From 5a7e1165bb6331b1ffef24002d1b6fccfa66739e Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Thu, 22 Sep 2016 11:47:29 -0400 Subject: [PATCH 01/93] 'namespaceSelector' in the NetworkPolicy example --- docs/user-guide/networkpolicies.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/user-guide/networkpolicies.md b/docs/user-guide/networkpolicies.md index eb4bbe1b74..22c2ed2952 100644 --- a/docs/user-guide/networkpolicies.md +++ b/docs/user-guide/networkpolicies.md @@ -64,6 +64,9 @@ spec: role: db ingress: - from: + - namespaceSelector: + matchLabels: + project: myproject - podSelector: matchLabels: role: frontend From 3c7d5fc9c618e0116d5fd813cd079da41e00d4b3 Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Thu, 22 Sep 2016 12:52:39 -0400 Subject: [PATCH 02/93] Update networkpolicies.md --- docs/user-guide/networkpolicies.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/user-guide/networkpolicies.md b/docs/user-guide/networkpolicies.md index 22c2ed2952..0afe1791b2 100644 --- a/docs/user-guide/networkpolicies.md +++ b/docs/user-guide/networkpolicies.md @@ -84,3 +84,9 @@ __spec__: `NetworkPolicy` [spec](https://github.com/kubernetes/kubernetes/tree/{ __podSelector__: Each `NetworkPolicy` includes a `podSelector` which selects the grouping of pods to which the `ingress` rules in the policy apply. __ingress__: Each `NetworkPolicy` includes a list of whitelist `ingress` rules. Each rule allows traffic which matches both the `from` and `ports` sections. + +In plain language, this example NetworkPolicy: + +1. applies to all pods in the current (???) namespace with the label "role=db" +2. allows tcp/6379 ingress traffic to the "role=db" pods from any pod in the current namespace with the label "role=frontend" (due to the podSelector list element) +3. allows tcp/6379 ingress traffic to the "role=db" pods from any pod in the namespace "myproject" (due to the namespaceSelector list element) From c31b8d608b8c1ea55badc71b2ec1c2ff18f4329f Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Thu, 22 Sep 2016 12:55:09 -0400 Subject: [PATCH 03/93] Update networkpolicies.md --- docs/user-guide/networkpolicies.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/user-guide/networkpolicies.md b/docs/user-guide/networkpolicies.md index 0afe1791b2..bb9ab465f8 100644 --- a/docs/user-guide/networkpolicies.md +++ b/docs/user-guide/networkpolicies.md @@ -56,6 +56,7 @@ A minimal `NetworkPolicy` might look like this: ```yaml apiVersion: extensions/v1beta1 kind: NetworkPolicy +namespace: default metadata: name: test-network-policy spec: @@ -87,6 +88,6 @@ __ingress__: Each `NetworkPolicy` includes a list of whitelist `ingress` rules. In plain language, this example NetworkPolicy: -1. applies to all pods in the current (???) namespace with the label "role=db" +1. applies to all pods in the default namespace with the label "role=db" 2. allows tcp/6379 ingress traffic to the "role=db" pods from any pod in the current namespace with the label "role=frontend" (due to the podSelector list element) 3. allows tcp/6379 ingress traffic to the "role=db" pods from any pod in the namespace "myproject" (due to the namespaceSelector list element) From a27740b33ada451ba557c04696cf9438ed76ed85 Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Thu, 22 Sep 2016 13:11:18 -0400 Subject: [PATCH 04/93] Update networkpolicies.md --- docs/user-guide/networkpolicies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/networkpolicies.md b/docs/user-guide/networkpolicies.md index bb9ab465f8..6fb1829713 100644 --- a/docs/user-guide/networkpolicies.md +++ b/docs/user-guide/networkpolicies.md @@ -56,9 +56,9 @@ A minimal `NetworkPolicy` might look like this: ```yaml apiVersion: extensions/v1beta1 kind: NetworkPolicy -namespace: default metadata: name: test-network-policy + namespace: default spec: podSelector: matchLabels: From 273ac45bb496b1aac9385548d5dbbc36573cfea0 Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Thu, 22 Sep 2016 13:18:18 -0400 Subject: [PATCH 05/93] Update networkpolicies.md --- docs/user-guide/networkpolicies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/networkpolicies.md b/docs/user-guide/networkpolicies.md index 6fb1829713..402e1a32d2 100644 --- a/docs/user-guide/networkpolicies.md +++ b/docs/user-guide/networkpolicies.md @@ -66,7 +66,7 @@ spec: ingress: - from: - namespaceSelector: - matchLabels: + matchLabels: project: myproject - podSelector: matchLabels: From 95b028be80e5cee05fc62b83d8922028165af9a0 Mon Sep 17 00:00:00 2001 From: anatoly techtonik Date: Sun, 9 Oct 2016 17:29:57 +0300 Subject: [PATCH 06/93] Update kubectl-overview.md Add link to kubectl installation instructions --- docs/user-guide/kubectl-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/kubectl-overview.md b/docs/user-guide/kubectl-overview.md index 81f171a445..6257b8011a 100644 --- a/docs/user-guide/kubectl-overview.md +++ b/docs/user-guide/kubectl-overview.md @@ -5,7 +5,7 @@ assignees: --- -Use this overview of the `kubectl` command line interface to help you start running commands against Kubernetes clusters. This overview quickly covers `kubectl` syntax, describes the command operations, and provides common examples. For details about each command, including all the supported flags and subcommands, see the [kubectl](/docs/user-guide/kubectl) reference documentation. +`kubectl` is a command line interface to for running commands against Kubernetes clusters. This overview quickly covers `kubectl` syntax, describes the command operations, and provides common examples. For details about each command, including all the supported flags and subcommands, see the [kubectl](/docs/user-guide/kubectl) reference documentation. For installation instructions see [prerequisites](http://kubernetes.io/docs/user-guide/prereqs/). TODO: Auto-generate this file to ensure it's always in sync with any `kubectl` changes, see [#14177](http://pr.k8s.io/14177). From 5fabbd59d005e67781bc03b9a35690f862c94ff0 Mon Sep 17 00:00:00 2001 From: anatoly techtonik Date: Sun, 9 Oct 2016 17:30:38 +0300 Subject: [PATCH 07/93] Update kubectl-overview.md --- docs/user-guide/kubectl-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/kubectl-overview.md b/docs/user-guide/kubectl-overview.md index 6257b8011a..6d0d0eb135 100644 --- a/docs/user-guide/kubectl-overview.md +++ b/docs/user-guide/kubectl-overview.md @@ -5,7 +5,7 @@ assignees: --- -`kubectl` is a command line interface to for running commands against Kubernetes clusters. This overview quickly covers `kubectl` syntax, describes the command operations, and provides common examples. For details about each command, including all the supported flags and subcommands, see the [kubectl](/docs/user-guide/kubectl) reference documentation. For installation instructions see [prerequisites](http://kubernetes.io/docs/user-guide/prereqs/). +`kubectl` is a command line interface for running commands against Kubernetes clusters. This overview quickly covers `kubectl` syntax, describes the command operations, and provides common examples. For details about each command, including all the supported flags and subcommands, see the [kubectl](/docs/user-guide/kubectl) reference documentation. For installation instructions see [prerequisites](http://kubernetes.io/docs/user-guide/prereqs/). TODO: Auto-generate this file to ensure it's always in sync with any `kubectl` changes, see [#14177](http://pr.k8s.io/14177). From 97aa665e143e86e15e0e14e31243dc11d6237b4f Mon Sep 17 00:00:00 2001 From: anatoly techtonik Date: Mon, 10 Oct 2016 10:50:49 +0300 Subject: [PATCH 08/93] Make link portable --- docs/user-guide/kubectl-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/kubectl-overview.md b/docs/user-guide/kubectl-overview.md index 6d0d0eb135..1b2c6ff026 100644 --- a/docs/user-guide/kubectl-overview.md +++ b/docs/user-guide/kubectl-overview.md @@ -5,7 +5,7 @@ assignees: --- -`kubectl` is a command line interface for running commands against Kubernetes clusters. This overview quickly covers `kubectl` syntax, describes the command operations, and provides common examples. For details about each command, including all the supported flags and subcommands, see the [kubectl](/docs/user-guide/kubectl) reference documentation. For installation instructions see [prerequisites](http://kubernetes.io/docs/user-guide/prereqs/). +`kubectl` is a command line interface for running commands against Kubernetes clusters. This overview quickly covers `kubectl` syntax, describes the command operations, and provides common examples. For details about each command, including all the supported flags and subcommands, see the [kubectl](/docs/user-guide/kubectl) reference documentation. For installation instructions see [prerequisites](/docs/user-guide/prereqs). TODO: Auto-generate this file to ensure it's always in sync with any `kubectl` changes, see [#14177](http://pr.k8s.io/14177). From 1a0c8a9766f85944caa64c5e603b844a9c7c0f27 Mon Sep 17 00:00:00 2001 From: Clemens Tolboom Date: Wed, 12 Oct 2016 13:01:50 +0200 Subject: [PATCH 09/93] Resolve push denied I failed pushing until switched account as reported in http://stackoverflow.com/a/39996807/598513 --- docs/hellonode.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/hellonode.md b/docs/hellonode.md index 602a383a5b..dce486b51d 100755 --- a/docs/hellonode.md +++ b/docs/hellonode.md @@ -150,6 +150,8 @@ gcloud docker push gcr.io/$PROJECT_ID/hello-node:v1 If all goes well, you should be able to see the container image listed in the console: *Compute > Container Engine > Container Registry*. We now have a project-wide Docker image available which Kubernetes can access and orchestrate. +If you get a __denied: Unable to create the repository, please check that you have access to do so.__ check whether you push as the right user. Use `gcloud auth list` and then `gcloud config set account example@gmail.com` + ![image](/images/hellonode/image_10.png) ## Create your Kubernetes Cluster From d054714d278551272a44da370374418164079d11 Mon Sep 17 00:00:00 2001 From: Misty De Meo Date: Wed, 12 Oct 2016 16:17:53 -0700 Subject: [PATCH 10/93] Basics: fix minor typo --- docs/tutorials/kubernetes-basics/index.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/tutorials/kubernetes-basics/index.html b/docs/tutorials/kubernetes-basics/index.html index d678461e41..7edee6fd53 100644 --- a/docs/tutorials/kubernetes-basics/index.html +++ b/docs/tutorials/kubernetes-basics/index.html @@ -33,7 +33,7 @@

What can Kubernetes do for you?

-

With modern web services, users expect applications to be available 24/7, and developers expect to deploy new versions of those applications several times a day. Containzerization helps package software to serve these goals, enabling applications to be released and updated in an easy and fast way without downtime. Kubernetes helps you make sure those containerized applications run where and when you want, and helps them find the resources and tools they need to work. Kubernetes is a production-ready, open source platform designed with the Google's accumulated experience in container orchestration, combined with best-of-breed ideas from the community.

+

With modern web services, users expect applications to be available 24/7, and developers expect to deploy new versions of those applications several times a day. Containerization helps package software to serve these goals, enabling applications to be released and updated in an easy and fast way without downtime. Kubernetes helps you make sure those containerized applications run where and when you want, and helps them find the resources and tools they need to work. Kubernetes is a production-ready, open source platform designed with the Google's accumulated experience in container orchestration, combined with best-of-breed ideas from the community.

