From 1eca303e91efc19f967f0a981ef73415987f84ff Mon Sep 17 00:00:00 2001 From: Mitesh Jain <47820816+miteshskj@users.noreply.github.com> Date: Wed, 6 Apr 2022 11:07:24 +0530 Subject: [PATCH 001/101] Remove stale information about pod selector. --- .../docs/concepts/workloads/controllers/daemonset.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/en/docs/concepts/workloads/controllers/daemonset.md b/content/en/docs/concepts/workloads/controllers/daemonset.md index ffb1fbd614..a2eb884e22 100644 --- a/content/en/docs/concepts/workloads/controllers/daemonset.md +++ b/content/en/docs/concepts/workloads/controllers/daemonset.md @@ -76,9 +76,9 @@ A Pod Template in a DaemonSet must have a [`RestartPolicy`](/docs/concepts/workl The `.spec.selector` field is a pod selector. It works the same as the `.spec.selector` of a [Job](/docs/concepts/workloads/controllers/job/). -As of Kubernetes 1.8, you must specify a pod selector that matches the labels of the -`.spec.template`. The pod selector will no longer be defaulted when left empty. Selector -defaulting was not compatible with `kubectl apply`. Also, once a DaemonSet is created, +You must specify a pod selector that matches the labels of the +`.spec.template`. +Also, once a DaemonSet is created, its `.spec.selector` can not be mutated. Mutating the pod selector can lead to the unintentional orphaning of Pods, and it was found to be confusing to users. @@ -91,8 +91,8 @@ The `.spec.selector` is an object consisting of two fields: When the two are specified the result is ANDed. -If the `.spec.selector` is specified, it must match the `.spec.template.metadata.labels`. -Config with these not matching will be rejected by the API. +The `.spec.selector` must match the `.spec.template.metadata.labels`. +Config with these two not matching will be rejected by the API. ### Running Pods on select Nodes From af059477fb28aa49058de2a5a368336102c378a7 Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Wed, 13 Apr 2022 16:57:01 -0700 Subject: [PATCH 002/101] [ja] Clean up various broken links --- content/ja/docs/concepts/cluster-administration/addons.md | 2 +- content/ja/docs/concepts/cluster-administration/networking.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/content/ja/docs/concepts/cluster-administration/addons.md b/content/ja/docs/concepts/cluster-administration/addons.md index f0f1baa402..70619ab3c1 100644 --- a/content/ja/docs/concepts/cluster-administration/addons.md +++ b/content/ja/docs/concepts/cluster-administration/addons.md @@ -29,7 +29,7 @@ content_type: concept * [OVN4NFV-K8S-Plugin](https://github.com/opnfv/ovn4nfv-k8s-plugin)は、クラウドネイティブベースのService function chaining(SFC)、Multiple OVNオーバーレイネットワーク、動的なサブネットの作成、動的な仮想ネットワークの作成、VLANプロバイダーネットワーク、Directプロバイダーネットワークを提供し、他のMulti-networkプラグインと付け替え可能なOVNベースのCNIコントローラープラグインです。 * [NSX-T](https://docs.vmware.com/en/VMware-NSX-T/2.0/nsxt_20_ncp_kubernetes.pdf) Container Plug-in(NCP)は、VMware NSX-TとKubernetesなどのコンテナオーケストレーター間のインテグレーションを提供します。また、NSX-Tと、Pivotal Container Service(PKS)とOpenShiftなどのコンテナベースのCaaS/PaaSプラットフォームとのインテグレーションも提供します。 * [Nuage](https://github.com/nuagenetworks/nuage-kubernetes/blob/v5.1.1-1/docs/kubernetes-1-installation.rst)は、Kubernetes Podと非Kubernetes環境間で可視化とセキュリティモニタリングを使用してポリシーベースのネットワークを提供するSDNプラットフォームです。 -* [Romana](https://romana.io)は、[NetworkPolicy API](/ja/docs/concepts/services-networking/network-policies/)もサポートするPodネットワーク向けのL3のネットワークソリューションです。Kubeadmアドオンのインストールの詳細は[こちら](https://github.com/romana/romana/tree/master/containerize)で確認できます。 +* [Romana](https://github.com/romana/romana)は、[NetworkPolicy API](/ja/docs/concepts/services-networking/network-policies/)もサポートするPodネットワーク向けのL3のネットワークソリューションです。Kubeadmアドオンのインストールの詳細は[こちら](https://github.com/romana/romana/tree/master/containerize)で確認できます。 * [Weave Net](https://www.weave.works/docs/net/latest/kubernetes/kube-addon/)は、ネットワークパーティションの両面で機能し、外部データベースを必要とせずに、ネットワークとネットワークポリシーを提供します。 ## サービスディスカバリ diff --git a/content/ja/docs/concepts/cluster-administration/networking.md b/content/ja/docs/concepts/cluster-administration/networking.md index dacaf08146..444e7ef3d1 100644 --- a/content/ja/docs/concepts/cluster-administration/networking.md +++ b/content/ja/docs/concepts/cluster-administration/networking.md @@ -115,7 +115,7 @@ addressing, and it can be used in combination with other CNI plugins. ### CNI-Genie from Huawei -[CNI-Genie](https://github.com/Huawei-PaaS/CNI-Genie) is a CNI plugin that enables Kubernetes to [simultaneously have access to different implementations](https://github.com/Huawei-PaaS/CNI-Genie/blob/master/docs/multiple-cni-plugins/README.md#what-cni-genie-feature-1-multiple-cni-plugins-enables) of the [Kubernetes network model](/ja/docs/concepts/cluster-administration/networking/#how-to-implement-the-kubernetes-networking-model) in runtime. This includes any implementation that runs as a [CNI plugin](https://github.com/containernetworking/cni#3rd-party-plugins), such as [Flannel](https://github.com/coreos/flannel#flannel), [Calico](http://docs.projectcalico.org/), [Romana](http://romana.io), [Weave-net](https://www.weave.works/products/weave-net/). +[CNI-Genie](https://github.com/Huawei-PaaS/CNI-Genie) is a CNI plugin that enables Kubernetes to [simultaneously have access to different implementations](https://github.com/Huawei-PaaS/CNI-Genie/blob/master/docs/multiple-cni-plugins/README.md#what-cni-genie-feature-1-multiple-cni-plugins-enables) of the [Kubernetes network model](/ja/docs/concepts/cluster-administration/networking/#how-to-implement-the-kubernetes-networking-model) in runtime. This includes any implementation that runs as a [CNI plugin](https://github.com/containernetworking/cni#3rd-party-plugins), such as [Flannel](https://github.com/coreos/flannel#flannel), [Calico](http://docs.projectcalico.org/), [Romana](https://github.com/romana/romana), [Weave-net](https://www.weave.works/products/weave-net/). CNI-Genie also supports [assigning multiple IP addresses to a pod](https://github.com/Huawei-PaaS/CNI-Genie/blob/master/docs/multiple-ips/README.md#feature-2-extension-cni-genie-multiple-ip-addresses-per-pod), each from a different CNI plugin. @@ -273,7 +273,7 @@ at [ovn-kubernetes](https://github.com/openvswitch/ovn-kubernetes). ### Romana -[Romana](https://romana.io) is an open source network and security automation solution that lets you deploy Kubernetes without an overlay network. Romana supports Kubernetes [Network Policy](/docs/concepts/services-networking/network-policies/) to provide isolation across network namespaces. +[Romana](https://github.com/romana/romana) is an open source network and security automation solution that lets you deploy Kubernetes without an overlay network. Romana supports Kubernetes [Network Policy](/docs/concepts/services-networking/network-policies/) to provide isolation across network namespaces. ### Weave Net from Weaveworks From 613bb080ff7cce4fc0de48cb1614546c324fdc8e Mon Sep 17 00:00:00 2001 From: Sean Wei Date: Sat, 16 Apr 2022 21:56:25 +0800 Subject: [PATCH 003/101] Remove deprecated `extensions` API group in document --- content/en/docs/reference/access-authn-authz/abac.md | 4 ++-- content/en/docs/reference/access-authn-authz/rbac.md | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/content/en/docs/reference/access-authn-authz/abac.md b/content/en/docs/reference/access-authn-authz/abac.md index 197901a170..4587bf1f83 100644 --- a/content/en/docs/reference/access-authn-authz/abac.md +++ b/content/en/docs/reference/access-authn-authz/abac.md @@ -33,13 +33,13 @@ properties: - `group`, type string; if you specify `group`, it must match one of the groups of the authenticated user. `system:authenticated` matches all authenticated requests. `system:unauthenticated` matches all unauthenticated requests. - Resource-matching properties: - `apiGroup`, type string; an API group. - - Ex: `extensions` + - Ex: `apps`, `networking.k8s.io` - Wildcard: `*` matches all API groups. - `namespace`, type string; a namespace. - Ex: `kube-system` - Wildcard: `*` matches all resource requests. - `resource`, type string; a resource type - - Ex: `pods` + - Ex: `pods`, `deployments` - Wildcard: `*` matches all resource requests. - Non-resource-matching properties: - `nonResourcePath`, type string; non-resource request paths. diff --git a/content/en/docs/reference/access-authn-authz/rbac.md b/content/en/docs/reference/access-authn-authz/rbac.md index f17b9ae8dd..75ee947c03 100644 --- a/content/en/docs/reference/access-authn-authz/rbac.md +++ b/content/en/docs/reference/access-authn-authz/rbac.md @@ -384,11 +384,11 @@ rules: ``` Allow reading/writing Deployments (at the HTTP level: objects with `"deployments"` -in the resource part of their URL) in both the `"extensions"` and `"apps"` API groups: +in the resource part of their URL) in the `"apps"` API groups: ```yaml rules: -- apiGroups: ["extensions", "apps"] +- apiGroups: ["apps"] # # at the HTTP level, the name of the resource for accessing Deployment # objects is "deployments" @@ -397,7 +397,7 @@ rules: ``` Allow reading Pods in the core API group, as well as reading or writing Job -resources in the `"batch"` or `"extensions"` API groups: +resources in the `"batch"` API group: ```yaml rules: @@ -407,7 +407,7 @@ rules: # objects is "pods" resources: ["pods"] verbs: ["get", "list", "watch"] -- apiGroups: ["batch", "extensions"] +- apiGroups: ["batch"] # # at the HTTP level, the name of the resource for accessing Job # objects is "jobs" From 70c7785cddb6aeba65a284746ad7e095d4e90d17 Mon Sep 17 00:00:00 2001 From: Onur Date: Sun, 17 Apr 2022 20:02:10 +0300 Subject: [PATCH 004/101] Update ingress.md 'spec' is just another field that any Kubernetes object (Ingress here) needs. --- content/en/docs/concepts/services-networking/ingress.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/services-networking/ingress.md b/content/en/docs/concepts/services-networking/ingress.md index e1ca55ab80..413142f90d 100644 --- a/content/en/docs/concepts/services-networking/ingress.md +++ b/content/en/docs/concepts/services-networking/ingress.md @@ -74,7 +74,7 @@ A minimal Ingress resource example: {{< codenew file="service/networking/minimal-ingress.yaml" >}} -As with all other Kubernetes resources, an Ingress needs `apiVersion`, `kind`, and `metadata` fields. +As with all other Kubernetes resources, an Ingress needs `apiVersion`, `kind`, `metadata` and `spec` fields. The name of an Ingress object must be a valid [DNS subdomain name](/docs/concepts/overview/working-with-objects/names#dns-subdomain-names). For general information about working with config files, see [deploying applications](/docs/tasks/run-application/run-stateless-application-deployment/), [configuring containers](/docs/tasks/configure-pod-container/configure-pod-configmap/), [managing resources](/docs/concepts/cluster-administration/manage-deployment/). From 5d099dba126c4557b41b12227c74e4a6bebb1a63 Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Mon, 28 Feb 2022 09:45:22 +0800 Subject: [PATCH 005/101] [zh] Translate kubelet config v1beta1 --- .../config-api/kubelet-config.v1beta1.md | 2719 ++++++++++++----- 1 file changed, 1997 insertions(+), 722 deletions(-) diff --git a/content/zh/docs/reference/config-api/kubelet-config.v1beta1.md b/content/zh/docs/reference/config-api/kubelet-config.v1beta1.md index bee05b68db..0c1bfab0b2 100644 --- a/content/zh/docs/reference/config-api/kubelet-config.v1beta1.md +++ b/content/zh/docs/reference/config-api/kubelet-config.v1beta1.md @@ -1,1604 +1,2879 @@ --- -title: Kubelet Configuration (v1beta1) +title: Kubelet 配置 (v1beta1) content_type: tool-reference package: kubelet.config.k8s.io/v1beta1 auto_generated: true --- + -## Resource Types - + +## 资源类型 - [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) - [SerializedNodeConfigSource](#kubelet-config-k8s-io-v1beta1-SerializedNodeConfigSource) - - - ## `KubeletConfiguration` {#kubelet-config-k8s-io-v1beta1-KubeletConfiguration} - - - - + +KubeletConfiguration 中包含 Kubelet 的配置。 - + - + - - - - - - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + + +

imageMinimumGCAge是对未使用镜像进行垃圾搜集之前允许其存在的时长。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑这种变更可能触发垃圾收集或者延迟垃圾收集， +并且可能影响节点上镜像的额外开销。

+

默认值："2m"

+ - - + - - + - - + - - + - - + - - + - - + - - + - - + + + + + - - + - - + + + + + - - + + +

topologyManagerScope代表的是拓扑提示生成的范围， +拓扑提示信息由提示提供者生成，提供给拓扑管理器。合法值包括：

+
    +
  • container：拓扑策略是按每个容器来实施的。
    • +
  • pod：拓扑策略是按每个 Pod 来实施的。
    • +
+

"pod" 范围要求启用TopologyManager特性门控。

+

默认值："container"

+ - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + + + + + - - + - - + + +

configMapAndSecretChangeDetectionStrategy是 ConfigMap 和 Secret +管理器的运行模式。合法值包括：

+
    +
  • Get：kubelet 从 API 服务器直接取回必要的对象；
    • +
  • Cache：kubelet 使用 TTL 缓存来管理来自 API 服务器的对象；
    • +
  • Watch：kubelet 使用 watch 操作来观察所关心的对象的变更。
    • +
+

默认值："Watch"

+ - - + - - + - - - + +

reservedSystemCPUs选项设置为宿主级系统线程和 Kubernetes +相关线程所预留的 CPU 列表。此字段提供的是一种“静态”的 CPU 列表，而不是像 +systemReserved和kubeReserved所提供的“动态”列表。 +此选项不支持systemReservedCgroup或kubeReservedCgroup。

+ - - + - - + - - + + - - + - - + + +

用逗号分隔的白名单列表，其中包含不安全的 sysctl 或 sysctl 模式（以∗结尾）。 +

+

不安全的 sysctl 组有 kernel.shm∗、kernel.msg∗、 +kernel.sem、fs.mqueue.∗ 和net.∗。

+

例如："kernel.msg∗,net.ipv4.route.min\_pmtu"

+

默认值：[]

+ - - + - - + - - + - - - + +

logging设置日志机制选项。更多的详细信息科参阅 +日志选项。

+

默认值：

+ 
Format: text
 + - - + + +

enableSystemLogHandler用来启用通过 Web 接口 host:port/logs/ +访问系统日志的能力。

+

默认值：true

+ - - + + +

shutdownGracePeriod设置节点关闭期间，节点自身需要延迟以及为 +Pod 提供的宽限期限的总时长。

+

默认值："0s"

+ - - + + +

shutdownGracePeriodCriticalPods设置节点关闭期间用来终止关键性 +Pod 的时长。此时长要短于shutdownGracePeriod。 +例如，如果shutdownGracePeriod=30s，shutdownGracePeriodCriticalPods=10s， +在节点关闭期间，前 20 秒钟被预留用来体面终止普通 Pod，后 10 秒钟用来终止关键 Pod。

+

默认值："0s"

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - -
FieldDescription
字段描述
apiVersion
string		kubelet.config.k8s.io/v1beta1
kind
string		KubeletConfiguration
enableServer [Required]
+
enableServer [必需]
bool 		- enableServer enables Kubelet's secured server. + +

enableServer 会启用 kubelet 的安全服务器。

+

注意：kubelet 的不安全端口由 readOnlyPort 选项控制。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能会影响到与 kubelet 服务器交互的组件。

+

默认值：true

+
staticPodPath
string 		- staticPodPath is the path to the directory containing local (static) pods to + +

staticPodPath 是指向要运行的本地（静态）Pod 的目录， +或者指向某个静态 Pod 文件的路径。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑新路径下所给的静态 Pod 集合可能与 kubelet +启动时所看到的集合不同，而这一差别可能会扰乱节点状态。

+

默认值：""

