merge master to 1.10, with fixes (#7682)
This commit is contained in:
Jennifer Rondeau
committed by
k8s-ci-robot
k8s-ci-robot
parent
bb8c59a640
commit
44b51d6056
@@ -67,7 +67,7 @@ for the Pod:
|
||||
{% include code.html language="yaml" file="memory-request-limit.yaml" ghlink="/docs/tasks/configure-pod-container/memory-request-limit.yaml" %}
|
||||
|
||||
In the configuration file, the `args` section provides arguments for the Container when it starts.
|
||||
The `-mem-total 150Mi` argument tells the Container to attempt to allocate 150 MiB of memory.
|
||||
The `"--vm-bytes", "150M"` arguments tell the Container to attempt to allocate 150 MiB of memory.
|
||||
|
||||
Create the Pod:
|
||||
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
enemies=aliens
|
||||
lives=3
|
||||
enemies.cheat=true
|
||||
enemies.cheat.level=noGoodRotten
|
||||
secret.code.passphrase=UUDDLRLRBABAS
|
||||
secret.code.allowed=true
|
||||
secret.code.lives=30
|
||||
@@ -0,0 +1,4 @@
|
||||
color.good=purple
|
||||
color.bad=yellow
|
||||
allow.textmode=true
|
||||
how.nice.to.look=fairlyNice
|
||||
@@ -63,7 +63,7 @@ Here is the configuration file for the hostPath PersistentVolume:
|
||||
{% include code.html language="yaml" file="task-pv-volume.yaml" ghlink="/docs/tasks/configure-pod-container/task-pv-volume.yaml" %}
|
||||
|
||||
The configuration file specifies that the volume is at `/mnt/data` on the
|
||||
the cluster's Node. The configuration also specifies a size of 10 gibibytes and
|
||||
cluster's Node. The configuration also specifies a size of 10 gibibytes and
|
||||
an access mode of `ReadWriteOnce`, which means the volume can be mounted as
|
||||
read-write by a single Node. It defines the [StorageClass name](/docs/concepts/storage/persistent-volumes/#class)
|
||||
`manual` for the PersistentVolume, which will be used to bind
|
||||
|
||||
@@ -31,8 +31,8 @@ The data source corresponds to a key-value pair in the ConfigMap, where
|
||||
* key = the file name or the key you provided on the command line, and
|
||||
* value = the file contents or the literal value you provided on the command line.
|
||||
|
||||
You can use [`kubectl describe`](/docs/user-guide/kubectl/{{page.version}}/#describe) or
|
||||
[`kubectl get`](/docs/user-guide/kubectl/{{page.version}}/#get) to retrieve information
|
||||
You can use [`kubectl describe`](/docs/reference/generated/kubectl/kubectl-commands/#describe) or
|
||||
[`kubectl get`](/docs/reference/generated/kubectl/kubectl-commands/#get) to retrieve information
|
||||
about a ConfigMap.
|
||||
|
||||
### Create ConfigMaps from directories
|
||||
@@ -42,13 +42,13 @@ You can use `kubectl create configmap` to create a ConfigMap from multiple files
|
||||
For example:
|
||||
|
||||
```shell
|
||||
kubectl create configmap game-config --from-file=docs/user-guide/configmap/kubectl
|
||||
kubectl create configmap game-config --from-file=https://k8s.io/docs/tasks/configure-pod-container/configmap/kubectl
|
||||
```
|
||||
|
||||
combines the contents of the `docs/user-guide/configmap/kubectl/` directory
|
||||
combines the contents of the `docs/tasks/configure-pod-container/configmap/kubectl/` directory
|
||||
|
||||
```shell
|
||||
ls docs/user-guide/configmap/kubectl/
|
||||
ls docs/tasks/configure-pod-container/configmap/kubectl/
|
||||
game.properties
|
||||
ui.properties
|
||||
```
|
||||
@@ -68,7 +68,7 @@ game.properties: 158 bytes
|
||||
ui.properties: 83 bytes
|
||||
```
|
||||
|
||||
The `game.properties` and `ui.properties` files in the `docs/user-guide/configmap/kubectl/` directory are represented in the `data` section of the ConfigMap.
