[ko] Merge dev-1.24-ko.1 into main

content/ko/examples/admin/logging/two-files-counter-pod-agent-sidecar.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
   - name: count
-    image: busybox
+    image: busybox:1.28
     args:
     - /bin/sh
     - -c

content/ko/examples/admin/logging/two-files-counter-pod-streaming-sidecar.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
   - name: count
-    image: busybox
+    image: busybox:1.28
     args:
     - /bin/sh
     - -c
@@ -22,14 +22,14 @@ spec:
     - name: varlog
       mountPath: /var/log
   - name: count-log-1
-    image: busybox
-    args: [/bin/sh, -c, 'tail -n+1 -f /var/log/1.log']
+    image: busybox:1.28
+    args: [/bin/sh, -c, 'tail -n+1 -F /var/log/1.log']
     volumeMounts:
     - name: varlog
       mountPath: /var/log
   - name: count-log-2
-    image: busybox
-    args: [/bin/sh, -c, 'tail -n+1 -f /var/log/2.log']
+    image: busybox:1.28
+    args: [/bin/sh, -c, 'tail -n+1 -F /var/log/2.log']
     volumeMounts:
     - name: varlog
       mountPath: /var/log

content/ko/examples/admin/logging/two-files-counter-pod.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
   - name: count
-    image: busybox
+    image: busybox:1.28
     args:
     - /bin/sh
     - -c

content/ko/examples/admin/resource/limit-range-pod-1.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
   - name: busybox-cnt01
-    image: busybox
+    image: busybox:1.28
     command: ["/bin/sh"]
     args: ["-c", "while true; do echo hello from cnt01; sleep 10;done"]
     resources:
@@ -16,7 +16,7 @@ spec:
         memory: "200Mi"
         cpu: "500m"
   - name: busybox-cnt02
-    image: busybox
+    image: busybox:1.28
     command: ["/bin/sh"]
     args: ["-c", "while true; do echo hello from cnt02; sleep 10;done"]
     resources:
@@ -24,7 +24,7 @@ spec:
         memory: "100Mi"
         cpu: "100m"
   - name: busybox-cnt03
-    image: busybox
+    image: busybox:1.28
     command: ["/bin/sh"]
     args: ["-c", "while true; do echo hello from cnt03; sleep 10;done"]
     resources:
@@ -32,6 +32,6 @@ spec:
         memory: "200Mi"
         cpu: "500m"
   - name: busybox-cnt04
-    image: busybox
+    image: busybox:1.28
     command: ["/bin/sh"]
     args: ["-c", "while true; do echo hello from cnt04; sleep 10;done"]

content/ko/examples/admin/resource/limit-range-pod-2.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
   - name: busybox-cnt01
-    image: busybox
+    image: busybox:1.28
     command: ["/bin/sh"]
     args: ["-c", "while true; do echo hello from cnt01; sleep 10;done"]
     resources:
@@ -16,7 +16,7 @@ spec:
         memory: "200Mi"
         cpu: "500m"
   - name: busybox-cnt02
-    image: busybox
+    image: busybox:1.28
     command: ["/bin/sh"]
     args: ["-c", "while true; do echo hello from cnt02; sleep 10;done"]
     resources:
@@ -24,7 +24,7 @@ spec:
         memory: "100Mi"
         cpu: "100m"
   - name: busybox-cnt03
-    image: busybox
+    image: busybox:1.28
     command: ["/bin/sh"]
     args: ["-c", "while true; do echo hello from cnt03; sleep 10;done"]
     resources:
@@ -32,6 +32,6 @@ spec:
         memory: "200Mi"
         cpu: "500m"
   - name: busybox-cnt04
-    image: busybox
+    image: busybox:1.28
     command: ["/bin/sh"]
     args: ["-c", "while true; do echo hello from cnt04; sleep 10;done"]

content/ko/examples/admin/resource/limit-range-pod-3.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
   - name: busybox-cnt01
-    image: busybox
+    image: busybox:1.28
     resources:
       limits:
         memory: "300Mi"

content/ko/examples/application/job/cronjob.yaml

@@ -10,7 +10,7 @@ spec:
         spec:
           containers:
           - name: hello
-            image: busybox
+            image: busybox:1.28
             imagePullPolicy: IfNotPresent
             command:
             - /bin/sh

content/ko/examples/application/job/job-tmpl.yaml

@@ -13,6 +13,6 @@ spec:
     spec:
       containers:
       - name: c
-        image: busybox
+        image: busybox:1.28
         command: ["sh", "-c", "echo Processing item $ITEM && sleep 5"]
       restartPolicy: Never

