Merge release 1.12 into release 1.13 (#14171)
* ZH-trans: Update coarse-parallel-processing-work-queue.md (#11862) * ZH-trans: Update coarse-parallel-processing-work-queue.md * Update coarse-parallel-processing-work-queue.md * zh-trans: add /docs/concepts/architecture/cloud-controller.md (#11799) * docs/concepts/architecture/cloud-controller.md * docs/concepts/architecture/cloud-controller.md * docs/concepts/architecture/cloud-controller.md * fix * fix * fix * zh-trans: /docs/contribute/style/kubernetes-components.md (#11838) Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> zh-trans: /docs/contribute/generate-ref-docs/kubernetes-components.md; update Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> * Update weave-network-policy.md (#11858) * ZH-trans: add Update define-environment-variable-container.md (#11859) * Update define-environment-variable-container.md * Update define-environment-variable-container.md * Update define-environment-variable-container.md * Update define-environment-variable-container.md * Update define-environment-variable-container.md * Update fine-parallel-processing-work-queue.md (#11863) * Update fine-parallel-processing-work-queue.md * Update fine-parallel-processing-work-queue.md * Update setup-extension-api-server.md (#11864) * zh-trans: add / docs/reference/setup-tools/kubeadm/kubeadm-join.md (#11798) * zh-trans: add / docs/reference/setup-tools/kubeadm/kubeadm-join.md zh-trans: add / docs/reference/setup-tools/kubeadm/kubeadm-join.md * Update kubeadm-join.md * Create kubeadm_join.md * zh-trans: update docs/concepts/containers/images.md (#11877) * zh-trans: update docs/concepts/containers/images.md * zh-trans: update docs/concepts/containers/images.md * Update kubeadm_alpha_phase_controlplane.md (#11878) * 更新第 115 行翻译 * zh_trans: kubeadm_token_generate.md (#11884) * zh_trans: kubeadm_token_generate.md zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_token_generate.md * Better translation Better translation * zh-trans: add /docs/tasks/configure-pod-container/configure-pod-initialization.md (#11886) zh-trans: add /docs/tasks/configure-pod-container/configure-pod-initialization.md * zh-trans:add content/zh/docs/reference/issues-security (#11890) * zh-trans: add content/zh/docs/tutorials/online-training/overview.md (#11892) * zh_trans: kubeadm_token_delete.md (#11883) * zh_trans: kubeadm_token_delete.md zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_token_create.md * fix tpye error fix tpye error * Better translation Better translation * zh_trans: independent/create-cluster-kubeadm.md (#11882) * zh_trans: independent/create-cluster-kubeadm.md zh_trans: docs/setup/independent/create-cluster-kubeadm.md * fix word style error * fix type error * better zhtran better zhtran * fix "Create" -> "create" fix "Create" -> "create" * zh-trans: add docs/concepts/storage/storage-classes.md (#11788) * ZH-trans: fixing formatting errors (#11661) * ZH-trans: fixing formatting errors * Update ZH-trans: fixing formatting errors storage-classes zh part 1 * storage-classes zh trans * fix typo update trans for provisioner & fix typo * fix typo * 根据校对更新翻译 * zh_trans: kubeadm-token.md (#11898) zh_trans: /docs/reference/setup-tools/kubeadm/kubeadm-token.md * zh-trans: add /docs/tasks/configure-pod-container/quality-service-pod.md (#11900) * zh-trans: add /docs/tasks/configure-pod-container/quality-service-pod.md zh-trans: add /docs/tasks/configure-pod-container/quality-service-pod.md * Update quality-service-pod.md * zh_trans: kubeadm_alpha_phase_bootstrap-token_node.md (#11897) zh_trans: Path：/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token_node.md * zh-trans: add /docs/concepts/storage/volumes.md (#11767) * zh-trans: add /docs/concepts/storage/volumes.md zh-trans: add /docs/concepts/storage/volumes.md * Update volumes.md * Update volumes.md * self-review * Update volumes.md * fix docs format error (#11934) fix docs format error of https://v1-12.docs.kubernetes.io/zh/docs/reference/setup-tools/kubeadm/kubeadm-join/ * Update cloud-controller.md (#11922) * zh-trans: /docs/reference/glossary/approver.md (#11924) zh-trans: /docs/reference/glossary/approver.md * zh-trans: add docs/setup/on-premises-vm/dcos.md (#11891) * zh-trans: add docs/setup/on-premises-vm/dcos.md * Update content/zh/docs/setup/on-premises-vm/dcos.md Co-Authored-By: SataQiu <1527062125@qq.com> * zh-trans: /docs/tasks/configure-pod-container/configure-persistent-vo… (#11915) * zh-trans: /docs/tasks/configure-pod-container/configure-persistent-volume-storage.md zh-trans: /docs/tasks/configure-pod-container/configure-persistent-volume-storage.md * Update configure-persistent-volume-storage.md * zh_trans: kubeadm_alpha.md (#11902) * zh_trans: kubeadm_alpha.md zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha.md * Better translation Better translation * zh-trans: /docs/reference/glossary/downstream.md (#11931) * zh-trans: /docs/reference/glossary/downstream.md zh-trans: /docs/reference/glossary/downstream.md * Update downstream.md * Update downstream.md * ZH-trans: Update install-kubeadm.md (#11955) * fix typo of install-kubeadm.md fix typo of install-kubeadm.md * Update install-kubeadm.md * zh-trans: add kubeadm/generated/kubeadm_alpha_phase_certs_renew_all.md (#11952) * zh-trans: add /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_renew_all.md zh-trans: add /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_renew_all.md * Update kubeadm_alpha_phase_certs_renew_all.md * renew 的翻译更新为续期 * zh-trans:kubeadm/generated/kubeadm_alpha_phase_certs_renew_etcd-peer.md (#11953) * zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_renew_etcd-peer.md /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_renew_etcd-peer.md * Update kubeadm_alpha_phase_certs_renew_etcd-peer.md * zh-trans: /docs/contribute/generate-ref-docs/kubectl.md (#11941) Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> * fix docs format error (#11936) fix docs format error of https://v1-12.docs.kubernetes.io/zh/docs/reference/setup-tools/kubeadm/kubeadm-config/ * Update pull request (#11921) * Update pull request (#11960) * ZH-trans: add kubefed-options.md (#11956) * Update ZH-trans: add kubefed-options.md * Update kubefed-options.md * ZH-trans: add generated/... (#11880) * Update pull request * Update kubeadm_alpha_phase_certs_renew.md * Update pull request (#11881) * ZH-trans: add generated/... (#11879) * Update pull request * Resolving file conflicts * zh-trans: add zh/ docs/tasks/configure-pod-container/configure-servic… (#11889) * zh-trans: add zh/ docs/tasks/configure-pod-container/configure-service-account.md zh-trans: add zh/ docs/tasks/configure-pod-container/configure-service-account.md * Update configure-service-account.md * Update configure-service-account.md * zh-trans: update docs/concepts/cluster-administration/kubelet-garbage-collection.md (#11875) * zh-trans: update docs/concepts/cluster-administration/kubelet-garbage-collection.md * zh-trans: update docs/concepts/cluster-administration/kubelet-garbage-collection.md * zh-trans:update kubelet-garbage-collection.md * zh_trans: kubeadm_alpha_phase_kubeconfig_user.md (#11901) * zh_trans: kubeadm_alpha_phase_kubeconfig_user.md zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig_user.md * Better translation * zh-trans:add docs/reference/using-api/client-libraries.md (#11958) * zh-trans:add docs/reference/using-api/client-libraries.md * Update content/zh/docs/reference/using-api/client-libraries.md Co-Authored-By: SataQiu <1527062125@qq.com> * zh-trans: add pull-image-private-registry.md (#11912) * zh-trans: add pull-image-private-registry.md zh-trans: add pull-image-private-registry.md * Update pull-image-private-registry.md * Update pull-image-private-registry.md * ZH-trans: add kubeadm_alpha_phase_kubelet_config_annotate-cri.md (#11972) * Create kubeadm_alpha_phase_kubelet_config_annotate-cri.md * Update kubeadm_alpha_phase_kubelet_config_annotate-cri.md * ZH-trans: add kubeadm_alpha_phase_kubelet_config.md (#11974) * Create kubeadm_alpha_phase_kubelet_config.md * Update kubeadm_alpha_phase_kubelet_config.md * fix Typo "##" -> "## " (#12011) * fix Typo "##" -> "## " fix Typo "##" -> "## " * update basic-stateful-set.md * fix web style error (#12010) fix web style error * Create kubeadm_alpha_phase_selfhosting.md (#12006) * Create kubeadm_alpha_phase_controlplane_apiserver.md (#12005) * zh-trans:/docs/tasks/debug-application-cluster/resource-usage-monitor… (#11995) * zh-trans:/docs/tasks/debug-application-cluster/resource-usage-monitoring.md zh-trans:/docs/tasks/debug-application-cluster/resource-usage-monitoring.md * Update resource-usage-monitoring.md * Update resource-usage-monitoring.md * zh-trans:/docs/tasks/debug-application-cluster/core-metrics-pipeline.md (#11990) zh-trans:/docs/tasks/debug-application-cluster/core-metrics-pipeline.md * zh-trans:/docs/tasks/debug-application-cluster/troubleshooting.md (#11989) zh-trans:/docs/tasks/debug-application-cluster/troubleshooting.md * Create kubeadm_alpha_phase_certs_renew_apiserver-kubelet-client.md (#11969) * Create kubeadm_alpha_phase_certs_renew_apiserver-kubelet-client.md * Update kubeadm_alpha_phase_certs_renew_apiserver-kubelet-client.md * zh-trans: /docs/tasks/debug-application-cluster/debug-init-containers.md (#11962) * zh-trans: /docs/tasks/debug-application-cluster/debug-init-containers.md zh-trans: /docs/tasks/debug-application-cluster/debug-init-containers.md * Update debug-init-containers.md * zh-trans: docs/reference/glossary/horizontal-pod-autoscaler.md (#11930) * zh-trans: docs/reference/glossary/horizontal-pod-autoscaler.md zh-trans: docs/reference/glossary/horizontal-pod-autoscaler.md * Update horizontal-pod-autoscaler.md * zh-trans: add /docs/tasks/configure-pod-container/configure-projected… (#11911) * zh-trans: add /docs/tasks/configure-pod-container/configure-projected-volume-storage.md zh-trans: add /docs/tasks/configure-pod-container/configure-projected-volume-storage.md * Update configure-projected-volume-storage.md * Update configure-projected-volume-storage.md * zh-trans: /docs/tasks/configure-pod-container/extended-resource.md (#11918) * zh-trans: /docs/tasks/configure-pod-container/extended-resource.md zh-trans: /docs/tasks/configure-pod-container/extended-resource.md * Update extended-resource.md * Update extended-resource.md * zh-trans: add translate-compose-kubernetes.md (#11910) * zh-trans: add translate-compose-kubernetes.md zh-trans: add translate-compose-kubernetes.md * Update translate-compose-kubernetes.md * Update translate-compose-kubernetes.md * Update translate-compose-kubernetes.md * Update translate-compose-kubernetes.md * Update translate-compose-kubernetes.md * Update translate-compose-kubernetes.md * zh-trans: zh/docs/reference/glossary/flexvolume.md (#11925) * zh-trans: zh/docs/reference/glossary/flexvolume.md zh-trans: zh/docs/reference/glossary/flexvolume.md * Update