs/admin/authorization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/authorization.md b/docs/admin/authorization.md index b188932b5a..58f4be2271 100644 --- a/docs/admin/authorization.md +++ b/docs/admin/authorization.md @@ -204,7 +204,7 @@ As of 1.3 RBAC mode is in alpha and considered experimental. To use RBAC, you must both enable the authorization module with `--authorization-mode=RBAC`, and [enable the API version]( -cluster-management.md/#Turn-on-or-off-an-api-version-for-your-cluster), +cluster-management/#Turn-on-or-off-an-api-version-for-your-cluster), with a `--runtime-config=` that includes `rbac.authorization.k8s.io/v1alpha1`. ### Roles, RolesBindings, ClusterRoles, and ClusterRoleBindings From 037957614d180a74ae140fab9b693e90bd1d86b5 Mon Sep 17 00:00:00 2001 From: fbsolo Date: Sat, 27 Aug 2016 00:49:30 -0700 Subject: [PATCH 07/18] This sets a URL in authorization.md to point to a specific anchor in cluster-management.md --- docs/admin/authorization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/authorization.md b/docs/admin/authorization.md index 58f4be2271..b188932b5a 100644 --- a/docs/admin/authorization.md +++ b/docs/admin/authorization.md @@ -204,7 +204,7 @@ As of 1.3 RBAC mode is in alpha and considered experimental. To use RBAC, you must both enable the authorization module with `--authorization-mode=RBAC`, and [enable the API version]( -cluster-management/#Turn-on-or-off-an-api-version-for-your-cluster), +cluster-management.md/#Turn-on-or-off-an-api-version-for-your-cluster), with a `--runtime-config=` that includes `rbac.authorization.k8s.io/v1alpha1`. ### Roles, RolesBindings, ClusterRoles, and ClusterRoleBindings From 6305359afca58b469e60603acad2e30153bad223 Mon Sep 17 00:00:00 2001 From: fbsolo Date: Sat, 27 Aug 2016 01:06:19 -0700 Subject: [PATCH 08/18] This sets a URL in authorization.md to point to a specific anchor in cluster-management.md --- docs/admin/authorization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/authorization.md b/docs/admin/authorization.md index b188932b5a..18e97398a3 100644 --- a/docs/admin/authorization.md +++ b/docs/admin/authorization.md @@ -204,7 +204,7 @@ As of 1.3 RBAC mode is in alpha and considered experimental. To use RBAC, you must both enable the authorization module with `--authorization-mode=RBAC`, and [enable the API version]( -cluster-management.md/#Turn-on-or-off-an-api-version-for-your-cluster), +cluster-management.md/#Turn-on-or-off-an-API-version-for-your-cluster), with a `--runtime-config=` that includes `rbac.authorization.k8s.io/v1alpha1`. ### Roles, RolesBindings, ClusterRoles, and ClusterRoleBindings From d8834d91761fd8898ece241185c087ca26c7cb40 Mon Sep 17 00:00:00 2001 From: Eric Tune Date: Thu, 25 Aug 2016 09:30:56 -0700 Subject: [PATCH 09/18] Expand OIDC docs. --- docs/admin/authentication.md | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/docs/admin/authentication.md b/docs/admin/authentication.md index b4f7d8c639..bbceb4f818 100644 --- a/docs/admin/authentication.md +++ b/docs/admin/authentication.md @@ -45,8 +45,13 @@ with the request: All values are opaque to the authentication system and only hold significance when interpreted by an [authorizer](/docs/admin/authorization/). -Multiple authentication methods may be enabled at once. In these cases, the first -authenticator to successfully authenticate the request short-circuits evaluation. +You can enable multiple authentication methods at once. You should usually use at least two methods: + + - service account tokens for service accounts + - at least one other method for user authentication. + +When multiple are enabled, the first authenticator module +to successfully authenticate the request short-circuits evaluation. The API server does not guarantee the order authenticators run in. ### X509 Client Certs @@ -189,7 +194,9 @@ verify ID token's signature and determine the end users identity. To enable the plugin, pass the following required flags: * `--oidc-issuer-url` URL