content/ko/examples/application/mysql/mysql-configmap.yaml

@@ -9,8 +9,10 @@ data:
     # Primary에만 이 구성을 적용한다.
     [mysqld]
     log-bin
+    datadir=/var/lib/mysql/mysql
   replica.cnf: |
     # 레플리카에만 이 구성을 적용한다.
     [mysqld]
     super-read-only
+    datadir=/var/lib/mysql/mysql
 

content/ko/examples/application/mysql/mysql-services.yaml

@@ -27,4 +27,3 @@ spec:
     port: 3306
   selector:
     app: mysql
-

content/ko/examples/application/nginx-with-request.yaml

@@ -0,0 +1,23 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  selector:
+    matchLabels:
+      app: nginx
+  replicas: 2
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+      - name: nginx
+        image: nginx
+        resources:
+          limits:
+            memory: "128Mi"
+            cpu: "500m"
+        ports:
+        - containerPort: 80

content/ko/examples/controllers/daemonset.yaml

@@ -15,8 +15,11 @@ spec:
         name: fluentd-elasticsearch
     spec:
       tolerations:
-      # this toleration is to have the daemonset runnable on master nodes
-      # remove it if your masters can't run pods
+      # 이 톨러레이션(toleration)은 데몬셋이 컨트롤 플레인 노드에서 실행될 수 있도록 만든다.
+      # 컨트롤 플레인 노드가 이 파드를 실행해서는 안 되는 경우, 이 톨러레이션을 제거한다.
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+        effect: NoSchedule
       - key: node-role.kubernetes.io/master
         operator: Exists
         effect: NoSchedule

content/ko/examples/controllers/fluentd-daemonset-update.yaml

@@ -19,9 +19,13 @@ spec:
         name: fluentd-elasticsearch
     spec:
       tolerations:
-      # 이 톨러레이션(toleration)은 마스터 노드에서 실행 가능한 데몬셋이
-      # 마스터에서 파드를 실행할 수 없는 경우 이를 제거하는 것이다
+      # 이 톨러레이션(toleration)은 데몬셋이 컨트롤 플레인 노드에서 실행될 수 있도록 만든다.
+      # 컨트롤 플레인 노드가 이 파드를 실행해서는 안 되는 경우, 이 톨러레이션을 제거한다.
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+        effect: NoSchedule
       - key: node-role.kubernetes.io/master
+        operator: Exists
         effect: NoSchedule
       containers:
       - name: fluentd-elasticsearch

content/ko/examples/controllers/fluentd-daemonset.yaml

@@ -19,9 +19,13 @@ spec:
         name: fluentd-elasticsearch
     spec:
       tolerations:
-      # 이 톨러레이션(toleration)은 마스터 노드에서 실행 가능한 데몬셋이
-      # 마스터에서 파드를 실행할 수 없는 경우 이를 제거하는 것이다
+      # 이 톨러레이션(toleration)은 데몬셋이 컨트롤 플레인 노드에서 실행될 수 있도록 만든다.
+      # 컨트롤 플레인 노드가 이 파드를 실행해서는 안 되는 경우, 이 톨러레이션을 제거한다.
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+        effect: NoSchedule
       - key: node-role.kubernetes.io/master
+        operator: Exists
         effect: NoSchedule
       containers:
       - name: fluentd-elasticsearch

content/ko/examples/debug/counter-pod.yaml

@@ -5,6 +5,6 @@ metadata:
 spec:
   containers:
   - name: count
-    image: busybox
+    image: busybox:1.28
     args: [/bin/sh, -c,
             'i=0; while true; do echo "$i: $(date)"; i=$((i+1)); sleep 1; done']

content/ko/examples/debug/node-problem-detector-configmap.yaml

@@ -0,0 +1,49 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: node-problem-detector-v0.1
+  namespace: kube-system
+  labels:
+    k8s-app: node-problem-detector
+    version: v0.1
+    kubernetes.io/cluster-service: "true"
+spec:
+  selector:
+    matchLabels:
+      k8s-app: node-problem-detector  
+      version: v0.1
+      kubernetes.io/cluster-service: "true"
+  template:
+    metadata:
+      labels:
+        k8s-app: node-problem-detector
+        version: v0.1
+        kubernetes.io/cluster-service: "true"
+    spec:
+      hostNetwork: true
+      containers:
+      - name: node-problem-detector
+        image: k8s.gcr.io/node-problem-detector:v0.1
+        securityContext:
+          privileged: true
+        resources:
+          limits:
+            cpu: "200m"
+            memory: "100Mi"
+          requests:
+            cpu: "20m"
+            memory: "20Mi"
+        volumeMounts:
+        - name: log
+          mountPath: /log
+          readOnly: true
+        - name: config # config/ 디렉토리를 컨피그맵 볼륨(ConfigMap volume)으로 덮어쓴다
+          mountPath: /config
+          readOnly: true
+      volumes:
+      - name: log
+        hostPath:
+          path: /var/log/
+      - name: config # 컨피그맵 볼륨(ConfigMap volume)을 정의한다
+        configMap:
+          name: node-problem-detector-config