From 9b4654451716948d412815d1049c5ed0d1e5f62a Mon Sep 17 00:00:00 2001 From: anbern Date: Fri, 14 Oct 2016 22:25:23 +0200 Subject: [PATCH 11/93] Update hellonode.md Docker for Windows 1.12/1.12.1 does not work as described when pushing images to the google container image registry - it stops with an error message. It takes a long time (6h to several days) to find a solution and since Docker is becoming more popular on windows this seems worth mentioning. --- docs/hellonode.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/hellonode.md b/docs/hellonode.md index 602a383a5b..a4f228018c 100755 --- a/docs/hellonode.md +++ b/docs/hellonode.md @@ -152,6 +152,8 @@ If all goes well, you should be able to see the container image listed in the co ![image](/images/hellonode/image_10.png) +**Note:** *Docker for Windows, Version 1.12 or 1.12.1, does not yet support this procedure. Instead, it replies with the message 'denied: Unable to access the repository; please check that you have permission to access it'. A bugfix is available at http://stackoverflow.com/questions/39277986/unable-to-push-to-google-container-registry-unable-to-access-the-repository?answertab=votes#tab-top.* + ## Create your Kubernetes Cluster A cluster consists of a Master API server and a set of worker VMs called Nodes. From 4e1dd8314c64df24a04d14d70362cd3895d089b5 Mon Sep 17 00:00:00 2001 From: Clemens Tolboom Date: Tue, 18 Oct 2016 13:10:11 +0200 Subject: [PATCH 12/93] Update text to latest suggestions. I had to remove _To_ to join sentences and places a dot. --- docs/hellonode.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/hellonode.md b/docs/hellonode.md index dce486b51d..308588fd97 100755 --- a/docs/hellonode.md +++ b/docs/hellonode.md @@ -150,7 +150,7 @@ gcloud docker push gcr.io/$PROJECT_ID/hello-node:v1 If all goes well, you should be able to see the container image listed in the console: *Compute > Container Engine > Container Registry*. We now have a project-wide Docker image available which Kubernetes can access and orchestrate. -If you get a __denied: Unable to create the repository, please check that you have access to do so.__ check whether you push as the right user. Use `gcloud auth list` and then `gcloud config set account example@gmail.com` +If you see an error message like the following: __denied: Unable to create the repository, please check that you have access to do so.__ ensure that you are pushing the image to Container Registry with the correct user credentials, use `gcloud auth list` and then `gcloud config set account example@gmail.com`. ![image](/images/hellonode/image_10.png) From ad39de970d1248a7fd81eb445e9bc45ffd4fabcc Mon Sep 17 00:00:00 2001 From: anatoly techtonik Date: Tue, 18 Oct 2016 14:12:52 +0300 Subject: [PATCH 13/93] Remove 'quickly' --- docs/user-guide/kubectl-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/kubectl-overview.md b/docs/user-guide/kubectl-overview.md index ff3813fb3a..3607f47d53 100644 --- a/docs/user-guide/kubectl-overview.md +++ b/docs/user-guide/kubectl-overview.md @@ -5,7 +5,7 @@ assignees: --- -`kubectl` is a command line interface for running commands against Kubernetes clusters. This overview quickly covers `kubectl` syntax, describes the command operations, and provides common examples. For details about each command, including all the supported flags and subcommands, see the [kubectl](/docs/user-guide/kubectl) reference documentation. For installation instructions see [prerequisites](/docs/user-guide/prereqs). +`kubectl` is a command line interface for running commands against Kubernetes clusters. This overview covers `kubectl` syntax, describes the command operations, and provides common examples. For details about each command, including all the supported flags and subcommands, see the [kubectl](/docs/user-guide/kubectl) reference documentation. For installation instructions see [prerequisites](/docs/user-guide/prereqs). TODO: Auto-generate this file to ensure it's always in sync with any `kubectl` changes, see [#14177](http://pr.k8s.io/14177). From 5b6055a3749df91ae277904117944d7020c524a8 Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Wed, 12 Oct 2016 18:47:00 -0300 Subject: [PATCH 14/93] Clarify secrets file mode might be read in decimal notation Fixes: https://github.com/kubernetes/kubernetes/issues/33475 --- docs/user-guide/secrets/index.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/user-guide/secrets/index.md b/docs/user-guide/secrets/index.md index 4da56a3cca..75527a2be5 100644 --- a/docs/user-guide/secrets/index.md +++ b/docs/user-guide/secrets/index.md @@ -344,6 +344,9 @@ In this case, the file resulting in `/etc/foo/my-group/my-username` will have permission value of `0777`. Owing to JSON limitations, you must specify the mode in decimal notation. +Note that this permission value might be displayed in decimal notation if you +read it later. + **Consuming Secret Values from Volumes** Inside the container that mounts a secret volume, the secret keys appear as From e80c15b5837437f5cf3d79f9a78c04fdb513e691 Mon Sep 17 00:00:00 2001 From: Ben Hall Date: Tue, 11 Oct 2016 11:31:41 +0100 Subject: [PATCH 15/93] Fix links for interactive scenarios. --- docs/tutorials/kubernetes-basics/cluster-interactive.html | 2 +- docs/tutorials/kubernetes-basics/cluster-intro.html | 2 +- docs/tutorials/kubernetes-basics/deploy-interactive.html | 2 +- docs/tutorials/kubernetes-basics/deploy-intro.html | 2 +- docs/tutorials/kubernetes-basics/explore-interactive.html | 2 +- docs/tutorials/kubernetes-basics/explore-intro.html | 2 +- docs/tutorials/kubernetes-basics/expose-interactive.html | 2 +- docs/tutorials/kubernetes-basics/expose-intro.html | 2 +- docs/tutorials/kubernetes-basics/scale-interactive.html | 2 +- docs/tutorials/kubernetes-basics/scale-intro.html | 2 +- docs/tutorials/kubernetes-basics/update-intro.html | 2 +- 11 files changed, 11 insertions(+), 11 deletions(-) diff --git a/docs/tutorials/kubernetes-basics/cluster-interactive.html b/docs/tutorials/kubernetes-basics/cluster-interactive.html index 8b07b331c7..f1de469494 100644 --- a/docs/tutorials/kubernetes-basics/cluster-interactive.html +++ b/docs/tutorials/kubernetes-basics/cluster-interactive.html @@ -22,7 +22,7 @@
- Continue to Module 2› + Continue to Module 2›
diff --git a/docs/tutorials/kubernetes-basics/cluster-intro.html b/docs/tutorials/kubernetes-basics/cluster-intro.html index 009a8e3947..eb7835e242 100644 --- a/docs/tutorials/kubernetes-basics/cluster-intro.html +++ b/docs/tutorials/kubernetes-basics/cluster-intro.html @@ -97,7 +97,7 @@ redirect_from:
- Start Interactive Tutorial › + Start Interactive Tutorial ›
diff --git a/docs/tutorials/kubernetes-basics/deploy-interactive.html b/docs/tutorials/kubernetes-basics/deploy-interactive.html index 73d7e9dfc3..ff3e4643d5 100644 --- a/docs/tutorials/kubernetes-basics/deploy-interactive.html +++ b/docs/tutorials/kubernetes-basics/deploy-interactive.html @@ -26,7 +26,7 @@
- Continue to Module 3› + Continue to Module 3›
diff --git a/docs/tutorials/kubernetes-basics/deploy-intro.html b/docs/tutorials/kubernetes-basics/deploy-intro.html index 9fafe6012e..3664398794 100644 --- a/docs/tutorials/kubernetes-basics/deploy-intro.html +++ b/docs/tutorials/kubernetes-basics/deploy-intro.html @@ -95,7 +95,7 @@
- Start Interactive Tutorial › + Start Interactive Tutorial ›
diff --git a/docs/tutorials/kubernetes-basics/explore-interactive.html b/docs/tutorials/kubernetes-basics/explore-interactive.html index 9b16d4bca4..db8d52a482 100644 --- a/docs/tutorials/kubernetes-basics/explore-interactive.html +++ b/docs/tutorials/kubernetes-basics/explore-interactive.html @@ -26,7 +26,7 @@
- Continue to Module 4› + Continue to Module 4›
diff --git a/docs/tutorials/kubernetes-basics/explore-intro.html b/docs/tutorials/kubernetes-basics/explore-intro.html index 4789838827..23dd27714b 100644 --- a/docs/tutorials/kubernetes-basics/explore-intro.html +++ b/docs/tutorials/kubernetes-basics/explore-intro.html @@ -129,7 +129,7 @@
- Start Interactive Tutorial › + Start Interactive Tutorial ›
diff --git a/docs/tutorials/kubernetes-basics/expose-interactive.html b/docs/tutorials/kubernetes-basics/expose-interactive.html index 3288807588..56b9ca4861 100644 --- a/docs/tutorials/kubernetes-basics/expose-interactive.html +++ b/docs/tutorials/kubernetes-basics/expose-interactive.html @@ -23,7 +23,7 @@
- Continue to Module 5› + Continue to Module 5›
diff --git a/docs/tutorials/kubernetes-basics/expose-intro.html b/docs/tutorials/kubernetes-basics/expose-intro.html index 81c1981bf4..8506bf8d9d 100644 --- a/docs/tutorials/kubernetes-basics/expose-intro.html +++ b/docs/tutorials/kubernetes-basics/expose-intro.html @@ -125,7 +125,7 @@
- Start Interactive Tutorial › + Start Interactive Tutorial ›
diff --git a/docs/tutorials/kubernetes-basics/scale-interactive.html b/docs/tutorials/kubernetes-basics/scale-interactive.html index d41b6cb36b..aa2134864d 100644 --- a/docs/tutorials/kubernetes-basics/scale-interactive.html +++ b/docs/tutorials/kubernetes-basics/scale-interactive.html @@ -23,7 +23,7 @@
- Continue to Module 6› + Continue to Module 6›
diff --git a/docs/tutorials/kubernetes-basics/scale-intro.html b/docs/tutorials/kubernetes-basics/scale-intro.html index b4b5d47c91..7d046756f9 100644 --- a/docs/tutorials/kubernetes-basics/scale-intro.html +++ b/docs/tutorials/kubernetes-basics/scale-intro.html @@ -107,7 +107,7 @@
- Start Interactive Tutorial › + Start Interactive Tutorial ›
diff --git a/docs/tutorials/kubernetes-basics/update-intro.html b/docs/tutorials/kubernetes-basics/update-intro.html index b7867f3b1f..411bef8d4f 100644 --- a/docs/tutorials/kubernetes-basics/update-intro.html +++ b/docs/tutorials/kubernetes-basics/update-intro.html @@ -122,7 +122,7 @@
- Start Interactive Tutorial › + Start Interactive Tutorial ›