of the provider which allows the API server to discover -public signing keys. Only URLs which use the `https://` scheme are accepted. +public signing keys. Only URLs which use the `https://` scheme are accepted. This is typically +the provider's URL without a path, for example "https://accounts.google.com" or "https://login.salesforce.com". + * `--oidc-client-id` A client id that all tokens must be issued for. Importantly, the API server is not an OAuth2 client, rather it can only be @@ -212,6 +219,17 @@ other claims, such as `email`, depending on their provider. * `--oidc-groups-claim` JWT claim to use as the user's group. If the claim is present it must be an array of strings. +Kubernetes does not provide an OpenID Connect Identity Provider. +You can use an existing public OpenID Connect Identity Provider (such as Google, or [others](http://connect2id.com/products/nimbus-oauth-openid-connect-sdk/openid-connect-providers)). +Or, you can run your own Identity Provider, such as CoreOS [dex](https://github.com/coreos/dex), [Keycloak](https://github.com/keycloak/keycloak) or CloudFoundary [UAA](https://github.com/cloudfoundry/uaa). + +The provider needs to support [OpenID connect discovery]https://openid.net/specs/openid-connect-discovery-1_0.html); not all do. + +Setup instructions for specific systems: + +- [UAA]: http://apigee.com/about/blog/engineering/kubernetes-authentication-enterprise +- [Dex]: https://speakerdeck.com/ericchiang/kubernetes-access-control-with-dex + ### Webhook Token Authentication Webhook authentication is a hook for verifying bearer tokens. From 86975061d788ea9b6aa10c91875a535a64ab3a4a Mon Sep 17 00:00:00 2001 From: Matthew Wong Date: Tue, 30 Aug 2016 17:25:16 -0400 Subject: [PATCH 10/18] Update StorageClass docs (#1121) * Update StorageClass docs * Fix broken link --- docs/user-guide/persistent-volumes/index.md | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/docs/user-guide/persistent-volumes/index.md b/docs/user-guide/persistent-volumes/index.md index 32ac8fbd00..8f6bf30a25 100644 --- a/docs/user-guide/persistent-volumes/index.md +++ b/docs/user-guide/persistent-volumes/index.md @@ -238,7 +238,7 @@ equal to `""` is always interpreted to be requesting a PV with no class, so it can only be bound to PVs with no class (no annotation or one set equal to `""`). A PVC with no annotation is not quite the same and is treated differently by the cluster depending on whether the -[`DefaultStorageClass` admission plugin](docs/admin/admission-controllers/#defaultstorageclass) +[`DefaultStorageClass` admission plugin](/docs/admin/admission-controllers/#defaultstorageclass) is turned on. * If the admission plugin is turned on, the administrator may specify a @@ -256,7 +256,8 @@ same way as PVCs that have their annotation set to `""`. When a PVC specifies a `selector` in addition to requesting a `StorageClass`, the requirements are ANDed together: only a PV of the requested class and with -the requested labels may be bound to the PVC. +the requested labels may be bound to the PVC. Note that currently, a PVC with a +non-empty `selector` can't have a PV dynamically provisioned for it. In the future after beta, the `volume.beta.kubernetes.io/storage-class` annotation will become an attribute. @@ -295,13 +296,12 @@ dynamically provisioned. The name of a `StorageClass` object is significant, and is how users can request a particular class. Administrators set the name and other parameters -of a class, all of which are opaque to users, when first creating -`StorageClass` objects, and the objects cannot be updated once they are -created. +of a class when first creating `StorageClass` objects, and the objects cannot +be updated once they are created. Administrators can specify a default `StorageClass` just for PVCs that don't request any particular class to bind to: see the -[`PersistentVolumeClaim` section](docs/user-guide/persistent-volumes/#class-1) +[`PersistentVolumeClaim` section](#persistentvolumeclaims) for