|
||||
The `game.properties` and `ui.properties` files in the `docs/tasks/configure-pod-container/configmap/kubectl/` directory are represented in the `data` section of the ConfigMap.
|
||||
|
||||
```shell
|
||||
kubectl get configmaps game-config -o yaml
|
||||
@@ -107,7 +107,7 @@ You can use `kubectl create configmap` to create a ConfigMap from an individual
|
||||
For example,
|
||||
|
||||
```shell
|
||||
kubectl create configmap game-config-2 --from-file=docs/user-guide/configmap/kubectl/game.properties
|
||||
kubectl create configmap game-config-2 --from-file=https://k8s.io/docs/tasks/configure-pod-container/configmap/kubectl/game.properties
|
||||
```
|
||||
|
||||
would produce the following ConfigMap:
|
||||
@@ -127,7 +127,7 @@ game.properties: 158 bytes
|
||||
You can pass in the `--from-file` argument multiple times to create a ConfigMap from multiple data sources.
|
||||
|
||||
```shell
|
||||
kubectl create configmap game-config-2 --from-file=docs/user-guide/configmap/kubectl/game.properties --from-file=docs/user-guide/configmap/kubectl/ui.properties
|
||||
kubectl create configmap game-config-2 --from-file=https://k8s.io/docs/tasks/configure-pod-container/configmap/kubectl/game.properties --from-file=https://k8s.io/docs/tasks/configure-pod-container/configmap/kubectl/ui.properties
|
||||
```
|
||||
|
||||
```shell
|
||||
@@ -143,6 +143,75 @@ game.properties: 158 bytes
|
||||
ui.properties: 83 bytes
|
||||
```
|
||||
|
||||
Use the option `--from-env-file` to create a ConfigMap from an env-file, for example:
|
||||
```shell
|
||||
# Env-files contain a list of environment variables.
|
||||
# These syntax rules apply:
|
||||
# Each line in an env file has to be in VAR=VAL format.
|
||||
# Lines beginning with # (i.e. comments) are ignored.
|
||||
# Blank lines are ignored.
|
||||
# There is no special handling of quotation marks (i.e. they will be part of the ConfigMap value)).
|
||||
|
||||
|
||||
cat docs/tasks/configure-pod-container/game-env-file.properties
|
||||
enemies=aliens
|
||||
lives=3
|
||||
allowed="true"
|
||||
|
||||
# This comment and the empty line above it are ignored
|
||||
```
|
||||
|
||||
```shell
|
||||
kubectl create configmap game-config-env-file \
|
||||
--from-env-file=docs/tasks/configure-pod-container/game-env-file.properties
|
||||
```
|
||||
|
||||
would produce the following ConfigMap:
|
||||
|
||||
```shell
|
||||
kubectl get configmap game-config-env-file -o yaml
|
||||
apiVersion: v1
|
||||
data:
|
||||
allowed: '"true"'
|
||||
enemies: aliens
|
||||
lives: "3"
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
creationTimestamp: 2017-12-27T18:36:28Z
|
||||
name: game-config-env-file
|
||||
namespace: default
|
||||
resourceVersion: "809965"
|
||||
selfLink: /api/v1/namespaces/default/configmaps/game-config-env-file
|
||||
uid: d9d1ca5b-eb34-11e7-887b-42010a8002b8
|
||||
```
|
||||
|
||||
When passing `--from-env-file` multiple times to create a ConfigMap from multiple data sources, only the last env-file is used:
|
||||
|
||||
```shell
|
||||
kubectl create configmap config-multi-env-files \