From 0a28be36134737da3af0593e591f5e545cec4f50 Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Wed, 19 Oct 2016 08:55:03 -0400 Subject: [PATCH 16/93] Update networkpolicies.md --- docs/user-guide/networkpolicies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/networkpolicies.md b/docs/user-guide/networkpolicies.md index d7c4f572bb..91646633cd 100644 --- a/docs/user-guide/networkpolicies.md +++ b/docs/user-guide/networkpolicies.md @@ -89,7 +89,7 @@ __podSelector__: Each `NetworkPolicy` includes a `podSelector` which selects the __ingress__: Each `NetworkPolicy` includes a list of whitelist `ingress` rules. Each rule allows traffic which matches both the `from` and `ports` sections. -In plain language, this example NetworkPolicy: +This example NetworkPolicy has the following characteristics: 1. applies to all pods in the default namespace with the label "role=db" 2. allows tcp/6379 ingress traffic to the "role=db" pods from any pod in the current namespace with the label "role=frontend" (due to the podSelector list element) From d8688fa817129ed3cc358990c6b262349e265c16 Mon Sep 17 00:00:00 2001 From: Chris Marino Date: Fri, 21 Oct 2016 13:32:29 -0700 Subject: [PATCH 17/93] Add Romana to docs ToC, and kubeadm page --- _data/guides.yml | 2 ++ docs/admin/addons.md | 2 ++ docs/getting-started-guides/kubeadm.md | 2 +- docs/getting-started-guides/network-policy/romana.md | 9 +++++++++ 4 files changed, 14 insertions(+), 1 deletion(-) create mode 100644 docs/getting-started-guides/network-policy/romana.md diff --git a/_data/guides.yml b/_data/guides.yml index 40d47b08d6..8214dcb740 100644 --- a/_data/guides.yml +++ b/_data/guides.yml @@ -68,6 +68,8 @@ toc: path: /docs/getting-started-guides/network-policy/walkthrough/ - title: Using Calico for NetworkPolicy path: /docs/getting-started-guides/network-policy/calico/ + - title: Using Romana for NetworkPolicy + path: /docs/getting-started-guides/network-policy/romana/ - title: Batch Jobs section: diff --git a/docs/admin/addons.md b/docs/admin/addons.md index 6e28edfaa2..02898e2857 100644 --- a/docs/admin/addons.md +++ b/docs/admin/addons.md @@ -12,6 +12,8 @@ This page lists some of the available add-ons and links to their respective inst * [Weave Net](https://github.com/weaveworks/weave-kube) provides networking and network policy, will carry on working on both sides of a network partition, and does not require an external database. * [Calico](https://github.com/projectcalico/calico-containers/tree/master/docs/cni/kubernetes/manifests/kubeadm) is a secure L3 networking and network policy provider. * [Canal](https://github.com/tigera/canal/tree/master/k8s-install/kubeadm) unites Flannel and Calico, providing networking and network policy. +* [Romana](romana.io) is a Layer 3 networking solution for network policy. Kubeadmin add-on installation details available [here](https://github.com/romana/romana/tree/master/containerize) + ## Visualization & Control diff --git a/docs/getting-started-guides/kubeadm.md b/docs/getting-started-guides/kubeadm.md index f4f4c15211..e7326c73df 100644 --- a/docs/getting-started-guides/kubeadm.md +++ b/docs/getting-started-guides/kubeadm.md @@ -166,7 +166,7 @@ By way of example, you can install [Weave Net](https://github.com/weaveworks/wea # kubectl apply -f https://git.io/weave-kube daemonset "weave-net" created -If you prefer [Calico](https://github.com/projectcalico/calico-containers/tree/master/docs/cni/kubernetes/manifests/kubeadm) or [Canal](https://github.com/tigera/canal/tree/master/k8s-install/kubeadm), please refer to their respective installation guides. +If you prefer [Calico](https://github.com/projectcalico/calico-containers/tree/master/docs/cni/kubernetes/manifests/kubeadm) or [Canal](https://github.com/tigera/canal/tree/master/k8s-install/kubeadm), or [Romana](https://github.com/romana/romana/tree/master/containerize) please refer to their respective installation guides. You should only install one pod network per cluster. Once a pod network has been installed, you can confirm that it is working by checking that the `kube-dns` pod is `Running` in the output of `kubectl get pods --all-namespaces`. diff --git a/docs/getting-started-guides/network-policy/romana.md b/docs/getting-started-guides/network-policy/romana.md new file mode 100644 index 0000000000..7a4dea113a --- /dev/null +++ b/docs/getting-started-guides/network-policy/romana.md @@ -0,0 +1,9 @@ +--- +assignees: +- chrismarino + +--- + +Romana details + +More changes. From f5ca6fae323501cb4e161d89b0d506ab2dd18c21 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Sat, 22 Oct 2016 03:19:06 +0100 Subject: [PATCH 18/93] Update documentation about CNI flags and requirements (#1516) * Update CNI kubelet option names * Expand the minimum CNI requirements --- docs/admin/network-plugins.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/admin/network-plugins.md b/docs/admin/network-plugins.md index c0397016da..8cfeb658c9 100644 --- a/docs/admin/network-plugins.md +++ b/docs/admin/network-plugins.md @@ -36,7 +36,11 @@ Place plugins in `network-plugin-dir/plugin-name/plugin-name`, i.e if you have a ### CNI -The CNI plugin is selected by passing Kubelet the `--network-plugin=cni` command-line option. Kubelet reads the first CNI configuration file from `--network-plugin-dir` and uses the CNI configuration from that file to set up each pod's network. The CNI configuration file must match the [CNI specification](https://github.com/containernetworking/cni/blob/master/SPEC.md), and any required CNI plugins referenced by the configuration must be present in `/opt/cni/bin`. +The CNI plugin is selected by passing Kubelet the `--network-plugin=cni` command-line option. Kubelet reads a file from `--cni-conf-dir` (default `/etc/cni/net.d`) and uses the CNI configuration from that file to set up each pod's network. The CNI configuration file must match the [CNI specification](https://github.com/containernetworking/cni/blob/master/SPEC.md), and any required CNI plugins referenced by the configuration must be present in `--cni-bin-dir` (default `/opt/cni/bin`). + +If there are multiple CNI configuration files in the directory, the first one in lexicographic order of file name is used. + +In addition to the CNI plugin specified by the configuration file, Kubernetes requires the standard CNI `lo` plugin, at minimum version 0.2.0 ### kubenet @@ -44,7 +48,7 @@ The Linux-only kubenet plugin provides functionality similar to the `--configure The plugin requires a few things: -* The standard CNI `bridge` and `host-local` plugins are required. Kubenet will first search for them in `/opt/cni/bin`. Specify `network-plugin-dir` to supply additional search path. The first found match will take effect. +* The standard CNI `bridge`, `lo` and `host-local` plugins are required, at minimum version 0.2.0. Kubenet will first search for them in `/opt/cni/bin`. Specify `network-plugin-dir` to supply additional search path. The first found match will take effect. * Kubelet must be run with the `--network-plugin=kubenet` argument to enable the plugin * Kubelet must also be run with the `--reconcile-cidr` argument to ensure the IP subnet assigned to the node by configuration or the controller-manager is propagated to the plugin * The node must be assigned an IP subnet through either the `--pod-cidr` kubelet command-line option or the `--allocate-node-cidrs=true --cluster-cidr=` controller-manager command-line options. @@ -66,6 +70,6 @@ This option is provided to the network-plugin; currently **only kubenet supports ## Usage Summary * `--network-plugin=exec` specifies that we use the `exec` plugin, with executables located in `--network-plugin-dir`. -* `--network-plugin=cni` specifies that we use the `cni` network plugin with actual CNI plugin binaries located in `/opt/cni/bin` and CNI plugin configuration located in `network-plugin-dir`, config location defaults to `/etc/cni/net.d`. +* `--network-plugin=cni` specifies that we use the `cni` network plugin with actual CNI plugin binaries located in `--cni-bin-dir` (default `/opt/cni/bin`) and CNI plugin configuration located in `--cni-conf-dir` (default `/etc/cni/net.d`). * `--network-plugin=kubenet` specifies that we use the `kubenet` network plugin with CNI `bridge` and `host-local` plugins placed in `/opt/cni/bin` or `network-plugin-dir`. * `--network-plugin-mtu=9001` specifies the MTU to use, currently only used by the `kubenet` network plugin. \ No newline at end of file From ed4c37d5114ee5d4ada26866838a8b571018b2bd Mon Sep 17 00:00:00 2001 From: Ilya Dmitrichenko Date: Thu, 20 Oct 2016 12:33:42 +0100 Subject: [PATCH 19/93] Get rid of git dependency in kubeadm guide --- docs/getting-started-guides/kubeadm.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/getting-started-guides/kubeadm.md b/docs/getting-started-guides/kubeadm.md index f4f4c15211..4fa854cc94 100644 --- a/docs/getting-started-guides/kubeadm.md +++ b/docs/getting-started-guides/kubeadm.md @@ -177,8 +177,8 @@ Once a pod network has been installed, you can confirm that it is working by che As an example, install a sample microservices application, a socks shop, to put your cluster through its paces. To learn more about the sample microservices app, see the [GitHub README](https://github.com/microservices-demo/microservices-demo). - # git clone https://github.com/microservices-demo/microservices-demo - # kubectl apply -f microservices-demo/deploy/kubernetes/manifests/sock-shop-ns.yml -f microservices-demo/deploy/kubernetes/manifests + # kubectl create namespace sock-shop + # kubectl apply -n sock-shop -f "https://github.com/microservices-demo/microservices-demo/blob/master/deploy/kubernetes/complete-demo.yaml?raw=true" You can then find out the port that the [NodePort feature of services](/docs/user-guide/services/) allocated for the front-end service by running: @@ -216,7 +216,7 @@ See the [list of add-ons](/docs/admin/addons/) to explore other add-ons, includi ## Cleanup -* To uninstall the socks shop, run `kubectl delete -f microservices-demo/deploy/kubernetes/manifests` on the master. +* To uninstall the socks shop, run `kubectl delete namespace sock-shop` on the master. * To undo what `kubeadm` did, simply delete the machines you created for this tutorial, or run the script below and then start over or uninstall the packages. From a79c12489e32eaf62a7fb98cd7e0879ddf12dde3 Mon Sep 17 00:00:00 2001 From: MichalMankowski Date: Mon, 24 Oct 2016 16:21:16 +0200 Subject: [PATCH 20/93] fix typo and add section about kubectl configuration --- .../centos/centos_manual_config.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/docs/getting-started-guides/centos/centos_manual_config.md b/docs/getting-started-guides/centos/centos_manual_config.md index 75b7cccbf7..ffa2d402f5 100644 --- a/docs/getting-started-guides/centos/centos_manual_config.md +++ b/docs/getting-started-guides/centos/centos_manual_config.md @@ -123,7 +123,7 @@ KUBE_API_ARGS="" ```shell $ etcdctl mkdir /kube-centos/network -$ etcdclt mk /kube-centos/network/config "{ \"Network\": \"172.30.0.0/16\", \"SubnetLen\": 24, \"Backend\": { \"Type\": \"vxlan\" } }" +$ etcdctl mk /kube-centos/network/config "{ \"Network\": \"172.30.0.0/16\", \"SubnetLen\": 24, \"Backend\": { \"Type\": \"vxlan\" } }" ``` * Configure flannel to overlay Docker network in /etc/sysconfig/flanneld on the master (also in the nodes as we'll see): @@ -196,6 +196,13 @@ for SERVICES in kube-proxy kubelet flanneld docker; do systemctl status $SERVICES done ``` +* Configure kubectl + +```shell +kubectl config set-cluster default-cluster --server=http://kube-centos:8080 +kubectl config set-context default-system --cluster=default-cluster --user=default-admin +kubectl config use-context default-system +``` *You should be finished!* From cacbf7ca350824ea05699552ac20496bbc1f82fb Mon Sep 17 00:00:00 2001 From: masstomato Date: Mon, 24 Oct 2016 23:22:37 +0900 Subject: [PATCH 21/93] Fix typo Fix 'ectdclt' to 'etcdctl'. --- docs/getting-started-guides/centos/centos_manual_config.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started-guides/centos/centos_manual_config.md b/docs/getting-started-guides/centos/centos_manual_config.md index 75b7cccbf7..fc091e7357 100644 --- a/docs/getting-started-guides/centos/centos_manual_config.md +++ b/docs/getting-started-guides/centos/centos_manual_config.md @@ -123,7 +123,7 @@ KUBE_API_ARGS="" ```shell $ etcdctl mkdir /kube-centos/network -$ etcdclt mk /kube-centos/network/config "{ \"Network\": \"172.30.0.0/16\", \"SubnetLen\": 24, \"Backend\": { \"Type\": \"vxlan\" } }" +$ etcdctl mk /kube-centos/network/config "{ \"Network\": \"172.30.0.0/16\", \"SubnetLen\": 24, \"Backend\": { \"Type\": \"vxlan\" } }" ``` * Configure flannel to overlay Docker network in /etc/sysconfig/flanneld on the master (also in the nodes as we'll see): From fff7f38748f1efd47dc7fcf1152b2b619d7c8c8d Mon Sep 17 00:00:00 2001 From: MichalMankowski Date: Mon, 24 Oct 2016 16:24:01 +0200 Subject: [PATCH 22/93] change to kube-centos --- docs/getting-started-guides/centos/centos_manual_config.