details. ```yaml @@ -373,16 +373,14 @@ provisioner: kubernetes.io/glusterfs parameters: endpoint: "glusterfs-cluster" resturl: "http://127.0.0.1:8081" - restauthenabled: "true" restuser: "admin" restuserkey: "password" ``` * `endpoint`: `glusterfs-cluster` is the endpoint/service name which includes GlusterFS trusted pool IP addresses and this parameter is mandatory. -* `resturl` : Gluster REST service url which provision gluster volumes on demand. The format should be `IPaddress:Port` and this is a mandatory parameter for GlusterFS dynamic provisioner. -* `restauthenabled` : Gluster REST service authentication boolean is required if the authentication is enabled on the REST server. If this value is 'true', 'restuser' and 'restuserkey' have to be filled. -* `restuser` : Gluster REST service user who has access to create volumes in the Gluster Trusted Pool. -* `restuserkey` : Gluster REST service user's password which will be used for authentication to the REST server. +* `resturl` : Gluster REST service url which provision gluster volumes on demand. The format should be a valid URL and this is a mandatory parameter for GlusterFS dynamic provisioner. +* `restuser` : Gluster REST service user who has access to create volumes in the Gluster Trusted Pool. This parameter is optional, empty string will be used when omitted. +* `restuserkey` : Gluster REST service user's password which will be used for authentication to the REST server. This parameter is optional, empty string will be used when omitted. #### OpenStack Cinder From 7f63196f298b2062f924c41ed98b5aabce08639d Mon Sep 17 00:00:00 2001 From: Derek Carr Date: Tue, 30 Aug 2016 17:28:29 -0400 Subject: [PATCH 11/18] Remove deprecated namespace admission plug-ins (#1079) --- docs/admin/admission-controllers.md | 15 --------------- .../coreos/cloud-configs/master.yaml | 2 +- .../fedora/fedora-calico.md | 2 +- 3 files changed, 2 insertions(+), 17 deletions(-) diff --git a/docs/admin/admission-controllers.md b/docs/admin/admission-controllers.md index a99b44f339..c8fc6b3eb3 100644 --- a/docs/admin/admission-controllers.md +++ b/docs/admin/admission-controllers.md @@ -117,21 +117,6 @@ When the plug-in sets a compute resource request, it annotates the pod with info See the [InitialResouces proposal](https://github.com/kubernetes/kubernetes/blob/{{page.githubbranch}}/docs/proposals/initial-resources.md) for more details. -### NamespaceExists (deprecated) - -This plug-in will observe all incoming requests that attempt to create a resource in a Kubernetes `Namespace` -and reject the request if the `Namespace` was not previously created. We strongly recommend running -this plug-in to ensure integrity of your data. - -The functionality of this admission controller has been merged into `NamespaceLifecycle` - -### NamespaceAutoProvision (deprecated) - -This plug-in will observe all incoming requests that attempt to create a resource in a Kubernetes `Namespace` -and create a new `Namespace` if one did not already exist previously. - -We strongly recommend `NamespaceLifecycle` over `NamespaceAutoProvision`. - ### NamespaceLifecycle This plug-in enforces that a `Namespace` that is undergoing termination cannot have new objects created in it, diff --git a/docs/getting-started-guides/coreos/cloud-configs/master.yaml b/docs/getting-started-guides/coreos/cloud-configs/master.yaml index fbacf82ef5..768e91ab40 100644 --- a/docs/getting-started-guides/coreos/cloud-configs/master.yaml +++ b/docs/getting-started-guides/coreos/cloud-configs/master.yaml @@ -91,7 +91,7 @@ coreos: ExecStart=/opt/bin/kube-apiserver \ --service-account-key-file=/opt/bin/kube-serviceaccount.key \ --service-account-lookup=false \ - --admission-control=NamespaceLifecycle,NamespaceAutoProvision,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota \ + --admission-control=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota \ --runtime-config=api/v1 \ --allow-privileged=true \ --insecure-bind-address=0.0.0.0 \ diff --git a/docs/getting-started-guides/fedora/fedora-calico.md b/docs/getting-started-guides/fedora/fedora-calico.md index 126db607f4..c9c029e229 100644 --- a/docs/getting-started-guides/fedora/fedora-calico.md +++ b/docs/getting-started-guides/fedora/fedora-calico.md @@ -97,7 +97,7 @@ KUBE_API_ADDRESS="--insecure-bind-address=0.0.0.0" KUBE_ETCD_SERVERS="--etcd-servers=http://kube-master:4001" # Remove ServiceAccount from this line to run without API Tokens -KUBE_ADMISSION_CONTROL="--admission-control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ResourceQuota" +KUBE_ADMISSION_CONTROL="--admission-control=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ResourceQuota" ``` * Create /var/run/kubernetes on master: From 84d826416cf515e3016af959b56c8fba4e33829c Mon Sep 17 00:00:00 2001 From: Jamie Alessio Date: Tue, 30 Aug 2016 14:29:19 -0700 Subject: [PATCH 12/18] Make hello-node 'gsutil rm' command able to be copy/pasted (#1075) --- docs/hellonode.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/hellonode.md b/docs/hellonode.md index 2283599fb7..e489927aff 100755 --- a/docs/hellonode.md +++ b/docs/hellonode.md @@ -423,7 +423,7 @@ gs://artifacts.<$PROJECT_ID>.appspot.com/ And then to remove the all the images under this path, run: ```shell -gsutil rm -r gs://artifacts.<$PROJECT_ID>.appspot.com/ +gsutil rm -r gs://artifacts.$PROJECT_ID.appspot.com/ ``` You can also delete the entire Google Cloud project but note that you must first disable billing on the project. Additionally, deleting a project will only happen after the current billing cycle ends. From 45e8948c551e997ca896b7d7e3ced8d670d86b25 Mon Sep 17 00:00:00 2001 From: jseldess Date: Tue, 30 Aug 2016 17:29:48 -0400 Subject: [PATCH 13/18] minor copy edits (#1080) --- docs/getting-started-guides/minikube.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/getting-started-guides/minikube.md b/docs/getting-started-guides/minikube.md index b2c9b8a776..f92910cb8b 100644 --- a/docs/getting-started-guides/minikube.md +++ b/docs/getting-started-guides/minikube.md @@ -127,7 +127,7 @@ List the nodes in your cluster by running: kubectl get nodes ``` -Minikube contains a built-in Docker daemon that for running containers. +Minikube contains a built-in Docker daemon for running containers. If you use another Docker daemon for building your containers, you will have to publish them to a registry before minikube can pull them. You can use minikube's built in Docker daemon to avoid this extra step of pushing your images. Use the built-in Docker daemon with: @@ -136,7 +136,7 @@ Use the built-in Docker daemon with: eval $(minikube docker-env) ``` This command sets up the Docker environment variables so a Docker client can communicate with the minikube Docker daemon. -Minikube currently supports only docker version 1.11.1 on the server, which is what is supported by Kubernetes 1.3. With a newer docker version you'll get this [issue](https://github.com/kubernetes/minikube/issues/338). +Minikube currently supports only docker version 1.11.1 on the server, which is what is supported by Kubernetes 1.3. With a newer docker version, you'll get this [issue](https://github.com/kubernetes/minikube/issues/338). ```shell docker ps From df7afa60b826d33ad07fa4b20b2baa5d43d2183c Mon Sep 17 00:00:00 2001 From: Tom Xing Date: Wed, 31 Aug 2016 05:30:17 +0800 Subject: [PATCH 14/18] Updated kubectl bash completion usage in the doc. (#1093) We have moved the shell script into `kubectl completion` command in [#23801](https://github.com/kubernetes/kubernetes/pull/23801), updated the bash completion usage in the doc. Fixes #1092 --- docs/getting-started-guides/gce.md | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/docs/getting-started-guides/gce.md b/docs/getting-started-guides/gce.md index bc3d664909..d768c4db7f 100644 --- a/docs/getting-started-guides/gce.md +++ b/docs/getting-started-guides/gce.md @@ -95,17 +95,29 @@ potential issues with client/server version skew. You may find it useful to enable `kubectl` bash completion: -``` -$ source ./contrib/completions/bash/kubectl -``` +* If you're using kubectl with Kubernetes version 1.2 or earlier, you can source the kubectl completion script as follows:
+ ``` + $ source ./contrib/completions/bash/kubectl + ``` -**Note**: This will last for the duration of your bash session. If you want to make this permanent you need to add this line in your bash profile. +* If you're using kubectl with Kubernetes version 1.3, use the `kubectl completion` command as follows:
+ ``` + $ source <(kubectl completion bash) + ``` -Alternatively, on most linux distributions you can also move the completions file to your bash_completions.d like this: +**Note**: The above commands will last for the duration of your bash session. If you want to make this permanent you need to add corresponding command in your bash profile. -``` -$ cp ./contrib/completions/bash/kubectl /etc/bash_completion.d/ -``` +Alternatively, on most linux distributions you can also add a completions file to your bash_completions.d as follows: + +* For kubectl with Kubernetes v1.2 or earlier:
+ ``` + $ cp ./contrib/completions/bash/kubectl /etc/bash_completion.d/ + ``` + +* For kubectl with Kubernetes v1.3:
+ ``` + $ kubectl completion bash | sudo tee /etc/bash_completion.d/kubectl + ``` but then you have to update it when you update kubectl. From 3522d6da5ad20a5d13d8d3a1489566c69b2c872d Mon Sep 17 00:00:00 2001 From: Ritesh H Shukla Date: Tue, 30 Aug 2016 14:31:38 -0700 Subject: [PATCH 15/18] Update documentation for vsphere cloud provider. (#1102) This update adds the new configuration needed to configure the vsphere cloud provider. --- docs/getting-started-guides/vsphere.md | 34 +++++++++++++++++++++++--- 1 file changed, 30 insertions(+), 4 deletions(-) diff --git a/docs/getting-started-guides/vsphere.md b/docs/getting-started-guides/vsphere.md index adab2b9027..b3679c56e8 100644 --- a/docs/getting-started-guides/vsphere.md +++ b/docs/getting-started-guides/vsphere.md @@ -25,10 +25,14 @@ mkdir -p $GOPATH export PATH=$PATH:$GOPATH/bin ``` -4. Install the govc tool to interact with ESXi/vCenter: +4. Install the govc tool to interact with ESXi/vCenter. Head to [govc Releases](https://github.com/vmware/govmomi/releases) to download the latest. ```shell -go get github.com/vmware/govmomi/govc +# Sample commands for v0.8.0 for 64 bit Linux. +curl -OL https://github.com/vmware/govmomi/releases/download/v0.8.0/govc_linux_amd64.gz +gzip -d govc_linux_amd64.gz +chmod +x govc_linux_amd64 +mv govc_linux_amd64 /usr/local/bin/govc ``` 5. Get or build a [binary release](/docs/getting-started-guides/binary_release) @@ -43,7 +47,7 @@ md5sum -c kube.vmdk.gz.md5 gzip -d kube.vmdk.gz ``` -Import this VMDK into your vSphere datastore: +Configure the environment for govc ```shell export GOVC_URL='hostname' # hostname of the vc @@ -52,9 +56,30 @@ export GOVC_PASSWORD='password' # password for the above username export GOVC_NETWORK='Network Name' # Name of the network the vms should join. Many times it could be "VM Network" export GOVC_INSECURE=1 # If the host above uses a self-signed cert export GOVC_DATASTORE='target datastore' +# To get resource pool via govc: govc ls -l 'host/*' | grep ResourcePool | awk '{print $1}' | xargs -n1 -t govc pool.info export GOVC_RESOURCE_POOL='resource pool or cluster with access to datastore' export GOVC_GUEST_LOGIN='kube:kube' # Used for logging into kube.vmdk during deployment. +export GOVC_PORT=443 # The port to be used by vSphere cloud provider plugin +# To get datacente via govc: govc datacenter.info +export GOVC_DATACENTER='ha-datacenter' # The datacenter to be used by vSphere cloud provider plugin +``` +Sample environment +```shell +export GOVC_URL='10.161.236.217' +export GOVC_USERNAME='administrator' +export GOVC_PASSWORD='MyPassword1' +export GOVC_NETWORK='VM Network' +export GOVC_INSECURE=1 +export GOVC_DATASTORE='datastore1' +export