|
||||
--from-env-file=docs/tasks/configure-pod-container/game-env-file.properties \
|
||||
--from-env-file=docs/tasks/configure-pod-container/ui-env-file.properties
|
||||
```
|
||||
|
||||
would produce the following ConfigMap:
|
||||
|
||||
```
|
||||
kubectl get configmap config-multi-env-files -o yaml
|
||||
apiVersion: v1
|
||||
data:
|
||||
color: purple
|
||||
how: fairlyNice
|
||||
textmode: "true"
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
creationTimestamp: 2017-12-27T18:38:34Z
|
||||
name: config-multi-env-files
|
||||
namespace: default
|
||||
resourceVersion: "810136"
|
||||
selfLink: /api/v1/namespaces/default/configmaps/config-multi-env-files
|
||||
uid: 252c4572-eb35-11e7-887b-42010a8002b8
|
||||
```
|
||||
|
||||
#### Define the key to use when creating a ConfigMap from a file
|
||||
|
||||
You can define a key other than the file name to use in the `data` section of your ConfigMap when using the `--from-file` argument:
|
||||
@@ -156,7 +225,7 @@ where `<my-key-name>` is the key you want to use in the ConfigMap and `<path-to-
|
||||
For example:
|
||||
|
||||
```shell
|
||||
kubectl create configmap game-config-3 --from-file=game-special-key=docs/user-guide/configmap/kubectl/game.properties
|
||||
kubectl create configmap game-config-3 --from-file=game-special-key=https://k8s.io/docs/tasks/configure-pod-container/configmap/kubectl/game.properties
|
||||
|
||||
kubectl get configmaps game-config-3 -o yaml
|
||||
```
|
||||
@@ -476,6 +545,11 @@ basis. The [Secrets](/docs/concepts/configuration/secret/#using-secrets-as-files
|
||||
|
||||
When a ConfigMap already being consumed in a volume is updated, projected keys are eventually updated as well. Kubelet is checking whether the mounted ConfigMap is fresh on every periodic sync. However, it is using its local ttl-based cache for getting the current value of the ConfigMap. As a result, the total delay from the moment when the ConfigMap is updated to the moment when new keys are projected to the pod can be as long as kubelet sync period + ttl of ConfigMaps cache in kubelet.
|
||||
|
||||
**Note:** A container using a ConfigMap as a
|
||||
[subPath](/docs/concepts/storage/volumes/#using-subpath) volume will not receive
|
||||
ConfigMap updates.
|
||||
{: .note}
|
||||
|
||||
{% endcapture %}
|
||||
|
||||
{% capture discussion %}
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
approvers:
|
||||
reviewers:
|
||||
- jpeeler
|
||||
- pmorie
|
||||
title: Configure a Pod to Use a Projected Volume for Storage
|
||||
@@ -57,7 +57,7 @@ the Pod:
|
||||
|
||||
{% capture whatsnext %}
|
||||
* Learn more about [`projected`](/docs/concepts/storage/volumes/#projected) volumes.
|
||||
* Read the the [all-in-one volume](https://github.com/kubernetes/community/blob/{{page.githubbranch}}/contributors/design-proposals/node/all-in-one-volume.md) design document.
|
||||
* Read the [all-in-one volume](https://github.com/kubernetes/community/blob/{{page.githubbranch}}/contributors/design-proposals/node/all-in-one-volume.md) design document.