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started-guides/centos/centos_manual_config.md b/docs/getting-started-guides/centos/centos_manual_config.md index ffa2d402f5..f95d4bebd6 100644 --- a/docs/getting-started-guides/centos/centos_manual_config.md +++ b/docs/getting-started-guides/centos/centos_manual_config.md @@ -199,7 +199,7 @@ done * Configure kubectl ```shell -kubectl config set-cluster default-cluster --server=http://kube-centos:8080 +kubectl config set-cluster default-cluster --server=http://centos-master:8080 kubectl config set-context default-system --cluster=default-cluster --user=default-admin kubectl config use-context default-system ``` From 4fd44b16043a2aa88d918acade36da2c4e3d1645 Mon Sep 17 00:00:00 2001 From: Devan Goodwin Date: Thu, 20 Oct 2016 12:45:54 -0300 Subject: [PATCH 23/93] Document kubeadm --skip-preflight-checks. --- docs/admin/kubeadm.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/docs/admin/kubeadm.md b/docs/admin/kubeadm.md index 57a21528c2..989c925862 100644 --- a/docs/admin/kubeadm.md +++ b/docs/admin/kubeadm.md @@ -12,6 +12,11 @@ This document provides information on how to use kubeadm's advanced options. Running kubeadm init bootstraps a Kubernetes cluster. This consists of the following steps: +1. kubeadm runs a series of pre-flight checks to validate the system state +before making changes. Some checks only trigger warnings, others are +considered errors and will exit kubeadm until the problem is corrected or +the user specifies `--skip-preflight-checks`. + 1. kubeadm generates a token that additional nodes can use to register themselves with the master in future. @@ -112,6 +117,12 @@ to change the DNS name suffix. Again, you will need to update the `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` file accordingly else DNS will not function correctly. +- `--skip-preflight-checks` + +By default, `kubeadm` runs a series of preflight checks to validate the system +before making any changes. Advanced users can use this flag to bypass these if +necessary. + - `--token` By default, `kubeadm init` automatically generates the token used to initialise @@ -134,6 +145,12 @@ Here's an example on how to use it: `kubeadm join --token=the_secret_token 192.168.1.1` +- `--skip-preflight-checks` + +By default, `kubeadm` runs a series of preflight checks to validate the system +before making any changes. Advanced users can use this flag to bypass these if +necessary. + - `--token=` By default, when `kubeadm init` runs, a token is generated and revealed in the output. From 56a8e8bafc5843b6ba084a20dbc879590191f355 Mon Sep 17 00:00:00 2001 From: Chris Marino Date: Mon, 24 Oct 2016 08:22:02 -0700 Subject: [PATCH 24/93] Minor content re-org, edits --- Gemfile.lock | 5 +++++ docs/admin/addons.md | 3 +-- docs/admin/networking.md | 4 ++-- docs/getting-started-guides/kubeadm.md | 5 ++--- docs/getting-started-guides/network-policy/romana.md | 12 ++++++++++-- .../network-policy/walkthrough.md | 9 ++++++++- docs/getting-started-guides/scratch.md | 9 ++------- 7 files changed, 30 insertions(+), 17 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index ee385b958b..1229f4c4a0 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -17,6 +17,7 @@ GEM faraday (0.9.2) multipart-post (>= 1.2, < 3) ffi (1.9.14) + ffi (1.9.14-x64-mingw32) forwardable-extended (2.6.0) gemoji (2.1.0) html-pipeline (2.4.2) @@ -74,6 +75,9 @@ GEM nokogiri (1.6.8) mini_portile2 (~> 2.1.0) pkg-config (~> 1.1.7) + nokogiri (1.6.8-x64-mingw32) + mini_portile2 (~> 2.1.0) + pkg-config (~> 1.1.7) octokit (4.3.0) sawyer (~> 0.7.0, >= 0.5.3) pathutil (0.14.0) @@ -94,6 +98,7 @@ GEM PLATFORMS ruby + x64-mingw32 DEPENDENCIES activesupport (= 4.2.7) diff --git a/docs/admin/addons.md b/docs/admin/addons.md index 02898e2857..5e6573d349 100644 --- a/docs/admin/addons.md +++ b/docs/admin/addons.md @@ -12,8 +12,7 @@ This page lists some of the available add-ons and links to their respective inst * [Weave Net](https://github.com/weaveworks/weave-kube) provides networking and network policy, will carry on working on both sides of a network partition, and does not require an external database. * [Calico](https://github.com/projectcalico/calico-containers/tree/master/docs/cni/kubernetes/manifests/kubeadm) is a secure L3 networking and network policy provider. * [Canal](https://github.com/tigera/canal/tree/master/k8s-install/kubeadm) unites Flannel and Calico, providing networking and network policy. -* [Romana](romana.io) is a Layer 3 networking solution for network policy. Kubeadmin add-on installation details available [here](https://github.com/romana/romana/tree/master/containerize) - +* [Romana](http://romana.io) is a Layer 3 networking solution for network policy. Kubeadmin add-on installation details available [here](https://github.com/romana/romana/tree/master/containerize). ## Visualization & Control diff --git a/docs/admin/networking.md b/docs/admin/networking.md index 9275b88565..2acbf062d4 100644 --- a/docs/admin/networking.md +++ b/docs/admin/networking.md @@ -1,4 +1,4 @@ ---- +--- assignees: - lavalamp - thockin @@ -191,7 +191,7 @@ Calico can also be run in policy enforcement mode in conjunction with other netw ### Romana -[Romana](http://romana.io) is an open source software defined networking (SDN) solution that lets you deploy Kubernetes without an overlay network. +[Romana](http://romana.io) is an open source network and security automation solution that lets you deploy Kubernetes without an overlay network. Romana supports Kubernetes [Network Policy](/docs/user-guide/networkpolicies/) to provide isolation across network namespaces. ### Contiv diff --git a/docs/getting-started-guides/kubeadm.md b/docs/getting-started-guides/kubeadm.md index e7326c73df..1672c8a614 100644 --- a/docs/getting-started-guides/kubeadm.md +++ b/docs/getting-started-guides/kubeadm.md @@ -158,15 +158,14 @@ Before you can deploy applications to it, you need to install a pod network. You must install a pod network add-on so that your pods can communicate with each other when they are on different hosts. **It is necessary to do this before you try to deploy any applications to your cluster.** -Several projects provide Kubernetes pod networks. -You can see a complete list of available network add-ons on the [add-ons page](/docs/admin/addons/). +Several projects are available that enable Kubernetes pod networks including Calico, Romana and Weave. Some may also support [Network Policy](/docs/user-guide/networkpolicies/). See the [add-ons page](/docs/admin/addons/) for a complete list of available network add-ons. By way of example, you can install [Weave Net](https://github.com/weaveworks/weave-kube) by logging in to the master and running: # kubectl apply -f https://git.io/weave-kube daemonset "weave-net" created -If you prefer [Calico](https://github.com/projectcalico/calico-containers/tree/master/docs/cni/kubernetes/manifests/kubeadm) or [Canal](https://github.com/tigera/canal/tree/master/k8s-install/kubeadm), or [Romana](https://github.com/romana/romana/tree/master/containerize) please refer to their respective installation guides. +If you prefer [Calico](https://github.com/projectcalico/calico-containers/tree/master/docs/cni/kubernetes/manifests/kubeadm) or [Canal](https://github.com/tigera/canal/tree/master/k8s-install/kubeadm), or [Romana](/docs/getting-started-guides/network-policy/romana/) please refer to their respective installation guides. You should only install one pod network per cluster. Once a pod network has been installed, you can confirm that it is working by checking that the `kube-dns` pod is `Running` in the output of `kubectl get pods --all-namespaces`. diff --git a/docs/getting-started-guides/network-policy/romana.md b/docs/getting-started-guides/network-policy/romana.md index 7a4dea113a..26ca728490 100644 --- a/docs/getting-started-guides/network-policy/romana.md +++ b/docs/getting-started-guides/network-policy/romana.md @@ -4,6 +4,14 @@ assignees: --- -Romana details +# Installation with kubeadmin + +Begin by following the [kubeadm getting started guide](/docs/getting-started-guides/kubeadm/) and complete steps 1, 2, and 3. + +Once completed, follow the [containerized installation guide](https://github.com/romana/romana/tree/master/containerize) for kubeadmin. + +## Romana Network Policy Resources + +* [Overview of Romana Network Policy](https://github.com/romana/romana/wiki/Romana-policies) +* [Example Policies](https://github.com/romana/core/tree/master/policy) -More changes. diff --git a/docs/getting-started-guides/network-policy/walkthrough.md b/docs/getting-started-guides/network-policy/walkthrough.md index 122baa653a..e4e86be5a7 100644 --- a/docs/getting-started-guides/network-policy/walkthrough.md +++ b/docs/getting-started-guides/network-policy/walkthrough.md @@ -6,7 +6,14 @@ assignees: Kubernetes can be used to declare network policies which govern how Pods can communicate with each other. This document helps you get started using the Kubernetes [NetworkPolicy API](/docs/user-guide/networkpolicies), and provides a demonstration thereof. -In this article we assume that a Kubernetes cluster has been created with network policy support. There are a number of network providers which support NetworkPolicy (see the "Using X for NetworkPolicy" articles in this section). The reference implementation is [Calico](/docs/getting-started-guides/network-policy/calico) running on GCE. +In this article, we assume a network provider that supports the NetworkPolicy API has been installed. Network providers can be installed as add-ons using [kubeadmin](/docs/getting-started-guides/kubeadm/), or any other suitable cluster installer. + +There are a number of network providers which support NetworkPolicy including: + +* [Calico](/docs/getting-started-guides/network-policy/calico/) +* [Romana](/docs/getting-started-guides/network-policy/romana/) + +The reference implementation is [Calico](/docs/getting-started-guides/network-policy/calico) running on GCE. The following example walkthrough will work on a Kubernetes cluster using any of the listed providers. diff --git a/docs/getting-started-guides/scratch.md b/docs/getting-started-guides/scratch.md index 970939465d..5eca3be201 100644 --- a/docs/getting-started-guides/scratch.md +++ b/docs/getting-started-guides/scratch.md @@ -85,6 +85,7 @@ to implement one of the above options: - [Flannel](https://github.com/coreos/flannel) - [Calico](http://https://github.com/projectcalico/calico-containers) - [Weave](http://weave.works/) + - [Romana](http://romana.io/) - [Open vSwitch (OVS)](http://openvswitch.org/) - [More found here](/docs/admin/networking#how-to-achieve-this) - You can also write your own. @@ -129,14 +130,8 @@ Also, you need to pick a static IP for master node. #### Network Policy -Kubernetes enables the definition of fine-grained network policy between Pods -using the [NetworkPolicy](/docs/user-guide/networkpolicy) resource. +Kubernetes enables the definition of fine-grained network policy between Pods using the [NetworkPolicy](/docs/user-guide/network-policy) resource. -Not all networking providers support the Kubernetes NetworkPolicy features. -For clusters which choose to enable NetworkPolicy, the -[Calico policy controller addon](https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/calico-policy-controller) -can enforce the NetworkPolicy API on top of native cloud-provider networking, -Flannel, or Calico networking. ### Cluster Naming From b36034a97c9ba9d606a03438b95f52aabe690754 Mon Sep 17 00:00:00 2001 From: Chris Marino Date: Mon, 24 Oct 2016 08:22:22 -0700 Subject: [PATCH 25/93] edits --- docs/getting-started-guides/scratch.