flexvolume.md * zh_trans: kubeadm_alpha_phase_bootstrap-token_create.md (#11947) * zh_trans: kubeadm_alpha_phase_bootstrap-token_create.md zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token_create.md * better translation better translation * zh-trans:add docs/setup/turnkey/alibaba-cloud.md (#11959) * zh_trans: kubeadm_completion.md (#11895) * zh_trans: kubeadm_completion.md zh_trans: /docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_bootstrap-token_node.md * Better translation Better translation * Update kubeadm_completion.md * better translation better translation * zh-trans: add /zh/ docs/tasks/debug-application-cluster/crictl.md (#11961) * zh-trans: add /zh/ docs/tasks/debug-application-cluster/crictl.md zh-trans: add /zh/ docs/tasks/debug-application-cluster/crictl.md * Update crictl.md * ZH-trans: add kubeadm_alpha_phase_certs_front-proxy-ca.md (#11968) * ZH-trans: add kubeadm_alpha_phase_controlplane_all.md (#11970) * Create kubeadm_alpha_phase_controlplane_all.md * Update kubeadm_alpha_phase_controlplane_all.md * Update kubeadm_alpha_phase_controlplane_all.md * Update kubeadm_alpha_phase_controlplane_all.md * ZH-trans: add kubeadm_alpha_phase_upload-config.md (#11971) * Create kubeadm_alpha_phase_upload-config.md * Update kubeadm_alpha_phase_upload-config.md * Update kubeadm_alpha_phase_upload-config.md * ZH-trans: Fixed some incorrect translations (#11973) * zh-trans: /docs/tasks/debug-application-cluster/determine-reason-pod-… (#11977) * zh-trans: /docs/tasks/debug-application-cluster/determine-reason-pod-failure.md zh-trans: /docs/tasks/debug-application-cluster/determine-reason-pod-failure.md * Update determine-reason-pod-failure.md * zh-trans: /docs/tasks/debug-application-cluster/local-debugging.md (#11988) * zh-trans: /docs/tasks/debug-application-cluster/local-debugging.md zh-trans: /docs/tasks/debug-application-cluster/local-debugging.md * Update local-debugging.md * zh-trans:/docs/tasks/debug-application-cluster/events-stackdriver.md (#11996) zh-trans:/docs/tasks/debug-application-cluster/events-stackdriver.md * zh-trans:/docs/tasks/debug-application-cluster/get-shell-running-cont… (#11998) * zh-trans:/docs/tasks/debug-application-cluster/get-shell-running-container.md zh-trans:/docs/tasks/debug-application-cluster/get-shell-running-container.md * Update get-shell-running-container.md * zh-trans:/docs/tasks/debug-application-cluster/logging-elasticsearch-kibana.md (#12001) zh-trans:/docs/tasks/debug-application-cluster/logging-elasticsearch-kibana.md * ZH-trans: ad kubeadm_alpha_phase_kubelet_config_write-to-disk.md (#12004) * Create kubeadm_alpha_phase_kubelet_config_write-to-disk.md * Update kubeadm_alpha_phase_kubelet_config_write-to-disk.md * Remove old-generated kubefed docs (generated on 25-march-2018) (#12093) * Update _index.md (#12061) * Update kubeadm_reset.md (#12047) * ZH-trasn: add kubeadm_alpha_phase_kubeconfig_controller-manager.md (#12032) * Create kubeadm_alpha_phase_kubeconfig_controller-manager.md * Update kubeadm_alpha_phase_kubeconfig_controller-manager.md * ZH-trans: add kubeadm_alpha_phase_preflight_node.md (#12035) * Create kubeadm_alpha_phase_preflight_node.md * Update kubeadm_alpha_phase_preflight_node.md * Update kubeadm_alpha_phase_preflight_node.md * ZH-trans: add kubeadm_alpha_phase_controlplane_scheduler.md (#12031) * Create kubeadm_alpha_phase_controlplane_scheduler.md * Update kubeadm_alpha_phase_controlplane_scheduler.md * ZH-trans: add kubeadm_alpha_phase_bootstrap-token_node_allow-post-csrs.md (#12039) * Create kubeadm_alpha_phase_bootstrap-token_node_allow-post-csrs.md * Update kubeadm_alpha_phase_bootstrap-token_node_allow-post-csrs.md * ZH-trans: add kubeadm_alpha_phase_kubelet_write-env-file.md (#12034) * Create kubeadm_alpha_phase_kubelet_write-env-file.md * Update kubeadm_alpha_phase_kubelet_write-env-file.md * ZH-trans: add kubeadm_upgrade_node_experimental-control-plane.md (#12036) * Create kubeadm_upgrade_node_experimental-control-plane.md * Update kubeadm_upgrade_node_experimental-control-plane.md * Create kubeadm_alpha_phase_bootstrap-token_node_allow-auto-approve.md (#12038) * Create kubeadm_alpha_phase_etcd.md (#12040) * ZH-trans: add kubeadm_alpha_phase_certs_renew_etcd-server.md (#12041) * Create kubeadm_alpha_phase_certs_renew_etcd-server.md * Update kubeadm_alpha_phase_certs_renew_etcd-server.md * Update advanced.md (#12044) * ZH-trans: add kubeadm_alpha_phase_certs_renew_etcd-healthcheck-client.md (#12042) * Create kubeadm_alpha_phase_certs_renew_etcd-healthcheck-client.md * Update kubeadm_alpha_phase_certs_renew_etcd-healthcheck-client.md * Update kubeadm_alpha_phase_certs_renew_etcd-healthcheck-client.md * Update kubeadm_version.md (#12046) * Update _index.md (#12063) * zh-trans:/docs/reference/setup-tools/kubefed/kubefed_version.md (#12085) zh-trans:/docs/reference/setup-tools/kubefed/kubefed_version.md * ZH-trans: add kubeadm_alpha_phase_certs_etcd-peer.md (#12037) * Create kubeadm_alpha_phase_certs_etcd-peer.md * Update kubeadm_alpha_phase_certs_etcd-peer.md * Update kubeadm_alpha_phase_certs_etcd-peer.md * ZH-trans: add kubeadm_alpha_phase_kubelet_config_download.md (#12033) * Create kubeadm_alpha_phase_kubelet_config_download.md * Update kubeadm_alpha_phase_kubelet_config_download.md * zh-trans: add docs/tasks/access-application-cluster/_index.md (#12048) * zh-trans: update cpu-constraint-namespace.md and cpu-default-namespace.md (#12106) * ZH-trans: update kubeadm_alpha_phase_upload-config.md (#12110) * zh-tran: /docs/reference/setup-tools/kubefed/kubefed_unjoin.md (#12022) * zh-tran: /docs/reference/setup-tools/kubefed/kubefed_unjoin.md zh-tran: /docs/reference/setup-tools/kubefed/kubefed_unjoin.md * Update kubefed_unjoin.md * Update kubefed_unjoin.md * Update kubefed_unjoin.md * zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_… (#12114) * zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_apiserver.md zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_certs_apiserver.md * Update kubeadm_alpha_phase_certs_apiserver.md * Update kubeadm_alpha_phase_certs_apiserver.md * zh-trans:/docs/reference/kubectl/docker-cli-to-kubectl.md (#12088) * zh-trans:/docs/reference/kubectl/docker-cli-to-kubectl.md zh-trans:/docs/reference/kubectl/docker-cli-to-kubectl.md * Update docker-cli-to-kubectl.md * zh-trans: /docs/reference/kubectl/conventions.md (#12089) * zh-trans: /docs/reference/kubectl/conventions.md zh-trans: /docs/reference/kubectl/conventions.md * Update conventions.md * zh-trans organize-cluster-access-kubeconfig.md (#12094) * zh-trans:/docs/reference/setup-tools/kubefed/kubefed.md (#12086) * zh-trans:/docs/reference/setup-tools/kubefed/kubefed.md zh-trans:/docs/reference/setup-tools/kubefed/kubefed.md * Update kubefed.md * zh-trans:/docs/reference/setup-tools/kubefed/kubefed_join.md (#12029) * zh-trans:/docs/reference/setup-tools/kubefed/kubefed_join.md zh-trans:/docs/reference/setup-tools/kubefed/kubefed_join.md * Update kubefed_join.md * Update kubefed_join.md * zh-trans: /docs/reference/setup-tools/kubefed/kubefed_init.md (#12020) * zh-trans: /docs/reference/setup-tools/kubefed/kubefed_init.md zh-trans: /docs/reference/setup-tools/kubefed/kubefed_init.md * Update kubefed_init.md * Update kubefed_init.md * Update kubefed_init.md * zh-trans: add docs/setup/independent/control-plane-flags.md (#12043) * zh-trans: add docs/setup/independent/control-plane-flags.md * update content/zh/docs/setup/independent/control-plane-flags.md * zh-trans:/docs/tasks/tools/install-kubectl.md (#11992) * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * Update configure-aggregation-layer.md * . * . * . * . * . * . * . * . * configure-aggregation-layer.md * . * . * Update configure-aggregation-layer.md * . * . * . * . * zh-trans: add /docs/concepts/cluster-administration/manage-deployment.md (#11899) * add /docs/concepts/cluster-administration/manage-deployment.md * 更新部分翻译，去除多余的反引号 * 更新部分翻译 * zh-trans: add docs/tasks/service-catalog/install-service-catalog-using-sc.md (#12045) * zh-trans: add docs/tasks/service-catalog/install-service-catalog-using-sc.md * update docs/tasks/service-catalog/install-service-catalog-using-sc.md * zh-trans:/docs/reference/setup-tools/kubefed/kubefed_options.md (#12087) * zh-trans:/docs/reference/setup-tools/kubefed/kubefed_options.md zh-trans:/docs/reference/setup-tools/kubefed/kubefed_options.md * Update kubefed_options.md * Update kubefed_options.md * zh-trans: Fix some blog links issue (#12115) * zh-trans: Fix some blog links issue * Revert the space change * update Set Kubelet parameters via a config file (#12150) * zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig_all.md (#12185) zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_kubeconfig_all.md * zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_… (#12184) * zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_etcd_local.md zh-trans:/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_phase_etcd_local.md * Update kubeadm_alpha_phase_etcd_local.md * zh-trans: kubeadm/generated/kubeadm_alpha_phase_kubelet_config_upload.md (#12130) zh-trans: kubeadm/generated/kubeadm_alpha_phase_kubelet_config_upload.md * zh-trans: kubeadm/generated/kubeadm_alpha_phase_kubeconfig_admin.md (#12131) zh-trans: kubeadm/generated/kubeadm_alpha_phase_kubeconfig_admin.md * zh-trans: /docs/contribute/generate-ref-docs/kubernetes-api.md (#12141) Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> * zh-trans:/docs/concepts/overview/object-management-kubectl/imperative… (#12151) * zh-trans:/docs/concepts/overview/object-management-kubectl/imperative-config.md zh-trans:/docs/concepts/overview/object-management-kubectl/imperative-config.md * Update imperative-config.md * ZH-trans: added a blog post Chinese translation: 2018-05-01-developing-on-kubernetes.md (#12009) * added a blog post chinese translation * Update 2018-05-01-developing-on-kubernetes.md apply some suggested changes per review comments * Update 2018-05-01-developing-on-kubernetes.md cont to review and improve the wording, up to squash * more update and rewording * ZH-trans: add kubeadm_alpha_phase_kubelet_config_enable-dynamic.md (#12209) * ZH-trans: add kubeadm_alpha_phase_kubelet_config_enable-dynamic.md * Update kubeadm_alpha_phase_kubelet_config_enable-dynamic.md * ZH-trans: add kubeadm_alpha_phase_certs_renew_apiserver.md (#12210) * ZH-trans: add kubeadm_alpha_phase_certs_renew_apiserver.md * Update kubeadm_alpha_phase_certs_renew_apiserver.md * Update kubeadm_alpha_phase_certs_renew_apiserver.md * ZH-trans: add kubeadm_alpha_phase_certs_front-proxy-client.md (#12212) * fix docs style (#12225) * fix docs style fix docs style * fix docs style fix docs style * ZH-trans: add rbac.md (#12263) * ZH-trans: add rbac.md * Update rbac.md * ZH-trans: add persistent-volume-claim.md (#12264) * ZH-trans: add persistent-volume-claim.md * Update persistent-volume-claim.md * Update persistent-volume-claim.md * Update docker-cli-to-kubectl.md (#12288) * ZH-trans: add kubeadm_alpha_phase_selfhosting_convert-from-staticpods.md (#12285) * ZH-trans: add kubeadm_alpha_phase_selfhosting_convert-from-staticpods.md * Update kubeadm_alpha_phase_selfhosting_convert-from-staticpods.md * ZH-trans: add coredns.md (#12282) * ZH-trans: add coredns.md * Update coredns.md * ZH-trans: add kubeadm_alpha_phase_certs_etcd-healthcheck-client.md (#12286) * ZH-trans: add kubeadm_alpha_phase_certs_etcd-healthcheck-client.md * Update kubeadm_alpha_phase_certs_etcd-healthcheck-client.md * ZH-trans: add kubeadm_alpha_phase_kubeconfig_kubelet.md (#12284) * ZH-trans: add kubeadm_alpha_phase_kubeconfig_kubelet.md * Update kubeadm_alpha_phase_kubeconfig_kubelet.md * ZH-trans: add service-account.md (#12261) * ZH-trans: add service-account.md * Update service-account.md * ZH-trans: add security-context.md (#12262) * ZH-trans: add security-context.md * Update security-context.md * Update security-context.md * Update security-context.md * fix typo "_必须_" -> "必须" (#12300) fix typo "_必须_" -> "必须" * fix docs style error (#12307) fix docs style error * Create explore-interactive.html (#12311) * fix docs style error (#12314) fix docs style error * ZH-trans: add kube-controller-manager.md (#12260) * ZH-trans: add kube-controller-manager.md * Update kube-controller-manager.md * Update kube-controller-manager.md * Update kube-controller-manager.md * zh-trans: /docs/contribute/localization.md (#12295) Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> zh-trans: /docs/contribute/localization.md; update Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> zh-trans: /docs/contribute/localization.md; update2 Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> * ZH-trans: update tools.md (#12320) ZH-trans: update tools.md * ZH-trans: fix "kubead -config" -> "kubeadm-config" (#12319) * ZH-trans: update kubeadm_config.md * fix style error * correct "availability” trans for chinese (#12394) * ZH-trans:/docs/tasks/debug-application-cluster/debug-service.md (#12275) * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * Update configure-aggregation-layer.md * . * . * . * . * . * . * . * . * configure-aggregation-layer.md * . * . * Update configure-aggregation-layer.md * . * . * . * . * . * . * . * . * Translate some remnant partials for localization (#12240) * zh-trans: /docs/tasks/administer-cluster/limit-storage-consumption.md (#12415) * zh-trans: /docs/tasks/administer-cluster/limit-storage-consumption.md zh-trans: /docs/tasks/administer-cluster/limit-storage-consumption.md * Update limit-storage-consumption.md * Update limit-storage-consumption.md * update link to SSH tunneling (#12615) Signed-off-by: PingWang <wang.ping5@zte.com.cn> * zh-trans: update content/zh/docs/setup/certificates.md (#12620) * ZH-trans: add kubeadm_alpha_phase_certs_apiserver-kubelet-client.md (#12619) * ZH-trans: add kubeadm_alpha_phase_certs_apiserver-kubelet-client.md * Update kubeadm_alpha_phase_certs_apiserver-kubelet-client.md * zh-trans: node-conformance.md (#12356) * zh-trans: node-conformance.md zh-trans: node-conformance.md * better translation better translation * zh-trans: translate docs/getting-started-guides/ubuntu/operational-co… (#12353) * zh-trans: translate docs/getting-started-guides/ubuntu/operational-considerations.md * Adopt PR suggestions * add period sign * zh-trans: krib.md (#12363) * zh-trans: krib.md zh-trans: krib.md * Update krib.md * Update krib.md * Update krib.md * Update krib.md * zh-trans: /docs/tasks/administer-federation/events.md (#12411) * zh-trans: /docs/tasks/administer-federation/events.md zh-trans: /docs/tasks/administer-federation/events.md * Update events.md * Update events.md * zh-trans: /docs/setup/turnkey/azure.md (#12412) zh-trans: /docs/setup/turnkey/azure.md * zh-trans:/docs/tasks/administer-federation/hpa.md & /docs/tasks/administer-cluster/extended-resource-node.md (#12432) * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * Update configure-aggregation-layer.md * . * . * . * . * . * . * . * . * configure-aggregation-layer.md * . * . * Update configure-aggregation-layer.md * . * . * . * . * . * Add arm64, ppc64le and s390x platforms for calico (#12666) Signed-off-by: PingWang <wang.ping5@zte.com.cn> add only Signed-off-by: PingWang <wang.ping5@zte.com.cn> * zh-trans: developing-cloud-controller-manager.md (#12413) * zh-trans: /docs/tasks/administer-cluster/developing-cloud-controller-manager.md zh-trans: /docs/tasks/administer-cluster/developing-cloud-controller-manager.md * Update developing-cloud-controller-manager.md * fix typo: delete useless "**" * Update developing-cloud-controller-manager.md * ZH-trans: add 2018-05-01-developing-on-kubernetes.md (#12814) * ZH-trans: update encrypt-data.md (#12939) * ZH-trans: update encrypt-data.md * Update encrypt-data.md * ZH-trans: add example-task-template.md (#12940) * ZH-trans: add example-task-template.md * Update example-task-template.md * Added Instana to tools (#12978) Instana is already available in the english version of the text, therefore I added it here too. Hope my skills were enough to make the text still correct :-) * ZH-trans: add expose-interactive.html (#12965) * ZH-trans: add expose-interactive.html * Update content/zh/docs/tutorials/kubernetes-basics/expose/expose-interactive.html Co-Authored-By: xichengliudui <1693291525@qq.com> * ZH-trans: add cloudstack.md (#12967) * Create cloudstack.md * Update cloudstack.md * Update cloudstack.md * Update cloudstack.md * ZH-trans: add container-lifecycle-hooks.md (#12941) * ZH-trans: add container-lifecycle-hooks.md * Update container-lifecycle-hooks.md * translate content/zh/docs/tasks/administer-cluster/dns-debugging-resolution.md to chinese (#12904) * ZH-trans: add expose-external-ip-address.md (#12955) * ZH-trans: add expose-external-ip-address.md * Update expose-external-ip-address.md * Update expose-external-ip-address.md * Update expose-external-ip-address.md * Update expose-external-ip-address.md * Update expose-external-ip-address.md * ZH-trans: add dns-horizontal-autoscaling.md (#12948) * ZH-trans: add dns-horizontal-autoscaling.md * Update dns-horizontal-autoscaling.md * Update dns-horizontal-autoscaling.md * zh-trans: update content/zh/docs/concepts/_index.md (#13182) * zh-trans: update content/zh/docs/reference/access-authn-authz/node.md (#13181) * Update dns-horizontal-autoscaling.md (#13119) * Update dns-horizontal-autoscaling.md * Update dns-horizontal-autoscaling.md * Update dns-horizontal-autoscaling.md * ZH-trans: add 2018-10-03-kubedirector.md (#13048) * ZH-trans: add 2018-10-03-kubedirector.md * Update 2018-10-03-kubedirector.md * Update 2018-10-03-kubedirector.md * ZH-trans: add guestbook.md (#12953) * ZH-trans: add guestbook.md * Update guestbook.md * Update guestbook.md * Update guestbook.md * Update guestbook.md * ZH-trans: add set-up-placement-policies-federation.md (#12947) * ZH-trans: add set-up-placement-policies-federation.md * update pull request * Update set-up-placement-policies-federation.md * Update set-up-placement-policies-federation.md * Update set-up-placement-policies-federation.md * Update set-up-placement-policies-federation.md * ZH-trans: add service-accounts-admin.md (#13047) * ZH-trans: add service-accounts-admin.md * Update service-accounts-admin.md * Update service-accounts-admin.md * ZH-trans: add update-api-object-kubectl-patch.md (#12943) * ZH-trans: add update-api-object-kubectl-patch.md * Update update-api-object-kubectl-patch.md * Update update-api-object-kubectl-patch.md * Update update-api-object-kubectl-patch.md * Update update-api-object-kubectl-patch.md * ZH-trans: add parallel-processing-expansion.md (#12944) * ZH-trans: add parallel-processing-expansion.md * Update parallel-processing-expansion.md * Update parallel-processing-expansion.md * zh-trans: add 2018-12-05-new-contributor-shanghai.md (#12778) * add zh 2017-03-00-Five-Days-Of-Kubernetes-1-6.md add zh 2018-12-05-new-contributor-shanghai.md * Delete 2017-03-00-Five-Days-Of-Kubernetes-1-6.md * zh-trans: /docs/contribute/style/write-new-topic.md (#12572) Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> zh-trans: /docs/contribute/style/write-new-topic.md; update Signed-off-by: liyuan198251 <li.yuan4@zte.com.cn> * zh-trans: update content/zh/docs/setup/salt.md (#13202) * zh-trans: add docs/reference/setup-tools/kubeadm/generated/kubeadm_token.md (#13198) * ZH-trans: add kubeadm_upgrade_diff.md (#13170) * ZH-trans: add kubeadm_upgrade_diff.md * Update kubeadm_upgrade_diff.md * Update kubeadm_upgrade_diff.md * zh-trans: update docs/reference/access-authn-authz/authorization.md (#13180) * zh-trans: update docs/reference/setup-tools/kubeadm/kubeadm-config.md (#13179) * zh-trans: add docs/concepts/storage/dynamic-provisioning.md (#13171) * ZH-trans: add 2015-05-00-Kubernetes-On-Openstack.md (#13149) * ZH-trans: add Kubernetes开源项目产品经理 * Update 2015-05-00-Kubernetes-On-Openstack.md * ZH-trans: add 2015-03-00-Welcome-To-Kubernetes-Blog.md (#13131) * ZH-trans: add 2015-03-00-Welcome-To-Kubernetes-Blog.md * Update 2015-03-00-Welcome-To-Kubernetes-Blog.md * ZH-trans: add 2015-06-00-Slides-Cluster-Management-With.md (#13123) * ZH-trans: add 2015-06-00-Slides-Cluster-Management-With.md * Update 2015-06-00-Slides-Cluster-Management-With.md * Create 2015-03-00-Kubernetes-Gathering-Videos.md (#13124) * ZH-trans: add 2015-03-00-Weekly-Kubernetes-Community-Hangout.md (#13129) * ZH-trans: add 2015-03-00-Weekly-Kubernetes-Community-Hangout.md * Update 2015-03-00-Weekly-Kubernetes-Community-Hangout.md * ZH-trans: add 2015-04-00-Kubernetes-Release-0150.md (#13130) * ZH-trans: add 2015-04-00-Kubernetes-Release-0150.md * Update 2015-04-00-Kubernetes-Release-0150.md * ZH-trans: add 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md (#13132) * ZH-trans: add 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md * Update 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md * Update 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md * Update 2015-04-00-Weekly-Kubernetes-Community-Hangout_17.md * ZH-trans: add 2015-04-00-Weekly-Kubernetes-Community-Hangout_29.md (#13147) * ZH-trans: add 2015-05-00-Weekly-Kubernetes-Community-Hangout.md (#13148) * ZH-trans: add flannel_multi_node_cluster.md (#13195) * ZH-trans: add flannel_multi_node_cluster.md * Update flannel_multi_node_cluster.md * Update flannel_multi_node_cluster.md * zh-trans: add docs/reference/command-line-tools-reference/kubelet-authentication-authorization.md (#13200) * zh-trans: add docs/reference/command-line-tools-reference/kubelet-authentication-authorization.md * Update kubelet-authentication-authorization.md * zh-trans: /docs/tasks/administer-cluster/out-of-resource.md (#12879) * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * configure-aggregation-layer.md * Update configure-aggregation-layer.md * . * . * . * . * . * . * . * . * configure-aggregation-layer.md * . * . * Update configure-aggregation-layer.md * . * . * . * . * . * . * zh-trans: update docs/setup/node-conformance.md (#13201) * zh-trans: update docs/setup/node-conformance.md * zh-trans: update docs/setup/on-premises-vm/dcos.md * zh-trans: add content/zh/blog/_posts/2018-10-15-steering-election-results.md (#13227) * zh-trans: add content/zh/blog/_posts/2018-10-15-steering-election-results.md * Update content/zh/blog/_posts/2018-10-15-steering-election-results.md Co-Authored-By: SataQiu <1527062125@qq.com> * Add @xichengliudui to sig-docs-zh-owners (release-1.12) (#13167) * Add @xichengliudui to sig-docs-zh-owners * Update OWNERS_ALIASES * ZH-trans: add coreos.md (#13193) * ZH-trans: coreos.md * Update coreos.md * Update coreos.md * Update coreos.md * Update coreos.md * Update coreos.md * Update coreos.md * add SataQiu as a sig-docs-zh-owner (#13271) * Fix relative links issue in zh content (#13312) * `http://kubernetes.io/docs/` -> `/docs/` * `https://kubernetes.io/docs/` -> `/docs/` * zh-trans: add docs/reference/setup-tools/kubeadm/kubeadm-upgrade.md (#13194) * zh-trans: add docs/reference/setup-tools/kubeadm/kubeadm-upgrade.md * Update content/zh/docs/reference/setup-tools/kubeadm/kubeadm-upgrade.