+
syncFrequency
meta/v1.Duration 		- syncFrequency is the max period between synchronizing running + +

syncFrequency 是对运行中的容器和配置进行同步的最长周期。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑缩短这一同步周期可能会带来负面的性能影响， +尤其当节点上 Pod 个数增加时。相反，增加此周期长度时可能会导致 ConfigMap、 +Secret 这类资源未被及时更新。

+

默认值："1m"

+
fileCheckFrequency
meta/v1.Duration 		- fileCheckFrequency is the duration between checking config files for -new data -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

fileCheckFrequency 是对配置文件中新数据进行检查的时间间隔值。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑缩短此时长会导致 kubelet 更为频繁地重新加载其静态 Pod 配置， +而这会带来负面的性能影响。

+

默认值："20s"

+
httpCheckFrequency
meta/v1.Duration 		- httpCheckFrequency is the duration between checking http for new data -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

httpCheckFrequency 是对 HTTP 服务器上新数据进行检查的时间间隔值。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑缩短此时长会导致 kubelet 更为频繁地轮询 +staticPodURL，而这会带来负面的性能影响。

+

默认值："20s"

+
staticPodURL
string 		- staticPodURL is the URL for accessing static pods to run -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

staticPodURL 是访问要运行的静态 Pod 的 URL 地址。 +

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，新的 URL 上包含的静态 Pod 集合可能与 kubelet +初始启动时看到的不同，而这种差异可能会扰乱节点状态。

+

默认值：""

+
staticPodURLHeader
map[string][]string 		- staticPodURLHeader is a map of slices with HTTP headers to use when accessing the podURL -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

staticPodURLHeader是一个由字符串组成的映射表，其中包含的 HTTP +头部信息用于访问podURL。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，要考虑可能导致无法从staticPodURL +读取最新的静态 Pod 集合。

+

默认值：nil

+
address
string 		+ +

address 是 kubelet 提供服务所用的 IP 地址（设置为 0.0.0.0 +使用所有网络接口提供服务）。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能干扰与 kubelet 服务器交互的组件。

+

默认值："0.0.0.0"

+
port
int32 		+ +

port 是 kubelet 用来提供服务所使用的端口号。 +这一端口号必须介于 1 到 65535 之间，包含 1 和 65535。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能干扰与 kubelet 服务器交互的组件。

+

默认值：10250

+
readOnlyPort
int32 		- readOnlyPort is the read-only port for the Kubelet to serve on with + +

readOnlyPort 是 kubelet 用来提供服务所使用的只读端口号。 +此端口上的服务不支持身份认证或鉴权。这一端口号必须介于 1 到 65535 之间， +包含 1 和 65535。将此字段设置为 0 会禁用只读服务。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能干扰与 kubelet 服务器交互的组件。

+

默认值：0（禁用）

+
tlsCertFile
string 		- tlsCertFile is the file containing x509 Certificate for HTTPS. (CA cert, + +

tlsCertFile是包含 HTTPS 所需要的 x509 证书的文件 +（如果有 CA 证书，会串接到服务器证书之后）。如果tlsCertFile +和tlsPrivateKeyFile都没有设置，则系统会为节点的公开地址生成自签名的证书和私钥， +并将其保存到 kubelet --cert-dir参数所指定的目录下。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能干扰与 kubelet 服务器交互的组件。

+

默认值：""

+
tlsPrivateKeyFile
string 		- tlsPrivateKeyFile is the file containing x509 private key matching tlsCertFile -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

tlsPrivateKeyFile是一个包含与tlsCertFile +证书匹配的 X509 私钥的文件。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能干扰与 kubelet 服务器交互的组件。

+

默认值：""

+
tlsCipherSuites
[]string 		- TLSCipherSuites is the list of allowed cipher suites for the server. + +

tlsCipherSuites是一个字符串列表，其中包含服务器所接受的加密包名称。 +列表中的每个值来自于tls包中定义的常数（https://golang.org/pkg/crypto/tls/#pkg-constants）。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能干扰到与 kubelet 服务器交互的组件。

+

默认值：nil

+
tlsMinVersion
string 		- TLSMinVersion is the minimum TLS version supported. + +

tlsMinVersion给出所支持的最小 TLS 版本。 +字段取值来自于tls包中的常数定义（https://golang.org/pkg/crypto/tls/#pkg-constants）。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能干扰到与 kubelet 服务器交互的组件。

+

默认值：""

+
rotateCertificates
bool 		- rotateCertificates enables client certificate rotation. The Kubelet will request a + +

rotateCertificates用来启用客户端证书轮换。kubelet 会调用 +certificates.k8s.io API 来请求新的证书。需要有一个批复人批准证书签名请求。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑禁用此行为时可能导致 kubelet 无法在当前证书过期时向 +API 服务器执行身份认证。

+

默认值：false +
serverTLSBootstrap
bool 		- serverTLSBootstrap enables server certificate bootstrap. Instead of self + +

serverTLSBootstrap用来启用服务器证书引导。系统不再使用自签名的服务证书， +kubelet 会调用certificates.k8s.io API 来请求证书。 +需要有一个批复人来批准证书签名请求（CSR）。 +设置此字段时，RotateKubeletServerCertificate特性必须被启用。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑禁用此特性会导致 kubelet 的服务器证书无法被续约， +长期上这会干扰到与 kubelet 服务器交互的组件，因为证书会过期。

+

默认值：false

+
authentication
KubeletAuthentication 		- authentication specifies how requests to the Kubelet's server are authenticated -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

authorization设置发送给 kubelet 服务器的请求是如何进行身份认证的。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能干扰与 kubelet 服务器交互的组件。

+

默认值：

+ 

+  anonymous:
+    enabled: false
+  webhook:
+    enabled: true
+    cacheTTL: "2m"
+
+
authorization
KubeletAuthorization 		- authorization specifies how requests to the Kubelet's server are authorized -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

authorization设置发送给 kubelet 服务器的请求是如何进行鉴权的。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能会干扰到与 kubelet 服务器交互的组件。

+

默认值：

+ 

+  mode: Webhook
+  webhook:
+    cacheAuthorizedTTL: "5m"
+    cacheUnauthorizedTTL: "30s"
+
+
registryPullQPS
int32 		- registryPullQPS is the limit of registry pulls per second. -Set to 0 for no limit. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

registryPullQPS是每秒钟可以执行的镜像仓库拉取操作限值。 +此值必须不能为负数。将其设置为 0 表示没有限值。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑这类更新可能会因为镜像拉取所产生的流量变化而导致集群可扩缩能力问题。

+

默认值：5 +
registryBurst
int32 		- registryBurst is the maximum size of bursty pulls, temporarily allows + +

registryBurst是突发性镜像拉取的上限值，允许镜像拉取临时上升到所指定数量， +不过仍然不超过registryPullQPS所设置的约束。此值必须是非负值。 +只有registryPullQPS参数值大于 0 时才会使用此设置。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能因为镜像拉取所造成的流量变化，导致集群可扩缩能力受影响。

+

默认值：10

+
eventRecordQPS
int32 		- eventRecordQPS is the maximum event creations per second. If 0, there -is no limit enforced. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

eventRecordQPS设置每秒钟可创建的事件个数上限。如果此值为 0， +则表示没有限制。此值不能设置为负数。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能因为生成事件所造成的流量变化，导致集群可扩缩能力受影响。

+

默认值：5

+
eventBurst
int32 		- eventBurst is the maximum size of a burst of event creations, temporarily + +

eventBurst是突发性事件创建的上限值，允许事件创建临时上升到所指定数量， +不过仍然不超过eventRecordQPS所设置的约束。此值必须是非负值， +且只有eventRecordQPS大于 0 时才会使用此设置。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能因为事件创建所造成的流量变化，导致集群可扩缩能力受影响。

+

默认值：10

+
enableDebuggingHandlers
bool 		- enableDebuggingHandlers enables server endpoints for log access + +

enableDebuggingHandlers启用服务器上用来访问日志、 +在本地运行容器和命令的端点，包括exec、attach、 +logs和portforward等功能。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑禁用此能力可能干扰到与 kubelet 服务器交互的组件。

+

默认值：true

+
enableContentionProfiling
bool 		- enableContentionProfiling enables lock contention profiling, if enableDebuggingHandlers is true. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

enableContentionProfiling用于启用锁竞争性能分析， +仅用于enableDebuggingHandlers为true的场合。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑启用此分析可能隐含着一定的性能影响。

+

默认值：false +
healthzPort
int32 		- healthzPort is the port of the localhost healthz endpoint (set to 0 to disable) -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

healthzPort是本地主机上提供healthz端点的端口 +（设置值为 0 时表示禁止）。合法值介于 1 和 65535 之间。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能干扰到监控 kubelet 健康状况的组件。

+

默认值：10248

+
healthzBindAddress
string 		- healthzBindAddress is the IP address for the healthz server to serve on -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

healthzBindAddress是healthz服务器用来提供服务的 IP 地址。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能影响到监测 kubelet 健康状况的组件。

+

默认值："127.0.0.1"

+
oomScoreAdj
int32 		- oomScoreAdj is The oom-score-adj value for kubelet process. Values + +

oomScoreAdj 是为 kubelet 进程设置的oom-score-adj值。 +所设置的取值要在 [-1000, 1000] 范围之内。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能影响到内存压力较大时节点的稳定性。

+

默认值：-999

+
clusterDomain
string 		- clusterDomain is the DNS domain for this cluster. If set, kubelet will + +

clusterDomain是集群的 DNS 域名。如果设置了此字段，kubelet +会配置所有容器，使之在搜索主机的搜索域的同时也搜索这里指定的 DNS 域。

+

DynamicKubeletConfig （已弃用，默认为关闭）： +不建议动态更新此字段，因为这一设置值要与整个集群中的其他组件保持一致。

+

默认值：""

+
clusterDNS
[]string 		- clusterDNS is a list of IP addresses for the cluster DNS server. If set, + +

clusterDNS是集群 DNS 服务器的 IP 地址的列表。 +如果设置了，kubelet 将会配置所有容器使用这里的 IP 地址而不是宿主系统上的 DNS +服务器来完成 DNS 解析。 +

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑变更仅会对更新后创建的 Pod 起作用。建议在更改此字段之前腾空节点。

+

默认值：nil

+
streamingConnectionIdleTimeout
meta/v1.Duration 		- streamingConnectionIdleTimeout is the maximum time a streaming connection + +

streamingConnectionIdleTimeout设置流式连接在被自动关闭之前可以空闲的最长时间。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能影响到依赖于通过与 kubelet +服务器间流式连接来接受非频繁更新事件的组件。

+

默认值："4h"

+
nodeStatusUpdateFrequency
meta/v1.Duration 		- nodeStatusUpdateFrequency is the frequency that kubelet computes node + +

nodeStatusUpdateFrequency是 kubelet 计算节点状态的频率。 +如果未启用节点租约特性，这一字段设置的也是 kubelet 向控制面投递节点状态的频率。

+

注意：如果节点租约特性未被启用，更改此参数设置时要非常小心， +所设置的参数值必须与节点控制器的nodeMonitorGracePeriod协同。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑变更可能影响节点的可扩缩性。还要注意节点控制器的 +nodeMonitorGracePeriod必须设置为N∗nodeStatusUpdateFrequency， +其中N是节点控制器标记节点不健康之前执行重试的次数。

+

默认值："10s"

+
nodeStatusReportFrequency
meta/v1.Duration 		- nodeStatusReportFrequency is the frequency that kubelet posts node + +

nodeStatusReportFrequency是节点状态未发生变化时，kubelet +向控制面更新节点状态的频率。如果节点状态发生变化，则 kubelet 会忽略这一频率设置， +立即更新节点状态。

+

此字段仅当启用了节点租约特性时才被使用。nodeStatusReportFrequency +的默认值是"5m"。不过，如果nodeStatusUpdateFrequency +被显式设置了，则nodeStatusReportFrequency的默认值会等于 +nodeStatusUpdateFrequency值，这是为了实现向后兼容。

+

默认值："5m"

+
nodeLeaseDurationSeconds
int32 		- nodeLeaseDurationSeconds is the duration the Kubelet will set on its corresponding Lease, -when the NodeLease feature is enabled. This feature provides an indicator of node -health by having the Kubelet create and periodically renew a lease, named after the node, -in the kube-node-lease namespace. If the lease expires, the node can be considered unhealthy. -The lease is currently renewed every 10s, per KEP-0009. In the future, the lease renewal interval -may be set based on the lease duration. -Requires the NodeLease feature gate to be enabled. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

nodeLeaseDurationSeconds是 kubelet 会在其对应的 Lease 对象上设置的时长值。 +NodeLease让 kubelet 来在kube-node-lease名字空间中创建 +按节点名称命名的租约并定期执行续约操作，并通过这种机制来了解节点健康状况。

+

如果租约过期，则节点可被视作不健康。根据 KEP-0009 约定，目前的租约每 10 秒钟续约一次。 +在将来，租约的续约时间间隔可能会根据租约的时长来设置。

+

此字段的取值必须大于零。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑缩短租约期限可能降低节点对那些暂时导致 kubelet +无法续约的问题的容忍度（例如，时延很短的网络问题）。

+

默认值：40

+
imageMinimumGCAge
meta/v1.Duration 		- imageMinimumGCAge is the minimum age for an unused image before it is -garbage collected. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that -it may trigger or delay garbage collection, and may change the image overhead -on the node. -Default: "2m"
imageGCHighThresholdPercent
int32 		- imageGCHighThresholdPercent is the percent of disk usage after which -image garbage collection is always run. The percent is calculated as -this field value out of 100. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

imageGCHighThresholdPercent所给的是镜像的磁盘用量百分数， +一旦镜像用量超过此阈值，则镜像垃圾收集会一直运行。百分比是用这里的值除以 100 +得到的，所以此字段取值必须介于 0 和 100 之间，包括 0 和 100。如果设置了此字段， +则取值必须大于imageGCLowThresholdPercent取值。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑这种变更可能触发垃圾收集或者延迟垃圾收集， +并且可能影响节点上镜像的额外开销。

+

默认值：85

+
imageGCLowThresholdPercent
int32 		- imageGCLowThresholdPercent is the percent of disk usage before which + +

imageGCLowThresholdPercent所给的是镜像的磁盘用量百分数， +镜像用量低于此阈值时不会执行镜像垃圾收集操作。垃圾收集操作也将此作为最低磁盘用量边界。 +百分比是用这里的值除以 100 得到的，所以此字段取值必须介于 0 和 100 之间，包括 0 和 100。 +如果设置了此字段，则取值必须小于imageGCHighThresholdPercent取值。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑这种变更可能触发垃圾收集或者延迟垃圾收集， +并且可能影响节点上镜像的额外开销。

+

默认值：80

+
volumeStatsAggPeriod
meta/v1.Duration 		- How frequently to calculate and cache volume disk usage for all pods -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

volumeStatsAggPeriod是计算和缓存所有 Pod 磁盘用量的频率。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑缩短此周期长度可能产生性能影响。

+

默认值："1m"

+
kubeletCgroups
string 		- kubeletCgroups is the absolute name of cgroups to isolate the kubelet in -Dynamic Kubelet Config (beta): This field should not be updated without a full node + +

kubeletCgroups是用来隔离 kubelet 的控制组（CGroup）的绝对名称。

+

DynamicKubeletConfig （已弃用）： +更新此字段时需要对整个节点执行重启。最安全的做法是确保此值与本地配置相同。

+

默认值：""

+
systemCgroups
string 		- systemCgroups is absolute name of cgroups in which to place + +

systemCgroups是用来放置那些未被容器化的、非内核的进程的控制组 +(CGroup）的绝对名称。设置为空字符串表示没有这类容器。回滚此字段设置需要重启节点。 +当此字段非空时，必须设置cgroupRoot字段。

+

DynamicKubeletConfig （已弃用）： +更新此字段时需要对整个节点执行重启。最安全的做法是确保此值与本地配置相同。

+

默认值：""

+
cgroupRoot
string 		- cgroupRoot is the root cgroup to use for pods. This is handled by the + +

cgroupRoot是用来运行 Pod 的控制组 (CGroup）。 +容器运行时会尽可能处理此字段的设置值。

+

DynamicKubeletConfig （已弃用）： +更新此字段时需要对整个节点执行重启。最安全的做法是确保此值与本地配置相同。

+

默认值：""

+
cgroupsPerQOS
bool 		- Enable QoS based Cgroup hierarchy: top level cgroups for QoS Classes -And all Burstable and BestEffort pods are brought up under their -specific top level QoS cgroup. -Dynamic Kubelet Config (beta): This field should not be updated without a full node + +

cgroupsPerQOS用来启用基于 QoS 的控制组（CGroup）层次结构： +顶层的控制组用于不同 QoS 类，所有Burstable和BestEffort Pod +都会被放置到对应的顶级 QoS 控制组下。