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/getting-started-guides/scratch.md b/docs/getting-started-guides/scratch.md index 5eca3be201..d1695c0bab 100644 --- a/docs/getting-started-guides/scratch.md +++ b/docs/getting-started-guides/scratch.md @@ -132,6 +132,7 @@ Also, you need to pick a static IP for master node. Kubernetes enables the definition of fine-grained network policy between Pods using the [NetworkPolicy](/docs/user-guide/network-policy) resource. +Not all networking providers support the Kubernetes NetworkPolicy API, see [Using Network Policy](/docs/getting-started-guides/network-policy/walkthrough/) for more information. ### Cluster Naming From e162232e3675d4c15f90d9a1a619c9ea047caf38 Mon Sep 17 00:00:00 2001 From: Chris Marino Date: Mon, 24 Oct 2016 09:15:09 -0700 Subject: [PATCH 26/93] revert Gemfile --- Gemfile.lock | 5 ----- 1 file changed, 5 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 1229f4c4a0..ee385b958b 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -17,7 +17,6 @@ GEM faraday (0.9.2) multipart-post (>= 1.2, < 3) ffi (1.9.14) - ffi (1.9.14-x64-mingw32) forwardable-extended (2.6.0) gemoji (2.1.0) html-pipeline (2.4.2) @@ -75,9 +74,6 @@ GEM nokogiri (1.6.8) mini_portile2 (~> 2.1.0) pkg-config (~> 1.1.7) - nokogiri (1.6.8-x64-mingw32) - mini_portile2 (~> 2.1.0) - pkg-config (~> 1.1.7) octokit (4.3.0) sawyer (~> 0.7.0, >= 0.5.3) pathutil (0.14.0) @@ -98,7 +94,6 @@ GEM PLATFORMS ruby - x64-mingw32 DEPENDENCIES activesupport (= 4.2.7) From e21ed27c58219b9db5be0f8f4a596f5f53e02965 Mon Sep 17 00:00:00 2001 From: Joe Beda Date: Mon, 17 Oct 2016 11:11:45 -0700 Subject: [PATCH 27/93] Document kubeadm automation. --- docs/admin/kubeadm.md | 60 ++++++++++++++++++++------ docs/getting-started-guides/kubeadm.md | 2 + 2 files changed, 48 insertions(+), 14 deletions(-) diff --git a/docs/admin/kubeadm.md b/docs/admin/kubeadm.md index 989c925862..451041ceb5 100644 --- a/docs/admin/kubeadm.md +++ b/docs/admin/kubeadm.md @@ -9,7 +9,7 @@ assignees: This document provides information on how to use kubeadm's advanced options. -Running kubeadm init bootstraps a Kubernetes cluster. This consists of the +Running `kubeadm init` bootstraps a Kubernetes cluster. This consists of the following steps: 1. kubeadm runs a series of pre-flight checks to validate the system state @@ -17,23 +17,35 @@ before making changes. Some checks only trigger warnings, others are considered errors and will exit kubeadm until the problem is corrected or the user specifies `--skip-preflight-checks`. -1. kubeadm generates a token that additional nodes can use to register themselves -with the master in future. +1. kubeadm generates a token that additional nodes can use to register +themselves with the master in future. Optionally, the user can provide a token. 1. kubeadm generates a self-signed CA using openssl to provision identities for each node in the cluster, and for the API server to secure communication with clients. -1. Outputting a kubeconfig file for the kubelet to use to connect to the API server, -as well as an additional kubeconfig file for administration. +1. Outputting a kubeconfig file for the kubelet to use to connect to the API +server, as well as an additional kubeconfig file for administration. -1. kubeadm generates Kubernetes resource manifests for the API server, controller manager -and scheduler, and placing them in `/etc/kubernetes/manifests`. The kubelet watches -this directory for static resources to create on startup. These are the core -components of Kubernetes, and once they are up and running we can use `kubectl` -to set up/manage any additional components. +1. kubeadm generates Kubernetes resource manifests for the API server, +controller manager and scheduler, and placing them in +`/etc/kubernetes/manifests`. The kubelet watches this directory for static +resources to create on startup. These are the core components of Kubernetes, and +once they are up and running we can use `kubectl` to set up/manage any +additional components. -1. kubeadm installs any add-on components, such as DNS or discovery, via the API server. +1. kubeadm installs any add-on components, such as DNS or discovery, via the API +server. + +Running `kubeadm join` on each node in the cluster consists of the following steps: + +1. Use the token to talk to the API server and securely get the root CA +certificate. + +1. Creates a local key pair. Prepares a certificate signing request (CSR) and +sends that off to the API server for signing. + +1. Configures the local kubelet to connect to the API server ## Usage @@ -127,7 +139,7 @@ necessary. By default, `kubeadm init` automatically generates the token used to initialise each new node. If you would like to manually specify this token, you can use the -`--token` flag. The token must be of the format '<6 character string>.<16 character string>'. +`--token` flag. The token must be of the format `<6 character string>.<16 character string>`. - `--use-kubernetes-version` (default 'v1.4.1') the kubernetes version to initialise @@ -138,8 +150,8 @@ for a full list of available versions). ### `kubeadm join` -`kubeadm join` has one mandatory flag, the token used to secure cluster bootstrap, -and one mandatory argument, the master IP address. +When you use kubeadm join, you must supply the token used to secure cluster +boostrap as a mandatory flag, and the master IP address as a mandatory argument. Here's an example on how to use it: @@ -156,6 +168,26 @@ necessary. By default, when `kubeadm init` runs, a token is generated and revealed in the output. That's the token you should use here. +## Automating kubeadm + +Rather than copying the token you obtained from `kubeadm init` to each node, as +in the basic `kubeadm` tutorials, you can parallelize the token distribution for +easier automation. To implement this automation, you must know the IP address +that the master will have after it is started. + +1. Generate a token. This token must have the form `<6 character string>.<16 +character string>` + + Here is a simple python one-liner for this: + + ``` + python -c 'import random; print "%0x.%0x" % (random.SystemRandom().getrandbits(3*8), random.SystemRandom().getrandbits(8*8))' + ``` + +1. Start both the master node and the worker nodes concurrently with this token. As they come up they should find each other and form the cluster. + +Once the cluster is up, you can grab the admin credentials from the master node at `/etc/kubernetes/admin.conf` and use that to talk to the cluster. + ## Troubleshooting * Some users on RHEL/CentOS 7 have reported issues with traffic being routed incorrectly due to iptables being bypassed. You should ensure `net.bridge.bridge-nf-call-iptables` is set to 1 in your sysctl config, eg. diff --git a/docs/getting-started-guides/kubeadm.md b/docs/getting-started-guides/kubeadm.md index 4fa854cc94..cd73f3e73f 100644 --- a/docs/getting-started-guides/kubeadm.md +++ b/docs/getting-started-guides/kubeadm.md @@ -13,6 +13,8 @@ The installation uses a tool called `kubeadm` which is part of Kubernetes 1.4. This process works with local VMs, physical servers and/or cloud servers. It is simple enough that you can easily integrate its use into your own automation (Terraform, Chef, Puppet, etc). +See the full [`kubeadm` reference](/docs/admin/kubeadm) for information on all `kubeadm` command-line flags and for advice on automating `kubeadm` itself. + **The `kubeadm` tool is currently in alpha but please try it out and give us [feedback](/docs/getting-started-guides/kubeadm/#feedback)!** ## Prerequisites From 71de608f4d5141be89db659b203dadeb031d5406 Mon Sep 17 00:00:00 2001 From: Joe Beda Date: Mon, 17 Oct 2016 12:30:58 -0700 Subject: [PATCH 28/93] Document kubeadm evn variables --- docs/admin/kubeadm.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/docs/admin/kubeadm.md b/docs/admin/kubeadm.md index 451041ceb5..a8acd6b1cb 100644 --- a/docs/admin/kubeadm.md +++ b/docs/admin/kubeadm.md @@ -188,6 +188,21 @@ character string>` Once the cluster is up, you can grab the admin credentials from the master node at `/etc/kubernetes/admin.conf` and use that to talk to the cluster. +## Environment variables + +There are some environment variables that modify the way that `kubeadm` works. Most users will have no need to set these. + +| Variable | Default | Description | +| --- | --- | --- | +| `KUBE_KUBERNETES_DIR` | `/etc/kubernetes` | Where most configuration files are written to and read from | +| `KUBE_HOST_PKI_PATH` | `/etc/kubernetes/pki` | Directory for master PKI assets | +| `KUBE_HOST_ETCD_PATH` | `/var/lib/etcd` | Local etcd state for Kubernetes cluster | +| `KUBE_HYPERKUBE_IMAGE` | `` | If set, use a single hyperkube image with this name. If not set, individual images per server component will be used. | +| `KUBE_DISCOVERY_IMAGE` | `gcr.io/google_containers/kube-discovery-:1.0` | The bootstrap discovery helper image to use. | +| `KUBE_ETCD_IMAGE` | `gcr.io/google_containers/etcd-:2.2.5` | The etcd container image to use. | +| `KUBE_COMPONENT_LOGLEVEL` | `--v=4` | Logging configuration for all Kubernetes components | + + ## Troubleshooting * Some users on RHEL/CentOS 7 have reported issues with traffic being routed incorrectly due to iptables being bypassed. You should ensure `net.bridge.bridge-nf-call-iptables` is set to 1 in your sysctl config, eg. From 569d9b2fe8046a6450b279e8923d2166b851de08 Mon Sep 17 00:00:00 2001 From: ankurshukla Date: Mon, 24 Oct 2016 14:59:01 -0700 Subject: [PATCH 29/93] Updates to the ISV label and adding 2 new ISV partners --- _includes/partner-script.js | 30 ++++++++++++++++++++++-------- images/square-logos/diamanti.png | Bin 0 -> 12983 bytes images/square-logos/sematext.png | Bin 0 -> 15119 bytes partners/index.html | 2 +- 4 files changed, 23 insertions(+), 9 deletions(-) create mode 100644 images/square-logos/diamanti.png create mode 100644 images/square-logos/sematext.png diff --git a/_includes/partner-script.js b/_includes/partner-script.js index 79cbf6d513..4d1c78a734 100644 --- a/_includes/partner-script.js +++ b/_includes/partner-script.js @@ -126,6 +126,20 @@ link: 'https://github.com/nuagenetworks/nuage-kubernetes', blurb: 'The Nuage SDN platform provides policy-based networking between Kubernetes Pods and non-Kubernetes environments with visibility and security monitoring.' }, + { + type: 0, + name: 'Sematext', + logo: 'sematext', + link: 'https://sematext.com/kubernetes/', + blurb: 'Logging & Monitoring: Automatic collection and processing of Metrics, Events and Logs for auto-discovered pods and Kubernetes nodes.' + }, + { + type: 0, + name: 'Diamanti', + logo: 'diamanti', + link: 'https://www.diamanti.com/products/', + blurb: 'Diamanti deploys containers with guaranteed performance using Kubernetes in the first hyperconverged appliance purpose built for containerized applications.' + }, { type: 1, name: 'Apprenda', @@ -169,28 +183,28 @@ blurb: 'Container Solutions is a premium software consultancy that focuses on programmable infrastructure, offering our expertise in software development, strategy and operations to help you innovate at speed and scale.' } ] - + var isvContainer = document.getElementById('isvContainer') var servContainer = document.getElementById('servContainer') - + var sorted = partners.sort(function (a, b) { if (a.name > b.name) return 1 if (a.name < b.name) return -1 return 0 }) - + sorted.forEach(function (obj) { var box = document.createElement('div') box.className = 'partner-box' var img = document.createElement('img') img.src = '/images/square-logos/' + obj.logo + '.png' - + var div = document.createElement('div') - + var p = document.createElement('p') p.textContent = obj.blurb - + var link = document.createElement('a') link.href = obj.link link.target = '_blank' @@ -201,8 +215,8 @@ box.appendChild(img) box.appendChild(div) - + var container = obj.type ? servContainer : isvContainer container.appendChild(box) }) -})(); \ No newline at end of file +})(); diff --git a/images/square-logos/diamanti.png b/images/square-logos/diamanti.png new file mode 100644 index 0000000000000000000000000000000000000000..37f1d989982a1ab4c467a5625b44821095c1d4ca GIT binary patch literal 12983 zcmZ{~bx<5Z*SEd+2G`)81a}hL-95Mmm&M(k;KAM9ZE+_!izT=_Ebc*H?x&u&>Z`lH z_m7#bI@QxN)79tnIlsOll@+DXkcp51005edw7BYfTl{{d01@BsJ-?