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update kubeadm-upgrade.md * ZH-trans: add kubeadm-upgrade-ha-1-12.md (#13306) * ZH-trans: add kubeadm-upgrade-ha-1-12.md * Update kubeadm-upgrade-ha-1-12.md * Update kubeadm-upgrade-ha-1-12.md * Update kubeadm-upgrade-ha-1-12.md * Update kubeadm-upgrade-ha-1-12.md * Update kubeadm-upgrade-ha-1-12.md * Update kubeadm-upgrade-ha-1-12.md * Update config.toml (#13408) * zh-trans: add content/zh/blog/_posts/2018-11-08-kubernetes-docs-update-i18n.md (#13221) * zh-trans: add content/zh/docs/reference/kubernetes-api/labels-annotations-taints.md (#13236) * zh-trans: add content/zh/blog/_posts/2018-10-16-kubernetes-2018-north-american-contributor-summit.md (#13274) * zh-trans: add content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md (#13268) * zh-trans: add content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md * Update content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md Co-Authored-By: SataQiu <1527062125@qq.com> * zh-trans: update content/zh/docs/tasks/service-catalog/install-service-catalog-using-helm.md * ZH-trans: add 2017-10-00-Five-Days-Of-Kubernetes-18.md (#13427) * ZH-trans: add 2017-10-00-Five-Days-Of-Kubernetes-18.md * Update 2017-10-00-Five-Days-Of-Kubernetes-18.md * zh-trans: add content/zh/docs/tasks/administer-federation/daemonset.md (#13239) * message * more message * remove data.json * ZH-trans: add aws.md (#13276) * ZH-trans: add aws.md * Update aws.md * Update aws.md * ZH-trans: add cluster-interactive.html (#13479) * ZH-trans: add cluster-interactive.html * Update cluster-interactive.html * ZH-trans: add update-intro.html (#13480) * Create update-intro.html * Update update-intro.html * Update update-intro.html * Update update-intro.html * Update update-intro.html * Update update-intro.html * ZH-trans: add README.md (#13235) * ZH-trans: add vendoring * Update README.md * zh: docs/cocepts/cluster-administration/logging.md (#13541) * zh: docs/cocepts/cluster-administration/logging.md * Update logging.md * zh-trans: update docker-cli-to-kubectl.md (#13591) * Update docker-cli-to-kubectl.md * Update docker-cli-to-kubectl.md * zh-trans: update advanced.md (#13592) * ZH-trans: add 2017-11-00-Autoscaling-In-Kubernetes.md (#13424) * ZH-trans: add 2017-11-00-Autoscaling-In-Kubernetes.md * Update 2017-11-00-Autoscaling-In-Kubernetes.md * ZH-trans: add fedora_manual_config.md (#13439) * ZH-trans: add fedora_manual_config.md * Update fedora_manual_config.md * zh-trans: content/zh/docs/concepts/overview/working-with-objects/labe… (#12277) * zh-trans: content/zh/docs/concepts/overview/working-with-objects/labels.md * update trans * update trans * zh: docs/contribute/start.md trans (#13632) * zh：docs/contribute/start.md trans * Update start.md * Update start.md * Update start.md * Update start.md * Update content/zh/docs/contribute/start.md Co-Authored-By: zhangqx2010 <zhangqx2010@users.noreply.github.com> * Update content/zh/docs/contribute/start.md Co-Authored-By: zhangqx2010 <zhangqx2010@users.noreply.github.com> * Update content/zh/docs/contribute/start.md Co-Authored-By: zhangqx2010 <zhangqx2010@users.noreply.github.com> * zh-trans: update docs/reference/setup-tools/kubefed (#13729) * Update 2017-10-00-Five-Days-Of-Kubernetes-18.md (#13472) * zh-trans: add configure-multiple-schedulers.md (#13492) * zh-trans: add configure-multiple-schedulers.md * Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update configure-multiple-schedulers.md * Update configure-multiple-schedulers.md * Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/tasks/administer-cluster/configure-multiple-schedulers.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update configure-multiple-schedulers.md * zh-trans: add docs/tasks/configure-pod-container/share-process-namespace.md (#13551) * zh-trans: add docs/tasks/configure-pod-container/share-process-namespace.md * Update share-process-namespace.md * zh-trans: update docs/admin/accessing-the-api.md (#13744) * zh-trans: add content/zh/blog/_posts/2018-10-11-topology-aware-volume-provisioning.md (#13303) * ZH-trans: add 2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md (#13241) * ZH-trans: add 2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md * Update 2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md * Update 2016-02-00-Kubecon-Eu-2016-Kubernetes-Community-In.md * ZH-trans: add 2016-07-00-Citrix-Netscaler-And-Kubernetes.md (#13242) * ZH-trans: add 2016-07-00-Citrix-Netscaler-And-Kubernetes.md * Update 2016-07-00-Citrix-Netscaler-And-Kubernetes.md * Update 2016-07-00-Citrix-Netscaler-And-Kubernetes.md * zh-trans: update docs/admin/bootstrap-tokens.md (#13770) * zh-trans: update content/zh/docs/admin/cluster-large.md (#13771) * zh-trans: update content/zh/docs/admin/kube-apiserver.md (#13774) * zh-trans: update content/zh/docs/admin/kube-apiserver.md * Update kube-apiserver.md * Update content/zh/docs/admin/kube-apiserver.md Co-Authored-By: SataQiu <1527062125@qq.com> * zh-trans: update content/zh/docs/admin/multiple-zones.md (#13775) * zh-trans: update content/zh/docs/admin/multiple-zones.md * Update multiple-zones.md * zh-trans: update node-conformance.md and ovs-networking.md (#13776) * zh-trans: update high-availability/_index.md and authorization/webhook.md (#13780) * zh-trans: update content/zh/docs/admin/authorization/_index.md (#13779) * zh-trans: update content/zh/docs/admin/authorization/_index.md * Update _index.md * Update content/zh/docs/admin/authorization/_index.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/admin/authorization/_index.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update content/zh/docs/admin/authorization/_index.md Co-Authored-By: SataQiu <1527062125@qq.com> * zh-trans: update content/zh/docs/admin/authorization/abac.md (#13777) * zh-trans: update content/zh/docs/admin/authorization/abac.md * Update content/zh/docs/admin/authorization/abac.md Co-Authored-By: SataQiu <1527062125@qq.com> * Update abac.md * zh-trans: update content/zh/docs/admin/service-accounts-admin.md (#13778) * zh-trans: update content/zh/docs/admin/service-accounts-admin.md * Update content/zh/docs/admin/service-accounts-admin.md Co-Authored-By: SataQiu <1527062125@qq.com> * zh-trans: update content/zh/docs/concepts/architecture (#13797) * ZH-trans: add cluster.md (#13500) * ZH-trans: add cluster.md * Update cluster.md * Update cluster.md * Update cluster.md * zh-trans: update docs/concepts/cluster-administration (#13825) * Exclude content-en changes in the PR * Exclude content/ko changes in the PR * Exclude OWNERS_ALIASES change in the PR * rm kubeadm/generated/README.md to fix the build * Remove generated sass assets
This commit is contained in:
chenrui
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
d437c2e5e5
commit
577b431931
@@ -0,0 +1,11 @@
|
||||
---
|
||||
title: "配置"
|
||||
weight: 70
|
||||
---
|
||||
|
||||
<!--
|
||||
---
|
||||
title: "Configuration"
|
||||
weight: 70
|
||||
---
|
||||
-->
|
||||
@@ -1,22 +1,74 @@
|
||||
---
|
||||
title: 为容器管理计算资源
|
||||
content_template: templates/concept
|
||||
weight: 20
|
||||
feature:
|
||||
title: 自动装箱
|
||||
description: >
|
||||
根据资源需求和其他约束自动放置容器，同时不会牺牲可用性，将任务关键工作负载和尽力服务工作负载进行混合放置，以提高资源利用率并节省更多资源。
|
||||
---
|
||||
|
||||
<!--
|
||||
---
|
||||
title: Managing Compute Resources for Containers
|
||||
content_template: templates/concept
|
||||
weight: 20
|
||||
feature:
|
||||
title: Automatic binpacking
|
||||
description: >
|
||||
Automatically places containers based on their resource requirements and other constraints, while not sacrificing availability. Mix critical and best-effort workloads in order to drive up utilization and save even more resources.
|
||||
---
|
||||
-->
|
||||
|
||||
{{% capture overview %}}
|
||||
|
||||
当您定义 [Pod](/docs/user-guide/pods) 的时候可以选择为每个容器指定需要的 CPU 和内存（RAM）大小。当为容器指定了资源请求后，调度器就能够更好的判断出将容器调度到哪个节点上。如果您还为容器指定了资源限制，节点上的资源就可以按照指定的方式做竞争。关于资源请求和限制的不同点和更多资料请参考 [Resource QoS](https://git.k8s.io/community/contributors/design-proposals/resource-qos.md)。
|
||||
<!--
|
||||
When you specify a [Pod](/docs/concepts/workloads/pods/pod/), you can optionally specify how
|
||||
much CPU and memory (RAM) each Container needs. When Containers have resource
|
||||
requests specified, the scheduler can make better decisions about which nodes to
|
||||
place Pods on. And when Containers have their limits specified, contention for
|
||||
resources on a node can be handled in a specified manner. For more details about
|
||||
the difference between requests and limits, see
|
||||
[Resource QoS](https://git.k8s.io/community/contributors/design-proposals/node/resource-qos.md).
|
||||
-->
|
||||
当您定义 [Pod](/docs/user-guide/pods) 的时候可以选择为每个容器指定需要的 CPU 和内存（RAM）大小。当为容器指定了资源请求后，调度器就能够更好的判断出将容器调度到哪个节点上。如果您还为容器指定了资源限制，Kubernetes 就可以按照指定的方式来处理节点上的资源竞争。关于资源请求和限制的不同点和更多资料请参考 [Resource QoS](https://git.k8s.io/community/contributors/design-proposals/resource-qos.md)。
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
|
||||
{{% capture body %}}
|
||||
|
||||
<!--
|
||||
## Resource types
|
||||
*CPU* and *memory* are each a *resource type*. A resource type has a base unit.
|
||||
CPU is specified in units of cores, and memory is specified in units of bytes.
|
||||
CPU and memory are collectively referred to as *compute resources*, or just
|
||||
*resources*. Compute
|
||||
resources are measurable quantities that can be requested, allocated, and
|
||||
consumed. They are distinct from
|
||||
[API resources](/docs/concepts/overview/kubernetes-api/). API resources, such as Pods and
|
||||
[Services](/docs/concepts/services-networking/service/) are objects that can be read and modified
|
||||
through the Kubernetes API server.