+

DynamicKubeletConfig （已弃用）： +更新此字段时需要对整个节点执行重启。最安全的做法是确保此值与本地配置相同。

+

默认值：true

+
cgroupDriver
string 		- driver that the kubelet uses to manipulate cgroups on the host (cgroupfs or systemd) -Dynamic Kubelet Config (beta): This field should not be updated without a full node + +

cgroupDriver是 kubelet 用来操控宿主系统上控制组 (CGroup） +的驱动程序（cgroupfs 或 systemd）。

+

DynamicKubeletConfig （已弃用）： +更新此字段时需要对整个节点执行重启。最安全的做法是确保此值与本地配置相同。

+

默认值："cgroupfs"

+
cpuManagerPolicy
string 		- CPUManagerPolicy is the name of the policy to use. + +

cpuManagerPolicy是要使用的策略名称。需要启用CPUManager +特性门控。

+

DynamicKubeletConfig （已弃用）： +更新此字段时需要对整个节点执行重启。最安全的做法是确保此值与本地配置相同。

+

默认值："None"

+
cpuManagerPolicyOptions
+map[string]string +		 + +

cpuManagerPolicyOptions是一组key=value键值映射， +容许通过额外的选项来精细调整 CPU 管理器策略的行为。需要CPUManager和 +CPUManagerPolicyOptions两个特性门控都被启用。

+

DynamicKubeletConfig （已弃用）： +更新此字段时需要对整个节点执行重启。最安全的做法是确保此值与本地配置相同。

+

默认值：nil

+
cpuManagerReconcilePeriod
meta/v1.Duration 		- CPU Manager reconciliation period. + +

cpuManagerReconcilePeriod是 CPU 管理器的协调周期时长。 +需要启用CPUManager特性门控。

+

DynamicKubeletConfig （已弃用）： +

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑缩短周期时长可能带来的性能影响。

+

默认值："10s"

+
memoryManagerPolicy
+string +		 + +

memoryManagerPolicy是内存管理器要使用的策略的名称。 +要求启用MemoryManager特性门控。

+

DynamicKubeletConfig （已弃用）： +更新此字段时需要对整个节点执行重启。最安全的做法是确保此值与本地配置相同。

+

默认值："none"

+
topologyManagerPolicy
string 		- TopologyManagerPolicy is the name of the policy to use. -Policies other than "none" require the TopologyManager feature gate to be enabled. -Dynamic Kubelet Config (beta): This field should not be updated without a full node + +

topologyManagerPolicy是要使用的拓扑管理器策略名称。合法值包括：

+
    +
  • restricted：kubelet 仅接受在所请求资源上实现最佳 NUMA 对齐的 Pod。
    • +
  • best-effort：kubelet 会优选在 CPU 和设备资源上实现 NUMA 对齐的 Pod。
    • +
  • none：kubelet 不了解 Pod CPU 和设备资源 NUMA 对齐需求。
    • +
  • single-numa-node：kubelet 仅允许在 CPU 和设备资源上对齐到同一 NUMA 节点的 Pod。
    • +
+

如果策略不是 "none"，则要求启用TopologyManager特性门控。

+

DynamicKubeletConfig （已弃用）： +更新此字段时需要对整个节点执行重启。最安全的做法是确保此值与本地配置相同。

+

默认值："none"

+
topologyManagerScope
string 		- TopologyManagerScope represents the scope of topology hint generation -that topology manager requests and hint providers generate. -"pod" scope requires the TopologyManager feature gate to be enabled. -Default: "container"
qosReserved
map[string]string 		- qosReserved is a set of resource name to percentage pairs that specify + +

qosReserved是一组从资源名称到百分比值的映射，用来为Guaranteed +QoS 类型的负载预留供其独占使用的资源百分比。目前支持的资源为："memory"。 +需要启用QOSReserved特性门控。

+

DynamicKubeletConfig （已弃用）： +更新此字段时需要对整个节点执行重启。最安全的做法是确保此值与本地配置相同。

+

默认值：nil

+
runtimeRequestTimeout
meta/v1.Duration 		- runtimeRequestTimeout is the timeout for all runtime requests except long running + +

runtimeRequestTimeout用来设置除长期运行的请求（pull、 +logs、exec和attach）之外所有运行时请求的超时时长。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能干扰与 kubelet 服务器交互的组件。

+

默认值："2m"

+
hairpinMode
string 		- hairpinMode specifies how the Kubelet should configure the container + +

hairpinMode设置 kubelet 如何为发夹模式数据包配置容器网桥。 +设置此字段可以让 Service 中的端点在尝试访问自身 Service 时将服务请求路由的自身。 +可选值有：

+ +
    +
  • "promiscuous-bridge"：将容器网桥设置为混杂模式。
    • +
  • "hairpin-veth"：在容器的 veth 接口上设置发夹模式标记。
    • +
  • "none"：什么也不做。
    • +
+ +

一般而言，用户必须设置--hairpin-mode=hairpin-veth才能实现发夹模式的网络地址转译 +（NAT），因为混杂模式的网桥要求存在一个名为cbr0的容器网桥。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑取决于网络插件，可能需要重启节点。

+

默认值："promiscuous-bridge"

+
maxPods
int32 		- maxPods is the number of pods that can run on this Kubelet. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

maxPods是此 kubelet 上课运行的 Pod 个数上限。此值必须为非负整数。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑变更可能导致 kubelet 重启时 Pod 无法被准入， +而且可能改变Node.status.capacity[v1.ResourcePods]中报告的数值， +从而影响将来的调度决策。增大此个数值也可能会降低性能，因为会有更多的 Pod +塞到同一节点运行。

+

默认值：110

+
podCIDR
string 		- The CIDR to use for pod IP addresses, only used in standalone mode. -In cluster mode, this is obtained from the master. -Dynamic Kubelet Config (beta): This field should always be set to the empty default. + +

podCIDR是用来设置 Pod IP 地址的 CIDR 值，仅用于独立部署模式。 +运行于集群模式时，这一数值会从控制面获得。

+

DynamicKubeletConfig （已弃用）： +此字段应该总是设置为默认的空字符串值。并且仅用来设置独立运行的 kubelet， +因为这种 kubelet 模式下无法利用动态 kubelet 配置能力。

+

默认值：""

+
podPidsLimit
int64 		- PodPidsLimit is the maximum number of pids in any pod. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

podPidsLimit是每个 Pod 中可使用的 PID 个数上限。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑减小此值可能会导致变更后无法创建容器进程。

+

默认值：-1

+
resolvConf
string 		- ResolverConfig is the resolver configuration file used as the basis + +

resolvConf是一个域名解析配置文件，用作容器 DNS 解析配置的基础。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑变更仅会对更新完成后所创建的 Pod 起作用。 +建议在变更此字段之前先腾空节点。如果此值设置为空字符串，则会覆盖 DNS 解析的默认配置， +本质上相当于禁用了 DNS 查询。

+

默认值："/etc/resolv.conf"

+
runOnce
bool 		- RunOnce causes the Kubelet to check the API server once for pods, + +

runOnce字段被设置时，kubelet 会咨询 API 服务器一次并获得 Pod 列表， +运行在静态 Pod 文件中指定的 Pod 及这里所获得的的 Pod，然后退出。

+

默认值：false

+
cpuCFSQuota
bool 		- cpuCFSQuota enables CPU CFS quota enforcement for containers that + +

cpuCFSQuota允许为设置了 CPU 限制的容器实施 CPU CFS 配额约束。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑禁止此功能可能会降低节点稳定性。

+

默认值：true

+
cpuCFSQuotaPeriod
meta/v1.Duration 		- CPUCFSQuotaPeriod is the CPU CFS quota period value, cpu.cfs_period_us. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

cpuCFSQuotaPeriod设置 CPU CFS 配额周期值，cpu.cfs_period_us。 +此值需要介于 1 微秒和 1 秒之间，包含 1 微秒和 1 秒。 +此功能要求启用CustomCPUCFSQuotaPeriod特性门控被启用。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑为容器所设置的限制值可能导致cpu.cfs_period_us +设置发生变化。这一变化会在节点被重新配置时触发容器重启。

+

默认值："100ms"

+
nodeStatusMaxImages
int32 		- nodeStatusMaxImages caps the number of images reported in Node.Status.Images. + +

nodeStatusMaxImages限制Node.status.images中报告的镜像数量。 +此值必须大于 -2。

+

注意：如果设置为 -1，则不会对镜像数量做限制；如果设置为 0，则不会返回任何镜像。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑节点状态中可能报告不同的数值。

+

默认值：50

+
maxOpenFiles
int64 		- maxOpenFiles is Number of files that can be opened by Kubelet process. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

maxOpenFiles是 kubelet 进程可以打开的文件个数。此值必须不能为负数。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能影响到 kubelet 与节点文件系统间交互的能力。

+

默认值：1000000

+
contentType
string 		- contentType is contentType of requests sent to apiserver. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

contentType是向 API 服务器发送请求时使用的内容类型。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑这样做可能影响 kubelet 与 API 服务器通信的能力。 +如果 kubelet 因为此字段的变更而失去与 API 服务器间的连接， +则之前所作的变更无法通过动态 kubelet 配置来实现回退。

+

默认值："application/vnd.kubernetes.protobuf"

+
kubeAPIQPS
int32 		- kubeAPIQPS is the QPS to use while talking with kubernetes apiserver -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

kubeAPIQPS设置与 Kubernetes API 服务器通信时要使用的 QPS（每秒查询数）。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑这可能因为 kubelet 与 API 服务器之间流量的变化而影响集群扩缩能力。

+

默认值：5

+
kubeAPIBurst
int32 		- kubeAPIBurst is the burst to allow while talking with kubernetes apiserver -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

kubeAPIBurst设置与 Kubernetes API 服务器通信时突发的流量级别。 +此字段取值不可以是负数。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑这可能因为 kubelet 与 API 服务器之间流量的变化而影响集群扩缩能力。

+

默认值：10

+
serializeImagePulls
bool 		- serializeImagePulls when enabled, tells the Kubelet to pull images one + +

serializeImagePulls被启用时会通知 kubelet 每次仅拉取一个镜像。 +我们建议不要在所运行的 docker 守护进程版本低于 1.9、使用 aufs +存储后端的节点上更改默认值。详细信息可参见 Issue #10959。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑这可能会影响镜像拉取的性能。

+

默认值：true

+
evictionHard
map[string]string 		- Map of signal names to quantities that defines hard eviction thresholds. For example: {"memory.available": "300Mi"}. + +

evictionHard是一个映射，是从信号名称到定义硬性驱逐阈值的映射。 +例如：{"memory.available": "300Mi"}。 +如果希望显式地禁用，可以在任意资源上将其阈值设置为 0% 或 100%。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑这可能会触发或延迟 Pod 驱逐操作。

+

默认值：

+ 
+  memory.available:  "100Mi"
+  nodefs.available:  "10%"
+  nodefs.inodesFree: "5%"
+  imagefs.available: "15%"
+
+
evictionSoft
map[string]string 		- Map of signal names to quantities that defines soft eviction thresholds. -For example: {"memory.available": "300Mi"}. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

evictionSoft是一个映射，是从信号名称到定义软性驱逐阈值的映射。 +例如：{"memory.available": "300Mi"}。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑这可能会触发或延迟 Pod 驱逐操作， +并且可能造成节点所报告的可分配资源数量发生变化。

+

默认值：nil

+
evictionSoftGracePeriod
map[string]string 		- Map of signal names to quantities that defines grace periods for each soft eviction signal. -For example: {"memory.available": "30s"}. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

evictionSoftGracePeriod是一个映射，是从信号名称到每个软性驱逐信号的宽限期限。 +例如：{"memory.available": "30s"}。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑这可能会触发或延迟 Pod 驱逐操作。

+

默认值：nil

+
evictionPressureTransitionPeriod
meta/v1.Duration 		- Duration for which the kubelet has to wait before transitioning out of an eviction pressure condition. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

evictionPressureTransitionPeriod设置 kubelet +离开驱逐压力状况之前必须要等待的时长。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑减少此字段值可能会在节点过量分配时降低节点稳定性。

+

默认值："5m"

+
evictionMaxPodGracePeriod
int32 		- Maximum allowed grace period (in seconds) to use when terminating pods in -response to a soft eviction threshold being met. This value effectively caps -the Pod's TerminationGracePeriodSeconds value during soft evictions. + +

evictionMaxPodGracePeriod是指达到软性逐出阈值而引起 Pod 终止时， +可以赋予的宽限期限最大值（按秒计）。这个值本质上限制了软性逐出事件发生时， +Pod 可以获得的terminationGracePeriodSeconds。

+

注意：由于 Issue #64530 的原因，系统中存在一个缺陷，即此处所设置的值会在软性逐出时覆盖 +Pod 的宽限期设置，从而有可能增加 Pod 上原本设置的宽限期限时长。 +这个缺陷会在未来版本中修复。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑缩短此宽限期限值会导致软性逐出期间 Pod +在被杀死之前用来体面地完成清理工作可用的时间。

+

默认值：0

+
evictionMinimumReclaim
map[string]string 		- Map of signal names to quantities that defines minimum reclaims, which describe the minimum -amount of a given resource the kubelet will reclaim when performing a pod eviction while -that resource is under pressure. For example: {"imagefs.available": "2Gi"} -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

evictionMinimumReclaim是一个映射，定义信号名称与最小回收量数值之间的关系。 +最小回收量指的是资源压力较大而执行 Pod 驱逐操作时，kubelet 对给定资源的最小回收量。 +例如：{"imagefs.available": "2Gi"}。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑这可能会改变驱逐操作应对资源压力的效果。

+

默认值：nil

+
podsPerCore
int32 		- podsPerCore is the maximum number of pods per core. Cannot exceed MaxPods. -If 0, this field is ignored. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

podsPerCore设置的是每个核上 Pod 个数上限。此值不能超过maxPods。 +所设值必须是非负整数。如果设置为 0，则意味着对 Pod 个数没有限制。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑变更可能导致 kubelet 重启时 Pod 无法被准入， +还可能导致Node.status.capacity.pods所报告的数值发生变化， +进而影响到将来的调度决策。增大此值也会降低性能，因为在同一个处理器核上需要运行更多的 Pod。

+

默认值：0

+
enableControllerAttachDetach
bool 		- enableControllerAttachDetach enables the Attach/Detach controller to + +

enableControllerAttachDetach用来允许 Attach/Detach +控制器管理调度到本节点的卷的挂接（attachment）和解除挂接（detachement）， +并且禁止 kubelet 执行任何 attach/detach 操作。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑在运行中的节点上更改由哪个组件来负责卷管理时， +这一变更可能导致节点在被更新前尚未腾空时卷无法被解除挂接。 +如果 kubelet 尚未更新volumes.kubernetes.io/controller-managed-attach-detach +注解时 Pod 已经被调度到了该节点，节点上的卷也会无法解除挂接。 +一般而言，最安全的做法是将此字段设置为与本地配置相同的值。

+

默认值：true

+
protectKernelDefaults
bool 		- protectKernelDefaults, if true, causes the Kubelet to error if kernel + +

protectKernelDefaults设置为true时，会令 kubelet +在发现内核参数与预期不符时出错退出。若此字段设置为false，则 kubelet +会尝试更改内核参数以满足其预期。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑启用此设置会在内核参数与 kubelet 预期不匹配时导致 +kubelet 进入崩溃循环（Crash-Loop）状态。

+

默认值：false

+
makeIPTablesUtilChains
bool 		- If true, Kubelet ensures a set of iptables rules are present on host. -These rules will serve as utility rules for various components, e.g. KubeProxy. -The rules will be created based on IPTablesMasqueradeBit and IPTablesDropBit. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

makeIPTablesUtilChains设置为true时，相当于允许 kubelet +确保一组 iptables 规则存在于宿主机上。这些规则会为不同的组件（例如 kube-proxy） +提供工具性质的规则。它们是基于iptablesMasqueradeBit和iptablesDropBit +来创建的。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑禁用此行为会导致 kubelet 无法在本地 iptables +规则出错时实现自愈。

+

默认值：true

+
iptablesMasqueradeBit
int32 		- iptablesMasqueradeBit is the bit of the iptables fwmark space to mark for SNAT + +

iptablesMasqueradeBit是 iptables fwmark 空间中用来为 SNAT +作标记的位。此值必须介于[0, 31]区间，必须与其他标记位不同。

+

警告：请确保此值设置与 kube-proxy 中对应的参数设置取值相同。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑此处的变更要与其他组件（如 kube-proxy）相应的变更协调一致。 +只有当makeIPTablesUtilChains能力被启用时，这里的更新才会起作用。

+

默认值：14

+
iptablesDropBit
int32 		- iptablesDropBit is the bit of the iptables fwmark space to mark for dropping packets. + +

iptablesDropBit是 iptables fwmark 空间中用来标记丢弃包的数据位。 +此值必须介于[0, 31]区间，必须与其他标记位不同。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑此处的变更要与其他组件（如 kube-proxy）相应的变更协调一致。 +只有当makeIPTablesUtilChains能力被启用时，这里的更新才会起作用。