-w-kT2&(%Q}d z01D23E*L;Y76AZ&tYjr7rmSoUasfG8f*dGh#Kb5ZoIvJQwq^i;$8xrsg}U0&M}hnG z8&SE4fFwDPDjtwRRWvF9H{lCCHRs;;ver;vJqs43DMDqjOo%SFksHiL%;hqiW^ zg#(d4IRG$$jXx-zU#MXK4}Sdo3{<^H-2fPmITRqES0S^Pl_dNP<5)CZ4<;Z4rq?Bb zTMih23lR2-6)gb>OTq+Xr+rZa6JXc3$_UDjkFYfGrol znO8=ZMxp>d!~nb3g3o90mIf$!uJ=*q4H&}BfV`t+&1;AM%#B2TeB08}-tO+A?4YQw z@tCIXt3|(IujY&GKR^EG``gX#?N5R1`himL51aiHH}b_KQ@=ihn5^!{Nj7(ro`~WX90>m+$w>}B$|%bQ&pi> z4iVLTuY&7{yfvMwcZbIgl<58N4c=Xp!kA1%T1#F_aZ$RAg5(n?*766g4{#wW{WMgG zWpYhl+Ohr(5}2^Fg=QlG`1m7KL#r9NUT z&*YRQqD~xL{$bOA#FNBG!7viKo4q@*%dtzmOL?V>oNXfPSoEN_O{+R)ElaqExyQMO zXqLtlC2j`cN8N3=R0tXiuQUWUWzn!z&}{82`(xVj*Dj>r<<^4_ZU(4`$~ zEtyO)by{P1E{bqiot29Xns$(m zkq*+(q6gFa;3bS9C(9;(NhYReQ7^A3saUT-(YV$aSC1<%rBb6J zTN$cGtY%TpR~BAjQ3g^MD)Q5QiA2;MkRMPID^kg;H{9tQqChbvZ1iBHv_Y#3a}E4D z_@#bw$;XYpBkhH>BTAs6JfBC5LzY9cQS~~>TnK3=&G8}2Me)M{ZE5PY-_Ld2bGmIh z;u22zHa0Uon~Idw6s=0>N|j0}XxF!z)6(pcE{P89r$BU(VObhI8Yzo72txLO+LGE@ zDRSvY1p(gM8s-X{V&eP`arYkk(zCRjZi9dvc~I%PXV<|ai7(5G`itFT>8%v17Gfjn zC&U$02m$}^uZ|#oQkLPBOBFHw0b#LX<7DI1t&oJa8UDh*k};AP(N;rxJD+y!hU|t4 zzaW00{354ttZOAoCz|A#hNe6Yia1{H%eA#SAU-GsO~7mDs59tRIJRIw-~6q1doEtTL|m+ z77!PgN{k#a%f%&CIRnZ!eDBVD_)F1L>Q zTVAub*_n-*{ikIswP)YXtj@w$b0;`+>2kC=oTmpy#5Ps-W`t03lUZ#xs{EA1lmac9 z52#s8SrRm>7wTGy-7D^m&+!HC1f6ns1b6tk*4fv!4JWvITSi*Ol?FgLhM^l`{?u<9*|(0Y6ll(C|>rFriq72rZ%+w$!igGpl0G8{&`RDdOvy z7Hmp9wM?>K=>;p8t@)R^+Bw^WhM3K@C;n<>YsuKkk?=6n*L<_L?cR7ky$;{b-bUH+ z#!q7z(Rc97hxFfsmVPW}#%APA5tffozzY2Gs# zImVMxnZq!7I?*_`63>-&p8Ix+-H*NX3tSu~r^!UBwck}`&C|f|=(&QtgNMKn_8qZ` zzx5}W-tMnb<*8UQBNsC2$quKZ|ESp#m zFY;#%?h1Y?p8q24s>dF2IB2XVeKo16ymGMZ$CUZ3`O*G5Q;sfrN=52^D!M(|(sC2p z#`mVv+dGLBmefhwm5yMrSX*Hae`}{%=_q89Pe{E;{YL#!{oC2>TC?%OgZ<1Iv3KVk z=gHp{-Ol?L!O`v&4HylDzvh3@7UAAT=-l7ipI{6@aSFJ8r4J&&%nys1{wY-LQ$1cbG zuZeR?!yQ>288vNsHf?8KUCrL+_eaDzT#&V!F3-!4Z}We1cm&qEuDw9_zwd81KCbyW z(Y!#$JC@vO&Z;|=It_1xPeqo**24b^>AtQmp0D~__qyj@&#X$_BZdY~y(ZkoVTd8b zrN@njp@l(nxCME5wuPKtj-E@!rhZI)$-#ducpb07|H$I^@E5uOnMs?;PrXV_?6LDH zemU-i64tH^^$(GCk9u&h8Qgq-I_+~`btgS9+`v%U^`Y>meY5;mf2%fK`jkkRnD_<{ zmv;SZ%E7eqo^Mi^N~QHTFPfX z`3?Iw;t&n#(WX)Z5OaL2{{7896r3@smrSuSdg^xlUmr%~)byuvm)`i` z^YhEEulRC2Ts>X2XL1kZiBXF0;*e4Zw)Q>~_wqa)ips!q*I-PgD(i@$)i?j)k&7Q$ z)X-k(f)f_JD=J3z308W(3-s(EXRCS`->Dqu9gn(Zv9Uh)6oK1=lc#U@R_&pih^oN~ zVmZtl5-1lI`}Qq>f=G3seu@l15`GSIT1U(Vbw+LglSE}aWOMaK?_AMRz!fu|d>a)%JR9MtrQ2hOb|f-2GAY)T71pbZzu$9%NOstiBNzHgAu*Ck`RZ=gJN} zkeSA8!+n}iHP^?O>H-sK8s5nKuydF0wjE@@Tqyl$^pf)N)9f8uH_H^fX>dTa*3gv) z;}vZk)D}~kH%BvFer4l?Tn(+4Gtc**oKl6xoA10z?L)WE=8PwZyv<~CzV`m9HkvZq zai|OIGiP{JkZ}F;+SI_+b0+@ZdNiAhOKH5T9xEhlm-kLPuP{kc&Vof=toQnblF(rs z*V6v{_w4P8U?Kn8)20t*yy(UJ@z3pRl7-qA3TDJTGJZNdGu!(NkvU2i+n1r!`{LLf zw`Y~P;lC~JG(Gx_&3i^Gm$Bz9)8f-a7IMXYmIT`+lv6nDMC=T0O8I|?BGM4AOy=Vi zlswr`vaadI+|C1xwSvo>eCQ%;#(u2n45vngy!=Yn#d~i~}UmNuuTF|K&jcfzpG7xYYexDB-z@mv5RE z-M{}dl~bd!?*=jR`&(vN&TWQPa&f)l4TfQOv9o_u6nve|oZ|Hx+DW0jsFko`^B+YV zq~7<3XNNx0GW^^LHxwjQ9kX?3_x{Urp81q@KCW^uzKl95zMrH}^VWFwWB>68Cwu{& zVe~E63yYFL*N8d zB^QT39f!jBGNKAj*9wdHJ?~XQgtmqnmC`-{%9vROi7Uav^tavLsgqrmG2^xu#b`EH zl_0Pdy~mRZHm|Cf9o2;#mmMN7xYW|+H7ANc>_Jd@`*KDG5BiVIuSxZ5AdIXb{e?<{ zw(?7`#~)rXn^RPYhivkwAhw`ih};&m5mNchh%3Wt?-QO}0aaLPqb=Gv3XYH( z-)Gj-z3tz=Rj6UWYDPt67?sj>ukc4E??uy7>UZPi-N&wHZeicH}+x|R;2ool~0BCkmJEND6hPJKYnY|t!Mx+8|B62 zVGLzkyMxY==&)CASvxy{!;={i&Pu3^Hr|@pHqeY-0@KXn75h0=QbC}sp~-66SooJ% zvb##--w2kr=Y1t%U}F7+r&`iEm4t{(FGdsnR0#K3H}D(mMKC9+X-I#k<=KZnj0qH@yV8E$T=yVj?-^`|97bBzYUDa{(d(+!`Ee`7GA$ zjEdQy&kCdhBa8M1^LJ<8RW;Caz=5*`ow-Vxtj}+RL1I>23$y0YK&zGC`(fXtKZ~%s z5#?fz!B|_K4uM`TL3$p`wj{h(pGX!~c8p;Ac=-c!wn{E>j=Y4zHsOLC_0f(t#tE`N zHcy185-CEQ?$;V4=<2-Y+@2rF-wA!*0o{{-xtS)GY;bycX-XG!h&?N|DOEIWsJ z;TtK$f5mS9b{3k(TZ3F4-KfcUP2TMcGYfu-vH^MCOf#)4LkN?;{IZ73??Vik4I1}| z!BFGX3#Z-Ts%*glc6dF*^`c}!yWs$dG!qdSk>^M69D@k&96!>WBtylblUfW|RU54o zmFx7K692|3)~SOm1ixLfFx7)+DYTdjrb%C{*Z8McB={s>NXxk#V`Vv#X^3{BR9|9) zP<^H=|HIV)63hU@Pb0!G|Gx6Z+K1aN=TiD=n)_fgBCW>yt+8wS2WUo_+4Eivxn9sf zX)K~?NSWD9&#%Y{3Be;MqP8;{>kxEY_KM~7M8WL!d69t?&G83_%9%kp7_Dc1)RCIL zo84MVM!?jT<)1TAbdcG=f~KvcCKX&C0sl!4_S238A)*vLbaVgdEp!|r*uLT5(LH!l zZmRq}Dg4L&fJWWDLbCWD6=mEvStTWF<^T_&v}i1tp7))d3-z^xj{BDtlH9zV1fz+G zsV|gs*bx*+X^CkWdtl&rDWhrN2&s29eEA)$rMaM&1J3S%!9_*H#w@uM7&>${q`&Ce zox?)F=H!-~?nv#3HA$zJav7Sqeg@TTw^scAfBxXj#U-#9m}KJ>kAbH6I?IeOL~c8S&rMRlo5SE|PY53;smG@8q7 zP6Et;B*5j`+Fxv<{MM90`?s1kRh2eFapzti?esrnxjw%Kai)M%pNmmxXs=F=>nf_x zW7?6j&U;xve8$_9U;onZ+Dikly87GWy9*BTxY@4%Yxdffn-%G*o56B&DliWnh)`o{(jy!lcIClbW8L ziP|G3s;h2;2Ebr*_quUdS7Sw`)yW6yl4XV4_}weH+?E&<4%ycV0sF9G2qJX8{6r~O zU=3y=#kG77XW%IiRM9}Fvw&cubrYUM!1TFraPjf=-l~^fLV@4fK%k&tu|*yR)^`lj zF0?$ev76PBiod6CLR6p&j1{n=W10)7#Z9SN`k7J9ba<#>dh}>lC+|qHwh!kV#RNl3 z7g1<#!_e(IUMOv5C+_aN**vdI@3B;q3wt=O+-{1Lh?ef^mn3Z=Bv8?STP)!j6K1A| zT-*^n$Tj=!3M|C>8q4&_qGC4p5qCMeq!cI0=0z_NW_k$yM4w&X#^%HCiGu--3U<_F zxjm@0Oywd{N<={%1aQ@!z&!(S2HOs8%a0r^I=1br(>OANrd+lC*d|MCX?%U``ZkF`^!&Q{ymEj3Bg{oRBpsqd)-NRyuKf>n@ zDE=Cc-+XcRX!meNPBzT6!Ao9(rQUj?c*0@zhjn+D$#!x6u@x)sdD-~|`gHv>I{tR= z@cj8K*FCn3o^PkakoPM}%+uTRLuCwF^%@JO`we0sLVd1CxzZVdFB|2n{`VwzH3=C( zy(tVZu|Lo-lLK+(w$4!(2iuC+21 z`9#68kovyab=P9D#blz&O^}MCn*wG&lviCx{rm+RP4JzO;pg>RandY&Z|X71X!Ofu z_AE?ym70!zLbLwLWv5ZKVFkwX@rv=G7d8~kxl^wB-RSSWq-_-_w2uc!jusi$pE^xM z8zFHq)`0dfL#nh>Qk#|D5lFuJk%ugp<#W?~EZyKj(w|z{@}Zjz$D!%D%FKVWD@pTBaPemrN`fa96%GA%o+>DR_d+|gcS(voX0`F}1+Ecw zI(}hh?a`-m`WV7eCOsAYj^0i#&a5-pF*G8AmG!-dB@q{ykr-qb4)L1XOuhfqIAv8` z4daP_H&)Qxl5u(XNM{tTHKC*OyF7qN9+E~m2P};>A2(Ejn=EfO$rtxzD3D7lfqSm;hG`V5il=Y39yf){!tv#342XvTl@drr5uU8bTjwR=1!?|D4_E^a-(rr9dh%!%oy_0YUdlRbh+`<+zg&>YCn$*nKRfN|o9 zg8WxBk0;gVk7{*&ga`<+uBg6b@OrVmRo{9zjv`*@eFIF>GC-sx90kLiHspbOIf#kC z`Z5GMyjLC&oq?fB6fuhsoRlJYi<}WQmhEtGwrfgYJ*e;cJlt$nah$CtE}?MjP2C{L zeWT3yx5#D^ABhx5wiJ>-uBWBQK+=u+dIodx6JR z^+JyS&f@WGufK0@c?yT92>;K|Q1JGpe@_hlx(>!TC)P@S+QSa*rQ=h-cu4;2%Tv~{Ma%D6^Vc^Kj)3&{G6iziQk1K35PQ*@(z~pPP=DqO%`$t4s5|!fOXba zyNOi#pV!`rR!EP&wx29eb6767e-S-zC8XB5%AssaIAYdgblnh$dIEy!k_RitzisdL zbOo%dBSy1jeY2pi;Xcrs$l^!Nnp0Ge7clHkMD9)^B-mz$ERCyZm5Q=dlfX*9QQJSfC{iSh& z@CP|ATJ}53MiNYLD=Y0P-*uEN(zi2)PDwG8ayYja{9Dh0-b#}YvAQf&GqD1l!~R9t zTpX_utHk3!NmprvE1yZ=4N@!X{7=An{Y9jXdmv`D){`;IrKVfbD`Lt(S?o1-``q|0 zNPOHMrgqSO6A1i7MSwWG8fsJTrAEEYhLT=IjP3>8tC2V^=~Gep6&GQg*IkSvfuNG~ zaTlRHpTwnGU0Ifztlq##JYMzoeBqlD0;OuXo)GK@2#|%jrZ2M+s;ruXkM088JL?;b zh?ieEJe0|=WDOphg&m~&Ql$Q(aGZ=TN>mL;5V~0gI_n>ovsTtH2-yxIP~^77W(P<8 zZB}4KyG$tG|Bz2Y&#hf|@Hrhk^EY#7@tA!gjT82^T0eL_k-Vj@t()|Hf5KJjYJf$G zDesSL4A$>RG48z%{?+cnUG#(~TkOJyg@;wAi-!a+4FGRe*$mGvxa(YE0UQ8$z~w?q zDyPUYJh&9zyYFgc-7z+*^t%#FO|G9+46=~=2#fx-o^GXHp4e1Qudl~=7@(G5o%DR5 za_llBUBB_`Gqk_CiYQA0(x-8j;RqiG1T{3Vf=tw;&V`z09jB2DP^c}rDP(Q!PO845 zzNT%S$joi#pzG}PY0_)eP$vOAP z%VBQs-*UP9bFvOK(2~EMy#L!n&yykCD>^`XIJ6cQ_@KA!X8&DQ&XTDi_F4dNPp+)| zaZf7MvKr*BcMitjaH>8P2oIWROR-`s2OYigvU#oiKx9;-$R2}@h7U*pQ~-Jps#5o2 zk5%a{&1m4I=GQx3$dkU8LHW$9mWN~A{own*>sM|QL@O|;igtk#zQ>!^3^3QI(=90u+jt_xleqj zL%;7AfQIfi>WV>8QoK+KsK*E|*({h?Y2|EzUHjgN4{DGB?z(P_9d3+WFr=3fM?`B? z68}Mx7Z^KVg1Nx6+LAo``OpRf<$+?htp$_Q<4q)_Thvv9ZY=7W%EmggL|RD^X1uRL zx%)j?^sBz5v0K>4c&b7TKmw@mKTq1}h{+fluP(~^ysAlUuD|ILNVf1j>>^wO8P$3n zeTy1mKZzp3Gt^~`1m&p`mTsKS>eSBb2xU2k$=Gx~3deTy!T5B6)<>eGdI|a*Kf`gR zi;j3qh}&3T>sa;Pv05x^WpR2V+ds^yCD)5yC(V~YHhS5^0j^-_z_3n2H zo_$wXluwF>aZ;?PtO>)Qqp3}*b51*8HnMsMEz9ibslJRQJk6-NEq)G*?iVGpySPI0 zXpr|~GTsz@H3Go0T*&?M$l1Qe#&)CK@?VLleFX87k1Rm9xc^PkG=x*320;*kOPEnA(ONYw@xulU+v=uV~V%`2Jr1=&Xg) zqle00CAX6ksoK17nw~gfyEG&ns}?uS>Ts0bya4t|>y)k02*Lu)kQZY=EnLg#Eij-W z2Ff;qheI}L>7xtzZ0>bQhHqItT|Rev_I+UKe3*Yk!Wo@N4Vs^7e_mSnPMQkg)t%Gk zLL7ebAy0~KoRl5Qoe=!N7|Z>GQI!yBG|4w6)3y72(VmAuWS<`xfGkX~o;g7>&hu7a zd;u*?ahz(39H{^C`-}7tvakys08YpB`tB|=Z1c^OZ{3zP=;pI9XIodLyOX!`utii{ zx|^92JB}vUyVCTybM+ri-#N^X{o1$h}>!Kwwlez~MowUlR$5VEg? zhd9T)-Krp5mhTs`C_R$q35oYmWoCCTy5dL!uNxXX7=AE{Jax@7w$^Em@X~4)5$vtH zG)0Yn_-Ssb1%sP*V-yV$?L>jnNuLHNeh7+^gqOjs3L0dDD-ZJUN1x_|Px)&*V29BI zPvw;?oDsBmtCE0trIyWj3Ng`yuHH&cG9WLjqI~^BNLWile%UU)9(2`oA41 zEVuXK$ahFM3BwV2>yBuhaQ2S|%~pJQA7tT57MtVLbq+FQe@`!`11wOX#~Jk|18%#& ztIP(q!c!VxRgJYIwyJD|{Mr4S?ynC|6$;HvFQdmlsL3iTm%q;C4f&!5q514>1TOt?Y0fb|VP0{1{!G zs)OGe>;4e%GwcjghZX2*Z{swOUs6wcx_x2?YlnX zD=B3`1z_KtLY#q{qlxvPCF971k@qqEynTk*?ry^UBagpXe?K1vH%gge8&PPM2mu68HPTd)6SZ|t4nzuIk zqQy&QE>9E~?(fK>n9XsEDy{M7eiwhR@SX@!h{hyciJaZoLqW>jtItA7;JK$Tr43dV zCOW^7#&dQ*44k&}c3$ci8c?k40mpeBrD69#vtHE-7iOOoG4iVcx{vsiu*!r%KH);aAFrzH!{ zl=J4*9Cf(6|nyXhL?`lA*a?o;)ca+ukE7vgrNTbu2)3c|OYeC|qTMyWK-R zXMu{dgo?aEiu#!b3vB^!O1bmH8IHaNX%5lO&u6n!66E1+v&m)q z4B~?Jh7k9E=m#JbzH>YV`c3Gdn)2WIiIU&=Z)#hJghR?rD=Nr+{AN;nEvq)E9=EqM z*iHq?gJ1ux7FY$pD0FtnT=+(pG1qoIH%isQVSzbaH)s62Lb)^-MChAI#A#qf=3s{` zkKQwW$K9LDvbFWVQ>JVOUv0P;MZkdb1wNy;MmS+&SRpG*yRo){06LM{2ek_scfsdb zE~AT|mV@+Kbw1bJQ;A4Vs<9hbJ@+0}DtegScKu~PU34|EN98{bPhHCakb}p|kxS(9|h@osG*ySlOErq+!;q{Az~CF`3X2-gQS;G&`=U zrBx3qf++aQ@Ii1Gm_m5zZ(j=X=TNruEF6n|O>AOt(>5rsC(L#pf!qDjjsc5v)86Jt z+*=9zbd7FT4^D6d76+F=>F;Oj&c?`_C<1pSM>k5{#hy(v!DZ9M5w9KbE_^tjPb{L>W0@a>Z`n%0XR zgbV8B8+hZ7$mh;-_ah1lH>-Mwz&)C@W?|P$u$5P@;o+k&8ETmP;eU$IF6L5*k{$-iqkIo<6-=0}5v<9wipM?0G9 z{{|~-#qzy0$?`-hd2bZmcDhnXk-SQ~)ejXcp2n{p(a~SDL}VE2;z#q2k=jn&9LQSc zrN1<$TJ>AR^X*DIbh{4LZ7+mwT3Vhg9+`Wn%Kowr**w7%I`AS4T5uYIr1Q6%xVqD0 zxZaY!7Zwq~-w5?vlar(!oC0TTW~6#f>z8Hp3>kNoe7S@r&QHJ5`V8679A~QN3U#?n zEp4G9?+cz7+}zI^&A#D&x4KmhUzP_yognKPSOzaHZI-=7L(2B~ak)X^Zn1*>LDpDK zZFtz?(OjH2*|Afcp3kx_n4{_C*aE+*UB<@ssrP~(n~nUvT5h>HyWlwIKO-X2v5X;b z!AwAgETab3k_i=%xW8;-ld#tll}88j58mp`=NU7Se z7R1ONrHBn_Y(dCdv^h&OMnrJN;+z&AogG>~>=y9gSHZy@|>2 z*s3K zE&8+T?MDN2r65A0`eApEL*dokR(M|&=1ff{?xqDftay4H6LMWRgzK z;a%Ge%J~8Q7-Rt$#JuTy20;inX8&Ajaax<%Eo4?DwX;IUO}`>$?Ur+Hw)Xvz>v+<$ z+#RMSP}4Z(Y`W`QpPl#R_i&&(E=X=}aV)Uus+cVuilcpFK9Kk4&qIACgzJ6CMx4;> zTXrIk*BM~-P>^tZ#g|1k>5{Fa$nO|Ps?;Y}`+~{^;kB2X>ii8Q_xIl0Kkw%RP@!+$ zc%m$137-E=4xn?(sc8uxVWRpNev`t*DQyH z!Fl+aXx5SD2PtU&j5&nFa;{~u84KmtjQBf+dFkRRaY-0GBT3Z{9k+qAsUJ8<*fbfx zbIWj@wwy>8JTo7_oVo)sO=#1KPXI=Yo+_2Zp-2Rv%7UW2K~8Rf0-s*x;%_$7w@YuF z$k-fQbTUn*_ro3kUIbl^LteB5Zwk7W*#YbnO6x}-+&Rpd4~6vH7*4T#%VYOrTd2?O zBH~G|`ky$yF{;@zu+X*Y0oP~!(L|0ip93~71DcYEgi!+6JBLfyVH1p5bs7Fh>N;tyITs09of=udD&mHfWG^^5*E&_w=c>JeuPJ z^DCh51zb~ff9;(^P9CL2%wwSquxr~ehB@?$gW68%mrlGK1p&eMB&R0nL(cy$M_Xaez5gVFu-tc{Qze1Bjfk-!18<|u?VQZDF%{?AocNRF*paNj{lx?$=heR3*XQ3 z<^|*7pZ=<=j&+@?mikVlhMEF41}O#r0N9F9S*?G%;Gd+Rq5K;=e?b@jDRft; z{zm}7B>0aY02$wi0RThYPDVyU!`8*!<)f{OE48AG47ID9i?yAj6##fGWog^!Xz#xg zzgfM6C`Z7OlwGul(5ST_Q82=IMiv@$uu=p~-Xf7^H=djvh-@%70x2d27EPqdhV=zw z0d?CEj}QKwtmH z7Kc_ZWUcWKXfG*X{E-v!$7u*9#x*-BA1fk14 zUPu`YMhHlKj)4>cQt}9}tTaY#AQuFfj#!v)0vhaq>6?I^-vBJ@Hr)pSFi4^yLdcB= zs0pkhWC2@IpnT%p7db$W3m~*s?h^(U*a0p@U27;%)d+NrgE4CWG%SEiGa{530Qmr> zgLHIWKu9`3D1WXi_LsE+yvy>>Q|UEg&Gf=@fd**oA5e95IVhRN6<@Ow3Ya09Wk_-K zc&C%_1oGjoUyK4kZamSy+g?0*jpI~|j|;>!;Fz!rDN&&!zyZ_WP z8)q#kOcVv?^!%OS1Y~QBnd@;AWnF_SRS)FuFX>*m{>L|Rd2!8)i`!dU3rc+u1G8aW zzh|2slP=vS$2)(q$D6D5jz9E)JVt>EpxgDH(My#A@`(iW5cB1oScS(%%$G-s-?V*- z=FNI6gqxc9A7W%PqAz#~Xd@vB%)c0>Uo8Kuu{|J3tnmX?_7Vs_@$AJ$7D(61Z@_x) zU4L!>;JnqPdxi-O31%C-G2!