|
||||
-->
|
||||
|
||||
## 资源类型
|
||||
|
||||
*CPU* 和 *内存* 都是 *资源类型* 。资源类型具有基本单位。CPU 的单位是 core，内存的单位是 byte。
|
||||
*CPU* 和 *内存* 都是 *资源类型* 。资源类型具有基本单位。CPU 的单位是核心数，内存的单位是字节。
|
||||
|
||||
CPU和内存统称为*计算资源* ，也可以称为*资源* 。计算资源的数量是可以被请求、分配、消耗和可测量的。它们与 [API 资源](/docs/api/) 不同。 API 资源（如 Pod 和 [Service](/docs/user-guide/services)）是可通过 Kubernetes API server 读取和修改的对象。
|
||||
CPU和内存统称为*计算资源*，也可以称为*资源*。计算资源的数量是可以被请求、分配、消耗和可测量的。它们与 [API 资源](/docs/concepts/overview/kubernetes-api/) 不同。 API 资源（如 Pod 和 [Service](/docs/concepts/services-networking/service/)）是可通过 Kubernetes API server 读取和修改的对象。
|
||||
|
||||
<!--
|
||||
## Resource requests and limits of Pod and Container
|
||||
Each Container of a Pod can specify one or more of the following:
|
||||
* `spec.containers[].resources.limits.cpu`
|
||||
* `spec.containers[].resources.limits.memory`
|
||||
* `spec.containers[].resources.requests.cpu`
|
||||
* `spec.containers[].resources.requests.memory`
|
||||
Although requests and limits can only be specified on individual Containers, it
|
||||
is convenient to talk about Pod resource requests and limits. A
|
||||
*Pod resource request/limit* for a particular resource type is the sum of the
|
||||
resource requests/limits of that type for each Container in the Pod.
|
||||
-->
|
||||
|
||||
## Pod 和 容器的资源请求和限制
|
||||
|
||||
@@ -29,6 +81,27 @@ Pod 中的每个容器都可以指定以下的一个或者多个值：
|
||||
|
||||
尽管只能在个别容器上指定请求和限制，但是我们可以方便地计算出 Pod 资源请求和限制。特定资源类型的Pod 资源请求/限制是 Pod 中每个容器的该类型的资源请求/限制的总和。
|
||||
|
||||
<!--
|
||||
## Meaning of CPU
|
||||
Limits and requests for CPU resources are measured in *cpu* units.
|
||||
One cpu, in Kubernetes, is equivalent to:
|
||||
- 1 AWS vCPU
|
||||
- 1 GCP Core
|
||||
- 1 Azure vCore
|
||||
- 1 IBM vCPU
|
||||
- 1 *Hyperthread* on a bare-metal Intel processor with Hyperthreading
|
||||
Fractional requests are allowed. A Container with
|
||||
`spec.containers[].resources.requests.cpu` of `0.5` is guaranteed half as much
|
||||
CPU as one that asks for 1 CPU. The expression `0.1` is equivalent to the
|
||||
expression `100m`, which can be read as "one hundred millicpu". Some people say
|
||||
"one hundred millicores", and this is understood to mean the same thing. A
|
||||
request with a decimal point, like `0.1`, is converted to `100m` by the API, and
|
||||
precision finer than `1m` is not allowed. For this reason, the form `100m` might
|
||||
be preferred.
|
||||
CPU is always requested as an absolute quantity, never as a relative quantity;
|
||||
0.1 is the same amount of CPU on a single-core, dual-core, or 48-core machine.
|
||||
-->
|
||||
|
||||
## CPU 的含义
|
||||
|
||||
CPU 资源的限制和请求以 *cpu* 为单位。
|
||||
@@ -44,6 +117,14 @@ Kubernetes 中的一个 cpu 等于：
|
||||
|
||||
CPU 总是要用绝对数量，不可以使用相对数量；0.1 的 CPU 在单核、双核、48核的机器中的意义是一样的。
|
||||
|
||||
<!--
|
||||
## Meaning of memory
|
||||
Limits and requests for `memory` are measured in bytes. You can express memory as
|
||||
a plain integer or as a fixed-point integer using one of these suffixes:
|
||||
E, P, T, G, M, K. You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi,
|
||||
Mi, Ki. For example, the following represent roughly the same value:
|
||||
-->
|
||||
|
||||
## 内存的含义
|
||||
|
||||
内存的限制和请求以字节为单位。您可以使用以下后缀之一作为平均整数或定点整数表示内存：E，P，T，G，M，K。您还可以使用两个字母的等效的幂数：Ei，Pi，Ti ，Gi，Mi，Ki。例如，以下代表大致相同的值：
|
||||
@@ -52,6 +133,14 @@ CPU 总是要用绝对数量，不可以使用相对数量；0.1 的 CPU 在单
|
||||
128974848, 129e6, 129M, 123Mi
|
||||
```
|
||||
|
||||
<!--
|
||||
Here's an example.
|
||||
The following Pod has two Containers. Each Container has a request of 0.25 cpu
|
||||
and 64MiB (2<sup>26</sup> bytes) of memory. Each Container has a limit of 0.5
|
||||
cpu and 128MiB of memory. You can say the Pod has a request of 0.5 cpu and 128
|
||||
MiB of memory, and a limit of 1 cpu and 256MiB of memory.
|
||||
-->
|
||||
|
||||
下面是个例子。
|
||||
|
||||
以下 Pod 有两个容器。每个容器的请求为 0.25 cpu 和 64MiB（2<sup>26</sup> 字节）内存，每个容器的限制为 0.5 cpu 和 128MiB 内存。您可以说该 Pod 请求 0.5 cpu 和 128 MiB 的内存，限制为 1 cpu 和 256MiB 的内存。
|
||||
@@ -83,27 +172,91 @@ spec:
|
||||
cpu: "500m"
|
||||
```
|
||||
|
||||
<!--
|
||||
## How Pods with resource requests are scheduled
|
||||
When you create a Pod, the Kubernetes scheduler selects a node for the Pod to
|
||||
run on. Each node has a maximum capacity for each of the resource types: the
|
||||
amount of CPU and memory it can provide for Pods. The scheduler ensures that,
|
||||
for each resource type, the sum of the resource requests of the scheduled
|
||||
Containers is less than the capacity of the node. Note that although actual memory
|
||||
or CPU resource usage on nodes is very low, the scheduler still refuses to place
|
||||
a Pod on a node if the capacity check fails. This protects against a resource
|
||||
shortage on a node when resource usage later increases, for example, during a
|
||||
daily peak in request rate.
|
||||
-->
|
||||
|
||||
## 具有资源请求的 Pod 如何调度
|
||||
|
||||
当您创建一个 Pod 时，Kubernetes 调度程序将为 Pod 选择一个节点。每个节点具有每种资源类型的最大容量：可为 Pod 提供的 CPU 和内存量。调度程序确保对于每种资源类型，调度的容器的资源请求的总和小于节点的容量。请注意，尽管节点上的实际内存或 CPU 资源使用量非常低，但如果容量检查失败，则调度程序仍然拒绝在该节点上放置 Pod。当资源使用量稍后增加时，例如在请求率的每日峰值期间，这可以防止节点上的资源短缺。
|
||||
|
||||
<!--
|
||||
## How Pods with resource limits are run
|
||||
When the kubelet starts a Container of a Pod, it passes the CPU and memory limits
|
||||
to the container runtime.
|
||||
When using Docker:
|
||||
-->
|
||||
|
||||
## 具有资源限制的 Pod 如何运行
|
||||
|
||||
当 kubelet 启动一个 Pod 的容器时，它会将 CPU 和内存限制传递到容器运行时。
|
||||
|
||||
当使用 Docker 时：
|
||||
|
||||
- `spec.containers[].resources.requests.cpu` 的值将转换成 millicore 值，这是个浮点数，并乘以1024，这个数字中的较大者或2用作 `docker run` 命令中的[ `--cpu-shares`](https://docs.docker.com/engine/reference/run/#/cpu-share-constraint) 标志的值。
|
||||
<!--
|
||||
- The `spec.containers[].resources.requests.cpu` is converted to its core value,
|
||||
which is potentially fractional, and multiplied by 1024. The greater of this number
|
||||
or 2 is used as the value of the
|
||||
[`--cpu-shares`](https://docs.docker.com/engine/reference/run/#/cpu-share-constraint)
|
||||
flag in the `docker run` command.
|
||||
- The `spec.containers[].resources.limits.cpu` is converted to its millicore value and
|
||||
multiplied by 100. The resulting value is the total amount of CPU time that a container can use
|
||||
every 100ms. A container cannot use more than its share of CPU time during this interval.
|
||||
-->
|
||||
|
||||
- `spec.containers[].resources.requests.cpu` 的值将转换成 millicore 值，这是个浮点数，并乘以 1024，这个数字中的较大者或 2 用作 `docker run` 命令中的[ `--cpu-shares`](https://docs.docker.com/engine/reference/run/#/cpu-share-constraint) 标志的值。
|
||||
|
||||
- `spec.containers[].resources.limits.cpu` 被转换成 millicore 值。被乘以 100000 然后 除以 1000。这个数字用作 `docker run` 命令中的 [`--cpu-quota`](https://docs.docker.com/engine/reference/run/#/cpu-quota-constraint) 标志的值。[`--cpu-quota` ] 标志被设置成了 100000，表示测量配额使用的默认100ms 周期。如果 [`--cpu-cfs-quota`] 标志设置为 true，则 kubelet 会强制执行 cpu 限制。从 Kubernetes 1.2 版本起，此标志默认为 true。
|
||||
|
||||
<!--
|
||||
{{< note >}}
|
||||
The default quota period is 100ms. The minimum resolution of CPU quota is 1ms.
|
||||
{{</ note >}}
|
||||
-->
|
||||
|
||||
{{< note >}}
|
||||
默认配额限制为 100 毫秒。 CPU配额的最小单位为 1 毫秒。
|
||||
{{</ note >}}
|
||||
|
||||
- `spec.containers[].resources.limits.memory` 被转换为整型，作为 `docker run` 命令中的 [`--memory`](https://docs.docker.com/engine/reference/run/#/user-memory-constraints) 标志的值。
|
||||
|
||||
<!--
|
||||
If a Container exceeds its memory limit, it might be terminated. If it is
|
||||
restartable, the kubelet will restart it, as with any other type of runtime
|
||||
failure.
|
||||
If a Container exceeds its memory request, it is likely that its Pod will
|
||||
be evicted whenever the node runs out of memory.
|
||||
A Container might or might not be allowed to exceed its CPU limit for extended
|
||||
periods of time. However, it will not be killed for excessive CPU usage.
|
||||
To determine whether a Container cannot be scheduled or is being killed due to
|
||||
resource limits, see the
|
||||
[Troubleshooting](#troubleshooting) section.
|
||||
-->
|
||||
|
||||
如果容器超过其内存限制，则可能会被终止。如果可重新启动，则与所有其他类型的运行时故障一样，kubelet 将重新启动它。
|
||||
|
||||
如果一个容器超过其内存请求，那么当节点内存不足时，它的 Pod 可能被逐出。
|
||||
|
||||
容器可能被允许也可能不被允许超过其 CPU 限制时间。但是，由于 CPU 使用率过高，不会被杀死。
|
||||
|
||||
要确定容器是否由于资源限制而无法安排或被杀死，请参阅 [疑难解答](#troubleshooting) 部分。
|
||||
要确定容器是否由于资源限制而无法安排或被杀死，请参阅[疑难解答](#troubleshooting) 部分。
|
||||
|
||||
<!--
|
||||
## Monitoring compute resource usage
|
||||
The resource usage of a Pod is reported as part of the Pod status.
|
||||
If [optional monitoring](http://releases.k8s.io/{{< param "githubbranch" >}}/cluster/addons/cluster-monitoring/README.md)
|
||||
is configured for your cluster, then Pod resource usage can be retrieved from
|
||||
the monitoring system.