+

默认值：15

+
featureGates
map[string]bool 		- featureGates is a map of feature names to bools that enable or disable alpha/experimental + +

featureGates是一个从功能特性名称到布尔值的映射，用来启用或禁用实验性的功能。 +此字段可逐条更改文件 "k8s.io/kubernetes/pkg/features/kube_features.go" +中所给的内置默认值。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑你所启用或禁止的功能特性的文档。 +尽管我们鼓励功能特性的开发人员使动态启用或禁用功能特性成为可能， +某些变更可能要求重新启动节点，某些特性可能要求在从启用到禁用切换时作出精细的协调。

+

默认值：nil

+
failSwapOn
bool 		- failSwapOn tells the Kubelet to fail to start if swap is enabled on the node. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

failSwapOn通知 kubelet 在节点上启用交换分区时拒绝启动。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑缩短此周期长度可能产生性能影响。

+

默认值：true

+
memorySwap
+MemorySwapConfiguration +		 + +

memorySwap配置容器负载可用的交换内存。

+
containerLogMaxSize
string 		- A quantity defines the maximum size of the container log file before it is rotated. -For example: "5Mi" or "256Ki". -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

containerLogMaxSize是定义容器日志文件被轮转之前可以到达的最大尺寸。 +例如："5Mi" 或 "256Ki"。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能会触发日志轮转。

+

默认值："10Mi"

+
containerLogMaxFiles
int32 		- Maximum number of container log files that can be present for a container. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

containerLogMaxFiles设置每个容器可以存在的日志文件个数上限。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑降低此值可能导致日志文件被删除。

+

默认值："5"

+
configMapAndSecretChangeDetectionStrategy
ResourceChangeDetectionStrategy 		- ConfigMapAndSecretChangeDetectionStrategy is a mode in which -config map and secret managers are running. -Default: "Watch"
systemReserved
map[string]string 		- systemReserved is a set of ResourceName=ResourceQuantity (e.g. cpu=200m,memory=150G) + +

systemReserved是一组资源名称=资源数量对， +用来描述为非 Kubernetes 组件预留的资源（例如：'cpu=200m,memory=150G'）。

+

目前仅支持 CPU 和内存。更多细节可参见 http://kubernetes.io/zh/docs/user-guide/compute-resources。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑增加预留资源也许是不可能的，因为需要改变控制组大小。 +在更改了此字段之后，应该总是关注NodeAllocatableEnforced事件， +以确保更新是成功的。

+

默认值：Nil

+
kubeReserved
map[string]string 		- A set of ResourceName=ResourceQuantity (e.g. cpu=200m,memory=150G) pairs + +

kubeReserved是一组资源名称=资源数量对， +用来描述为 Kubernetes 系统组件预留的资源（例如：'cpu=200m,memory=150G'）。 +目前支持 CPU、内存和根文件系统的本地存储。 +更多细节可参见 https://kubernetes.io/zh/docs/concepts/configuration/manage-resources-containers/。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑增加预留资源也许是不可能的，因为需要改变控制组大小。 +在更改了此字段之后，应该总是关注NodeAllocatableEnforced事件， +以确保更新是成功的。

+

默认值：Nil

+
reservedSystemCPUs [Required]
+ +
reservedSystemCPUs [必需]
string 		- This ReservedSystemCPUs option specifies the cpu list reserved for the host level system threads and kubernetes related threads. -This provide a "static" CPU list rather than the "dynamic" list by system-reserved and kube-reserved. -This option overwrites CPUs provided by system-reserved and kube-reserved.
showHiddenMetricsForVersion
string 		- The previous version for which you want to show hidden metrics. + +

showHiddenMetricsForVersion是你希望显示隐藏度量值的上一版本。 +只有上一个次版本是有意义的，其他值都是不允许的。 +字段值的格式为<major>.<minor>，例如：1.16。 +此格式的目的是为了确保在下一个版本中有新的度量值被隐藏时，你有机会注意到这类变化， +而不是当这些度量值在其后的版本中彻底去除时来不及应对。

+

默认值：""

+
systemReservedCgroup
string 		- This flag helps kubelet identify absolute name of top level cgroup used to enforce `SystemReserved` compute resource reservation for OS system daemons. -Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) doc for more information. -Dynamic Kubelet Config (beta): This field should not be updated without a full node + +

systemReservedCgroup帮助 kubelet 识别用来为 OS 系统级守护进程实施 +systemReserved计算资源预留时使用的顶级控制组（CGroup）。 +参考[Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) +以了解详细信息。

+

DynamicKubeletConfig（已弃用）： +此字段更新时需要整个节点重启。最安全的做法是保持此值与本地配置相同。

+

默认值：""

+
kubeReservedCgroup
string 		- This flag helps kubelet identify absolute name of top level cgroup used to enforce `KubeReserved` compute resource reservation for Kubernetes node system daemons. -Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) doc for more information. -Dynamic Kubelet Config (beta): This field should not be updated without a full node + +

kubeReservedCgroup 帮助 kubelet 识别用来为 Kubernetes 节点系统级守护进程实施 +kubeReserved计算资源预留时使用的顶级控制组（CGroup）。 +参阅Node Allocatable +了解进一步的信息。

+

DynamicKubeletConfig（已弃用）： +此字段更新时需要整个节点重启。最安全的做法是保持此值与本地配置相同。

+

默认值：""

+
enforceNodeAllocatable
[]string 		- This flag specifies the various Node Allocatable enforcements that Kubelet needs to perform. -This flag accepts a list of options. Acceptable options are `none`, `pods`, `system-reserved` & `kube-reserved`. -If `none` is specified, no other options may be specified. -Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) doc for more information. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

此标志设置 kubelet 需要执行的各类节点可分配资源策略。此字段接受一组选项列表。 +可接受的选项有none、pods、system-reserved和 +kube-reserved。

+

如果设置了none，则字段值中不可以包含其他选项。

+

如果列表中包含system-reserved，则必须设置systemReservedCgroup。

+

如果列表中包含kube-reserved，则必须设置kubeReservedCgroup。

+

这个字段只有在cgroupsPerQOS被设置为true才被支持。

+

参阅Node Allocatable +了解进一步的信息。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑去掉此机制可能会降低节点稳定性。 +反之，添加此机制可能会降低原来使用资源超出预留量的组件的稳定性。 +例如，实施 kube-reserved 在 kubelet 使用资源超出预留量时可能导致 kubelet 发生 OOM， +而实施 system-reserved 机制可能导致使用资源超出预留量的系统守护进程发生 OOM。

+

默认值：["pods"]

+
allowedUnsafeSysctls
[]string 		- A comma separated whitelist of unsafe sysctls or sysctl patterns (ending in ∗). -Unsafe sysctl groups are kernel.shm∗, kernel.msg∗, kernel.sem, fs.mqueue.∗, and net.∗. -These sysctls are namespaced but not allowed by default. For example: "kernel.msg∗,net.ipv4.route.min_pmtu" -Default: []
volumePluginDir
string 		- volumePluginDir is the full path of the directory in which to search + +

volumePluginDir是用来搜索其他第三方卷插件的目录的路径。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑更改volumePluginDir可能干扰使用第三方卷插件的负载。

+

默认值："/usr/libexec/kubernetes/kubelet-plugins/volume/exec/"

+
providerID
string 		- providerID, if set, sets the unique id of the instance that an external provider (i.e. cloudprovider) -can use to identify a specific node. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

providerID字段被设置时，指定的是一个外部提供者（即云驱动）实例的唯一 ID， +该提供者可用来唯一性地标识特定节点。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑可能影响到 kubelet 与云驱动之间进行交互的能力。

+

默认值：""

+
kernelMemcgNotification
bool 		- kernelMemcgNotification, if set, the kubelet will integrate with the kernel memcg notification -to determine if memory eviction thresholds are crossed rather than polling. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + +

kernelMemcgNotification字段如果被设置了，会告知 kubelet 集成内核的 +memcg 通知机制来确定是否超出内存逐出阈值，而不是使用轮询机制来判定。

+

当 DynamicKubeletConfig （已弃用，默认为关闭）被启用时， +如果动态更新了此字段，请考虑这样做可能影响到 kubelet 与内核的交互方式。

+

默认值：false

+
logging [Required]
+ +
logging [必需]
LoggingConfiguration 		- Logging specifies the options of logging. -Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. -Defaults: - Format: text
enableSystemLogHandler
bool 		- enableSystemLogHandler enables system logs via web interface host:port/logs/ -Default: true
shutdownGracePeriod
meta/v1.Duration 		- ShutdownGracePeriod specifies the total duration that the node should delay the shutdown and total grace period for pod termination during a node shutdown. -Default: "30s"
shutdownGracePeriodCriticalPods
meta/v1.Duration 		- ShutdownGracePeriodCriticalPods specifies the duration used to terminate critical pods during a node shutdown. This should be less than ShutdownGracePeriod. -For example, if ShutdownGracePeriod=30s, and ShutdownGracePeriodCriticalPods=10s, during a node shutdown the first 20 seconds would be reserved for gracefully terminating normal pods, and the last 10 seconds would be reserved for terminating critical pods. -Default: "10s"
shutdownGracePeriodByPodPriority
+[]ShutdownGracePeriodByPodPriority +		 + +

shutdownGracePeriodByPodPriority设置基于 Pod +相关的优先级类值而确定的体面关闭时间。当 kubelet 收到关闭请求的时候，kubelet +会针对节点上运行的所有 Pod 发起关闭操作，这些关闭操作会根据 Pod 的优先级确定其宽限期限， +之后 kubelet 等待所有 Pod 退出。

+

数组中的每个表项代表的是节点关闭时 Pod 的体面终止时间；这里的 Pod +的优先级类介于列表中当前优先级类值和下一个表项的优先级类值之间。

+

例如，要赋予关键 Pod 10 秒钟时间来关闭，赋予优先级>=10000 Pod 20 秒钟时间来关闭， +赋予其余的 Pod 30 秒钟来关闭。

+

shutdownGracePeriodByPodPriority:

+
    +
  • priority: 2000000000 + shutdownGracePeriodSeconds: 10
    • +
  • priority: 10000 + shutdownGracePeriodSeconds: 20
    • +
  • priority: 0 + shutdownGracePeriodSeconds: 30
    • +
+

在退出之前，kubelet 要等待的时间上限为节点上所有优先级类的 +shutdownGracePeriodSeconds的最大值。 +当所有 Pod 都退出或者到达其宽限期限时，kubelet 会释放关闭防护锁。 +此功能要求GracefulNodeShutdown特性门控被启用。

+

当shutdownGracePeriod或shutdownGracePeriodCriticalPods +被设置时，此配置字段必须为空。

+

默认值：nil

+
reservedMemory
+[]MemoryReservation +		 + +

reservedMemory给出一个逗号分隔的列表，为 NUMA 节点预留内存。

+

此参数仅在内存管理器功能特性语境下有意义。内存管理器不会为容器负载分配预留内存。 +例如，如果你的 NUMA0 节点内存为 10Gi，reservedMemory设置为在 NUMA0 +上预留 1Gi 内存，内存管理器会认为其上只有 9Gi 内存可供分配。

+

你可以设置不同数量的 NUMA 节点和内存类型。你也可以完全忽略这个字段，不过你要清楚， +所有 NUMA 节点上预留内存的总量要等于通过 +node allocatable +设置的内存量。

+

如果至少有一个节点可分配参数设置值非零，则你需要设置至少一个 NUMA 节点。

+

此外，避免如下设置：

+
    +
  1. 在配置值中存在重复项，NUMA 节点和内存类型相同，但配置值不同，这是不允许的。
    2. +
  2. 为任何内存类型设置限制值为零。
    3. +
  3. NUMA 节点 ID 在宿主系统上不存在。/li> +
  4. 除memory和hugepages-<size>之外的内存类型。
    5. +
+

默认值：nil

+
enableProfilingHandler
+bool +		 + +

enableProfilingHandler启用通过 host:port/debug/pprof/ 接口来执行性能分析。

+

默认值：true

+
enableDebugFlagsHandler
+bool +		 + +

enableDebugFlagsHandler启用通过 host:port/debug/flags/v Web +接口上的标志设置。

+

默认值：true

+
seccompDefault
+bool +		 + +

seccompDefault字段允许针对所有负载将RuntimeDefault +设置为默认的 seccomp 配置。这一设置要求对应的SeccompDefault特性门控被启用。

+

默认值：false

+
memoryThrottlingFactor
+float64 +		 + +

当设置 cgroupv2 memory.high以实施MemoryQoS特性时， +memoryThrottlingFactor用来作为内存限制或节点可分配内存的系数。

+

减小此系数会为容器控制组设置较低的 high 限制值，从而增大回收压力；反之， +增大此系数会降低回收压力。更多细节参见 http://kep.k8s.io/2570。

+

默认值：0.8

+
registerWithTaints
+[]core/v1.Taint +		 + +

registerWithTaints是一个由污点组成的数组，包含 kubelet +注册自身时要向节点对象添加的污点。只有registerNode为true +时才会起作用，并且仅在节点的最初注册时起作用。

+

默认值：nil

+
registerNode
+bool +		 + +

registerNode启用向 API 服务器的自动注册。

+

默认值：true

+
- - ## `SerializedNodeConfigSource` {#kubelet-config-k8s-io-v1beta1-SerializedNodeConfigSource} - - - - + +SerializedNodeConfigSource 允许对 `v1.NodeConfigSource` 执行序列化操作。 +这一类型供 kubelet 内部使用，以便跟踪动态配置的检查点。 +此资源存在于 kubeletconfig API 组是因为它被当做是对 kubelet 的一种版本化输入。 - + - + - - - + +

source是我们执行序列化的数据源。

+ - - +
FieldDescription
字段描述
apiVersion
string		kubelet.config.k8s.io/v1beta1
kind
string		SerializedNodeConfigSource
source
-core/v1.NodeConfigSource +core/v1.NodeConfigSource 		- Source is the source that we are serializing
- - - -## `HairpinMode` {#kubelet-config-k8s-io-v1beta1-HairpinMode} - -(Alias of `string`) - - - -HairpinMode denotes how the kubelet should configure networking to handle -hairpin packets. - - - - ## `KubeletAnonymousAuthentication` {#kubelet-config-k8s-io-v1beta1-KubeletAnonymousAuthentication} - - - + +**出现在：** - [KubeletAuthentication](#kubelet-config-k8s-io-v1beta1-KubeletAuthentication) - - - - + - - + +

enabled允许匿名用户向 kubelet 服务器发送请求。 +未被其他身份认证方法拒绝的请求都会被当做匿名请求。 +匿名请求对应的用户名为system:anonymous，对应的用户组名为 +system:unauthenticated。

+ - -
FieldDescription
字段描述
enabled
bool 		- enabled allows anonymous requests to the kubelet server. -Requests that are not rejected by another authentication method are treated as anonymous requests. -Anonymous requests have a username of system:anonymous, and a group name of system:unauthenticated.
- - ## `KubeletAuthentication` {#kubelet-config-k8s-io-v1beta1-KubeletAuthentication} - - - + +**出现在：** - [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) - - - - + - - + +

x509包含与 x509 客户端证书认证相关的配置。

+ - - + + +

webhook包含与 Webhook 持有者令牌认证相关的配置。

+ - - + + +

anonymous包含与匿名身份认证相关的配置信息。

+ - -
FieldDescription
字段描述
x509
KubeletX509Authentication 		- x509 contains settings related to x509 client certificate authentication
webhook
KubeletWebhookAuthentication 		- webhook contains settings related to webhook bearer token authentication
anonymous
KubeletAnonymousAuthentication 		- anonymous contains settings related to anonymous authentication
- - ## `KubeletAuthorization` {#kubelet-config-k8s-io-v1beta1-KubeletAuthorization} - - - + +**出现在：** - [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) - - - - + - - + +

mode>是应用到 kubelet 服务器所接收到的请求上的鉴权模式。合法值包括 +AlwaysAllow和Webhook。 +Webhook 模式使用 SubjectAccessReview API 来确定鉴权。