`gD*2?4%K*Tv6%#%HfUzt+ht6=V(Am-x4o62=D|whP5ehCk57MiqBxx%QP1Yl7`5C$DFiu=gx?I zm76)~R!1rxEs(c6S!Rp76e}S!z}2-!jLO^R$i>m$3#k@jLr=6AsirN*D(fe$dRLCr z8hK?gQSAxB50vXd7XW!esLd#)p?WHMY75X}YI1r$yd`u&bfgf?o;S3K#maSzEqHf* z#O6HQ;d)Rux;gw<0#2|`giN0xJ$|GN&zt5rM8)cSooW1O`Dte@x_!2iOg<a1t9e>tN_s)>iKp?-tn>&A9vGw+Z(&eJ@*#8m1Ih_)Jfgx zk$r`|)IFq2Pb};(qTqoD8zz!WVpL)q5>MjFG?hY<-%%t3I$VO>hiSX%xalr$^;jBM ze2L5}E|0xnhzgMMKT_#^Mx7uX0t)Cjxf~3}qjm81HEX*U2zmKtcY|-}< zOKaK_MQfCJX-S^246hQeZmrfulC>o2X4;3_Z|-X7yG%u?7ye&X2~U~-Fq0MXsWfw2 z89J1vq^9VVLCZAD6b{=3Dvpb?3ftvc^&bLpqz9DV7`{=ki5*AI+SOjvUMa#TdZj8Z za#g`m>QF$I*DCAT>0ES@mfc|t%T{qITJ>(LgqqI6;YLevC*;bV{_^Jnd02@JiD2@ne&-zji&Ft-m^6nH#Au()@;2m z)IVuxa}IqktY4t__PtT9{LieP40EkNTZ{0Dn$;53%ChHddaM363^kNAl2mOkpuj5{ zoErShY|LNVH2$jSJxOd&^lS0^`Xr8u9lnTDM)97)|6`pSp~yRt)r|3PCz5`@E>re7 zZS*F<6AQeX4Fn_1eRf&enZFfmUfVQ(48Dknic}67;YgL>$Rz7u8EoHDa=-duwDEcR zDl4-#v*)-NUU?#LVs{e0oHNRo!bhp}SUNhlS(->XHt1*2cK1&j+rgu_pENhS zY2)$Zb~vFL{(EzisAfB6QN8|HZ$iUEb;BfMTqE>Ir?^x3J*SpsKCa2$%cjV#X4-J8 z3syOUrW$7t8Dw7Lyuv7>*J9ex+9$$q2$@+u2>GL{` zbI{1uJ8!(_GPLMb2?su#NQ#t7gql#&nKYQC_*FE+Ie{lb42E|PMUM?F=aj%y#Da_= z3#HmQltuM(!clx1zc>9a-U7Dm=8!ifacwHtDl3^H*{?D_Q9JR7i?nkGC&b5nfRxgx zCN|g{*z8z;8Y#C5t$F_C9M#B4nT$H*P#af{tj~_o04dzldCxS@f?8u^rEA?e7C9`O zQkKm+c05`;43881cAE2YjNgO5kPpJ`nk^@+r>*yQR@t)+a8gQBcT#bju@{%>u-D$z z9ba9`!8udMnBc9!4KmF?I>nmWtcr%l$3!J{@^vnC?sWuCrdR6C=5L*+PRM-PuKA8; z;RbCtPZC2N@V5wWRcEbdtsWE~YHuVfB1`vgQy!d*eyTZrI37TnMtVY}!)cgro|&bX z7T3{=ont*zz!{+Gc+NWYWXBf3e*5)X{~tP6S?{g=8}zjsN^Fs(PtiW*8>qjjK2g|E zaN0vM&NJjQwKEqf55%4m zf2$9)erwIBXf||cKKa~U?_+(lPnIn>zH-^_{rA<&+-$b6_)7c5XP28_H&<(~R{Y)G zJdKaEE_%K>`Pru4W^yTYEWIeR5g0XAkGcr_!eKQqNNpJDq$B zo({SWNh;y}J^hp&Ltebx#+UCNj=MdVJt z(k>n?c-i6q@=amx!XQ zw2s%(k)LOqkzDz@8G6X1wyl<|lpG=p#+;4!D-FWGkykfeh;v2e(ta2V znwRL%cv>a&Vlea#dVZY0i*skuX}itbX{_IP`)-&7*zOX4=~`)5z&k&pfl*6NS= zpZGru{m1^l7X9Dx|Jw#fa>e4_+_ayE+Pu#DFsY}HxrT$NBTY?3hi?q;mN~inB{Y_C zPMdDN;tFy~XsJn<$Be3FGvzx5)oFo;2_Q_?NI!bX_f1<@+ZL9&a^7fY z)7iSddE9R7v_!8HjA_&S+vJ;FMZkVycG|3=Dzx=;{74%YgcpHL49cC;#6tY4qEKV; z>d4y#eXJ{G_PfjBard~DBxKJenv9om8*_KFJTcZ&tz}(lQD_621~$be?yrSoA%U5v z`1ZlAcGEO-A&aNyx~tC&<;|yWxbh+m1Q@p~E+#+TXLziasVldg)OLn#*VD4Sve7`W!f$!@kL~hCfp_ zRia=GX1~mF9(Ej$u#7l&U_-@g3qm6m?}n)hPznt4tjRG0hE!W||Af@w5469KZRPi$ z;z8!tGRf^I?pvasJZ_${FrOI2e&NN%C#%*WIU||6s|@Rc+yN*mlpL!Vs~`NsFogH! z?J42$Z(}5ilRIua6pbw2*lNa639Xy*0D%605E~)!6geN+LSL!{oy+XsbgU3W7I@(B zc=bD;-`UkTV$Z&`2>r%YT8@Ag`tBs}>lCV{YlLX114v6i54Eb0^6NRlOLV!VBeRL( zZy~7^6b5aN(wIPU$!Eev0XvRE)6O=YC@ zTr7SMiKAv0ga>3m$k1#5gU?#51ptb7w8hRgjCOs(?*dg0o_K91XraPz5NPnLmK*Vk zb9#rd<6d3Hye(dS67M2jQ0Uxbsv%hT!87?=I60_`e0aDNF12Ah@2b&n+&II{eDjwr zi)2^xVU#mIa|mM~lfE{qND&em{6{@_J&)Dhu2?xWtW*at9Kr-VuLf{z_n3GOFiQV{ z9-i@z&pg%MLnHWLWAsN4rkAhc0AolbCpU8rT{(I<1$EKr6BF}xf(C5LH13f6yah8f z(;0Ja`R^y;Cnh>eI@!(q$VcsFIUy#CptQD=m0Nq^ z$tR1fLmy&Df4;AN``L^Ij^}Rn19rkR17J3BZ}k~I?4VMRf29A$xVUiCuT0$gIko<< zya7k#*f!qjnEprg{F{lvTZZM{*Ty3d(ts8+x za(fJnZ|TNb)osb()|{*ob?E8;q;|iqZuJn|?1-gOu<*9&FXpahX+e1*yAYU>-26Co zD_>?nKZ}?1?ax{@S}VbGUc5jwYIMj|R!;2c8+PjX+Tie(l<8aH%FSnXR;3$b4~EyD zX$)%Ds}PBemKr5+siio-xU?!L3J>8(n_}&_?NRNm2|DdsAtbCXk4L0gJXK2ReEC)E zO=4|2(w;x!5Ygv*vp(;?wnu&WFP8qE+oF@m?WekbC9uIXlp_y8Jk-E-^dUA)*^jx? zNclVt@l2kaOx_sI5S8T2EX?5u0SYp0gx>_*_9l0lTy46JO#7Y4Ft&ke7TIibsamwW zBURVrgS)1d%2x#sYm<&a&HAprUTIDvo_;viwEATCB1|~L`vVXcgFB5Tzgau-16X)t z)AzsSr#06(i!5!Iw!KRuV0};lp%HTr>9YV!@Htf zLd8-Pm!!mR0$o>-EMBPYXP5bq;vG$>%Nxqm`D}_^H(v`VRZ?8f5a5Q_fS{XQ~9=FU;p%C z{3}ytpHCLEf}f$P=)ELVzrwFCeeLgqV8zUe!>i+{!XsO!z|E$~z(8-jmFiTxTy53D z0!`;3MFoWEAj*YLKQipcQOE{W;2V4vtLi;hp2j!=W$|`ctfIOV+Py|2mcR3RyY5L& zyOI2qk5VEryaMV%dx6*7!adglI^4H#wgB#qQ;vX;j^hch;_WtDjYx zY;PSk2IV861Sq}Q0gOh>+yJtj9kEx3zU zPi3@Dg4#1_+A*XAE|(+`xT<1=U$QIqiym@Bt<)kAe#+Idu1S*z5Q9?;)dJ`~>mL8rkiPD38bzmhF-IyilO zB{~-NOZY$xV?*+#aTsh9@OewCA#l5q_+jb~6zcYgP#yff8sAS-%WM`90?urZ9)8zJ=f$>71u{bCM za=Y{!l}49F0b^^GR98{B;WwqRx$YBhC*dhllwM+^Dcf8~@M~K#f%>{0DY16KYprh` z$y!zHnEq$9*3D2d+F48Q%Fi$Jq%bID!iyF%+t{$!Ck7g=tSEAdmECE0z$ z9y}*K5-tkJdHSy1vRhgfO?X;h*^AX`aXsdL+Ap*0z5BSl75+Ks%}Kk4Kn(o5XN6=2 zHF?UtnebmUrfbtLp(W#OAJv05m`7Xw1xB}s(FRq*lqVb{$7sbnF&zlp)_tqN+;rK{ zcBg$;ur|<9a(!=59*^blbDDN>}8N3)W!;?`}NTH%<<7if@`wbNrht zwlF|$z&kn!FPRi{B0XRgx48OZ(DkX41B3G6P<7BF@B9`i7M0c67)e8uPj#s{V=ct= z&LkxfEM+0ew21Q1)%-f5AwB0cd*VQR-H$_LBA86m#rT6xp2Jn>QR?LgccWV+h9(<* zxfbU#YDM38M>`AN(5O$q>N{muuEUpVRh8@_rj@yJpLwS_gA}nplusukay9jI3pGa# zu7^Jw7s5MAyR$r>8;2AHqW97vu%xf&KLYMQHSKr*nyaJpOmlnwm}HyA*V57p(`fi6 z^1}c8=dh9wu1n-$XIsK=)t#BOSb4|vg%&Y?uC)n`C66+>Q@lCn0;Z(WgBDaxPH zP54Iprs>AeOx5Vjvto-a;J1t*p-b~0I>!0qGX0k;f+?X5+c|$D7%d*oCnx@tn+T6B z2$~%PhXonmO^2}*g=svg*`;#%sof>aAT{7M5Q0;X-mp$#xOW`p_M3Kvr{mfPhZS5> zC_Mi6^yO!U*Isj*)8ah!wt0LyXkioY@&<+}K6?U=bE;jHS5vyrq-y8&x-6_*tW_6Q z@~kv5Tx{BkU0oJ@hBgfeJis>BO8P0>z0S_A-XJVkq~jw#bmVVF(Jo>N*b13ao}+%# z6l^}7+J~bRuQG)v<}pr)POMhn`)qG}`e7RX#=vsPlvCYINlsmH=XA%3)Rw%$b{PI} zN}>!UeyJAi9BVi5-*~wYWTgRYSDXZLyz+de?@~t`cZ1>)excC*_J@hSvG%tNj{$mvZ%U<|mc=t>cM2U_~2u>v@!H@mE$;a4$7vW=X6VZ3?X)-h7BwI1r zap6s+#m+0l@$_qEs+TtY=QGb(bjKv*TBq6e0@02;JD+~^un^g= zRo$C6tJoGSk+q#(nDL`?ddNtQ5`l5mCXR>kL{k#msak*$lbNlum9t`j!Bn|42SigFRlp+fYxdXA$ z!RWS~by-gdCFLEw3AO!WC=8jjn5oXI5tCG5nZw`T$!mpcuxrOQ6j8n057W)B0YG5@ zD>czNf9~U?M`~KXqGXqA1zh6xHtI;f@*X1|;`A%R15grZcwbV8J3PLBI@dn%l=HG+ z5`cH@^z2|YGVSu-K$pU7!hdYwYP~_Ueco@!F#cGmpyoPnWJ;s}0V0d%PsDWzI zIKw*?XZHBh91yh4FE3Z}ohak{X}+!falL*X0hm^#-sn+OK^d9RG+)ZYybM#Am-b?n z(;_kAB6*k;G%OY=>NH}kQFR=(JySrWXLr>LJXyJ{{8!Dbp^!Z{&t&_%;|kUZb0y<8 z|2BCtiy;I+WR&+Fe|MDECj6%Y0;5AL;AxZ7#6&Zt*rV@r+R5>GvOg3QWy=oB+xVb{ zUG$ndO-k}baQQyNnI2aMTyzXlo)@ycW{|nm3HB2s-dRM4QLZ*?>6g@Ne4V@ZLI&W1q7zLS5NZe^Z$6$M=eZ9FtBD}JO*YRq<@jbdJcbp*q;GFw< z?bf*cykc!n#X;9?h^iU#PjGY znK+t|sKle7*ho(w#2@fLkou9+OQyxbfOvihF~KdT(x-DT-?y}DoU5NY9ty)+ZxXmi zMbTuEnAm?BA~HOASz`Ee8AahR9CX7QCBmv>WFTNxalWut8E^c_`>tB_Id6W|0ITaQ zPjpX)KacFEKYQ-#AVSPL*WLb1*-~#>s5RXS7tAsJQ;7J(Wo(k*>VwtRIhZ!fBS!4> z<3?AaL%eM|6TzbOsL00jpH6?j)P3WQ#HAP{E3%Zm<1!Ak)|7y?f6pe*MZsBz%Vw2VTTh^cUbQGWH@j_>YSb{m@oC$$ zGMZK!ae<3o5zOuN`i-xb7x5?-0};6gkVFK`gk6dIsiL*xe2_|VQ__F!rBr1AUwnDip=Iu*0j>WJg%z zUG4sgYi3p38>>O5Fg zbd~2OdjY)jj;8(N3g+~i_K@(H6dWim?2`*kB$_EAdLXqRXwD)v>cs)~+@`ZCsWo%8 zehTVEX($?ayz$AFfcDn2$lVUv?3AE$#$eu%O5)Cz4lTtoBPmg#-Gh3e4V2`#ymAdM z0{d?9F3C_^9iIOXTvl@aQ@dIwaY?{P(}mKbEVyv7cJ1^s6#n{r{rc<17oUpUp<1Q# zC)z*+d=1oW-#BLMRU~-WVjX4GTRtK<^O@_7h|x*sbR}Vc&g$PS%hSC^@?gkI_vEuI zS~BAfet7a%#=(^z7ww*ZyHZ})8O?YYsigBDCqs}Kv8bzG*mO@);WW|QfU-~uwzBsg z1?lY#ozMuYrd@VIu=UtId}-8!-bhDVsRnl0DQccq;-|gr|Ks zeucgRFOQ8RdPs*|y$r&UVbEK;xNU(rwV?bU`%E-~S7zs;KjI*zdyCQ6&04;Q)1SYe z?_EtAyoLknx3=w1Y1R(Y4Ov7-cW^8-uD*~*cc1Q)Q=0{wIHT}uaAC9D)i{(s z{A(4+i`1%pBR1-W)elLNRiR5qqG&|sw6w_0Vz~qP--=L7=yNWF@V{q~oy>dh*JMn?wI#VzQ4g2GLH-jXh)fClB&_+8r1*byg zpS_8rKO}ldjt}`N9$E7N2>?ziz5yIg*Qm*Yg@yfHgXyRmFDDK^pG^-PHyCMR%xbco zESqilEcBzcjfp=6|JTgmTtsNP`)>9{{T`;Y^RveEUJ>Jt|?3fV*Yy(6qi z$|Zm?RMtQnQ*1tJX@?X zh&j$}uE$0#Amd_4lq<|bU}tBacv@_kuNYmqU2NQ2{rVD8Q%bUJc1eQ(C3{}-@t+9o z{(03ol0Qv6zX1Et5GZ;Eimv+WJMw5%tM8SqJA0}PWyGK4oWgM8EWtQ66ugp+Zwa)3 zyRu=*g5V7_AwX)FSr?aj?PdRHTqvbpOZ2!qVix=HU?DHpDA(xZ5_RU-_vYriW`m29 zH*mOLc%ZGFn-pZ)b!)+RXUNQ7d7(Kp|GPvfNS zv=9cVhlhkxC(Co>1Y1j?V}>DcCd>WKknH-T4K6_eL8MM;$sK-9O-=&9-r-^J?muEj za?kqu`iZDG)6HATmi_OpJ#{9%I^(%v=uXS6W=_oye3ZG_Qdf$FBJ*vQZkl0L$xGSnbC=Ujxd#lC78 zc2_O^#Kab+%*fr**E{d9b}t5BpEJ$ygLRtp_4hN!{ zp4Brxk`d*U#R8wYIznNg@f-6@+*G89toG72(;gODC-Yn7`rO(f^Yx&`7#yJ_)W$k$ z%iv?tPrzG5-guKT{yr=!m5n_QmAdaToEj%5Ed^Qn!{W+Kp1j{L_=L5t1UxE z4v$g1n~wX5HvKm@DM)~v0&E309Wy16LgMnUm&8-T+C%~zP_E6)L#QDYdZ4s8CHk(> z=RJW>1ZuV}xTUl}2zb(`B&5kJK8!j9OqXLrLeD{)_2~Veanwr*UsaZ%1+fUvdWof~r-l2&kqg_PW2I2IUMI{ffw9=^(y}_R%Lm)?j zu)@S5s6H6osGEV8`@NPjIPtr%dfT$fn0ZH``bt^!Awn4Ij102^h@8l0jYh%fKzI#! z0K6du3+`&jMl0|IufLt>!x^cuR+=mUVo)dFvwv?G_E?eB9o}v&L*hg*rG@!}KR3On zq2KnF)p}3oBxMt_)HmKw{c;PJK|PrFGd<1#u z1XB(21|&tK=v=rtp*+P>e?x;PDthzc`N7f^iq%zsyyOUH+DYkASFwqQXszoi>JK=0 zF+Y7C^82-um1Pd*-Y#)O7sJZ{>F&EWQZ{~z)`KOtqRZVA&-n?&-A~Y7f79sK7cXGlIP zah>T*CE-wrLzde5{7GSOQFKW*4O8oy`WoWn2XOriJ(79HYqk`k$Ma!G9x-CHRso_i zbF|CpEe}#<!8X;8Am($lQ?6 zoQhY9(G2~GTs!ZaR5(M@XcfO9LxKtajMbM96cZNc^9l(8%EOccHH8vCa0js(oDy$X z7pmJa2}DF!&Gg5M?5EnPKl|DW1-$L46-1+1k~)Xb>~UG6;4vyQRA52At-{xKeH#2^ z1hRyubbkIwIA^8bHzuqO6+|qE>Cqq7JT1jjRa(qpedT=PXp^Ef5lGtS!?0-)>s*~B z;cc%zro@x!Qaxuvy^y^62ONfazp*5c53X`NOiL-;c}V*qZ5DmUK<_u`(e75Dhe$x3 zwnMNHOMWK;aA};g4#a^SoJKNei4RMkb-zM`rPl-Om{MC?3QD{eh_Q)z-$Fe^@y5#O zxO%t@W%B~K7f*UI@co);=4+2f#3r8HjhYiO(S+dhG-=JfDF^=Gv0|eih82&iTOV_v zeEi2}NK|0_x1$j-);l;Yg^j#FDi=faDJit}MQ>%TIbU#6hOOJ;aF|47+4HEm1GN%B}O40$4x~IbJIQLk$~56qtRaN z5SG%>KRgGEuZT*3?~~)VpfsQ_1?T6hfq{*i%*aJv+7^u1%0pRL7~>EBT3w$;CPERWzFPaOhx^^7b_2E3BX(@T;VP23#Cm|MzIau_&@9WErHS zaY~F|5dyx!3h1OWbX+#;{B@guxbCCTM1t>k6huEccJ^};nK`WB(qsc>9!9&@Xw1(j z{q3{6k3_uhPOz1m6%>cM3a6U%j3C4JDKI;izkZg}c1gY9JEdO&{cYA;Mjp2c1|_TJ zB@yN&gvZ&xp+KSPgY_=4iOgVg0toz*6lZ?LlLE;T1B^um)~rLCtdWA0mvx5CZE%JV z`qg9vmk8t6VTU3Cp0js$0tjazL8|9(`8#+Jmi8*&H)LtgKK{zk-CuZ>ujPQ9X%f?1 z)SYYPb4Jej9@$LDW1=DtDji|JEfuUHf;9gzPt}!29+BCYfi?Mo0gsO_KZ#3LP5Gnt zM}fqvuTymSmxed6!v6lcLm{Tr5t(0ZcS!xYWsI8W(vpc9rxe~Oy`G_g&wS9XRD8yG zsp-F6VTaciuGAq_eNk~-Z8m;N%1@Q(J(apo>;}wtidDWV8a!9XKd!K`)3Iu@1&w(# znp@(j=wtZlIY#Jz$0YHff48P7p#UGJsA~6rY5gu<`htdCy2dZpLFe=n1H=U`g z(z%}nl}M-o8{V+~(0yF7>1%F@AxLaZyr4B#MZdRbRftQz*3nY=`9{3fkXIc0vNn6S8 z?#w;Y9#V2(g%%TahVb9BDbjj*a0;P!Sv5HIR%f-;;_ov*3_^bDg8YTp3PKX_9f|vP zUZMpsrM*1;ek4Dw*W{8r|HaFt$&?%Rkgi95L%JP~(DR<%`U_6NszWQ=bveE4mdrZ7 zenKP9J|{71rF2qlF`JbiU6$essg_VabxsX=R~P~Wy$k4i0V8A4@RxUwomP)EznA$ig?_zR;sh^KD> zRk5c|tV~J@3Assl^(fNr7cA+SIzJ_dAh{;_v7q!-woVyc2{Vw^E-rofx^*A=w`GkR zA)!whmSlz&7RIE1L;5Ft0f&Qe@CC(`K$9mK`c3otDF?$K38YzC3R@;3eIjDm<|1YQ z7!Xsbi!JLo$a-n?U;XPcqIsard)VvqO*rK8e9(J?9iZ>iD1X}jUXczu<*S6`1-e5!6J2?%d0@*s)Yi1ut zGk%yECrU6f04ch^8SlKxISIP&{kdD+8EQ6H~4b|lL@!T5fx<^n3gPL zqkJiY2TwPZPJVQ0u;^V*@%4t$H!6XQuTxy|!TPb}E;1m>#5B6lnkNj>`-k=Ik5Tr* zX?<8`@Ei<$#aQ74Q;p+3w}K$*8D5&bc8jmP1vJPk9k^>Z-5$sf==t>MG*BrG_eZ6n zq^bf>%-xYYhVMIMyn-lNIAl8t`iHZoV(7W88f@6gDgK92lF{6g@>K8P-DziHmc0K8 z@_o*@KC*5)kr$IiQwpXG{pGrg#mLP8c1M?ESPk3W(%cu3C^an6@>`}?%5iR|g(^pj zWxT;yriR#SQ%uP$ACV)`={Om!QtJq*_vStP$K2&E4Y<_vxuV;MzTkfdC4@kQQ;7qH z=o2IlkM^Mae0*KDjHMGZ+qPH)vUTlw@2hF=Lo6CZSi*j$<)zW2+n?BO?c(WsAXXHx zhw9`7&1meaSubhQS^cU}-*>XV!(*P+5^W4mk5{3`u^YAw=p7wv9mFTm7Tv|Z)3N_BwO8P2?i8T>lO%uAC$4}pHa zepC;{Tq&QlJ?iKcDCbL7U;OgTzc7au1 zUtRrlu(uD|6q3of?G5^CgIGxOeS!YnK@?ryB?pCVmtXQpg>wmEd4Jg6LS%egn!L*Z zmZk|fYOvHKfiL5mNOfmNO%%v9mWiKQE(6aRaj+(6%9kN+7jLhvWgvqlq%ER=)O*#w zBwdc0Tsqg%(n_ee&(_I4kQ+rw{}B7)@pC6mS8GXzvt@MiSd|$(#MC5!L&rW0l=W)J z>>J_mJuxg6VG?_>j!!HjoP_5GKiWJ!uYPIM$u6-iGC&7vgFKgBcXzkeD4D^4U%u(o zpNY69N|c;0lHzvlE&Pc?Na^=JFdx<=u|2TO*GypeQqjJb^fPyfbBk453!22OGO1+Z zZDPd=ii+koiBz+p;C3y0zb}i}JOeJ`N%#ltd=s&=l7R2O&rWH7#w-o)*b_ z4+l*1*&9uD{}+KC|qj9`$y|9mOEt;gGUDqIs@`lU9Zv3 z7D1nDPAHbp{*{Dr?&4_uo{_4jC&*ZcX}Y|;5M~6Lu;{tnTj{eOEBV=q+MauaNM%v} z+sD0r?UI)uVXcx94>-%ouF^K9-J0M&R|qqq>G@rjw1nq|?J#q1!|~sk!(74?jdH?( zabhDs(yRTF6zNX4&YTVz3THydV?5e1@YzyY%rVUwm+dL7p6r=-iqu*HPDSdKH9P4g zQk{<5FAHY2US%%uvK310{H1yRiFOzrpiP(B(`5nO7g7tC*k=hKk&~JaehCskdJ9iC zO)@4FKryk3Ly5Nu8kV&8qqb9-{tFJ4n4l+>D%Xo}qJ|-Zts!yhfCg8FBu^4qO9^+T z@I0|ZV8r{b1w4DdLszp~-LbEW+sR7EkmAFnqygU1PrXe(?)vf4A>nm6>cQYsLV6rz z8cS1v?elr)vK!ahNi#<@xSqYPSxKW=>it0@zB@{-FlCocOzGmKj41=RGw*1l)S*+e zETS3@N!$jNt1V6tSPuM>5~+j&yY{O(?FEW~8`oBmflo)?vOL^;V(vE8Izbdf-g-9C z!l5BvRNPb~`rM?J(tcKJCem8V^=oe|`y#4e*{P*JkP?S@Xt$>&Y{TE9xyMq7# literal 0 HcmV?d00001 diff --git a/partners/index.html b/partners/index.html index 40dd076b30..c30a335401 100644 --- a/partners/index.html +++ b/partners/index.html @@ -15,7 +15,7 @@ title: Partners
We are working with a broad group of partners who contribute to the Kubernetes core codebase, making it stronger and richer. There partners create a vibrant Kubernetes ecosystem supporting a spectrum of complementing platforms, from open source solutions to market-leading technologies.