|
||||
-->
|
||||
|
||||
## 监控计算资源使用
|
||||
|
||||
@@ -111,6 +264,14 @@ Pod 的资源使用情况被报告为 Pod 状态的一部分。
|
||||
|
||||
如果为集群配置了 [可选监控](http://releases.k8s.io/{{< param "githubbranch" >}}/cluster/addons/cluster-monitoring/README.md)，则可以从监控系统检索 Pod 资源的使用情况。
|
||||
|
||||
<!--
|
||||
## Troubleshooting
|
||||
### My Pods are pending with event message failedScheduling
|
||||
If the scheduler cannot find any node where a Pod can fit, the Pod remains
|
||||
unscheduled until a place can be found. An event is produced each time the
|
||||
scheduler fails to find a place for the Pod, like this:
|
||||
-->
|
||||
|
||||
## 疑难解答
|
||||
|
||||
### 我的 Pod 处于 pending 状态且事件信息显示 failedScheduling
|
||||
@@ -124,8 +285,29 @@ Events:
|
||||
36s 5s 6 {scheduler } FailedScheduling Failed for reason PodExceedsFreeCPU and possibly others
|
||||
```
|
||||
|
||||
<!-
|
||||
In the preceding example, the Pod named "frontend" fails to be scheduled due to
|
||||
insufficient CPU resource on the node. Similar error messages can also suggest
|
||||
failure due to insufficient memory (PodExceedsFreeMemory). In general, if a Pod
|
||||
is pending with a message of this type, there are several things to try:
|
||||
- Add more nodes to the cluster.
|
||||
- Terminate unneeded Pods to make room for pending Pods.
|
||||
- Check that the Pod is not larger than all the nodes. For example, if all the
|
||||
nodes have a capacity of `cpu: 1`, then a Pod with a request of `cpu: 1.1` will
|
||||
never be scheduled.
|
||||
You can check node capacities and amounts allocated with the
|
||||
`kubectl describe nodes` command. For example:
|
||||
-->
|
||||
|
||||
在上述示例中，由于节点上的 CPU 资源不足，名为 “frontend” 的 Pod 将无法调度。由于内存不足（PodExceedsFreeMemory），类似的错误消息也可能会导致失败。一般来说，如果有这种类型的消息而处于 pending 状态，您可以尝试如下几件事情：
|
||||
|
||||
- 向集群添加更多节点。
|
||||
- 终止不需要的 Pod，为待处理的 Pod 腾出空间。
|
||||
- 检查 Pod 所需的资源是否大于所有节点的资源。 例如，如果全部节点的容量为`cpu：1`，那么一个请求为 `cpu：1.1`的 Pod 永远不会被调度。
|
||||
|
||||
您可以使用 `kubectl describe nodes` 命令检查节点容量和分配的数量。 例如：
|
||||
|
||||
|
||||
```shell
|
||||
$ kubectl describe nodes e2e-test-minion-group-4lw4
|
||||
Name: e2e-test-minion-group-4lw4
|
||||
@@ -156,6 +338,21 @@ Allocated resources:
|
||||
680m (34%) 400m (20%) 920Mi (12%) 1070Mi (14%)
|
||||
```
|
||||
|
||||
<!--
|
||||
In the preceding output, you can see that if a Pod requests more than 1120m
|
||||
CPUs or 6.23Gi of memory, it will not fit on the node.
|
||||
By looking at the `Pods` section, you can see which Pods are taking up space on
|
||||
the node.
|
||||
The amount of resources available to Pods is less than the node capacity, because
|
||||
system daemons use a portion of the available resources. The `allocatable` field
|
||||
[NodeStatus](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#nodestatus-v1-core)
|
||||
gives the amount of resources that are available to Pods. For more information, see
|
||||
[Node Allocatable Resources](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md).
|
||||
The [resource quota](/docs/concepts/policy/resource-quotas/) feature can be configured
|
||||
to limit the total amount of resources that can be consumed. If used in conjunction
|
||||
with namespaces, it can prevent one team from hogging all the resources.
|
||||
-->
|
||||
|
||||
在上面的输出中，您可以看到如果 Pod 请求超过 1120m CPU 或者 6.23Gi 内存，节点将无法满足。
|
||||
|
||||
通过查看 `Pods` 部分，您将看到哪些 Pod 占用的节点上的资源。
|
||||
@@ -164,6 +361,13 @@ Pod 可用的资源量小于节点容量，因为系统守护程序使用一部
|
||||
|
||||
可以将 [资源配额](/docs/concepts/policy/resource-quotas/) 功能配置为限制可以使用的资源总量。如果与 namespace 配合一起使用，就可以防止一个团队占用所有资源。
|
||||
|
||||
<!--
|
||||
### My Container is terminated
|
||||
Your Container might get terminated because it is resource-starved. To check
|
||||
whether a Container is being killed because it is hitting a resource limit, call
|
||||
`kubectl describe pod` on the Pod of interest:
|
||||
-->
|
||||
|
||||
## 我的容器被终止了
|
||||
|
||||
您的容器可能因为资源枯竭而被终止了。要查看容器是否因为遇到资源限制而被杀死，请在相关的 Pod 上调用 `kubectl describe pod`：
|
||||
@@ -210,6 +414,13 @@ Events:
|
||||
|
||||
您可以使用 `kubectl get pod` 命令加上 `-o go-template=...` 选项来获取之前终止容器的状态。
|
||||
|
||||
<!--
|
||||
In the preceding example, the `Restart Count: 5` indicates that the `simmemleak`
|
||||
Container in the Pod was terminated and restarted five times.
|
||||
You can call `kubectl get pod` with the `-o go-template=...` option to fetch the status
|
||||
of previously terminated Containers:
|
||||
-->
|
||||
|
||||
```shell
|
||||
[13:59:01] $ kubectl get pod -o go-template='{{range.status.containerStatuses}}{{"Container Name: "}}{{.name}}{{"\r\nLastState: "}}{{.lastState}}{{end}}' simmemleak-60xbc
|
||||
Container Name: simmemleak
|
||||
@@ -218,6 +429,10 @@ LastState: map[terminated:map[exitCode:137 reason:OOM Killed startedAt:2015-07-0
|
||||
|
||||
您可以看到容器因为 `reason:OOM killed` 被终止，`OOM` 表示 Out Of Memory。
|
||||
|
||||
<!--
|
||||
You can see that the Container was terminated because of `reason:OOM Killed`, where `OOM` stands for Out Of Memory.
|
||||
-->
|
||||
|
||||
## 不透明整型资源（Alpha功能）
|
||||
|
||||
Kubernetes 1.5 版本中引入不透明整型资源。不透明的整数资源允许集群运维人员发布新的节点级资源，否则系统将不了解这些资源。
|
||||
@@ -275,6 +490,26 @@ spec:
|
||||
all Containers in a Pod, such as
|
||||
[emptyDir volumes](/docs/concepts/storage/volumes/#emptydir).
|
||||
Kubernetes version 1.5 only supports Container requests and limits for CPU and
|
||||
memory. It is planned to add new resource types, including a node disk space
|
||||
resource, and a framework for adding custom
|
||||
[resource types](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/design-proposals/scheduling/resources.md).
|
||||
Kubernetes supports overcommitment of resources by supporting multiple levels of
|
||||
[Quality of Service](http://issue.k8s.io/168).
|
||||
In Kubernetes version 1.5, one unit of CPU means different things on different
|
||||
cloud providers, and on different machine types within the same cloud providers.
|
||||
For example, on AWS, the capacity of a node is reported in
|
||||
[ECUs](http://aws.amazon.com/ec2/faqs/), while in GCE it is reported in logical
|
||||
cores. We plan to revise the definition of the cpu resource to allow for more
|
||||
consistency across providers and platforms.
|
||||
-->
|
||||
|
||||
## 计划改进
|
||||
|
||||
在 kubernetes 1.5 版本中仅允许在容器上指定资源量。计划改进对所有容器在 Pod 中共享资源的计量，如 [emptyDir volume](/docs/concepts/storage/volumes/#emptydir)。
|
||||
|
||||
在 kubernetes 1.5 版本中仅支持容器对 CPU 和内存的申请和限制。计划增加新的资源类型，包括节点磁盘空间资源和一个可支持自定义 [资源类型](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/design-proposals/resources.md) 的框架。
|
||||
|
||||
Kubernetes 通过支持通过多级别的 [服务质量](http://issue.k8s.io/168) 来支持资源的过度使用。
|
||||
|
||||
在 kubernetes 1.5 版本中，一个 CPU 单位在不同的云提供商和同一云提供商的不同机器类型中的意味都不同。例如，在 AWS 上，节点的容量报告为 [ECU](http://aws.amazon.com/ec2/faqs/)，而在 GCE 中报告为逻辑内核。我们计划修改 cpu 资源的定义，以便在不同的提供商和平台之间保持一致。
|
||||
|
||||
@@ -288,12 +523,15 @@ Kubernetes 通过支持通过多级别的 [服务质量](http://issue.k8s.io/168
|
||||
* [ResourceRequirements](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#resourcerequirements-v1-core)
|
||||
-->
|
||||
|
||||
- 获取将 [CPU 和内存资源分配给容器](/docs/tasks/configure-pod-container/assign-cpu-ram-container/) 的实践经验
|
||||
- [容器](/docs/api-reference/{{< param "version" >}}/#container-v1-core)
|
||||
- [ResourceRequirements](/docs/resources-reference/{{< param "version" >}}/#resourcerequirements-v1-core)
|
||||
|
||||
{{% /capture %}}
|
||||
-->
|
||||
|
||||
- 获取将 [CPU 和内存资源分配给容器](/docs/tasks/configure-pod-container/assign-cpu-ram-container/) 的实践经验
|
||||
- [容器](/docs/api-reference/{{< param "version" >}}/#container-v1-core)
|
||||
- [ResourceRequirements](/docs/resources-reference/{{< param "version" >}}/#resourcerequirements-v1-core)
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,280 @@
|
||||
---
|
||||
title: 使用 kubeconfig 文件组织集群访问
|
||||
content_template: templates/concept
|
||||
weight: 60
|
||||
---
|
||||
<!--
|
||||
---
|
||||
title: Organizing Cluster Access Using kubeconfig Files
|
||||
content_template: templates/concept
|
||||
weight: 60
|
||||
---
|
||||
--->
|
||||
|
||||
{{% capture overview %}}
|
||||
|
||||
<!--
|
||||
Use kubeconfig files to organize information about clusters, users, namespaces, and
|
||||
authentication mechanisms. The `kubectl` command-line tool uses kubeconfig files to
|
||||
find the information it needs to choose a cluster and communicate with the API server
|
||||
of a cluster.
|
||||
--->
|
||||
使用 kubeconfig 文件来组织有关集群、用户、命名空间和身份认证机制的信息。`kubectl` 命令行工具使用 kubeconfig 文件来查找选择集群所需的信息，并与集群的 API 服务器进行通信。
|
||||
|
||||
<!--
|
||||
{{< note >}}
|
||||
A file that is used to configure access to clusters is called
|
||||
a *kubeconfig file*. This is a generic way of referring to configuration files.
|
||||
It does not mean that there is a file named `kubeconfig`.
|
||||
{{< /note >}}
|
||||
--->
|
||||
{{< note >}}
|
||||
注意：用于配置集群访问的文件称为 *kubeconfig 文件*。这是引用配置文件的通用方法。这并不意味着有一个名为 `kubeconfig` 的文件
|
||||
{{< /note >}}
|
||||
|
||||
<!--
|
||||
By default, `kubectl` looks for a file named `config` in the `$HOME/.kube` directory.
|
||||
You can specify other kubeconfig files by setting the `KUBECONFIG` environment
|
||||
variable or by setting the
|
||||
[`--kubeconfig`](/docs/reference/generated/kubectl/kubectl/) flag.
|
||||
--->
|
||||
默认情况下，`kubectl` 在 `$HOME/.kube` 目录下查找名为 `config` 的文件。您可以通过设置 `KUBECONFIG` 环境变量或者设置[`--kubeconfig`](/docs/reference/generated/kubectl/kubectl/)参数来指定其他 kubeconfig 文件。
|
||||
|
||||
<!--
|
||||
For step-by-step instructions on creating and specifying kubeconfig files, see
|
||||
[Configure Access to Multiple Clusters](/docs/tasks/access-application-cluster/configure-access-multiple-clusters).
|
||||
--->
|
||||
有关创建和指定 kubeconfig 文件的分步说明，请参阅[配置对多集群的访问](/docs/tasks/access-application-cluster/configure-access-multiple-clusters)。
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
|
||||
{{% capture body %}}
|
||||
|
||||
<!--
|
||||
## Supporting multiple clusters, users, and authentication mechanisms
|
||||
--->
|
||||
## 支持多集群、用户和身份认证机制
|
||||
|
||||
<!--
|
||||
Suppose you have several clusters, and your users and components authenticate
|
||||
in a variety of ways. For example:
|
||||
--->
|
||||
假设您有多个集群，并且您的用户和组件以多种方式进行身份认证。比如：
|
||||
|
||||
<!--
|
||||
- A running kubelet might authenticate using certificates.