+ - - + + +

webhook包含与 Webhook 鉴权相关的配置信息。

+ - -
FieldDescription
字段描述
mode
KubeletAuthorizationMode 		- mode is the authorization mode to apply to requests to the kubelet server. -Valid values are AlwaysAllow and Webhook. -Webhook mode uses the SubjectAccessReview API to determine authorization.
webhook
KubeletWebhookAuthorization 		- webhook contains settings related to Webhook authorization.
- - ## `KubeletAuthorizationMode` {#kubelet-config-k8s-io-v1beta1-KubeletAuthorizationMode} - + + +（`string` 类型的别名） - + +**出现在：** - [KubeletAuthorization](#kubelet-config-k8s-io-v1beta1-KubeletAuthorization) - - - - - - - ## `KubeletWebhookAuthentication` {#kubelet-config-k8s-io-v1beta1-KubeletWebhookAuthentication} - - - + +**出现在：** - [KubeletAuthentication](#kubelet-config-k8s-io-v1beta1-KubeletAuthentication) - - - - + - - + +

enabled允许使用tokenreviews.authentication.k8s.io +API 来提供持有者令牌身份认证。

+ - - + + +

cacheTTL启用对身份认证结果的缓存。

+ - -
FieldDescription
字段描述
enabled
bool 		- enabled allows bearer token authentication backed by the tokenreviews.authentication.k8s.io API
cacheTTL
meta/v1.Duration 		- cacheTTL enables caching of authentication results
- - ## `KubeletWebhookAuthorization` {#kubelet-config-k8s-io-v1beta1-KubeletWebhookAuthorization} - - - + +**出现在：** - [KubeletAuthorization](#kubelet-config-k8s-io-v1beta1-KubeletAuthorization) - - - - + - - + +

cacheAuthorizedTTL设置来自 Webhook 鉴权组件的 'authorized' +响应的缓存时长。

+ - - + +

cacheUnauthorizedTTL设置来自 Webhook 鉴权组件的 'unauthorized' +响应的缓存时长。

+ - -
FieldDescription
字段描述
cacheAuthorizedTTL
meta/v1.Duration 		- cacheAuthorizedTTL is the duration to cache 'authorized' responses from the webhook authorizer.
cacheUnauthorizedTTL
meta/v1.Duration 		- cacheUnauthorizedTTL is the duration to cache 'unauthorized' responses from the webhook authorizer.
- - ## `KubeletX509Authentication` {#kubelet-config-k8s-io-v1beta1-KubeletX509Authentication} - - - + +**出现在：** - [KubeletAuthentication](#kubelet-config-k8s-io-v1beta1-KubeletAuthentication) - - - - + - - + +

clientCAFile是一个指向 PEM 编发的证书包的路径。 +如果设置了此字段，则能够提供由此证书包中机构之一所签名的客户端证书的请求会被成功认证， +并且其用户名对应于客户端证书的CommonName、组名对应于客户端证书的 +Organization。

+ - -
FieldDescription
字段描述
clientCAFile
string 		- clientCAFile is the path to a PEM-encoded certificate bundle. If set, any request presenting a client certificate -signed by one of the authorities in the bundle is authenticated with a username corresponding to the CommonName, -and groups corresponding to the Organization in the client certificate.
- - - -## `ResourceChangeDetectionStrategy` {#kubelet-config-k8s-io-v1beta1-ResourceChangeDetectionStrategy} - -(Alias of `string`) +## `MemoryReservation` {#kubelet-config-k8s-io-v1beta1-MemoryReservation} + +**出现在：** - [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) - -ResourceChangeDetectionStrategy denotes a mode in which internal -managers (secret, configmap) are discovering object changes. - - - - - - - -## `LoggingConfiguration` {#LoggingConfiguration} - - - - -**Appears in:** - -- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) - - -LoggingConfiguration contains logging options -Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. + +MemoryReservation 为每个 NUMA 节点设置不同类型的内存预留。 - + - - - + + + + + + + +
FieldDescription
字段描述
format [Required]
+
numaNode [必需]
+int32 +		 + +

NUMA 节点

+
limits [必需]
+core/v1.ResourceList +		 + +

资源列表

+
+ +## `MemorySwapConfiguration` {#kubelet-config-k8s-io-v1beta1-MemorySwapConfiguration} + + +**出现在：** + +- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) + + + + + + + +

swapBehavior配置容器负载可以使用的交换内存。可以是 +

    +
  • ""、"LimitedSwap"：工作负载的内存和交换分区总用量不能超过 Pod 的内存限制；
    • +
  • "UnlimitedSwap"：工作负载可以无限制地使用交换分区，上限是可分配的约束。
    • +
+ - - - +
字段描述
swapBehavior
string 		- Format Flag specifies the structure of log messages. -default value of format is `text`
sanitization [Required]
+
+ +## `ResourceChangeDetectionStrategy` {#kubelet-config-k8s-io-v1beta1-ResourceChangeDetectionStrategy} + + +（`string` 类型的别名） + + +**出现在：** + +- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) + + +ResourceChangeDetectionStrategy 给出的是内部管理器（ConfigMap、Secret） +用来发现对象变化的模式。 + +## `ShutdownGracePeriodByPodPriority` {#kubelet-config-k8s-io-v1beta1-ShutdownGracePeriodByPodPriority} + + +**出现在：** + +- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) + + +ShutdownGracePeriodByPodPriority 基于 Pod 关联的优先级类数值来为其设置关闭宽限时间。 + + + + + + + + + + + + + +
字段描述
priority [必需]
+int32 +		 + +

priority是与关闭宽限期限相关联的优先级值。

+
shutdownGracePeriodSeconds [必需]
+int64 +		 + +

shutdownGracePeriodSeconds是按秒数给出的关闭宽限期限。 +

+ +## `FormatOptions` {#FormatOptions} + + +**出现在：** + +- [LoggingConfiguration](#LoggingConfiguration) + +

+ +FormatOptions 包含为不同日志格式提供的选项。 +

+ + + + + + + + + +
字段描述
json [必需]
+JSONOptions +		 +

+ [试验功能] json 包含为 "json" 日志格式提供的选项。 +

+
+ +## `JSONOptions` {#JSONOptions} + + +**出现在：** + +- [FormatOptions](#FormatOptions) + +

+ +JSONOptions 包含为 "json" 日志格式提供的选项。 +

+ + + + + +

+ + [试验功能] splitStream 将错误信息重定向到标准错误输出（stderr）， +而将提示信息重定向到标准输出（stdout），并为二者提供缓存。 +默认设置是将二者都写出到标准输出，并且不提供缓存。 +

+ + + + + - -
字段描述
splitStream [必需]
bool 		- [Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). -Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)
infoBufferSize [必需]
+k8s.io/apimachinery/pkg/api/resource.QuantityValue +		 +

+ + [试验功能] infoBufferSize 在分离数据流时用来设置提示数据流的大小。 +默认值为 0，相当于禁止缓存。 +

+
+ +## `LoggingConfiguration` {#LoggingConfiguration} + + +**出现在：** + +- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) + + +LoggingConfiguration 包含日志选项。 +参考 [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) +以了解更多信息。 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
字段描述
format [必需]
+string +		 +

+ + format 设置日志消息的结构。默认的格式取值为 text。 +

+
flushFrequency [必需]
+time.Duration +		 +

+ + 对日志进行清洗的最大间隔秒数。如果所选的日志后端在写入日志消息时不提供缓存， +则此配置会被忽略。 +

+
verbosity [必需]
+uint32 +		 +

+ + verbosity 用来确定日志消息记录的详细程度阈值。默认值为 0， +意味着仅记录最重要的消息。数值越大，额外的消息越多。出错消息总是会被记录下来。 +

+
vmodule [必需]
+VModuleConfiguration +		 +

+ + vmodule 会在单个文件层面重载 verbosity 阈值的设置。 +这一选项仅支持 "text" 日志格式。 +

+
sanitization [必需]
+bool +		 +

+ + [试验功能] 当启用此选项时，被标记为敏感的字段（密码、秘钥、令牌）不会被日志记录。 +运行时日志过滤功能可能会引入非常大的计算开销，因此在生产环境中不应启用。 +