|
||||
{% endcapture %}
|
||||
|
||||
{% include templates/task.md %}
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
approvers:
|
||||
reviewers:
|
||||
- bprashanth
|
||||
- liggitt
|
||||
- thockin
|
||||
|
||||
@@ -2,6 +2,7 @@ apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: cpu-demo-2
|
||||
namespace: cpu-example
|
||||
spec:
|
||||
containers:
|
||||
- name: cpu-demo-ctr-2
|
||||
|
||||
@@ -2,6 +2,7 @@ apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: cpu-demo
|
||||
namespace: cpu-example
|
||||
spec:
|
||||
containers:
|
||||
- name: cpu-demo-ctr
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
enemies=aliens
|
||||
lives=3
|
||||
allowed="true"
|
||||
|
||||
# This comment and the empty line above it are ignored
|
||||
@@ -2,19 +2,15 @@ apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: memory-demo-2
|
||||
namespace: mem-example
|
||||
spec:
|
||||
containers:
|
||||
- name: memory-demo-2-ctr
|
||||
image: vish/stress
|
||||
image: polinux/stress
|
||||
resources:
|
||||
requests:
|
||||
memory: "50Mi"
|
||||
limits:
|
||||
memory: "100Mi"
|
||||
args:
|
||||
- -mem-total
|
||||
- 250Mi
|
||||
- -mem-alloc-size
|
||||
- 10Mi
|
||||
- -mem-alloc-sleep
|
||||
- 1s
|
||||
command: ["stress"]
|
||||
args: ["--vm", "1", "--vm-bytes", "250M", "--vm-hang", "1"]
|
||||
|
||||
@@ -2,19 +2,15 @@ apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: memory-demo-3
|
||||
namespace: mem-example
|
||||
spec:
|
||||
containers:
|
||||
- name: memory-demo-3-ctr
|
||||
image: vish/stress
|
||||
image: polinux/stress
|
||||
resources:
|
||||
limits:
|
||||
memory: "1000Gi"
|
||||
requests:
|
||||
memory: "1000Gi"
|
||||
args:
|
||||
- -mem-total
|
||||
- 150Mi
|
||||
- -mem-alloc-size
|
||||
- 10Mi
|
||||
- -mem-alloc-sleep
|
||||
- 1s
|
||||
command: ["stress"]
|
||||
args: ["--vm", "1", "--vm-bytes", "150M", "--vm-hang", "1"]
|
||||
|
||||
@@ -2,19 +2,15 @@ apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: memory-demo
|
||||
namespace: mem-example
|
||||
spec:
|
||||
containers:
|
||||
- name: memory-demo-ctr
|
||||
image: vish/stress
|
||||
image: polinux/stress
|
||||
resources:
|
||||
limits:
|
||||
memory: "200Mi"
|
||||
requests:
|
||||
memory: "100Mi"
|
||||
args:
|
||||
- -mem-total
|
||||
- 150Mi
|
||||
- -mem-alloc-size
|
||||
- 10Mi
|
||||
- -mem-alloc-sleep
|
||||
- 1s
|
||||
command: ["stress"]
|
||||
args: ["--vm", "1", "--vm-bytes", "150M", "--vm-hang", "1"]
|
||||
|
||||
@@ -7,5 +7,5 @@ spec:
|
||||
- name: private-reg-container
|
||||
image: <your-private-image>
|
||||
imagePullSecrets:
|
||||
- name: regsecret
|
||||
- name: regcred
|
||||
|
||||
|
||||
@@ -22,12 +22,13 @@ private Docker registry or repository.
|
||||
|
||||
## Log in to Docker
|
||||
|
||||
On your laptop, you must authenticate with a registry in order to pull a private image:
|
||||
|
||||
docker login
|
||||
|
||||
When prompted, enter your Docker username and password.
|
||||
|
||||
The login process creates or updates a `config.json` file that holds an
|
||||
authorization token.
|
||||
The login process creates or updates a `config.json` file that holds an authorization token.
|
||||
|
||||
View the `config.json` file:
|
||||
|
||||
@@ -46,11 +47,13 @@ The output contains a section similar to this:
|
||||
**Note:** If you use a Docker credentials store, you won't see that `auth` entry but a `credsStore` entry with the name of the store as value.
|
||||
{: .note}
|
||||
|
||||
## Create a Secret that holds your authorization token
|
||||
## Create a Secret in the cluster that holds your authorization token
|
||||
|
||||
Create a Secret named `regsecret`:
|
||||
A Kubernetes cluster uses the Secret of `docker-registry` type to authenticate with a container registry to pull a private image.