|
||||
- A user might authenticate using tokens.
|
||||
- Administrators might have sets of certificates that they provide to individual users.
|
||||
--->
|
||||
- 正在运行的 kubelet 可能使用证书在进行认证。
|
||||
- 用户可能通过令牌进行认证。
|
||||
- 管理员可能拥有多个证书集合提供给各用户。
|
||||
|
||||
<!--
|
||||
With kubeconfig files, you can organize your clusters, users, and namespaces.
|
||||
You can also define contexts to quickly and easily switch between
|
||||
clusters and namespaces.
|
||||
--->
|
||||
使用 kubeconfig 文件，您可以组织集群、用户和命名空间。您还可以定义上下文，以便在集群和命名空间之间快速轻松地切换。
|
||||
|
||||
<!--
|
||||
## Context
|
||||
--->
|
||||
## 上下文（Context）
|
||||
|
||||
<!--
|
||||
A *context* element in a kubeconfig file is used to group access parameters
|
||||
under a convenient name. Each context has three parameters: cluster, namespace, and user.
|
||||
By default, the `kubectl` command-line tool uses parameters from
|
||||
the *current context* to communicate with the cluster.
|
||||
--->
|
||||
通过 kubeconfig 文件中的 *context* 元素，使用简便的名称来对访问参数进行分组。每个上下文都有三个参数：cluster、namespace 和 user。默认情况下，`kubectl` 命令行工具使用 *当前上下文* 中的参数与集群进行通信。
|
||||
|
||||
<!--
|
||||
To choose the current context:
|
||||
--->
|
||||
选择当前上下文
|
||||
```
|
||||
kubectl config use-context
|
||||
```
|
||||
|
||||
<!--
|
||||
## The KUBECONFIG environment variable
|
||||
--->
|
||||
## KUBECONFIG 环境变量
|
||||
|
||||
<!--
|
||||
The `KUBECONFIG` environment variable holds a list of kubeconfig files.
|
||||
For Linux and Mac, the list is colon-delimited. For Windows, the list
|
||||
is semicolon-delimited. The `KUBECONFIG` environment variable is not
|
||||
required. If the `KUBECONFIG` environment variable doesn't exist,
|
||||
`kubectl` uses the default kubeconfig file, `$HOME/.kube/config`.
|
||||
--->
|
||||
`KUBECONFIG` 环境变量包含一个 kubeconfig 文件列表。对于 Linux 和 Mac，列表以冒号分隔。对于 Windows，列表以分号分隔。`KUBECONFIG` 环境变量不是必要的。如果 `KUBECONFIG` 环境变量不存在，`kubectl` 使用默认的 kubeconfig 文件，`$HOME/.kube/config`。
|
||||
|
||||
<!--
|
||||
If the `KUBECONFIG` environment variable does exist, `kubectl` uses
|
||||
an effective configuration that is the result of merging the files
|
||||
listed in the `KUBECONFIG` environment variable.
|
||||
--->
|
||||
如果 `KUBECONFIG` 环境变量存在，`kubectl` 使用 `KUBECONFIG` 环境变量中列举的文件合并后的有效配置。
|
||||
|
||||
<!--
|
||||
## Merging kubeconfig files
|
||||
--->
|
||||
## 合并 kubeconfig 文件
|
||||
|
||||
<!--
|
||||
To see your configuration, enter this command:
|
||||
--->
|
||||
要查看配置，输入以下命令：
|
||||
```shell
|
||||
kubectl config view
|
||||
```
|
||||
|
||||
<!--
|
||||
As described previously, the output might be from a single kubeconfig file,
|
||||
or it might be the result of merging several kubeconfig files.
|
||||
--->
|
||||
如前所述，输出可能来自 kubeconfig 文件，也可能是合并多个 kubeconfig 文件的结果。
|
||||
|
||||
<!--
|
||||
Here are the rules that `kubectl` uses when it merges kubeconfig files:
|
||||
--->
|
||||
以下是 `kubectl` 在合并 kubeconfig 文件时使用的规则。
|
||||
|
||||
<!--
|
||||
1. If the `--kubeconfig` flag is set, use only the specified file. Do not merge.
|
||||
Only one instance of this flag is allowed.
|
||||
|
||||
Otherwise, if the `KUBECONFIG` environment variable is set, use it as a
|
||||
list of files that should be merged.
|
||||
Merge the files listed in the `KUBECONFIG` environment variable
|
||||
according to these rules:
|
||||
|
||||
* Ignore empty filenames.
|
||||
* Produce errors for files with content that cannot be deserialized.
|
||||
* The first file to set a particular value or map key wins.
|
||||
* Never change the value or map key.
|
||||
Example: Preserve the context of the first file to set `current-context`.
|
||||
Example: If two files specify a `red-user`, use only values from the first file's `red-user`.
|
||||
Even if the second file has non-conflicting entries under `red-user`, discard them.
|
||||
--->
|
||||
1. 如果设置了 `--kubeconfig` 参数，则仅使用指定的文件。不进行合并。此参数只能使用一次。
|
||||
|
||||
否则，如果设置了 `KUBECONFIG` 环境变量，将它用作应合并的文件列表。根据以下规则合并 `KUBECONFIG` 环境变量中列出的文件：
|
||||
|
||||
* 忽略空文件名。
|
||||
* 对于内容无法反序列化的文件，产生错误信息。
|
||||
* 第一个设置特定值或者映射键的文件将生效。
|
||||
* 永远不会更改值或者映射键。示例：保留第一个文件的上下文以设置 `current-context`。示例：如果两个文件都指定了 `red-user`，则仅使用第一个文件的 `red-user` 中的值。即使第二个文件在 `red-user` 下有非冲突条目，也要丢弃它们。
|
||||
|
||||
<!--
|
||||
For an example of setting the `KUBECONFIG` environment variable, see
|
||||
[Setting the KUBECONFIG environment variable](/docs/tasks/access-application-cluster/configure-access-multiple-clusters/#set-the-kubeconfig-environment-variable).
|
||||
--->
|
||||
有关设置 `KUBECONFIG` 环境变量的示例，请参阅[设置 KUBECONFIG 环境变量](/docs/tasks/access-application-cluster/configure-access-multiple-clusters/#set-the-kubeconfig-environment-variable)。
|
||||
|
||||
<!--
|
||||
Otherwise, use the default kubeconfig file, `$HOME/.kube/config`, with no merging.
|
||||
--->
|
||||
否则，使用默认的 kubeconfig 文件， `$HOME/.kube/config`，不进行合并。
|
||||
|
||||
<!--
|
||||
1. Determine the context to use based on the first hit in this chain:
|
||||
|
||||
1. Use the `--context` command-line flag if it exists.
|
||||
2. Use the `current-context` from the merged kubeconfig files.
|
||||
--->
|
||||
1. 根据此链中的第一个匹配确定要使用的上下文。
|
||||
|
||||
1. 如果存在，使用 `--context` 命令行参数。
|
||||
2. 使用合并的 kubeconfig 文件中的 `current-context`。
|
||||
|
||||
<!--
|
||||
An empty context is allowed at this point.
|
||||
--->
|
||||
这种场景下允许空上下文。
|
||||
|
||||
<!--
|
||||
1. Determine the cluster and user. At this point, there might or might not be a context.
|
||||
Determine the cluster and user based on the first hit in this chain,
|
||||
which is run twice: once for user and once for cluster:
|
||||
|
||||
1. Use a command-line flag if it exists: `--user` or `--cluster`.
|
||||
2. If the context is non-empty, take the user or cluster from the context.
|
||||
--->
|
||||
1. 确定集群和用户。此时，可能有也可能没有上下文。根据此链中的第一个匹配确定集群和用户，这将运行两次：一次用于用户，一次用于集群。
|
||||
|
||||
1. 如果存在，使用命令行参数：`--user` 或者 `--cluster`。
|
||||
2. 如果上下文非空，从上下文中获取用户或集群。
|
||||
|
||||
<!--
|
||||
The user and cluster can be empty at this point.
|
||||
--->
|
||||
这种场景下用户和集群可以为空。
|
||||
|
||||
<!--
|
||||
1. Determine the actual cluster information to use. At this point, there might or
|
||||
might not be cluster information.
|
||||
Build each piece of the cluster information based on this chain; the first hit wins:
|
||||
|
||||
1. Use command line flags if they exist: `--server`, `--certificate-authority`, `--insecure-skip-tls-verify`.
|
||||
2. If any cluster information attributes exist from the merged kubeconfig files, use them.
|
||||
3. If there is no server location, fail.
|
||||
--->
|
||||
1. 确定要使用的实际集群信息。此时，可能有也可能没有集群信息。基于此链构建每个集群信息；第一个匹配项会被采用：
|
||||
|
||||
1. 如果存在：`--server`、`--certificate-authority` 和 `--insecure-skip-tls-verify`，使用命令行参数。
|
||||
2. 如果合并的 kubeconfig 文件中存在集群信息属性，则使用它们。
|
||||
3. 如果没有 server 配置，则配置无效。
|
||||
|
||||
<!--
|
||||
2. Determine the actual user information to use. Build user information using the same
|
||||
rules as cluster information, except allow only one authentication
|
||||
technique per user:
|
||||
|
||||
1. Use command line flags if they exist: `--client-certificate`, `--client-key`, `--username`, `--password`, `--token`.
|
||||
2. Use the `user` fields from the merged kubeconfig files.
|
||||
3. If there are two conflicting techniques, fail.
|
||||
--->
|
||||
2. 确定要使用的实际用户信息。使用与集群信息相同的规则构建用户信息，但每个用户只允许一种身份认证技术：
|
||||
|
||||
1. 如果存在：`--client-certificate`、`--client-key`、`--username`、`--password` 和 `--token`，使用命令行参数。
|
||||
2. 使用合并的 kubeconfig 文件中的 `user` 字段。
|
||||
3. 如果存在两种冲突技术，则配置无效。
|
||||
|
||||
<!--
|
||||
3. For any information still missing, use default values and potentially
|
||||
prompt for authentication information.
|
||||
--->
|
||||
3. 对于仍然缺失的任何信息，使用其对应的默认值，并可能提示输入身份认证信息。
|
||||
|
||||
<!--
|
||||
## File references
|
||||
--->
|
||||
## 文件引用
|
||||
|
||||
<!--
|
||||
File and path references in a kubeconfig file are relative to the location of the kubeconfig file.
|
||||
File references on the command line are relative to the current working directory.
|
||||
In `$HOME/.kube/config`, relative paths are stored relatively, and absolute paths
|
||||
are stored absolutely.