+
options [必需]
+FormatOptions +		 +

+ + [试验功能] options 中包含特定于不同日志格式的配置参数。 +只有针对所选格式的选项会被使用，但是合法性检查时会查看所有选项配置。 +

+
+ +## `VModuleConfiguration` {#VModuleConfiguration} + + +（`[]k8s.io/component-base/config/v1alpha1.VModuleItem` 类型的别名） + + +**出现在：** + +- [LoggingConfiguration](#LoggingConfiguration) + + +VModuleConfiguration 是一个集合，其中包含一个个文件名（或文件名模式） +及其对应的详细程度阈值。 + From 50e01a032a83eb19f2da7094b67dcb39884c1c9d Mon Sep 17 00:00:00 2001 From: Onur Date: Mon, 18 Apr 2022 09:28:49 +0300 Subject: [PATCH 006/101] Update content/en/docs/concepts/services-networking/ingress.md Co-authored-by: Qiming Teng --- content/en/docs/concepts/services-networking/ingress.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/services-networking/ingress.md b/content/en/docs/concepts/services-networking/ingress.md index 413142f90d..da3ad5c6b4 100644 --- a/content/en/docs/concepts/services-networking/ingress.md +++ b/content/en/docs/concepts/services-networking/ingress.md @@ -74,7 +74,7 @@ A minimal Ingress resource example: {{< codenew file="service/networking/minimal-ingress.yaml" >}} -As with all other Kubernetes resources, an Ingress needs `apiVersion`, `kind`, `metadata` and `spec` fields. +An Ingress needs `apiVersion`, `kind`, `metadata` and `spec` fields. The name of an Ingress object must be a valid [DNS subdomain name](/docs/concepts/overview/working-with-objects/names#dns-subdomain-names). For general information about working with config files, see [deploying applications](/docs/tasks/run-application/run-stateless-application-deployment/), [configuring containers](/docs/tasks/configure-pod-container/configure-pod-configmap/), [managing resources](/docs/concepts/cluster-administration/manage-deployment/). From 6ce860aa8974efa24e104ca24d4397e207d9bdea Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Mon, 18 Apr 2022 20:33:27 +0800 Subject: [PATCH 007/101] [zh] Update deprecation-policy.md Signed-off-by: xin.li --- .../reference/using-api/deprecation-policy.md | 67 ++++++++----------- 1 file changed, 27 insertions(+), 40 deletions(-) diff --git a/content/zh/docs/reference/using-api/deprecation-policy.md b/content/zh/docs/reference/using-api/deprecation-policy.md index 95e6c0c4e5..e78ae5619d 100644 --- a/content/zh/docs/reference/using-api/deprecation-policy.md +++ b/content/zh/docs/reference/using-api/deprecation-policy.md @@ -142,37 +142,41 @@ might have to add an equivalent field or represent it as an annotation. 添加一个新的等效字段或者将其表现为一个注解。 -**规则 #3：给定类别的 API 版本在新的、稳定性未降低的 API 版本发布之前不可被废弃。** +**规则 #3：给定类别的 API 版本不可被弃用以支持稳定性更差的 API 版本。** -一个正式发布的（GA）API 版本可替换现有的正式 API 版本或 alpha、beta API 版本。 -Beta API 版本 *不可以* 替代正式的 API 版本。 + * 一个正式发布的（GA）API 版本可替换 beta 或 alpha API 版本。 + * Beta API 版本可以替换早期的 beta 和 alpha API 版本，但 **不可以** 替换正式的 API 版本。 + * Alpha API 版本可以替换早期的 alpha API 版本，但 **不可以** 替换正式的或 beta API 版本。 -**规则 #4a：除了每类 API 版本中的最新版本，旧的 API 版本在其被宣布被废弃之后 -至少以下时长内仍需被支持：** +**规则 #4a：最短 API 生命周期由 API 稳定性级别决定** - * **GA：12 个月或者 3 个发布版本（取其较长者）** - * **Beta: 9 个月或者 3 个发布版本（取其较长者）** - * **Alpha: 0 个发布版本** + * **GA API 版本可以被标记为已弃用，但不得在 Kubernetes 的主要版本中删除** + * **Beta API 版本必须支持 9 个月或弃用后的 3 个版本（以较长者为准）** + * **Alpha API 版本可能会在任何版本中被删除，不另行通知** -这里也包含了关于[最大支持 2 个发布版本的版本偏差](/zh/docs/setup/release/version-skew-policy/) -的约定。 +这确保了 beta API 支持涵盖了[最多 2 个版本的支持版本偏差](/zh/releases/version-skew-policy/)。 + +{{< note >}} + +目前没有删除正式版本 API 的 Kubernetes 主要版本修订计划。 +{{< /note >}} +
  • v1 is deprecated in favor of v2, but will not be removed
  • v2beta2 已被弃用，发布说明中包含对应的 "action required（采取行动）" 说明
    • -
  • v1 已被弃用，发布说明中包含对应的 "action required（采取行动）" 说明
    • +
  • v1 已被弃用，取而代之的是 v2，但不会被删除
    • @@ -400,23 +404,6 @@ API versions are supported in a series of subsequent releases. - - X+16 - - v2、v1（已弃用） - v2 - - - - X+17 - v2 - v2 - -
      -
    • v1 被删除，发布说明中包含对应的 "action required（采取行动）" 说明
      • -
    - - From 3458b424e96fdbf0d58a01a6dc8f774c9b386cbf Mon Sep 17 00:00:00 2001 From: zaunist Date: Tue, 19 Apr 2022 22:09:45 +0800 Subject: [PATCH 008/101] docs: Rsync access-cluster-service --- .../access-cluster-services.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) rename content/zh/docs/tasks/{administer-cluster => access-application-cluster}/access-cluster-services.md (99%) diff --git a/content/zh/docs/tasks/administer-cluster/access-cluster-services.md b/content/zh/docs/tasks/access-application-cluster/access-cluster-services.md similarity index 99% rename from content/zh/docs/tasks/administer-cluster/access-cluster-services.md rename to content/zh/docs/tasks/access-application-cluster/access-cluster-services.md index 2b0ce168fe..f2809b6849 100644 --- a/content/zh/docs/tasks/administer-cluster/access-cluster-services.md +++ b/content/zh/docs/tasks/access-application-cluster/access-cluster-services.md @@ -187,7 +187,7 @@ URL 的 `` 段支持的格式为： --> ##### 示例 -* 如要访问 Elasticsearch 服务末端 `_search?q=user:kimchy`，你可以使用： +* 如要访问 Elasticsearch 服务末端 `_search?q=user:kimchy`，你可以使用： ``` http://104.197.5.247/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/_search?q=user:kimchy @@ -199,7 +199,7 @@ URL 的 `` 段支持的格式为： * 如要访问 Elasticsearch 集群健康信息`_cluster/health?pretty=true`，你会使用： ``` - https://104.197.5.247/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/_cluster/health?pretty=true` + https://104.197.5.247/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/_cluster/health?pretty=true` ``` -- Web 服务器通常不能传递令牌，所以你可能需要使用基本（密码）认证。 +- Web 服务器通常不能传递令牌，所以你可能需要使用基本（密码）认证。 API 服务器可以配置为接受基本认证，但你的集群可能并没有这样配置。 - 某些 Web 应用可能无法工作，特别是那些使用客户端 Javascript 构造 URL 的 应用，所构造的 URL 可能并不支持代理路径前缀。 - From 42f4abba4ad378016693ce8a443a7defc950a5fa Mon Sep 17 00:00:00 2001 From: Jaesup Kwak <39186008+w4-jaesup@users.noreply.github.com> Date: Wed, 20 Apr 2022 01:42:23 +0900 Subject: [PATCH 009/101] Update assign-pod-node.md --- .../ko/docs/concepts/scheduling-eviction/assign-pod-node.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/ko/docs/concepts/scheduling-eviction/assign-pod-node.md b/content/ko/docs/concepts/scheduling-eviction/assign-pod-node.md index 0d099b13e7..494d3b1601 100644 --- a/content/ko/docs/concepts/scheduling-eviction/assign-pod-node.md +++ b/content/ko/docs/concepts/scheduling-eviction/assign-pod-node.md @@ -17,9 +17,9 @@ weight: 20 [레이블 셀렉터](/ko/docs/concepts/overview/working-with-objects/labels/)를 사용하여 선택을 용이하게 한다. 보통 스케줄러가 자동으로 합리적인 배치(예: 자원이 부족한 노드에 파드를 배치하지 않도록 노드 간에 파드를 분배하는 등)를 수행하기에 이러한 제약 조건은 필요하지 않지만 -간혹 파드가 배포할 노드를 제어해야 하는 경우가 있다. -예를 들어 SSD가 장착된 머신에 파드가 연결되도록 하거나 또는 동일한 가용성 영역(availability zone)에서 -많은 것을 통신하는 두 개의 서로 다른 서비스의 파드를 같이 배치할 수 있다. +간혹 파드가 배포될 노드를 제어해야 하는 경우가 있다. +예를 들어 SSD가 장착된 머신에 파드가 배포되도록 하거나 또는 많은 통신을 하는 두 개의 서로 다른 서비스의 파드를 +동일한 가용성 영역(availability zone)에 배치할 수 있다. From 28cea36e93b7eda87bfbb595f2d76cdf031e821a Mon Sep 17 00:00:00 2001 From: Rey Lejano Date: Tue, 19 Apr 2022 14:50:25 -0700 Subject: [PATCH 010/101] revert changes from PR 32941 that merged before 1.24 release --- .../production-environment/tools/kubeadm/install-kubeadm.md | 1 - .../tools/kubeadm/kubelet-integration.md | 2 -- .../tasks/administer-cluster/kubeadm/adding-windows-nodes.md | 1 - content/en/docs/tasks/network/customize-hosts-file-for-pods.md | 3 --- 4 files changed, 7 deletions(-) diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index 9ec735bd77..45c8717a83 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -14,7 +14,6 @@ card: This page shows how to install the `kubeadm` toolbox. For information on how to create a cluster with kubeadm once you have performed this installation process, see the [Using kubeadm to Create a Cluster](/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/) page. -{{% dockershim-removal %}} ## {{% heading "prerequisites" %}} diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md b/content/en/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md index 1da01fecce..4625299919 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md @@ -10,8 +10,6 @@ weight: 80 {{< feature-state for_k8s_version="v1.11" state="stable" >}} -{{% dockershim-removal %}} - The lifecycle of the kubeadm CLI tool is decoupled from the [kubelet](/docs/reference/command-line-tools-reference/kubelet), which is a daemon that runs on each node within the Kubernetes cluster. The kubeadm CLI tool is executed by the user when Kubernetes is diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes.md b/content/en/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes.md index a5739616bd..54efcd3d39 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes.md @@ -16,7 +16,6 @@ weight: 30 You can use Kubernetes to run a mixture of Linux and Windows nodes, so you can mix Pods that run on Linux on with Pods that run on Windows. This page shows how to register Windows nodes to your cluster. -{{% dockershim-removal %}} ## {{% heading "prerequisites" %}} {{< version-check >}} diff --git a/content/en/docs/tasks/network/customize-hosts-file-for-pods.md b/content/en/docs/tasks/network/customize-hosts-file-for-pods.md index 3ed2b0ed6a..7eba61fbea 100644 --- a/content/en/docs/tasks/network/customize-hosts-file-for-pods.md +++ b/content/en/docs/tasks/network/customize-hosts-file-for-pods.md @@ -11,9 +11,6 @@ min-kubernetes-server-version: 1.7 -{{% dockershim-removal %}} - - Adding entries to a Pod's `/etc/hosts` file provides Pod-level override of hostname resolution when DNS and other options are not applicable. You can add these custom entries with the HostAliases field in PodSpec. Modification not using HostAliases is not suggested because the file is managed by the kubelet and can be overwritten on during Pod creation/restart. From 0050ad941d96b6c72d3929a45e0aff4a00df7179 Mon Sep 17 00:00:00 2001 From: Mengjiao Liu Date: Tue, 19 Apr 2022 22:12:27 +0800 Subject: [PATCH 011/101] [zh]Add 2022-01-07-kubernetes-is-moving-on-from-dockershim.md --- ...kubernetes-is-moving-on-from-dockershim.md | 199 ++++++++++++++++++ 1 file changed, 199 insertions(+) create mode 100644 content/zh/blog/_posts/2022-01-07-kubernetes-is-moving-on-from-dockershim.md diff --git a/content/zh/blog/_posts/2022-01-07-kubernetes-is-moving-on-from-dockershim.md b/content/zh/blog/_posts/2022-01-07-kubernetes-is-moving-on-from-dockershim.md new file mode 100644 index 0000000000..248f6fda5e --- /dev/null +++ b/content/zh/blog/_posts/2022-01-07-kubernetes-is-moving-on-from-dockershim.md @@ -0,0 +1,199 @@ +--- +layout: blog +title: "Kubernetes 即将移除 Dockershim：承诺和下一步" +date: 2022-01-07 +slug: kubernetes-is-moving-on-from-dockershim +--- + + + +**作者：** Sergey Kanzhelev (Google), Jim Angel (Google), Davanum Srinivas (VMware), Shannon Kularathna (Google), Chris Short (AWS), Dawn Chen (Google) + + +Kubernetes 将在即将发布的 1.24 版本中移除 dockershim。我们很高兴能够通过支持开源容器运行时、支持更小的 +kubelet 以及为使用 Kubernetes 的团队提高工程速度来重申我们的社区价值。 +如果你[使用 Docker Engine 作为 Kubernetes 集群的容器运行时](/zh/docs/tasks/administer-cluster/migrating-from-dockershim/find-out-runtime-you-use/)， +请准备好在 1.24 中迁移！要检查你是否受到影响， +请参考[检查弃用 Dockershim 对你的影响](/zh/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you/)。 + + +## 为什么我们要离开 dockershim {#why-we-re-moving-away-from-dockershim} + +Docker 是 Kubernetes 使用的第一个容器运行时。 +这也是许多 Kubernetes 用户和爱好者如此熟悉 Docker 的原因之一。 +对 Docker 的支持被硬编码到 Kubernetes 中——一个被项目称为 dockershim 的组件。 + +随着容器化成为行业标准，Kubernetes 项目增加了对其他运行时的支持。 +最终实现了容器运行时接口（CRI），让系统组件（如 kubelet）以标准化的方式与容器运行时通信。 +因此，dockershim 成为了 Kubernetes 项目中的一个异常现象。 + +对 Docker 和 dockershim 的依赖已经渗透到 CNCF 生态系统中的各种工具和项目中，这导致了代码脆弱。 + +通过删除 dockershim CRI，我们拥抱了 CNCF 的第一个价值： +“[快比慢好](https://github.com/cncf/foundation/blob/master/charter.md#3-values)”。 +请继续关注未来关于这个话题的交流! + + +## 弃用时间线 {#deprecation-timeline} + +我们[正式宣布](/zh/blog/2020/12/08/kubernetes-1-20-release-announcement/)于 +2020 年 12 月弃用 dockershim。目标是在 2022 年 4 月， +Kubernetes 1.24 中完全移除 dockershim。 +此时间线与我们的[弃用策略](/zh/docs/reference/using api/deprecation-policy/#deprecating-a-feature-or-behavior)一致， +即规定已弃用的行为必须在其宣布弃用后至少运行 1 年。 + + +包括 dockershim 的 Kubernetes 1.23 版本，在 Kubernetes 项目中将再支持一年。 +对于托管 Kubernetes 的供应商，供应商支持可能会持续更长时间，但这取决于公司本身。 +无论如何，我们相信所有集群操作都有时间进行迁移。如果你有更多关于 dockershim 移除的问题， +请参考[弃用 Dockershim 的常见问题](/zh/blog/2020/12/02/dockershim-faq/)。 + + +在这个[你是否为 dockershim 的删除做好了准备](/blog/2021/11/12/are-you-ready-for-dockershim-removal/)的调查中， +我们询问你是否为 dockershim 的迁移做好了准备。我们收到了 600 多个回复。 +感谢所有花时间填写调查问卷的人。 + + +结果表明，在帮助你顺利迁移方面，我们还有很多工作要做。 +存在其他容器运行时，并且已被广泛推广。但是，许多用户告诉我们他们仍然依赖 dockershim， +并且有时需要重新处理依赖项。其中一些依赖项超出控制范围。 +根据收集到的反馈，我们采取了一些措施提供帮助。 + + +## 我们的下一个步骤 {#our-next-steps} + +根据提供的反馈： + +- CNCF 和 1.24 版本团队致力于及时交付 1.24 版本的文档。这包括像本文这样的包含更多信息的博客文章， + 更新现有的代码示例、教程和任务，并为集群操作人员生成迁移指南。 +- 我们正在联系 CNCF 社区的其他成员，帮助他们为这一变化做好准备。 + + +如果你是依赖 dockershim 的项目的一部分，或者如果你有兴趣帮助参与迁移工作，请加入我们！ +无论是我们的迁移工具还是我们的文档，总是有更多贡献者的空间。 +作为起步，请在 [Kubernetes Slack](https://slack.kubernetes.io/) 上的 +[#sig-node](https://kubernetes.slack.com/archives/C0BP8PW9G) 频道打个招呼！ + + +## 最终想法 {#final-thoughts} + +作为一个项目，我们已经看到集群运营商在 2021 年之前越来越多地采用其他容器运行时。 +我们相信迁移没有主要障碍。我们为改善迁移体验而采取的步骤将为你指明更清晰的道路。 + + +我们知道，从 dockershim 迁移是你可能需要执行的另一项操作，以保证你的 Kubernetes 基础架构保持最新。 +对于你们中的大多数人来说，这一步将是简单明了的。在某些情况下，你会遇到问题。 +社区已经详细讨论了推迟 dockershim 删除是否会有所帮助。 +例如，我们最近在 [11 月 11 日的 SIG Node 讨论](https://docs.google.com/document/d/1Ne57gvidMEWXR70OxxnRkYquAoMpt56o75oZtg-OeBg/edit#bookmark=id.r77y11bgzid)和 +[12 月 6 日 Kubernetes Steering 举行的委员会会议](https://docs.google.com/document/d/1qazwMIHGeF3iUh5xMJIJ6PDr-S3bNkT8tNLRkSiOkOU/edit#bookmark=id.m0ir406av7jx)谈到了它。 +我们已经在 2021 年[推迟](https://github.com/kubernetes/enhancements/pull/2481/)它一次， +因为其他运行时的采用率低于我们的预期，这也给了我们更多的时间来识别潜在的阻塞问题。 + + +在这一点上，我们相信你（和 Kubernetes）从移除 dockershim 中获得的价值可以弥补你将要进行的迁移工作。 +现在就开始计划以避免出现意外。在 Kubernetes 1.24 发布之前，我们将提供更多更新信息和指南。 + From ac879ddbaae095e54b81c89ea250b4b7d22a0aae Mon Sep 17 00:00:00 2001 From: Shivam Sharma Date: Wed, 20 Apr 2022 09:51:41 +0530 Subject: [PATCH 012/101] Hyperlink to support period update (#33007) * Hyperlink to support period update * Update _index.md --- content/en/releases/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/releases/_index.md b/content/en/releases/_index.md index af7819a0c1..d374f6eb5a 100644 --- a/content/en/releases/_index.md +++ b/content/en/releases/_index.md @@ -7,7 +7,7 @@ type: docs -The Kubernetes project maintains release branches for the most recent three minor releases ({{< skew latestVersion >}}, {{< skew prevMinorVersion >}}, {{< skew oldestMinorVersion >}}). Kubernetes 1.19 and newer receive approximately 1 year of patch support. Kubernetes 1.18 and older received approximately 9 months of patch support. +The Kubernetes project maintains release branches for the most recent three minor releases ({{< skew latestVersion >}}, {{< skew prevMinorVersion >}}, {{< skew oldestMinorVersion >}}). Kubernetes 1.19 and newer receive [approximately 1 year of patch support](/releases/patch-releases/#support-period). Kubernetes 1.18 and older received approximately 9 months of patch support. Kubernetes versions are expressed as **x.y.z**, where **x** is the major version, **y** is the minor version, and **z** is the patch version, following [Semantic Versioning](https://semver.org/) terminology. @@ -24,4 +24,4 @@ More information in the [version skew policy](/releases/version-skew-policy/) do Check out the [schedule](https://github.com/kubernetes/sig-release/tree/master/releases/release-{{< skew nextMinorVersion >}}) for the upcoming **{{< skew nextMinorVersion >}}** Kubernetes release! -## Helpful Resources \ No newline at end of file +## Helpful Resources From bd3eb7ad6f29452762de9ee3ef251850b8d42bcb Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Wed, 20 Apr 2022 18:14:27 +0800 Subject: [PATCH 013/101] [zh]update file content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md --- .../production-environment/tools/kubeadm/install-kubeadm.md | 1 - 1 file changed, 1 deletion(-) diff --git a/content/zh/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/zh/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index cc80a3e02a..51f9fd7758 100644 --- a/content/zh/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/zh/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -27,7 +27,6 @@ For information on how to create a cluster with kubeadm once you have performed 有关在执行此安装过程后如何使用 kubeadm 创建集群的信息，请参见 [使用 kubeadm 创建集群](/zh/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/) 页面。 -{{% dockershim-removal %}} ## {{% heading "prerequisites" %}} From 63cf9b57c27c5dbbf3b0185ca0e77bdd662ef04f Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Wed, 20 Apr 2022 18:20:34 +0800 Subject: [PATCH 014/101] [zh]update file content/zh/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes.md --- .../tasks/administer-cluster/kubeadm/adding-windows-nodes.md | 1 - 1 file changed, 1 deletion(-) diff --git a/content/zh/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes.md b/content/zh/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes.md index 7266b0ee4c..377b5f3956 100644 --- a/content/zh/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes.md +++ b/content/zh/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes.md @@ -25,7 +25,6 @@ You can use Kubernetes to run a mixture of Linux and Windows nodes, so you can m 混合使用运行于 Linux 上的 Pod 和运行于 Windows 上的 Pod。 本页面展示如何将 Windows 节点注册到你的集群。 -{{% dockershim-removal %}} ## {{% heading "prerequisites" %}} {{< version-check >}} From 320d290da5be1b19e35d6d318ecd2a2a0e0303e2 Mon Sep 17 00:00:00 2001 From: Priyanshu Ahlawat <84102724+PriyanshuAhlawat@users.noreply.github.com> Date: Wed, 20 Apr 2022 16:59:41 +0530 Subject: [PATCH 015/101] Add Traffic Shaping Annotations (#32549) * Update _index.md * Update _index.md * Update _index.md * Update _index.md * Update _index.md --- .../labels-annotations-taints/_index.md | 38 +++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/content/en/docs/reference/labels-annotations-taints/_index.md b/content/en/docs/reference/labels-annotations-taints/_index.md index d08c6ca90c..6b5de0b63b 100644 --- a/content/en/docs/reference/labels-annotations-taints/_index.md +++ b/content/en/docs/reference/labels-annotations-taints/_index.md @@ -168,6 +168,44 @@ Used on: Pod This annotation is used to set [Pod Deletion Cost](/docs/concepts/workloads/controllers/replicaset/#pod-deletion-cost) which allows users to influence ReplicaSet downscaling order. The annotation parses into an `int32` type. +### kubernetes.io/ingress-bandwidth + +{{< note >}} +Ingress traffic shaping annotation is an experimental feature. +If you want to enable traffic shaping support, you must add the `bandwidth` plugin to your CNI configuration file (default `/etc/cni/net.d`) and +ensure that the binary is included in your CNI bin dir (default `/opt/cni/bin`). +{{< /note >}} + +Example: `kubernetes.io/ingress-bandwidth: 10M` + +Used on: Pod + +You can apply quality-of-service traffic shaping to a pod and effectively limit its available bandwidth. +Ingress traffic (to the pod) is handled by shaping queued packets to effectively handle data. +To limit the bandwidth on a pod, write an object definition JSON file and specify the data traffic +speed using `kubernetes.io/ingress-bandwidth` annotation. The unit used for specifying ingress +rate is bits per second, as a [Quantity](/docs/reference/kubernetes-api/common-definitions/quantity/). +For example, `10M` means 10 megabits per second. + +### kubernetes.io/egress-bandwidth + +{{< note >}} +Egress traffic shaping annotation is an experimental feature. +If you want to enable traffic shaping support, you must add the `bandwidth` plugin to your CNI configuration file (default `/etc/cni/net.d`) and +ensure that the binary is included in your CNI bin dir (default `/opt/cni/bin`). +{{< /note >}} + +Example: `kubernetes.io/egress-bandwidth: 10M` + +Used on: Pod + +Egress traffic (from the pod) is handled by policing, which simply drops packets in excess of the configured rate. +The limits you place on a pod do not affect the bandwidth of other pods. +To limit the bandwidth on a pod, write an object definition JSON file and specify the data traffic +speed using `kubernetes.io/egress-bandwidth` annotation. The unit used for specifying egress +rate is bits per second, as a [Quantity](/docs/reference/kubernetes-api/common-definitions/quantity/). +For example, `10M` means 10 megabits per second. + ### beta.kubernetes.io/instance-type (deprecated) {{< note >}} Starting in v1.17, this label is deprecated in favor of [node.kubernetes.io/instance-type](#nodekubernetesioinstance-type). {{< /note >}} From ca25763e5e888025c845aa3a393dbaec5994530d Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Wed, 20 Apr 2022 21:53:05 +0800 Subject: [PATCH 016/101] [zh] Sync examples_test.go Signed-off-by: xin.li --- content/zh/examples/examples_test.go | 56 +++++++++++++++------------- 1 file changed, 31 insertions(+), 25 deletions(-) diff --git a/content/zh/examples/examples_test.go b/content/zh/examples/examples_test.go index f868eb3d4a..27eae2eadf 100644 --- a/content/zh/examples/examples_test.go +++ b/content/zh/examples/examples_test.go @@ -149,18 +149,17 @@ func getCodecForObject(obj runtime.Object) (runtime.Codec, error) { func validateObject(obj runtime.Object) (errors field.ErrorList) { podValidationOptions := validation.PodValidationOptions{ - AllowMultipleHugePageResources: true, - AllowDownwardAPIHugePages: true, + AllowDownwardAPIHugePages: true, + AllowInvalidPodDeletionCost: false, + AllowIndivisibleHugePagesValues: true, + AllowWindowsHostProcessField: true, + AllowExpandedDNSConfig: true, } quotaValidationOptions := validation.ResourceQuotaValidationOptions{ AllowPodAffinityNamespaceSelector: true, } - pspValidationOptions := policy_validation.PodSecurityPolicyValidationOptions{ - AllowEphemeralVolumeType: true, - } - // Enable CustomPodDNS for testing // feature.DefaultFeatureGate.Set("CustomPodDNS=true") switch t := obj.(type) { @@ -182,20 +181,23 @@ func validateObject(obj runtime.Object) (errors field.ErrorList) { case *api.Namespace: errors = validation.ValidateNamespace(t) case *api.PersistentVolume: - errors = validation.ValidatePersistentVolume(t) + opts := validation.PersistentVolumeSpecValidationOptions{ + AllowReadWriteOncePod: true, + } + errors = validation.ValidatePersistentVolume(t, opts) case *api.PersistentVolumeClaim: if t.Namespace == "" { t.Namespace = api.NamespaceDefault } - errors = validation.ValidatePersistentVolumeClaim(t) + opts := validation.PersistentVolumeClaimSpecValidationOptions{ + AllowReadWriteOncePod: true, + } + errors = validation.ValidatePersistentVolumeClaim(t, opts) case *api.Pod: if t.Namespace == "" { t.Namespace = api.NamespaceDefault } - opts := validation.PodValidationOptions{ - AllowMultipleHugePageResources: true, - } - errors = validation.ValidatePodCreate(t, opts) + errors = validation.ValidatePodCreate(t, podValidationOptions) case *api.PodList: for i := range t.Items { errors = append(errors, validateObject(&t.Items[i])...) @@ -277,11 +279,7 @@ func validateObject(obj runtime.Object) (errors field.ErrorList) { if t.Namespace == "" { t.Namespace = api.NamespaceDefault } - gv := schema.GroupVersion{ - Group: networking.GroupName, - Version: legacyscheme.Scheme.PrioritizedVersionsForGroup(networking.GroupName)[0].Version, - } - errors = networking_validation.ValidateIngressCreate(t, gv) + errors = networking_validation.ValidateIngressCreate(t) case *networking.IngressClass: /* if t.Namespace == "" { @@ -295,7 +293,7 @@ func validateObject(obj runtime.Object) (errors field.ErrorList) { errors = networking_validation.ValidateIngressClass(t) case *policy.PodSecurityPolicy: - errors = policy_validation.ValidatePodSecurityPolicy(t, pspValidationOptions) + errors = policy_validation.ValidatePodSecurityPolicy(t) case *apps.ReplicaSet: if t.Namespace == "" { t.Namespace = api.NamespaceDefault @@ -399,7 +397,7 @@ func TestExampleObjectSchemas(t *testing.T) { }, "admin/dns": { "busybox": {&api.Pod{}}, - "dns-horizontal-autoscaler": {&apps.Deployment{}}, + "dns-horizontal-autoscaler": {&api.ServiceAccount{}, &rbac.ClusterRole{}, &rbac.ClusterRoleBinding{}, &apps.Deployment{}}, "dnsutils": {&api.Pod{}}, }, "admin/logging": { @@ -447,7 +445,7 @@ func TestExampleObjectSchemas(t *testing.T) { }, "admin/sched": { "clusterrole": {&rbac.ClusterRole{}}, - "my-scheduler": {&api.ServiceAccount{}, &rbac.ClusterRoleBinding{}, &rbac.ClusterRoleBinding{}, &apps.Deployment{}}, + "my-scheduler": {&api.ServiceAccount{}, &rbac.ClusterRoleBinding{}, &rbac.ClusterRoleBinding{}, &api.ConfigMap{}, &apps.Deployment{}}, "pod1": {&api.Pod{}}, "pod2": {&api.Pod{}}, "pod3": {&api.Pod{}}, @@ -558,6 +556,7 @@ func TestExampleObjectSchemas(t *testing.T) { "pod-projected-svc-token": {&api.Pod{}}, "pod-rs": {&api.Pod{}, &api.Pod{}}, "pod-single-configmap-env-variable": {&api.Pod{}}, + "pod-with-affinity-anti-affinity": {&api.Pod{}}, "pod-with-node-affinity": {&api.Pod{}}, "pod-with-pod-affinity": {&api.Pod{}}, "pod-with-toleration": {&api.Pod{}}, @@ -586,6 +585,7 @@ func TestExampleObjectSchemas(t *testing.T) { }, "pods/probe": { "exec-liveness": {&api.Pod{}}, + "grpc-liveness": {&api.Pod{}}, "http-liveness": {&api.Pod{}}, "pod-with-http-healthcheck": {&api.Pod{}}, "pod-with-tcp-socket-healthcheck": {&api.Pod{}}, @@ -614,11 +614,15 @@ func TestExampleObjectSchemas(t *testing.T) { "security-context-4": {&api.Pod{}}, }, "pods/storage": { - "projected": {&api.Pod{}}, - "pv-claim": {&api.PersistentVolumeClaim{}}, - "pv-pod": {&api.Pod{}}, - "pv-volume": {&api.PersistentVolume{}}, - "redis": {&api.Pod{}}, + "projected": {&api.Pod{}}, + "projected-secret-downwardapi-configmap": {&api.Pod{}}, + "projected-secrets-nondefault-permission-mode": {&api.Pod{}}, + "projected-service-account-token": {&api.Pod{}}, + "pv-claim": {&api.PersistentVolumeClaim{}}, + "pv-duplicate": {&api.Pod{}}, + "pv-pod": {&api.Pod{}}, + "pv-volume": {&api.PersistentVolume{}}, + "redis": {&api.Pod{}}, }, "policy": { "baseline-psp": {&policy.PodSecurityPolicy{}}, @@ -643,6 +647,7 @@ func TestExampleObjectSchemas(t *testing.T) { "service/networking": { "curlpod": {&apps.Deployment{}}, "custom-dns": {&api.Pod{}}, + "default-ingressclass": {&networking.IngressClass{}}, "dual-stack-default-svc": {&api.Service{}}, "dual-stack-ipfamilies-ipv6": {&api.Service{}}, "dual-stack-ipv6-svc": {&api.Service{}}, @@ -658,6 +663,7 @@ func TestExampleObjectSchemas(t *testing.T) { "name-virtual-host-ingress": {&networking.Ingress{}}, "name-virtual-host-ingress-no-third-host": {&networking.Ingress{}}, "namespaced-params": {&networking.IngressClass{}}, + "networkpolicy": {&networking.NetworkPolicy{}}, "network-policy-allow-all-egress": {&networking.NetworkPolicy{}}, "network-policy-allow-all-ingress": {&networking.NetworkPolicy{}}, "network-policy-default-deny-egress": {&networking.NetworkPolicy{}}, From 134c25a1d84e2c2059168fd5b542408da22ac1ee Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Wed, 20 Apr 2022 22:12:09 +0800 Subject: [PATCH 017/101] [zh] Update blog/kubernetes-1-20-release-announcement.md Signed-off-by: xin.li --- content/zh/blog/_posts/2020-12-08-kubernetes-release-1.20.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/zh/blog/_posts/2020-12-08-kubernetes-release-1.20.md b/content/zh/blog/_posts/2020-12-08-kubernetes-release-1.20.md index b8ab648317..f79268f0fd 100644 --- a/content/zh/blog/_posts/2020-12-08-kubernetes-release-1.20.md +++ b/content/zh/blog/_posts/2020-12-08-kubernetes-release-1.20.md @@ -3,6 +3,7 @@ layout: blog title: 'Kubernetes 1.20: 最新版本' date: 2020-12-08 slug: kubernetes-1-20-release-announcement +evergreen: true --- **作者:** [Kubernetes 1.20 发布团队](https://github.com/kubernetes/sig-release/blob/master/releases/release-1.20/release_team.md) From fd32dc115979644d5ab9bb36f434a1ecf06dea4f Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Mon, 18 Apr 2022 20:53:45 +0800 Subject: [PATCH 018/101] [zh] Update access-cluster.md Signed-off-by: xin.li --- .../access-cluster.md | 72 +++---------------- 1 file changed, 11 insertions(+), 61 deletions(-) diff --git a/content/zh/docs/tasks/access-application-cluster/access-cluster.md b/content/zh/docs/tasks/access-application-cluster/access-cluster.md index 1dd18f0c90..591652dc9e 100644 --- a/content/zh/docs/tasks/access-application-cluster/access-cluster.md +++ b/content/zh/docs/tasks/access-application-cluster/access-cluster.md @@ -316,82 +316,32 @@ Python 客户端可以像 kubectl CLI 一样使用相同的 ## Accessing the API from a Pod When accessing the API from a pod, locating and authenticating -to the apiserver are somewhat different. - -The recommended way to locate the apiserver within the pod is with -the `kubernetes.default.svc` DNS name, which resolves to a Service IP which in turn -will be routed to an apiserver. - -The recommended way to authenticate to the apiserver is with a -[service account](/docs/tasks/configure-pod-container/configure-service-account/) credential. By kube-system, a pod -is associated with a service account, and a credential (token) for that -service account is placed into the filesystem tree of each container in that pod, -at `/var/run/secrets/kubernetes.io/serviceaccount/token`. +to the API server are somewhat different. --> ### 从 Pod 中访问 API {#accessing-the-api-from-a-pod} -当你从 Pod 中访问 API 时，定位和验证 apiserver 会有些许不同。 - -在 Pod 中定位 apiserver 的推荐方式是通过 `kubernetes.default.svc` -这个 DNS 名称，该名称将会解析为服务 IP，然后服务 IP 将会路由到 apiserver。 - -向 apiserver 进行身份验证的推荐方法是使用 -[服务帐户](/zh/docs/tasks/configure-pod-container/configure-service-account/) 凭据。 -通过 kube-system，Pod 与服务帐户相关联，并且该服务帐户的凭证（token） -被放置在该 Pod 中每个容器的文件系统中，位于 -`/var/run/secrets/kubernetes.io/serviceaccount/token`。 +当你从 Pod 中访问 API 时，定位和验证 API 服务器会有些许不同。 -如果可用，则将证书放入每个容器的文件系统中的 -`/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`， -并且应该用于验证 apiserver 的服务证书。 - -最后，名字空间作用域的 API 操作所使用的 default 名字空间将被放置在 -每个容器的 `/var/run/secrets/kubernetes.io/serviceaccount/namespace` -文件中。 - - -在 Pod 中，建议连接 API 的方法是： - -- 在 Pod 的边车容器中运行 `kubectl proxy`，或者以后台进程的形式运行。 - 这将把 Kubernetes API 代理到当前 Pod 的 localhost 接口， - 所以 Pod 中的所有容器中的进程都能访问它。 -- 使用 Go 客户端库，并使用 `rest.InClusterConfig()` 和 - `kubernetes.NewForConfig()` 函数创建一个客户端。 - 他们处理 apiserver 的定位和身份验证。 - [示例](https://git.k8s.io/client-go/examples/in-cluster-client-configuration/main.go) - -在每种情况下，Pod 的凭证都是为了与 apiserver 安全地通信。 +请参阅[从 Pod 中访问 API](/zh/docs/tasks/run-application/access-api-from-pod/) +了解更多详情。 ## 访问集群上运行的服务 {#accessing-services-running-on-the-cluster} 上一节介绍了如何连接到 Kubernetes API 服务器。 -有关连接到 Kubernetes 集群上运行的其他服务的信息，请参阅[访问集群服务](/zh/docs/tasks/administer-cluster/access-cluster-services/)。 - +有关连接到 Kubernetes 集群上运行的其他服务的信息，请参阅 +[访问集群服务](/zh/docs/tasks/administer-cluster/access-cluster-services/)。 -允许读/写在 "extensions" 和 "apps" API 组中的 Deployment（在 HTTP 层面，对应 +允许读/写在 `"apps"` API 组中的 Deployment（在 HTTP 层面，对应 URL 中资源部分为 "deployments"）： ```yaml rules: -- apiGroups: ["extensions", "apps"] +- apiGroups: ["apps"] resources: ["deployments"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] ``` -允许读取核心 API 组中的 "pods" 和读/写 `"batch"` 或 `"extensions"` API 组中的 +允许读取核心 API 组中的 "pods" 和读/写 `"batch"` API 组中的 "jobs"： ```yaml @@ -598,7 +598,7 @@ rules: - apiGroups: [""] resources: ["pods"] verbs: ["get", "list", "watch"] -- apiGroups: ["batch", "extensions"] +- apiGroups: ["batch"] resources: ["jobs"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] ``` From 1e6e5ad6b6c353125571649f48660ca279a776c9 Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Thu, 21 Apr 2022 01:32:46 +0800 Subject: [PATCH 021/101] [zh]update file content/zh/docs/concepts/services-networking/ingress.md --- content/zh/docs/concepts/services-networking/ingress.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/zh/docs/concepts/services-networking/ingress.md b/content/zh/docs/concepts/services-networking/ingress.md index 2a1548d654..037b135c0d 100644 --- a/content/zh/docs/concepts/services-networking/ingress.md +++ b/content/zh/docs/concepts/services-networking/ingress.md @@ -137,7 +137,7 @@ A minimal Ingress resource example: {{< codenew file="service/networking/minimal-ingress.yaml" >}} -与所有其他 Kubernetes 资源一样，Ingress 需要指定 `apiVersion`、`kind` 和 `metadata` 字段。 +Ingress 需要指定 `apiVersion`、`kind`、 `metadata`和 `spec` 字段。 