|
||||
|
||||
kubectl create secret docker-registry regsecret --docker-server=<your-registry-server> --docker-username=<your-name> --docker-password=<your-pword> --docker-email=<your-email>
|
||||
Create this Secret, naming it `regcred`:
|
||||
|
||||
kubectl create secret docker-registry regcred --docker-server=<your-registry-server> --docker-username=<your-name> --docker-password=<your-pword> --docker-email=<your-email>
|
||||
|
||||
where:
|
||||
|
||||
@@ -59,46 +62,44 @@ where:
|
||||
* `<your-pword>` is your Docker password.
|
||||
* `<your-email>` is your Docker email.
|
||||
|
||||
## Understanding your Secret
|
||||
You have successfully set your Docker credentials in the cluster as a Secret called `regcred`.
|
||||
|
||||
To understand what's in the Secret you just created, start by viewing the
|
||||
Secret in YAML format:
|
||||
## Inspecting the Secret `regcred`
|
||||
|
||||
kubectl get secret regsecret --output=yaml
|
||||
To understand the contents of the `regcred` Secret you just created, start by viewing the Secret in YAML format:
|
||||
|
||||
kubectl get secret regcred --output=yaml
|
||||
|
||||
The output is similar to this:
|
||||
|
||||
apiVersion: v1
|
||||
data:
|
||||
.dockercfg: eyJodHRwczovL2luZGV4L ... J0QUl6RTIifX0=
|
||||
.dockerconfigjson: eyJodHRwczovL2luZGV4L ... J0QUl6RTIifX0=
|
||||
kind: Secret
|
||||
metadata:
|
||||
...
|
||||
name: regsecret
|
||||
name: regcred
|
||||
...
|
||||
type: kubernetes.io/dockercfg
|
||||
type: kubernetes.io/dockerconfigjson
|
||||
|
||||
The value of the `.dockercfg` field is a base64 representation of your secret data.
|
||||
The value of the `.dockerconfigjson` field is a base64 representation of your Docker credentials.
|
||||
|
||||
Copy the base64 representation of the secret data into a file named `secret64`.
|
||||
|
||||
**Important**: Make sure there are no line breaks in your `secret64` file.
|
||||
|
||||
To understand what is in the `.dockercfg` field, convert the secret data to a
|
||||
To understand what is in the `.dockerconfigjson` field, convert the secret data to a
|
||||
readable format:
|
||||
|
||||
base64 -d secret64
|
||||
kubectl get secret regcred --output="jsonpath={.data.\.dockerconfigjson}" | base64 -d
|
||||
|
||||
The output is similar to this:
|
||||
|
||||
{"yourprivateregistry.com":{"username":"janedoe","password":"xxxxxxxxxxx","email":"jdoe@example.com","auth":"c3R...zE2"}}
|
||||
{"auths":{"yourprivateregistry.com":{"username":"janedoe","password":"xxxxxxxxxxx","email":"jdoe@example.com","auth":"c3R...zE2"}}}
|
||||
|
||||
Notice that the secret data contains the authorization token from your
|
||||
`config.json` file.
|
||||
Notice that the Secret data contains the authorization token similar to your local `~/.docker/config.json` file.
|
||||
|
||||
You have successfully set your Docker credentials as a Secret called `regcred` in the cluster.
|
||||
|
||||
## Create a Pod that uses your Secret
|
||||
|
||||
Here is a configuration file for a Pod that needs access to your secret data:
|
||||
Here is a configuration file for a Pod that needs access to your Docker credentials in `regcred`:
|
||||
|
||||
{% include code.html language="yaml" file="private-reg-pod.yaml" ghlink="/docs/tasks/configure-pod-container/private-reg-pod.yaml" %}
|
||||
|
||||
@@ -106,17 +107,12 @@ Download the above file:
|
||||
|
||||
wget -O my-private-reg-pod.yaml https://k8s.io/docs/tasks/configure-pod-container/private-reg-pod.yaml
|
||||
|
||||
In file `my-private-reg-pod.yaml`, replace `<your-private-image>` with the
|
||||
path to an image in a private repository.
