Merge branch 'master' of https://github.com/kubernetes/kubernetes.github.io into release-1.6

* 'master' of https://github.com/kubernetes/kubernetes.github.io: Update some description about secrets [Federation] Add a note about DNS API scopes to the Federation tutorial (#2943) Delete the useless spaces in html files Fix typo update resource-usage-monitoring.md
2017-03-23 15:23:47 -07:00
parent 2410c9e8da 57ad5d1cf6
commit 4568e52bd1
6 changed files with 36 additions and 10 deletions
@@ -84,13 +84,13 @@
            $('#relative-px').click(function() {
                $target.scrollTo('+=100', 500);
            });
-            $('#relative-px-hash').click(function() {                
+            $('#relative-px-hash').click(function() {
                $target.scrollTo({top:'-=100px', left:'+=100'}, 500);
            });
-            $('#percentage-px').click(function() {                
+            $('#percentage-px').click(function() {
                $target.scrollTo('50%', 800);
            });
-            $('#percentage-px-hash').click(function() {                
+            $('#percentage-px-hash').click(function() {
                $target.scrollTo({top:'50%', left:'20%'}, 800);
            });
            
@@ -16,7 +16,7 @@ Let's look at some of the other components in more detail.

 ### cAdvisor

-cAdvisor is an open source container resource usage and performance analysis agent. It is purpose built for containers and supports Docker containers natively. In Kubernetes, cadvisor is integrated into the Kubelet binary. cAdvisor auto-discovers all containers in the machine and collects CPU, memory, filesystem, and network usage statistics. cAdvisor also provides the overall machine usage by analyzing the 'root'? container on the machine.
+cAdvisor is an open source container resource usage and performance analysis agent. It is purpose-built for containers and supports Docker containers natively. In Kubernetes, cadvisor is integrated into the Kubelet binary. cAdvisor auto-discovers all containers in the machine and collects CPU, memory, filesystem, and network usage statistics. cAdvisor also provides the overall machine usage by analyzing the 'root'? container on the machine.

 On most Kubernetes clusters, cAdvisor exposes a simple UI for on-machine containers on port 4194. Here is a snapshot of part of cAdvisor's UI that shows the overall machine usage:

@@ -73,7 +73,7 @@ to [kubeadm](../kubeadm) and [kops](../kops).

 #### Checklist

-* Enusre the netchecker-agent's pods can resolve DNS requests and ping each over within the default namespace.
+* Ensure the netchecker-agent's pods can resolve DNS requests and ping each over within the default namespace.
  Those pods mimic similar behavior of the rest of the workloads and serve as cluster health indicators.

 ## Explore contributed add-ons
@@ -84,13 +84,13 @@
            $('#relative-px').click(function() {
                $target.scrollTo('+=100', 500);
            });
-            $('#relative-px-hash').click(function() {                
+            $('#relative-px-hash').click(function() {
                $target.scrollTo({top:'-=100px', left:'+=100'}, 500);
            });
-            $('#percentage-px').click(function() {                
+            $('#percentage-px').click(function() {
                $target.scrollTo('50%', 800);
            });
-            $('#percentage-px-hash').click(function() {                
+            $('#percentage-px-hash').click(function() {
                $target.scrollTo({top:'50%', left:'20%'}, 800);
            });
            
@@ -123,6 +123,34 @@ The domain suffix specified in `--dns-zone-name` must be an existing
 domain that you control, and that is programmable by your DNS provider.
 It must also end with a trailing dot.

+The machines in your host cluster must have the appropriate permissions
+to program the DNS service that you are using. For example, if your
+cluster is running on Google Compute Engine, you must enable the
+Google Cloud DNS API for your project.
+
+The machines in Google Container Engine (GKE) clusters are created
+without the Google Cloud DNS API scope by default. If you want to use a
+GKE cluster as a Federation host, you must create it using the `gcloud`
+command with the appropriate value in the `--scopes` field. You cannot
+modify a GKE cluster directly to add this scope, but you can create a
+new node pool for your cluster and delete the old one. *Note that this
+will cause pods in the cluster to be rescheduled.*
+
+To add the new node pool, run:
+
+```shell
+scopes="$(gcloud container node-pools describe --cluster=gke-cluster default-pool --format='value[delimiter=","](config.oauthScopes)')"
+gcloud container node-pools create new-np \
+    --cluster=gke-cluster \
+    --scopes="${scopes},https://www.googleapis.com/auth/ndev.clouddns.readwrite"
+```
+
+To delete the old node pool, run:
+
+```shell
+gcloud container node-pools delete default-pool --cluster gke-cluster
+```
+
 `kubefed init` sets up the federation control plane in the host
 cluster and also adds an entry for the federation API server in your
 local kubeconfig. Note that in the beta release in Kubernetes 1.6,
@@ -789,8 +789,6 @@ Pod level](#use-case-secret-visible-to-one-container-in-a-pod).
   run a pod which exposes the secret.
 - If multiple replicas of etcd are run, then the secrets will be shared between them.
   By default, etcd does not secure peer-to-peer communication with SSL/TLS, though this can be configured.
- - It is not possible currently to control which users of a Kubernetes cluster can
-   access a secret.  Support for this is planned.
 - Currently, anyone with root on any node can read any secret from the apiserver,
   by impersonating the kubelet.  It is a planned feature to only send secrets to
   nodes that actually require them, to restrict the impact of a root exploit on a