From 4cdf55fedc38ec8a655220fd47451e812f99d4c8 Mon Sep 17 00:00:00 2001 From: Xiaoyu Zhang Date: Thu, 23 Mar 2017 19:44:20 +0800 Subject: [PATCH 1/5] update resource-usage-monitoring.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit "purpose–built" means "designed and built for a particular use" --- .../cluster-administration/resource-usage-monitoring.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/concepts/cluster-administration/resource-usage-monitoring.md b/docs/concepts/cluster-administration/resource-usage-monitoring.md index 9bf778124b..56ceb51309 100644 --- a/docs/concepts/cluster-administration/resource-usage-monitoring.md +++ b/docs/concepts/cluster-administration/resource-usage-monitoring.md @@ -16,7 +16,7 @@ Let's look at some of the other components in more detail. ### cAdvisor -cAdvisor is an open source container resource usage and performance analysis agent. It is purpose built for containers and supports Docker containers natively. In Kubernetes, cadvisor is integrated into the Kubelet binary. cAdvisor auto-discovers all containers in the machine and collects CPU, memory, filesystem, and network usage statistics. cAdvisor also provides the overall machine usage by analyzing the 'root'? container on the machine. +cAdvisor is an open source container resource usage and performance analysis agent. It is purpose-built for containers and supports Docker containers natively. In Kubernetes, cadvisor is integrated into the Kubelet binary. cAdvisor auto-discovers all containers in the machine and collects CPU, memory, filesystem, and network usage statistics. cAdvisor also provides the overall machine usage by analyzing the 'root'? container on the machine. On most Kubernetes clusters, cAdvisor exposes a simple UI for on-machine containers on port 4194. Here is a snapshot of part of cAdvisor's UI that shows the overall machine usage: From 696ca85aff8474fb07fd3cdb01f4e5dd6049a4e1 Mon Sep 17 00:00:00 2001 From: Mike Rostermund Date: Thu, 23 Mar 2017 22:43:52 +0100 Subject: [PATCH 2/5] Fix typo --- docs/getting-started-guides/kargo.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started-guides/kargo.md b/docs/getting-started-guides/kargo.md index f314870a78..630b17b41b 100644 --- a/docs/getting-started-guides/kargo.md +++ b/docs/getting-started-guides/kargo.md @@ -73,7 +73,7 @@ to [kubeadm](../kubeadm) and [kops](../kops). #### Checklist -* Enusre the netchecker-agent's pods can resolve DNS requests and ping each over within the default namespace. +* Ensure the netchecker-agent's pods can resolve DNS requests and ping each over within the default namespace. Those pods mimic similar behavior of the rest of the workloads and serve as cluster health indicators. ## Explore contributed add-ons From facd9bcce7aa046b3dd6baa326ba292fedf9b7b3 Mon Sep 17 00:00:00 2001 From: yupengzte Date: Thu, 23 Mar 2017 17:08:05 +0800 Subject: [PATCH 3/5] Delete the useless spaces in html files Signed-off-by: yupengzte --- .../v1.5/node_modules/jquery.scrollto/demo/index.html | 6 +++--- .../v1.5/node_modules/jquery.scrollto/demo/index.html | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/api-reference/v1.5/node_modules/jquery.scrollto/demo/index.html b/docs/api-reference/v1.5/node_modules/jquery.scrollto/demo/index.html index 3f3347882e..be76cd4fc3 100644 --- a/docs/api-reference/v1.5/node_modules/jquery.scrollto/demo/index.html +++ b/docs/api-reference/v1.5/node_modules/jquery.scrollto/demo/index.html @@ -84,13 +84,13 @@ $('#relative-px').click(function() { $target.scrollTo('+=100', 500); }); - $('#relative-px-hash').click(function() { + $('#relative-px-hash').click(function() { $target.scrollTo({top:'-=100px', left:'+=100'}, 500); }); - $('#percentage-px').click(function() { + $('#percentage-px').click(function() { $target.scrollTo('50%', 800); }); - $('#percentage-px-hash').click(function() { + $('#percentage-px-hash').click(function() { $target.scrollTo({top:'50%', left:'20%'}, 800); }); diff --git a/docs/resources-reference/v1.5/node_modules/jquery.scrollto/demo/index.html b/docs/resources-reference/v1.5/node_modules/jquery.scrollto/demo/index.html index 3f3347882e..be76cd4fc3 100644 --- a/docs/resources-reference/v1.5/node_modules/jquery.scrollto/demo/index.html +++ b/docs/resources-reference/v1.5/node_modules/jquery.scrollto/demo/index.html @@ -84,13 +84,13 @@ $('#relative-px').click(function() { $target.scrollTo('+=100', 500); }); - $('#relative-px-hash').click(function() { + $('#relative-px-hash').click(function() { $target.scrollTo({top:'-=100px', left:'+=100'}, 500); }); - $('#percentage-px').click(function() { + $('#percentage-px').click(function() { $target.scrollTo('50%', 800); }); - $('#percentage-px-hash').click(function() { + $('#percentage-px-hash').click(function() { $target.scrollTo({top:'50%', left:'20%'}, 800); }); From c8179efc202ab7094c937ddff501edb514746684 Mon Sep 17 00:00:00 2001 From: Jonathan MacMillan Date: Thu, 23 Mar 2017 14:53:09 -0700 Subject: [PATCH 4/5] [Federation] Add a note about DNS API scopes to the Federation tutorial (#2943) * [Federation] Add a note about DNS API scopes to the Federation tutorial Not sure this is the right place for this, but I wanted to get the text out somewhere before I forgot about it. * Update set-up-cluster-federation-kubefed.md * Update set-up-cluster-federation-kubefed.md * Fix formatting of code blocks. --- .../set-up-cluster-federation-kubefed.md | 28 +++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/docs/tutorials/federation/set-up-cluster-federation-kubefed.md b/docs/tutorials/federation/set-up-cluster-federation-kubefed.md index 4af8db60b5..cc287b677f 100644 --- a/docs/tutorials/federation/set-up-cluster-federation-kubefed.md +++ b/docs/tutorials/federation/set-up-cluster-federation-kubefed.md @@ -97,6 +97,34 @@ kubefed init fellowship --host-cluster-context=rivendell --dns-zone-name="examp The domain suffix specified in `--dns-zone-name` must be an existing domain that you control, and that is programmable by your DNS provider. +The machines in your host cluster must have the appropriate permissions +to program the DNS service that you are using. For example, if your +cluster is running on Google Compute Engine, you must enable the +Google Cloud DNS API for your project. + +The machines in Google Container Engine (GKE) clusters are created +without the Google Cloud DNS API scope by default. If you want to use a +GKE cluster as a Federation host, you must create it using the `gcloud` +command with the appropriate value in the `--scopes` field. You cannot +modify a GKE cluster directly to add this scope, but you can create a +new node pool for your cluster and delete the old one. *Note that this +will cause pods in the cluster to be rescheduled.* + +To add the new node pool, run: + +```shell +scopes="$(gcloud container node-pools describe --cluster=gke-cluster default-pool --format='value[delimiter=","](config.oauthScopes)')" +gcloud container node-pools create new-np \ + --cluster=gke-cluster \ + --scopes="${scopes},https://www.googleapis.com/auth/ndev.clouddns.readwrite" +``` + +To delete the old node pool, run: + +```shell +gcloud container node-pools delete default-pool --cluster gke-cluster +``` + `kubefed init` sets up the federation control plane in the host cluster and also adds an entry for the federation API server in your local kubeconfig. Note that in the alpha release in Kubernetes 1.5, From 57ad5d1cf682f89865fff9087d725fd464bd5bea Mon Sep 17 00:00:00 2001 From: Cao Shufeng Date: Tue, 14 Mar 2017 03:45:46 -0400 Subject: [PATCH 5/5] Update some description about secrets We can use RBAC/ABAC to control which users can access secrets. --- docs/user-guide/secrets/index.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/docs/user-guide/secrets/index.md b/docs/user-guide/secrets/index.md index d5b19afd58..91fc5aa2ec 100644 --- a/docs/user-guide/secrets/index.md +++ b/docs/user-guide/secrets/index.md @@ -789,8 +789,6 @@ Pod level](#use-case-secret-visible-to-one-container-in-a-pod). run a pod which exposes the secret. - If multiple replicas of etcd are run, then the secrets will be shared between them. By default, etcd does not secure peer-to-peer communication with SSL/TLS, though this can be configured. - - It is not possible currently to control which users of a Kubernetes cluster can - access a secret. Support for this is planned. - Currently, anyone with root on any node can read any secret from the apiserver, by impersonating the kubelet. It is a planned feature to only send secrets to nodes that actually require them, to restrict the impact of a root exploit on a