|
||||
--->
|
||||
kubeconfig 文件中的文件和路径引用是相对于 kubeconfig 文件的位置。命令行上的文件引用是相当对于当前工作目录的。在 `$HOME/.kube/config` 中，相对路径按相对路径存储，绝对路径按绝对路径存储。
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
|
||||
{{% capture whatsnext %}}
|
||||
|
||||
<!--
|
||||
* [Configure Access to Multiple Clusters](/docs/tasks/access-application-cluster/configure-access-multiple-clusters/)
|
||||
* [`kubectl config`](/docs/reference/generated/kubectl/kubectl-commands#config)
|
||||
--->
|
||||
* [配置对多集群的访问](/docs/tasks/access-application-cluster/configure-access-multiple-clusters/)
|
||||
* [`kubectl config`](/docs/reference/generated/kubectl/kubectl-commands#config)
|
||||
{{% /capture %}}
|
||||
|
||||
|
||||
@@ -0,0 +1,175 @@
|
||||
---
|
||||
reviewers:
|
||||
- bsalamat
|
||||
title: 调度器性能调优
|
||||
content_template: templates/concept
|
||||
weight: 70
|
||||
---
|
||||
|
||||
<!-- ---
|
||||
reviewers:
|
||||
- bsalamat
|
||||
title: Scheduler Performance Tuning
|
||||
content_template: templates/concept
|
||||
weight: 70
|
||||
--- -->
|
||||
|
||||
{{% capture overview %}}
|
||||
|
||||
{{< feature-state for_k8s_version="1.12" >}}
|
||||
|
||||
<!-- Kube-scheduler is the Kubernetes default scheduler. It is responsible for
|
||||
placement of Pods on Nodes in a cluster. Nodes in a cluster that meet the
|
||||
scheduling requirements of a Pod are called "feasible" Nodes for the Pod. The
|
||||
scheduler finds feasible Nodes for a Pod and then runs a set of functions to
|
||||
score the feasible Nodes and picks a Node with the highest score among the
|
||||
feasible ones to run the Pod. The scheduler then notifies the API server about this
|
||||
decision in a process called "Binding". -->
|
||||
|
||||
Kube-scheduler 是 Kubernetes 的默认调度器。负责将 Pods 安排到集群中的节点上。
|
||||
集群中达到 Pod 调度要求的节点也被称为这个 Pod 的“可行性”节点。
|
||||
调度器首先找出 Pod 的可行性节点，然后运行一套打分函数来为可行性节点打分，
|
||||
最后挑选出分数最高的可行性节点来运行 Pod。随后，调度器将这个决定通知给 API 服务器，
|
||||
这个通知流程叫做“绑定”（"Binding"）。
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture body %}}
|
||||
|
||||
<!-- ## Percentage of Nodes to Score -->
|
||||
## 可行性打分的节点比例
|
||||
|
||||
<!-- Before Kubernetes 1.12, Kube-scheduler used to check the feasibility of all the
|
||||
nodes in a cluster and then scored the feasible ones. Kubernetes 1.12 has a new
|
||||
feature that allows the scheduler to stop looking for more feasible nodes once
|
||||
it finds a certain number of them. This improves the scheduler's performance in
|
||||
large clusters. The number is specified as a percentage of the cluster size and
|
||||
is controlled by a configuration option called `percentageOfNodesToScore`. The
|
||||
range should be between 1 and 100. Other values are considered as 100%. The
|
||||
default value of this option is 50%. A cluster administrator can change this value by providing a
|
||||
different value in the scheduler configuration. However, it may not be necessary to change this value. -->
|
||||
|
||||
在 Kubernetes 1.12 之前， Kube-scheduler 曾经是检查集群中所有节点的可行性，并为它们依次打分。
|
||||
而在 Kubernetes 1.12 中加入了一项新的功能，允许调度器在找到足够合适的可行性节点之后，停止搜索。
|
||||
这项功能将提高调度器在大型集群应用中的性能。这是一个比例参数，通过一个名为 `percentageOfNodesToScore` 的配置选项，
|
||||
指明了集群大小中的比例。参数值范围在 1 到 100 之间。其它的数值将被认为是 100%。
|
||||
选项的默认值为 50%。集群管理员也可以在调度器的配置文件中，提供不同数值来做修改。
|
||||
但可能也并不需要修改这个值。
|
||||
|
||||
```yaml
|
||||
apiVersion: componentconfig/v1alpha1
|
||||
kind: KubeSchedulerConfiguration
|
||||
algorithmSource:
|
||||
provider: DefaultProvider
|
||||
|
||||
...
|
||||
|
||||
percentageOfNodesToScore: 50
|
||||
```
|
||||
|
||||
{{< note >}}
|
||||
|
||||
<!-- **Note**: In clusters with zero or less than 50 feasible nodes, the
|
||||
scheduler still checks all the nodes, simply because there are not enough
|
||||
feasible nodes to stop the scheduler's search early. -->
|
||||
|
||||
**注意**：如果集群中可行性节点的数量为 0 或者小于 50 个，调度器还是会检查所有的节点，
|
||||
仅仅是因为没有足够多的可行性节点让调度器终止搜索。
|
||||
|
||||
{{< /note >}}
|
||||
|
||||
|
||||
|
||||
<!-- **To disable this feature**, you can set `percentageOfNodesToScore` to 100. -->
|
||||
可以将 `percentageOfNodesToScore` 设置为 100 来**禁止这项功能**。
|
||||
|
||||
<!-- ### Tuning percentageOfNodesToScore -->
|
||||
### 调优 `percentageOfNodesToScore`
|
||||
|
||||
<!-- `percentageOfNodesToScore` must be a value between 1 and 100
|
||||
with the default value of 50. There is also a hardcoded minimum value of 50
|
||||
nodes which is applied internally. The scheduler tries to find at
|
||||
least 50 nodes regardless of the value of `percentageOfNodesToScore`. This means
|
||||
that changing this option to lower values in clusters with several hundred nodes
|
||||
will not have much impact on the number of feasible nodes that the scheduler
|
||||
tries to find. This is intentional as this option is unlikely to improve
|
||||
performance noticeably in smaller clusters. In large clusters with over a 1000
|
||||
nodes setting this value to lower numbers may show a noticeable performance
|
||||
improvement. -->
|
||||
|
||||
`percentageOfNodesToScore` 的数值必须在 1 到 100 之间，默认值为 50。
|
||||
在内部设计里面，还存在有硬编码的至少 50 个节点的要求。无论 `percentageOfNodesToScore` 设置如何，
|
||||
调度器都至少会搜索 50 个节点。换言之，在只有数百个节点的集群中调低这个参数，并不会对调度器搜索可行性节点有影响。
|
||||
这样设计是经过考虑的，因为在较小的集群中，这个参数并不会显著提升性能。
|
||||
而在超过 1000 个节点的大型集群中调低这个参数，将会有显著的性能提升。
|
||||
|
||||
<!-- An important note to consider when setting this value is that when a smaller
|
||||
number of nodes in a cluster are checked for feasibility, some nodes are not
|
||||
sent to be scored for a given Pod. As a result, a Node which could possibly
|
||||
score a higher value for running the given Pod might not even be passed to the
|
||||
scoring phase. This would result in a less than ideal placement of the Pod. For
|
||||
this reason, the value should not be set to very low percentages. A general rule
|
||||
of thumb is to never set the value to anything lower than 30. Lower values
|
||||
should be used only when the scheduler's throughput is critical for your
|
||||
application and the score of nodes is not important. In other words, you prefer
|
||||
to run the Pod on any Node as long as it is feasible. -->
|
||||
|
||||
在设置这个数值时，需要注意一点，如果集群中只有较少的一部分节点进行了可行性检查，
|
||||
有些节点将不会被作可行性打分。
|
||||
因而，有运行 Pod 可行性分数更高的节点甚至可能不会到达打分阶段。这会造成一个并不十分理想的安排结果。
|
||||
正因为如此，这个数值不应该设置得非常低。
|
||||
一个重要原则就是这个数值不应该小于 30。
|
||||
更小的数值只应该在应用对调度器的吞吐量十分敏感，而节点的可行性打分相对不重要的前提下使用。
|
||||
换言之，只要节点适合运行 Pod 就可以安排到该节点上运行。
|
||||
|
||||
<!-- It is not recommended to lower this value from its default if your cluster has
|
||||
only several hundred Nodes. It is unlikely to improve the scheduler's
|
||||
performance significantly. -->
|
||||
|
||||
如果集群只有数百个节点，我们不建议将参数值调到比默认值低。因为这并不能显著提升调度器的性能。
|
||||
|
||||
<!-- ### How the scheduler iterates over Nodes -->
|
||||
### 调度器是如何遍历节点的
|
||||
|
||||
<!-- This section is intended for those who want to understand the internal details
|
||||
of this feature. -->
|
||||
|
||||
这一节是为那些希望了解这项功能内部细节的人准备的。
|
||||
|
||||
<!-- In order to give all the Nodes in a cluster a fair chance of being considered
|
||||
for running Pods, the scheduler iterates over the nodes in a round robin
|
||||
fashion. You can imagine that Nodes are in an array. The scheduler starts from
|
||||
the start of the array and checks feasibility of the nodes until it finds enough
|
||||
Nodes as specified by `percentageOfNodesToScore`. For the next Pod, the
|
||||
scheduler continues from the point in the Node array that it stopped at when checking
|
||||
feasibility of Nodes for the previous Pod. -->
|
||||
|
||||
为了让集群中所有的节点都有平等的机会被考虑运行 Pods，调度器需要以轮转的方式遍历所有的节点。
|
||||
你可以这样理解：所有节点都在记录在某数组之中，调度器从数组的一端开始检查节点的可行性，直到找到 `percentageOfNodesToScore`
|
||||
指明的、足够多的节点。对于下一个 pod，调度器将从前一个 Pod 的结束节点开始，继续开始搜索。
|
||||
|
||||
<!-- If Nodes are in multiple zones, the scheduler iterates over Nodes in various
|
||||
zones to ensure that Nodes from different zones are considered in the
|
||||
feasibility checks. As an example, consider six nodes in two zones: -->
|
||||
|
||||
如果节点在不同的区域，调度器也将遍历不同区域的所有节点，保证不同区域的节点都会被考虑在列。
|
||||
例如，如果六个节点分布在两个区域：
|
||||
|
||||
```
|
||||
Zone 1: Node 1, Node 2, Node 3, Node 4
|
||||
Zone 2: Node 5, Node 6
|
||||
```
|
||||
|
||||
<!-- The Scheduler evaluates feasibility of the nodes in this order: -->
|
||||
|
||||
调度器将会按照下面的顺序来对所有的节点进行可行性检查：
|
||||
|
||||
```
|
||||
Node 1, Node 5, Node 2, Node 6, Node 3, Node 4
|
||||
```
|
||||
|
||||
<!-- After going over all the Nodes, it goes back to Node 1. -->
|
||||
|
||||
当遍历完所有的节点后，会重新从 Node 1 开始搜索。
|
||||
|
||||
{{% /capture %}}
|
||||
@@ -548,13 +548,13 @@ spec:
|
||||
|
||||
### 客户端使用 Secret API
|
||||
|
||||
当部署与 secret API 交互的应用程序时，应使用诸如 [RBAC](https://kubernetes.io/docs/admin/authorization/rbac/) 之类的 [授权策略](https://kubernetes.io/docs/admin/authorization/) 来限制访问。
|
||||
当部署与 secret API 交互的应用程序时，应使用诸如 [RBAC](/docs/admin/authorization/rbac/) 之类的 [授权策略](/docs/admin/authorization/) 来限制访问。
|
||||
|
||||
Secret 中的值对于不同的环境来说重要性可能不同，例如对于 Kubernetes 集群内部（例如 service account 令牌）和集群外部来说就不一样。即使一个应用程序可以理解其期望的与之交互的 secret 有多大的能力，但是同一命名空间中的其他应用程序却可能不这样认为。
|
||||
|
||||
由于这些原因，在命名空间中 `watch` 和 `list` secret 的请求是非常强大的功能，应该避免这样的行为，因为列出 secret 可以让客户端检查所有 secret 是否在该命名空间中。在群集中`watch` 和 `list` 所有 secret 的能力应该只保留给最有特权的系统级组件。
|
||||
|
||||
需要访问 secrets API 的应用程序应该根据他们需要的 secret 执行 `get` 请求。这允许管理员限制对所有 secret 的访问，同时设置 [白名单访问](https://kubernetes.io/docs/admin/authorization/rbac/#referring-to-resources) 应用程序需要的各个实例。
|
||||
需要访问 secrets API 的应用程序应该根据他们需要的 secret 执行 `get` 请求。这允许管理员限制对所有 secret 的访问，同时设置 [白名单访问](/docs/admin/authorization/rbac/#referring-to-resources) 应用程序需要的各个实例。
|
||||
|
||||
为了提高循环获取的性能，客户端可以设计引用 secret 的资源，然后 `watch` 资源，在引用更改时重新请求 secret。此外，还提出了一种 [”批量监控“ API](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/bulk_watch.md) 来让客户端 `watch` 每个资源，该功能可能会在将来的 Kubernetes 版本中提供。
|
||||
|
||||
|
||||
Reference in New Issue
Block a user