Promote IdentifyOS to Beta

2022-03-25 12:05:38 +08:00
parent b2f72a383e
commit 2536593a39
3 changed files with 48 additions and 32 deletions
@@ -154,35 +154,43 @@ section refers to several key workload enablers and how they map to Windows.
  * Named pipe host mounts
  * Resource limits
  * OS field: 
-              {{< feature-state for_k8s_version="v1.23" state="alpha" >}}
-               `.spec.os.name` should be set to `windows` to indicate that the current Pod uses Windows containers.
-               `IdentifyPodOS` feature gate needs to be enabled for this field to be recognized and used by control plane
-               components and kubelet.
-               {{< note >}}
-              If the `IdentifyPodOS` feature gate is enabled and you set the `.spec.os.name` field to `windows`, you must not set the following fields in the `.spec` of that Pod:
-               * `spec.hostPID`
-               * `spec.hostIPC`
-               * `spec.securityContext.seLinuxOptions`
-               * `spec.securityContext.seccompProfile`
-               * `spec.securityContext.fsGroup`
-               * `spec.securityContext.fsGroupChangePolicy`
-               * `spec.securityContext.sysctls`
-               * `spec.shareProcessNamespace`
-               * `spec.securityContext.runAsUser`
-               * `spec.securityContext.runAsGroup`
-               * `spec.securityContext.supplementalGroups`
-               * `spec.containers[*].securityContext.seLinuxOptions`
-               * `spec.containers[*].securityContext.seccompProfile`
-               * `spec.containers[*].securityContext.capabilities`
-               * `spec.containers[*].securityContext.readOnlyRootFilesystem`
-               * `spec.containers[*].securityContext.privileged`
-               * `spec.containers[*].securityContext.allowPrivilegeEscalation`
-               * `spec.containers[*].securityContext.procMount`
-               * `spec.containers[*].securityContext.runAsUser`
-               * `spec.containers[*].securityContext.runAsGroup`

-            Note: In this table, wildcards (*) indicate all elements in a list. For example, spec.containers[*].securityContext refers to the Security Context object for all defined containers. If not, Pod API validation would fail causing admission failures.
-            {{< /note >}}
+    The `.spec.os.name` field should be set to `windows` to indicate that the current Pod uses Windows containers.
+    The `IdentifyPodOS` feature gate needs to be enabled for this field to be recognized and used by control plane
+    components and kubelet.
+
+    {{< note >}}
+    Starting from 1.24, the `IdentifyPodOS` feature gate is in Beta stage and defaults to be enabled.
+    {{< /note >}}
+
+    If the `IdentifyPodOS` feature gate is enabled and you set the `.spec.os.name` field to `windows`,
+    you must not set the following fields in the `.spec` of that Pod:
+
+    * `spec.hostPID`
+    * `spec.hostIPC`
+    * `spec.securityContext.seLinuxOptions`
+    * `spec.securityContext.seccompProfile`
+    * `spec.securityContext.fsGroup`
+    * `spec.securityContext.fsGroupChangePolicy`
+    * `spec.securityContext.sysctls`
+    * `spec.shareProcessNamespace`
+    * `spec.securityContext.runAsUser`
+    * `spec.securityContext.runAsGroup`
+    * `spec.securityContext.supplementalGroups`
+    * `spec.containers[*].securityContext.seLinuxOptions`
+    * `spec.containers[*].securityContext.seccompProfile`
+    * `spec.containers[*].securityContext.capabilities`
+    * `spec.containers[*].securityContext.readOnlyRootFilesystem`
+    * `spec.containers[*].securityContext.privileged`
+    * `spec.containers[*].securityContext.allowPrivilegeEscalation`
+    * `spec.containers[*].securityContext.procMount`
+    * `spec.containers[*].securityContext.runAsUser`
+    * `spec.containers[*].securityContext.runAsGroup`
+
+    In the above list, wildcards (`*`) indicate all elements in a list.
+    For example, `spec.containers[*].securityContext` refers to the SecurityContext object
+    for all containers. If any of these fields is specified, the Pod will
+    not be admited by the API server.

 * [Workload resources](/docs/concepts/workloads/controllers/) including:
  * ReplicaSet