-

ISV Partners

+

Technology Partners

Services Partners

From 2232e063aa1e41d044d66a700fc1caa49e2e5d61 Mon Sep 17 00:00:00 2001 From: Chris Marino Date: Mon, 24 Oct 2016 16:00:28 -0700 Subject: [PATCH 30/93] Edits for consistency.. Kubeadmin, etc. --- docs/admin/addons.md | 2 +- docs/getting-started-guides/network-policy/romana.md | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/admin/addons.md b/docs/admin/addons.md index 5e6573d349..4924efd604 100644 --- a/docs/admin/addons.md +++ b/docs/admin/addons.md @@ -12,7 +12,7 @@ This page lists some of the available add-ons and links to their respective inst * [Weave Net](https://github.com/weaveworks/weave-kube) provides networking and network policy, will carry on working on both sides of a network partition, and does not require an external database. * [Calico](https://github.com/projectcalico/calico-containers/tree/master/docs/cni/kubernetes/manifests/kubeadm) is a secure L3 networking and network policy provider. * [Canal](https://github.com/tigera/canal/tree/master/k8s-install/kubeadm) unites Flannel and Calico, providing networking and network policy. -* [Romana](http://romana.io) is a Layer 3 networking solution for network policy. Kubeadmin add-on installation details available [here](https://github.com/romana/romana/tree/master/containerize). +* [Romana](http://romana.io) is a Layer 3 networking solution for pod networks that also supports the [NetworkPolicy API(/docs/user-guide/networkpolicies/). Kubeadmin add-on installation details available [here](https://github.com/romana/romana/tree/master/containerize). ## Visualization & Control diff --git a/docs/getting-started-guides/network-policy/romana.md b/docs/getting-started-guides/network-policy/romana.md index 26ca728490..c25835ebb0 100644 --- a/docs/getting-started-guides/network-policy/romana.md +++ b/docs/getting-started-guides/network-policy/romana.md @@ -4,14 +4,14 @@ assignees: --- -# Installation with kubeadmin +# Installation with kubeadm -Begin by following the [kubeadm getting started guide](/docs/getting-started-guides/kubeadm/) and complete steps 1, 2, and 3. +Begin by following the [kubeadm getting started guide](/docs/getting-started-guides/kubeadm/) and complete steps 1, 2, and 3. Once completed, follow the [containerized installation guide](https://github.com/romana/romana/tree/master/containerize) for kubeadmin. Kubernetes network policies can then be applied to pods using the NetworkPolicy API. -Once completed, follow the [containerized installation guide](https://github.com/romana/romana/tree/master/containerize) for kubeadmin. +#### Additional Romana Network Policy Options -## Romana Network Policy Resources +In addition to the standard Kubernetes NetworkPolicy API, Romana also supports additional network policy functions. -* [Overview of Romana Network Policy](https://github.com/romana/romana/wiki/Romana-policies) -* [Example Policies](https://github.com/romana/core/tree/master/policy) +* [Romana Network Policy Capabilities](https://github.com/romana/romana/wiki/Romana-policies) +* [Example Romana Policies](https://github.com/romana/core/tree/master/policy) From 0bfafbf6a81fd3453de2cf8aaae5c180abb3f0b0 Mon Sep 17 00:00:00 2001 From: Chris Marino Date: Mon, 24 Oct 2016 16:22:55 -0700 Subject: [PATCH 31/93] Markdown error... --- docs/admin/addons.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/addons.md b/docs/admin/addons.md index 4924efd604..92b1e1998d 100644 --- a/docs/admin/addons.md +++ b/docs/admin/addons.md @@ -12,7 +12,7 @@ This page lists some of the available add-ons and links to their respective inst * [Weave Net](https://github.com/weaveworks/weave-kube) provides networking and network policy, will carry on working on both sides of a network partition, and does not require an external database. * [Calico](https://github.com/projectcalico/calico-containers/tree/master/docs/cni/kubernetes/manifests/kubeadm) is a secure L3 networking and network policy provider. * [Canal](https://github.com/tigera/canal/tree/master/k8s-install/kubeadm) unites Flannel and Calico, providing networking and network policy. -* [Romana](http://romana.io) is a Layer 3 networking solution for pod networks that also supports the [NetworkPolicy API(/docs/user-guide/networkpolicies/). Kubeadmin add-on installation details available [here](https://github.com/romana/romana/tree/master/containerize). +* [Romana](http://romana.io) is a Layer 3 networking solution for pod networks that also supports the [NetworkPolicy API](/docs/user-guide/networkpolicies/). Kubeadmin add-on installation details available [here](https://github.com/romana/romana/tree/master/containerize). ## Visualization & Control From 08d1ecd1dfe57a153acaa720f424472240957045 Mon Sep 17 00:00:00 2001 From: Chris Marino Date: Mon, 24 Oct 2016 16:25:58 -0700 Subject: [PATCH 32/93] Kubeadm consistency --- docs/admin/addons.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/addons.md b/docs/admin/addons.md index 92b1e1998d..e802343ab9 100644 --- a/docs/admin/addons.md +++ b/docs/admin/addons.md @@ -12,7 +12,7 @@ This page lists some of the available add-ons and links to their respective inst * [Weave Net](https://github.com/weaveworks/weave-kube) provides networking and network policy, will carry on working on both sides of a network partition, and does not require an external database. * [Calico](https://github.com/projectcalico/calico-containers/tree/master/docs/cni/kubernetes/manifests/kubeadm) is a secure L3 networking and network policy provider. * [Canal](https://github.com/tigera/canal/tree/master/k8s-install/kubeadm) unites Flannel and Calico, providing networking and network policy. -* [Romana](http://romana.io) is a Layer 3 networking solution for pod networks that also supports the [NetworkPolicy API](/docs/user-guide/networkpolicies/). Kubeadmin add-on installation details available [here](https://github.com/romana/romana/tree/master/containerize). +* [Romana](http://romana.io) is a Layer 3 networking solution for pod networks that also supports the [NetworkPolicy API](/docs/user-guide/networkpolicies/). Kubeadm add-on installation details available [here](https://github.com/romana/romana/tree/master/containerize). ## Visualization & Control From 8f02f91f536844a2ec68bfd0f4288862b1fcd044 Mon Sep 17 00:00:00 2001 From: Chris Love Date: Mon, 24 Oct 2016 18:56:11 -0600 Subject: [PATCH 33/93] Improving kubectl cheat sheet (#1486) * Improving kubectl cheatsheet * removing sentence and some cleanup --- docs/user-guide/kubectl-cheatsheet.md | 236 +++++++++++++++++++++----- 1 file changed, 191 insertions(+), 45 deletions(-) diff --git a/docs/user-guide/kubectl-cheatsheet.md b/docs/user-guide/kubectl-cheatsheet.md index b2e1c51fa9..14e6850f37 100644 --- a/docs/user-guide/kubectl-cheatsheet.md +++ b/docs/user-guide/kubectl-cheatsheet.md @@ -3,24 +3,57 @@ assignees: - bgrant0607 - erictune - krousey +- clove --- -An assortment of compact kubectl examples -See also: [Kubectl overview](/docs/user-guide/kubectl-overview/) and [JsonPath guide](/docs/user-guide/jsonpath). +See also: [Kubectl Overview](/docs/user-guide/kubectl-overview/) and [JsonPath Guide](/docs/user-guide/jsonpath). + +## Kubectl Autocomplete + +```console +$ source <(kubectl completion bash) # setup autocomplete in bash +$ source <(kubectl completion zsh) # setup autocomplete in zsh +``` + +## Kubectl Context and Configuration + +Set which Kubernetes cluster `kubectl` communicates with and modify configuration +information. See [kubeconfig file](/docs/user-guide/kubeconfig-file/) documentation for +detailed config file information. + +```console +$ kubectl config view # Show Merged kubeconfig settings. + +# use multiple kubeconfig files at the same time and view merged config +$ KUBECONFIG=~/.kube/config:~/.kube/kubconfig2 kubectl config view + +# Get the password for the e2e user +$ kubectl config view -o jsonpath='{.users[?(@.name == "e2e")].user.password}' + +$ kubectl config current-context # Display the current-context +$ kubectl config use-context my-cluster-name # set the default context to my-cluster-name + +# add a new cluster to your kubeconf that supports basic auth +$ kubectl config set-credentials kubeuser/foo.kubernetes.com --username=kubeuser --password=kubepassword + +# set a context utilizing a specific username and namespace. +$ kubectl config set-context gce --user=cluster-admin --namespace=foo \ + && kubectl config use-context gce +``` ## Creating Objects -```shell -$ kubectl create -f ./file.yml # create resource(s) in a json or yaml file +Kubernetes manifests can be defined in json or yaml. The file extension `.yaml`, +`.yml`, and `.json` can be used. -$ kubectl create -f ./file1.yml -f ./file2.yaml # create resource(s) in a json or yaml file - -$ kubectl create -f ./dir # create resources in all .json, .yml, and .yaml files in dir - -# Create from a URL - -$ kubectl create -f http://www.fpaste.org/279276/48569091/raw/ +```console +$ kubectl create -f ./my-manifest.yaml # create resource(s) +$ kubectl create -f ./my1.yaml -f ./my2.yaml # create from multiple files +$ kubectl create -f ./dir # create resource(s) in all manifest files in dir +$ kubectl create -f https://git.io/vPieo # create resource(s) from url +$ kubectl run nginx --image=nginx # start a single instance of nginx +$ kubectl explain pods,svc # get the documentation for pod and svc manifests # Create multiple YAML objects from stdin $ cat < # List a particular replication controller -$ kubectl get replicationcontroller # List a particular RC +$ kubectl get deployment my-dep # List a particular deployment -# Verbose output -$ kubectl describe nodes -$ kubectl describe pods -$ kubectl describe pods/ # Equivalent to previous -$ kubectl describe pods # Lists pods created by using common prefix +# Describe commands with verbose output +$ kubectl describe nodes my-node +$ kubectl describe pods my-pod -# List Services Sorted by Name -$ kubectl get services --sort-by=.metadata.name +$ kubectl get services --sort-by=.metadata.name # List Services Sorted by Name # List pods Sorted by Restart Count $ kubectl get pods --sort-by='.status.containerStatuses[0].restartCount' # Get the version label of all pods with label app=cassandra -$ kubectl get pods --selector=app=cassandra rc -o 'jsonpath={.items[*].metadata.labels.version}' +$ kubectl get pods --selector=app=cassandra rc -o \ + jsonpath='{.items[*].metadata.labels.version}' # Get ExternalIPs of all nodes $ kubectl get nodes -o jsonpath='{.items[*].status.addresses[?(@.type=="ExternalIP")].address}' # List Names of Pods that belong to Particular RC # "jq" command useful for transformations that are too complex for jsonpath -$ sel=$(kubectl get rc --output=json | jq -j '.spec.selector | to_entries | .[] | "\(.key)=\(.value),"') -$ sel=${sel%?} # Remove trailing comma -$ pods=$(kubectl get pods --selector=$sel --output=jsonpath={.items..metadata.name}) -$ echo $pods +$ sel=${$(kubectl get rc my-rc --output=json | jq -j '.spec.selector | to_entries | .[] | "\(.key)=\(.value),"')%?} +$ echo $(kubectl get pods --selector=$sel --output=jsonpath={.items..metadata.name}) # Check which nodes are ready -$ kubectl get nodes -o jsonpath='{range .items[*]}{@.metadata.name}:{range @.status.conditions[*]}{@.type}={@.status};{end}{end}'| tr ';' "\n" | grep "Ready=True" +$ JSONPATH='{range .items[*]}{@.metadata.name}:{range @.status.conditions[*]}{@.type}={@.status};{end}{end}' \ + && kubectl get nodes -o jsonpath=$JSONPATH | grep "Ready=True" ``` -## Modifying and Deleting Resources +## Updating Resources -```shell -$ kubectl label pods new-label=awesome # Add a Label -$ kubectl annotate pods icon-url=http://goo.gl/XXBTWq # Add an annotation +```console +$ kubectl rolling-update frontend-v1 -f frontend-v2.json # Rolling update pods of frontend-v1 +$ kubectl rolling-update frontend-v1 frontend-v2 --image=image:v2 # Change the name of the resource and update the image +$ kubectl rolling-update frontend --image=image:v2 # Update the pods image of frontend +$ kubectl rolling-update frontend-v1 frontend-v2 --rollback # Abort existing rollout in progress +$ cat pod.json | kubectl replace -f - # Replace a pod based on the JSON passed into stdin -# TODO: examples of kubectl edit, patch, delete, replace, scale, and rolling-update commands. +# Force replace, delete and then re-create the resource. Will cause a service outage. +$ kubectl replace --force -f ./pod.json + +# Create a service for a replicated nginx, which serves on port 80 and connects to the containers on port 8000 +$ kubectl expose rc nginx --port=80 --target-port=8000 + +# Update a single-container pod's image version (tag) to v4 +$ kubectl get pod mypod -o yaml | sed 's/\(image: myimage\):.*$/\1:v4/' | kubectl replace -f - + +$ kubectl label pods my-pod new-label=awesome # Add a Label +$ kubectl annotate pods my-pod icon-url=http://goo.gl/XXBTWq # Add an annotation +$ kubectl autoscale deployment foo --min=2 --max=10 # Auto scale a deployment "foo" +``` + +## Patching Resources +Patch a resource(s) with a strategic merge patch. + +```console +$ kubectl patch node k8s-node-1 -p '{"spec":{"unschedulable":true}}' # Partially update a node + +# Update a container's image; spec.containers[*].name is required because it's a merge key +$ kubectl patch pod valid-pod -p '{"spec":{"containers":[{"name":"kubernetes-serve-hostname","image":"new image"}]}}' + +# Update a container's image using a json patch with positional arrays +$ kubectl patch pod valid-pod --type='json' -p='[{"op": "replace", "path": "/spec/containers/0/image", "value":"new image"}]' +``` + +## Editing Resources +The edit any API resource in an editor. + +```console +$ kubectl edit svc/docker-registry # Edit the service named docker-registry +$ KUBE_EDITOR="nano" kubectl edit svc/docker-registry # Use an alternative editor +``` + +## Scaling Resources + +```console +$ kubectl scale --replicas=3 rs/foo # Scale a replicaset named 'foo' to +$ kubectl scale --replicas=3 -f foo.yaml # Scale a resource specified in "foo.yaml" to 3 +$ kubectl scale --current-replicas=2 --replicas=3 deployment/mysql # If the deployment named mysql's current size is 2, scale mysql to 3 +$ kubectl scale --replicas=5 rc/foo rc/bar rc/baz # Scale multiple replication controllers +``` + +## Deleting Resources + +```console +$ kubectl delete -f ./pod.json # Delete a pod using the type and name specified in pod.json +$ kubectl delete pod,service baz foo # Delete pods and services with same names "baz" and "foo" +$ kubectl delete pods,services -l name=myLabel # Delete pods and services with label name=myLabel +$ kubectl -n my-ns delete po,svc --all # Delete all pods and services in namespace my-ns ``` ## Interacting with running Pods -```shell -$ kubectl logs # dump pod logs (stdout) -$ kubectl logs -f # stream pod logs (stdout) until canceled (ctrl-c) or timeout - -$ kubectl run -i --tty busybox --image=busybox -- sh # Run pod as interactive shell -$ kubectl attach -i # Attach to Running Container -$ kubectl port-forward # Forward port of Pod to your local machine -$ kubectl port-forward # Forward port to service -$ kubectl exec -- ls / # Run command in existing pod (1 container case) -$ kubectl exec -c -- ls / # Run command in existing pod (multi-container case) +```console +$ kubectl logs my-pod # dump pod logs (stdout) +$ kubectl logs -f my-pod # stream pod logs (stdout) +$ kubectl run -i --tty busybox --image=busybox -- sh # Run pod as interactive shell +$ kubectl attach my-pod -i # Attach to Running Container +$ kubectl port-forward my-pod 5000 6000 # Forward port 6000 of Pod to your to 5000 on your local machine +$ kubectl port-forward my-svc 6000 # Forward port to service +$ kubectl exec my-pod -- ls / # Run command in existing pod (1 container case) +$ kubectl exec my-pod -c my-container -- ls / # Run command in existing pod (multi-container case) +$ kubectl top pod POD_NAME --containers # Show metrics for a given pod and its containers ``` + +## Interacting with Nodes and Cluster + +```console +$ kubectl cordon my-node # Mark my-node as unschedulable +$ kubectl drain my-node # Drain my-node in preparation for maintenance +$ kubectl uncordon my-node # Mark my-node as schedulable +$ kubectl top node my-node # Show metrics for a given node +$ kubectl cluster-info # Display addresses of the master and services +$ kubectl cluster-info dump # Dump current cluster state to stdout +$ kubectl cluster-info dump --output-directory=/path/to/cluster-state # Dump current cluster state to /path/to/cluster-state + +# If a taint with that key and effect already exists, its value is replaced as specified. +$ kubectl taint nodes foo dedicated=special-user:NoSchedule +``` + +## Resource types + +The following table includes a list of all the supported resource types and their abbreviated aliases. + +Resource type | Abbreviated alias +-------------------- | -------------------- +`clusters` | +`componentstatuses` |`cs` +`configmaps` |`cm` +`daemonsets` |`ds` +`deployments` |`deploy` +`endpoints` |`ep` +`event` |`ev` +`horizontalpodautoscalers` |`hpa` +`ingresses` |`ing` +`jobs` | +`limitranges` |`limits` +`namespaces` |`ns` +`networkpolicies` | +`nodes` |`no` +`petset` | +`persistentvolumeclaims` |`pvc` +`persistentvolumes` |`pv` +`pods` |`po` +`podsecuritypolicies` |`psp` +`podtemplates` | +`replicasets` |`rs` +`replicationcontrollers` |`rc` +`resourcequotas` |`quota` +`scheduledjob` | +`secrets` | +`serviceaccount` |`sa` +`services` |`svc` +`storageclasses` | +`thirdpartyresources` | + +### Formatting output + +To output details to your terminal window in a specific format, you can add either the `-o` or `-output` flags to a supported `kubectl` command. + +Output format | Description +--------------| ----------- +`-o=custom-columns=` | Print a table using a comma separated list of custom columns +`-o=custom-columns-file=` | Print a table using the custom columns template in the `` file +`-o=json` | Output a JSON formatted API object +`-o=jsonpath=