content/ko/examples/debug/node-problem-detector.yaml

@@ -0,0 +1,43 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: node-problem-detector-v0.1
+  namespace: kube-system
+  labels:
+    k8s-app: node-problem-detector
+    version: v0.1
+    kubernetes.io/cluster-service: "true"
+spec:
+  selector:
+    matchLabels:
+      k8s-app: node-problem-detector  
+      version: v0.1
+      kubernetes.io/cluster-service: "true"
+  template:
+    metadata:
+      labels:
+        k8s-app: node-problem-detector
+        version: v0.1
+        kubernetes.io/cluster-service: "true"
+    spec:
+      hostNetwork: true
+      containers:
+      - name: node-problem-detector
+        image: k8s.gcr.io/node-problem-detector:v0.1
+        securityContext:
+          privileged: true
+        resources:
+          limits:
+            cpu: "200m"
+            memory: "100Mi"
+          requests:
+            cpu: "20m"
+            memory: "20Mi"
+        volumeMounts:
+        - name: log
+          mountPath: /log
+          readOnly: true
+      volumes:
+      - name: log
+        hostPath:
+          path: /var/log/

content/ko/examples/pods/init-containers.yaml

@@ -14,7 +14,7 @@ spec:
   # 이 컨테이너들은 파드 초기화 중에 실행된다.
   initContainers:
   - name: install
-    image: busybox
+    image: busybox:1.28
     command:
     - wget
     - "-O"

content/ko/examples/pods/inject/dependent-envars.yaml

@@ -10,7 +10,7 @@ spec:
       command:
         - sh
         - -c
-      image: busybox
+      image: busybox:1.28
       env:
         - name: SERVICE_PORT
           value: "80"

content/ko/examples/pods/pod-with-node-affinity.yaml

@@ -8,11 +8,10 @@ spec:
       requiredDuringSchedulingIgnoredDuringExecution:
         nodeSelectorTerms:
         - matchExpressions:
-          - key: kubernetes.io/e2e-az-name
+          - key: kubernetes.io/os
             operator: In
             values:
-            - e2e-az1
-            - e2e-az2
+            - linux
       preferredDuringSchedulingIgnoredDuringExecution:
       - weight: 1
         preference:

content/ko/examples/pods/resource/memory-request-limit-3.yaml

@@ -8,9 +8,9 @@ spec:
   - name: memory-demo-3-ctr
     image: polinux/stress
     resources:
-      limits:
-        memory: "1000Gi"
       requests:
         memory: "1000Gi"
+      limits:
+        memory: "1000Gi"
     command: ["stress"]
     args: ["--vm", "1", "--vm-bytes", "150M", "--vm-hang", "1"]

content/ko/examples/pods/resource/memory-request-limit.yaml

@@ -8,9 +8,9 @@ spec:
   - name: memory-demo-ctr
     image: polinux/stress
     resources:
-      limits:
-        memory: "200Mi"
       requests:
         memory: "100Mi"
+      limits:
+        memory: "200Mi"
     command: ["stress"]
     args: ["--vm", "1", "--vm-bytes", "150M", "--vm-hang", "1"]

content/ko/examples/pods/security/hello-apparmor.yaml

@@ -9,5 +9,5 @@ metadata:
 spec:
   containers:
   - name: hello
-    image: busybox
-    command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]
+    image: busybox:1.28
+    command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]

content/ko/examples/policy/restricted-psp.yaml

@@ -3,6 +3,7 @@ kind: PodSecurityPolicy
 metadata:
   name: restricted
   annotations:
+    # docker/default 는 seccomp를 위한 프로파일을 나타내지만, 특별히 도커 런타임에 묶여 있는 것은 아니다.
     seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
     apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
     apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'

content/ko/examples/service/networking/hostaliases-pod.yaml

@@ -15,7 +15,7 @@ spec:
     - "bar.remote"
   containers:
   - name: cat-hosts
-    image: busybox
+    image: busybox:1.28
     command:
     - cat
     args:

content/ko/examples/service/networking/networkpolicy.yaml

@@ -0,0 +1,35 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: test-network-policy
+  namespace: default
+spec:
+  podSelector:
+    matchLabels:
+      role: db
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - ipBlock:
+            cidr: 172.17.0.0/16
+            except:
+              - 172.17.1.0/24
+        - namespaceSelector:
+            matchLabels:
+              project: myproject
+        - podSelector:
+            matchLabels:
+              role: frontend
+      ports:
+        - protocol: TCP
+          port: 6379
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 10.0.0.0/24
+      ports:
+        - protocol: TCP
+          port: 5978
+