|
||||
|
||||
Example Docker Hub private image:
|
||||
In file `my-private-reg-pod.yaml`, replace `<your-private-image>` with the path to an image in a private registry such as:
|
||||
|
||||
janedoe/jdoe-private:v1
|
||||
|
||||
To pull the image from the private repository, Kubernetes needs credentials. The
|
||||
`imagePullSecrets` field in the configuration file specifies that Kubernetes
|
||||
should get the credentials from a Secret named
|
||||
`regsecret`.
|
||||
To pull the image from the private registry, Kubernetes needs credentials.
|
||||
The `imagePullSecrets` field in the configuration file specifies that Kubernetes should get the credentials from a Secret named `regcred`.
|
||||
|
||||
Create a Pod that uses your Secret, and verify that the Pod is running:
|
||||
|
||||
@@ -128,12 +124,10 @@ Create a Pod that uses your Secret, and verify that the Pod is running:
|
||||
{% capture whatsnext %}
|
||||
|
||||
* Learn more about [Secrets](/docs/concepts/configuration/secret/).
|
||||
* Learn more about
|
||||
[using a private registry](/docs/concepts/containers/images/#using-a-private-registry).
|
||||
* Learn more about [using a private registry](/docs/concepts/containers/images/#using-a-private-registry).
|
||||
* See [kubectl create secret docker-registry](/docs/user-guide/kubectl/{{page.version}}/#-em-secret-docker-registry-em-).
|
||||
* See [Secret](/docs/api-reference/{{page.version}}/#secret-v1-core)
|
||||
* See the `imagePullSecrets` field of
|
||||
[PodSpec](/docs/api-reference/{{page.version}}/#podspec-v1-core).
|
||||
* See [Secret](/docs/api-reference/{{page.version}}/#secret-v1-core).
|
||||
* See the `imagePullSecrets` field of [PodSpec](/docs/api-reference/{{page.version}}/#podspec-v1-core).
|
||||
|
||||
{% endcapture %}
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
approvers:
|
||||
reviewers:
|
||||
- erictune
|
||||
- mikedanese
|
||||
- thockin
|
||||
@@ -43,7 +43,7 @@ For more information about security mechanisms in Linux, see
|
||||
|
||||
To specify security settings for a Pod, include the `securityContext` field
|
||||
in the Pod specification. The `securityContext` field is a
|
||||
[PodSecurityContext](/docs/api-reference/{{page.version}}/#podsecuritycontext-v1-core) object.
|
||||
[PodSecurityContext](/docs/reference/generated/kubernetes-api/{{page.version}}/#podsecuritycontext-v1-core) object.
|
||||
The security settings that you specify for a Pod apply to all Containers in the Pod.
|
||||
Here is a configuration file for a Pod that has a `securityContext` and an `emptyDir` volume:
|
||||
|
||||
@@ -131,7 +131,7 @@ exit
|
||||
|
||||
To specify security settings for a Container, include the `securityContext` field
|
||||
in the Container manifest. The `securityContext` field is a
|
||||
[SecurityContext](/docs/api-reference/{{page.version}}/#securitycontext-v1-core) object.
|
||||
[SecurityContext](/docs/reference/generated/kubernetes-api/{{page.version}}/#securitycontext-v1-core) object.
|
||||
Security settings that you specify for a Container apply only to
|
||||
the individual Container, and they override settings made at the Pod level when
|
||||
there is overlap. Container settings do not affect the Pod's Volumes.
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
color=purple
|
||||
textmode=true
|
||||
how=fairlyNice
|
||||
Reference in New Issue
Block a user