GOVC_RESOURCE_POOL='/Datacenter/host/10.20.104.24/Resources' +export GOVC_GUEST_LOGIN='kube:kube' +export GOVC_PORT='443' +export GOVC_DATACENTER='Datacenter' +``` + +Import this VMDK into your vSphere datastore: +```shell govc import.vmdk kube.vmdk ./kube/ ``` @@ -63,6 +88,7 @@ Verify that the VMDK was correctly uploaded and expanded to ~3GiB: ```shell govc datastore.ls ./kube/ ``` + If you need to debug any part of the deployment, the guest login for the image that you imported is `kube:kube`. It is normally specified in the GOVC_GUEST_LOGIN parameter above. @@ -110,7 +136,7 @@ going on (find yourself authorized with your SSH key, or use the password IaaS Provider | Config. Mgmt | OS | Networking | Docs | Conforms | Support Level -------------------- | ------------ | ------ | ---------- | --------------------------------------------- | ---------| ---------------------------- -Vmware vSphere | Saltstack | Debian | OVS | [docs](/docs/getting-started-guides/vsphere) | | Community ([@imkin](https://github.com/imkin)) +Vmware vSphere | Saltstack | Debian | OVS | [docs](/docs/getting-started-guides/vsphere) | | Community ([@imkin](https://github.com/imkin)), ([@abrarshivani](https://github.com/abrarshivani)), ([@kerneltime](https://github.com/kerneltime)), ([@kerneltime](https://github.com/luomiao)) For support level information on all solutions, see the [Table of solutions](/docs/getting-started-guides/#table-of-solutions) chart. From b51d2544c9e54a6754c2258bc08ff9b2e2e2bacb Mon Sep 17 00:00:00 2001 From: Ankur Shukla Date: Tue, 30 Aug 2016 14:33:28 -0700 Subject: [PATCH 16/18] removing viacom from companies section (#1119) --- community.html | 1 - 1 file changed, 1 deletion(-) diff --git a/community.html b/community.html index a1e0e04d61..e6acc42b6f 100644 --- a/community.html +++ b/community.html @@ -34,7 +34,6 @@ title: Community
- From c5740ce48066bd0d40370e4492062053a86979a5 Mon Sep 17 00:00:00 2001 From: Alexander Brand Date: Tue, 30 Aug 2016 17:50:24 -0400 Subject: [PATCH 17/18] More details around leader election / failure case (#1056) --- docs/admin/high-availability/index.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/admin/high-availability/index.md b/docs/admin/high-availability/index.md index f88f6bf796..efe6ddac4b 100644 --- a/docs/admin/high-availability/index.md +++ b/docs/admin/high-availability/index.md @@ -185,6 +185,10 @@ cluster state, such as the controller manager and scheduler. To achieve this re instances of these actors, in case a machine dies. To achieve this, we are going to use a lease-lock in the API to perform master election. We will use the `--leader-elect` flag for each scheduler and controller-manager, using a lease in the API will ensure that only 1 instance of the scheduler and controller-manager are running at once. +The scheduler and controller-manager can be configured to talk to the API server that is on the same node (i.e. 127.0.0.1), or it can be configured to communicate using the load balanced IP address of the API servers. Regardless of how they are configured, the scheduler and controller-manager will complete the leader election process mentioned above when using the `--leader-elect` flag. + +In case of a failure accessing the API server, the elected leader will not be able to renew the lease, causing a new leader to be elected. This is especially relevant when configuring the scheduler and controller-manager to access the API server via 127.0.0.1, and the API server on the same node is unavailable. + ### Installing configuration files First, create empty log files on each node, so that Docker will mount the files not make new directories: From 2262731d15899d8a88f0044c9dde1610a1c319a3 Mon Sep 17 00:00:00 2001 From: devin-donnelly Date: Tue, 30 Aug 2016 16:39:31 -0700 Subject: [PATCH 18/18] Update .gitignore --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index 9905f71795..de345e5f59 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ _site/** .sass-cache/** CNAME +.travis.yml