Ingress 对象的命名必须是合法的 [DNS 子域名名称](/zh/docs/concepts/overview/working-with-objects/names#dns-subdomain-names)。 关于如何使用配置文件，请参见[部署应用](/zh/docs/tasks/run-application/run-stateless-application-deployment/)、 [配置容器](/zh/docs/tasks/configure-pod-container/configure-pod-configmap/)、 From c4b703f11f1003102d0486efdc2f87a4506a5b05 Mon Sep 17 00:00:00 2001 From: Akihito INOH Date: Thu, 21 Apr 2022 06:43:44 +0900 Subject: [PATCH 022/101] use for_k8s_version not for_kubernetes_version This commit use "for_k8s_version" property on feature-state short code, not "for_kubernetes_version". --- content/en/docs/concepts/workloads/controllers/daemonset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/workloads/controllers/daemonset.md b/content/en/docs/concepts/workloads/controllers/daemonset.md index ffb1fbd614..44ae849158 100644 --- a/content/en/docs/concepts/workloads/controllers/daemonset.md +++ b/content/en/docs/concepts/workloads/controllers/daemonset.md @@ -107,7 +107,7 @@ If you do not specify either, then the DaemonSet controller will create Pods on ### Scheduled by default scheduler -{{< feature-state for_kubernetes_version="1.17" state="stable" >}} +{{< feature-state for_k8s_version="1.17" state="stable" >}} A DaemonSet ensures that all eligible nodes run a copy of a Pod. Normally, the node that a Pod runs on is selected by the Kubernetes scheduler. However, From c6b6e5acb61d1ff8da75e03cd7e3e0ed9e1ac4e0 Mon Sep 17 00:00:00 2001 From: Jihoon Seo Date: Thu, 21 Apr 2022 10:02:26 +0900 Subject: [PATCH 023/101] Update api-reference shortcode --- layouts/shortcodes/api-reference.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/layouts/shortcodes/api-reference.html b/layouts/shortcodes/api-reference.html index 6fdceef838..785044dc17 100644 --- a/layouts/shortcodes/api-reference.html +++ b/layouts/shortcodes/api-reference.html @@ -4,4 +4,4 @@ {{ $textArg := .Get "text" }} {{ $page := site.GetPage "page" (printf "%s/%s" $base $pageArg) }} {{ $metadata := $page.Params.api_metadata }} -{{if $textArg}}{{ $textArg }}{{else if $anchorArg}}{{ $anchorArg }}{{else}}{{ $metadata.kind }}{{end}} \ No newline at end of file +{{if $textArg}}{{ $textArg }}{{else if $anchorArg}}{{ $anchorArg }}{{else}}{{ $metadata.kind }}{{end}} \ No newline at end of file From 2f27924d32a67964448ee4ddfe4aa14b27617423 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Mon, 18 Apr 2022 23:20:28 +0800 Subject: [PATCH 024/101] [zh] Update debug-pod-replication-controller.md Signed-off-by: xin.li --- .../debug-pod-replication-controller.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/zh/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md b/content/zh/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md index 749091bfbc..6a9cb1454d 100644 --- a/content/zh/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md +++ b/content/zh/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md @@ -143,8 +143,8 @@ worker node, but it can't run on that machine. Again, the information from * Make sure that you have the name of the image correct. * Have you pushed the image to the repository? -* Run a manual `docker pull ` on your machine to see if the image can be - pulled. +* Try to manually pull the image to see if it can be pulled. For example, if you + use Docker on your PC, run `docker pull `. --> ### 我的 Pod 一直在 Waiting @@ -154,7 +154,7 @@ worker node, but it can't run on that machine. Again, the information from * 确保你的镜像的名称正确。 * 你是否将镜像推送到存储库？ -* 在你的机器上手动运行 `docker pull `，看看是否可以拉取镜像。 +* 尝试手动拉取镜像，看能否拉取。例如，如果你在 PC 上使用 Docker，运行 `docker pull `。 ## Kubernetes 可执行文件和软件包内容 @@ -392,7 +403,8 @@ Kubernetes 版本对应的 DEB 和 RPM 软件包是： | Package name | Description | |--------------|-------------| | `kubeadm` | 给 kubelet 安装 `/usr/bin/kubeadm` CLI 工具和 [kubelet 的 systemd 文件](#the-kubelet-drop-in-file-for-systemd)。 | -| `kubelet` | 安装 kubelet 可执行文件到 `/usr/bin` 路径，安装 CNI 可执行文件到 `/opt/cni/bin` 路径。 | +| `kubelet` | 安装 `/usr/bin/kubelet` 可执行文件。 | | `kubectl` | 安装 `/usr/bin/kubectl` 可执行文件。 | | `cri-tools` | 从 [cri-tools git 仓库](https://github.com/kubernetes-sigs/cri-tools)中安装 `/usr/bin/crictl` 可执行文件。 | +| `kubernetes-cni` | 从 [plugins git 仓库](https://github.com/containernetworking/plugins)中安装 `/opt/cni/bin` 可执行文件。| From 480edf2561f4f35bba8c6c764ed47b88fc97d269 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Wed, 20 Apr 2022 21:37:30 +0800 Subject: [PATCH 026/101] [zh] add blog/2022-05-03-dockershim-historical-context.md Signed-off-by: xin.li --- ...022-05-03-dockershim-historical-context.md | 88 +++++++++++++++++++ 1 file changed, 88 insertions(+) create mode 100644 content/zh/blog/_posts/2022-05-03-dockershim-historical-context.md diff --git a/content/zh/blog/_posts/2022-05-03-dockershim-historical-context.md b/content/zh/blog/_posts/2022-05-03-dockershim-historical-context.md new file mode 100644 index 0000000000..eec914eeb6 --- /dev/null +++ b/content/zh/blog/_posts/2022-05-03-dockershim-historical-context.md @@ -0,0 +1,88 @@ +--- +layout: blog +title: "Dockershim：历史背景" +date: 2022-05-03 +slug: dockershim-historical-context +--- + + + + +**作者：** Kat Cosgrove + +自 Kubernetes v1.24 起，Dockershim 已被删除，这对项目来说是一个积极的举措。 +然而，背景对于充分理解某事很重要，无论是社交还是软件开发，这值得更深入的审查。 +除了 Kubernetes v1.24 中的 dockershim 移除之外，我们在社区中看到了一些 +混乱（有时处于恐慌级别）和对这一决定的不满，主要是由于缺乏有关此删除背景的了解。 +弃用并最终从 Kubernetes 中删除 dockershim 的决定并不是迅速或轻率地做出的。 +尽管如此，它已经工作了很长时间，以至于今天的许多用户都比这个决定更新， +更不用提当初为何引入 dockershim 了。 + +那么 dockershim 是什么，为什么它会消失呢？ + + +在 Kubernetes 的早期，我们只支持一个容器运行时，那个运行时就是 Docker Engine。 +那时，并没有太多其他选择，而 Docker 是使用容器的主要工具，所以这不是一个有争议的选择。 +最终，我们开始添加更多的容器运行时，比如 rkt 和 hypernetes，很明显 Kubernetes 用户 +希望选择最适合他们的运行时。 因此，Kubernetes 需要一种方法来允许集群操作员灵活地使用 +他们选择的任何运行时。 + + +[容器运行时接口](/blog/2016/12/container-runtime-interface-cri-in-kubernetes/) (CRI) +已发布以支持这种灵活性。 CRI 的引入对项目和用户来说都很棒，但它确实引入了一个问题：Docker Engine +作为容器运行时的使用早于 CRI，并且 Docker Engine 不兼容 CRI。 为了解决这个问题，在 kubelet 组件 +中引入了一个小型软件 shim (dockershim)，专门用于填补 Docker Engine 和 CRI 之间的空白， +允许集群操作员继续使用 Docker Engine 作为他们的容器运行时基本上不间断。 + + +然而，这个小软件 shim 从来没有打算成为一个永久的解决方案。 多年来，它的存在给 kubelet +本身带来了许多不必要的复杂性。 由于这个 shim，Docker 的一些集成实现不一致，导致维护人员 +的负担增加，并且维护特定于供应商的代码不符合我们的开源理念。 为了减少这种维护负担并朝着支 +持开放标准的更具协作性的社区迈进，[引入了 KEP-2221](https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/2221- remove-dockershim)， +建议移除 dockershim。 随着 Kubernetes v1.20 的发布，正式弃用。 + + +我们没有很好地传达这一点，不幸的是，弃用公告在社区内引起了一些恐慌。关于这对 Docker 作为 +一家公司意味着什么，Docker 构建的容器镜像是否仍然可以运行，以及 Docker Engine 究竟是 +什么导致了社交媒体上的一场大火，人们感到困惑。这是我们的错；我们应该更清楚地传达当时发生 +的事情和原因。为了解决这个问题，我们发布了[一篇博客](/zh/blog/2020/12/02/dont-panic-kubernetes-and-docker/) +和[相应的 FAQ](/zh/blog/2020/12/02/dockershim-faq/ ) 以减轻社区的恐惧并纠正对 +Docker 是什么以及容器如何在 Kubernetes 中工作的一些误解。由于社区的关注，Docker 和 Mirantis +共同决定继续以 [cri-dockerd] 的形式支持 dockershim 代码（https://www.mirantis.com/blog/the-future-of-dockershim-is -cri-dockerd/)， +允许你在需要时继续使用 Docker Engine 作为容器运行时。对于想要尝试其他运行时（如 containerd 或 cri-o） +的用户，[已编写迁移文档](/zh/docs/tasks/administer-cluster/migrating-from-dockershim/change-runtime-containerd/)。 + + +我们后来[调查了社区](https://kubernetes.io/blog/2021/11/12/are-you-ready-for-dockershim-removal/) +[发现还有很多用户有疑问和顾虑](/zh/blog/2022/01/07/kubernetes-is-moving-on-from-dockershim)。 +作为回应，Kubernetes 维护人员和 CNCF 承诺通过扩展文档和其他程序来解决这些问题。 事实上，这篇博文是 +这个计划的一部分。 随着如此多的最终用户成功迁移到其他运行时，以及改进的文档，我们相信每个人现在都为迁移铺平了道路。 + + +Docker 不会消失，无论是作为一种工具还是作为一家公司。 它是云原生社区的重要组成部分， +也是 Kubernetes 项目的历史。 没有他们，我们就不会是现在的样子。 也就是说，从 kubelet +中删除 dockershim 最终对社区、生态系统、项目和整个开源都有好处。 这是我们所有人齐心协力 +支持开放标准的机会，我们很高兴在 Docker 和社区的帮助下这样做。 \ No newline at end of file From 57b2d14c2a58d8ff1c214daaa319eb9b98bc548a Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Thu, 21 Apr 2022 10:02:01 +0800 Subject: [PATCH 027/101] [zh] Update /content/zh/docs/concepts/workloads/controllers/daemonset.md Signed-off-by: xin.li --- content/zh/docs/concepts/workloads/controllers/daemonset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/concepts/workloads/controllers/daemonset.md b/content/zh/docs/concepts/workloads/controllers/daemonset.md index f4ef51936d..db07f5e8a7 100644 --- a/content/zh/docs/concepts/workloads/controllers/daemonset.md +++ b/content/zh/docs/concepts/workloads/controllers/daemonset.md @@ -209,7 +209,7 @@ If you do not specify either, then the DaemonSet controller will create Pods on ### 通过默认调度器调度 {#scheduled-by-default-scheduler} -{{< feature-state for_kubernetes_version="1.17" state="stable" >}} +{{< feature-state for_k8s_version="1.17" state="stable" >}} -_字段选择器（Field selectors_）允许你根据一个或多个资源字段的值 +_字段选择器（Field selectors）_ 允许你根据一个或多个资源字段的值 [筛选 Kubernetes 资源](/zh/docs/concepts/overview/working-with-objects/kubernetes-objects)。 下面是一些使用字段选择器查询的例子： From fd1d03cc5fd4c2114724f61c35fd3f28d14e6fed Mon Sep 17 00:00:00 2001 From: Arhell Date: Thu, 21 Apr 2022 11:43:19 +0300 Subject: [PATCH 029/101] [ja] fix a nit in the feature-state short code --- content/ja/docs/concepts/workloads/controllers/daemonset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/ja/docs/concepts/workloads/controllers/daemonset.md b/content/ja/docs/concepts/workloads/controllers/daemonset.md index 26d611b157..92ab055a59 100644 --- a/content/ja/docs/concepts/workloads/controllers/daemonset.md +++ b/content/ja/docs/concepts/workloads/controllers/daemonset.md @@ -80,7 +80,7 @@ selector](/ja/docs/concepts/scheduling-eviction/assign-pod-node/)にマッチす ### デフォルトスケジューラーによってスケジューリングされる場合 -{{< feature-state state="stable" for-kubernetes-version="1.17" >}} +{{< feature-state for_k8s_version="1.17" state="stable" >}} DaemonSetは全ての利用可能なNodeが単一のPodのコピーを稼働させることを保証します。通常、Podが稼働するNodeはKubernetesスケジューラーによって選択されます。しかし、DaemonSetのPodは代わりにDaemonSetコントローラーによって作成され、スケジューリングされます。 下記の問題について説明します: From ff612509b418acdfe41cb06f742f373919eac7b4 Mon Sep 17 00:00:00 2001 From: liuhanguang123 <60683490+liuhanguang123@users.noreply.github.com> Date: Thu, 21 Apr 2022 16:45:12 +0800 Subject: [PATCH 030/101] Update deployment.md Fixed the difference between the Chinese and English versions --- content/zh/docs/concepts/workloads/controllers/deployment.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/concepts/workloads/controllers/deployment.md b/content/zh/docs/concepts/workloads/controllers/deployment.md index d4ef2b43a8..f5249b60d6 100644 --- a/content/zh/docs/concepts/workloads/controllers/deployment.md +++ b/content/zh/docs/concepts/workloads/controllers/deployment.md @@ -340,7 +340,7 @@ Follow the steps given below to update your Deployment: 1. 先来更新 nginx Pod 以使用 `nginx:1.16.1` 镜像，而不是 `nginx:1.14.2` 镜像。 ```shell - kubectl set image deployment/nginx-deployment nginx=nginx:1.16.1 + kubectl set image deployment.v1.apps/nginx-deployment nginx=nginx:1.16.1 ``` -_字段选择器（Field selectors）_ 允许你根据一个或多个资源字段的值 +“字段选择器（Field selectors）”允许你根据一个或多个资源字段的值 [筛选 Kubernetes 资源](/zh/docs/concepts/overview/working-with-objects/kubernetes-objects)。 下面是一些使用字段选择器查询的例子： From 81a8d46bd3ba33f39c9d9d9f5624941ab4bfc7f2 Mon Sep 17 00:00:00 2001 From: kinzhi Date: Thu, 21 Apr 2022 17:32:59 +0800 Subject: [PATCH 032/101] [zh]update file content/zh/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md (#33043) * [zh]update file content/zh/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md * [zh]update file content/zh/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md * [zh]update file content/zh/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md * [zh]update file content/zh/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md --- ...heck-if-dockershim-deprecation-affects-you.md | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/content/zh/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md b/content/zh/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md index 58363779ac..96132ad465 100644 --- a/content/zh/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md +++ b/content/zh/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md @@ -16,11 +16,14 @@ weight: 20 Kubernetes 的 `dockershim` 组件使得你可以把 Docker 用作 Kubernetes 的 {{< glossary_tooltip text="容器运行时" term_id="container-runtime" >}}。 -在 Kubernetes v1.20 版本中，内建组件 `dockershim` 被弃用。 +在 Kubernetes v1.20 版本中，内建组件 `dockershim` 被[弃用](/zh/blog/2020/12/08/kubernetes-1-20-release-announcement/#dockershim-deprecation)。 + +## {{% heading "whatsnext" %}} + +- 阅读[从 dockershim 迁移](/zh/docs/tasks/administer-cluster/migrating-from-dockershim/)以了解你的下一步工作 +- 阅读[dockershim 弃用常见问题解答](/zh/blog/2020/12/02/dockershim-faq/)文章了解更多信息。 \ No newline at end of file From 84184494fc1e5ff14697af91afd1de983a4d3731 Mon Sep 17 00:00:00 2001 From: kinzhi Date: Thu, 21 Apr 2022 22:10:58 +0800 Subject: [PATCH 033/101] [zh]update file content/zh/docs/tasks/network/customize-hosts-file-for-pods.md (#33042) * [zh]update file content/zh/docs/tasks/network/customize-hosts-file-for-pods.md * [zh]update file content/zh/docs/tasks/network/customize-hosts-file-for-pods.md * [zh]update file content/zh/docs/tasks/network/customize-hosts-file-for-pods.md * [zh]update file content/zh/docs/tasks/network/customize-hosts-file-for-pods.md * Update content/zh/docs/tasks/network/customize-hosts-file-for-pods.md Co-authored-by: Qiming Teng Co-authored-by: Qiming Teng --- .../network/customize-hosts-file-for-pods.md | 28 ++++++++++++------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/content/zh/docs/tasks/network/customize-hosts-file-for-pods.md b/content/zh/docs/tasks/network/customize-hosts-file-for-pods.md index c9f24ed91d..996b77980e 100644 --- a/content/zh/docs/tasks/network/customize-hosts-file-for-pods.md +++ b/content/zh/docs/tasks/network/customize-hosts-file-for-pods.md @@ -162,19 +162,27 @@ With the additional entries specified at the bottom. --> 在最下面额外添加了一些条目。 - -## 为什么 kubelet 管理 hosts 文件？ +## 为什么 kubelet 管理 hosts 文件？{#why-does-kubelet-manage-the-hosts-file} -kubelet [管理](https://github.com/kubernetes/kubernetes/issues/14633) Pod -中每个容器的 hosts 文件，避免 Docker 在容器已经启动之后去 -[修改](https://github.com/moby/moby/issues/17190) 该文件。 +kubelet 管理每个Pod 容器的 `hosts` 文件，以防止容器运行时在容器已经启动后修改文件。 +由于历史原因，Kubernetes 总是使用 Docker Engine 作为其容器运行时，而 Docker Engine +将在容器启动后修改 `/etc/hosts` 文件。 + +当前的 Kubernetes 可以使用多种容器运行时；即便如此，kubelet 管理在每个容器中创建 hosts文件， +以便你使用任何容器运行时运行容器时，结果都符合预期。 {{< caution >}} -然后我们可以使用提供的生成器库来编写自己的控制器。例如，下面是一个简单的控制，它打印出关于监视通知的节点信息，请看完整的例子： +然后我们可以使用提供的生成器库来编写自己的控制器。例如，下面是一个简单的控制，它打印出关于监视通知的节点信息， +在[此处](https://github.com/kubernetes-client/java/blob/master/examples/examples-release-13/src/main/java/io/kubernetes/client/examples/ControllerExample.java) +查看完整的例子： ```java ... Reconciler reconciler = new Reconciler() { From 5829407558d33d9c952f3651d29ad27a4f5aba88 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Thu, 21 Apr 2022 22:24:14 +0800 Subject: [PATCH 035/101] [zh] Update blog/2020-03-25-kubernetes-1.18-release-announcement.md Signed-off-by: xin.li --- .../_posts/2020-03-25-kubernetes-1.18-release-announcement.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/zh/blog/_posts/2020-03-25-kubernetes-1.18-release-announcement.md b/content/zh/blog/_posts/2020-03-25-kubernetes-1.18-release-announcement.md index 78b3aa3312..b191daab33 100644 --- a/content/zh/blog/_posts/2020-03-25-kubernetes-1.18-release-announcement.md +++ b/content/zh/blog/_posts/2020-03-25-kubernetes-1.18-release-announcement.md @@ -3,6 +3,7 @@ layout: blog title: 'Kubernetes 1.18: Fit & Finish' date: 2020-03-25 slug: kubernetes-1-18-release-announcement +evergreen: true --- **作者:** [Kubernetes 1.17发布团队](https://github.com/kubernetes/sig-release/blob/master/releases/release-1.17/release_team.md) @@ -67,14 +69,14 @@ Standard labels are used by Kubernetes components to support some features. For The labels are reaching general availability in this release. Kubernetes components have been updated to populate the GA and beta labels and to react to both. However, if you are using the beta labels in your pod specs for features such as node affinity, or in your custom controllers, we recommend that you start migrating them to the new GA labels. You can find the documentation for the new labels here: --> -- [实例类型](https://kubernetes.io/docs/reference/kubernetes-api/labels-annotations-taints/#nodekubernetesioinstance-type) -- [地区](https://kubernetes.io/docs/reference/kubernetes-api/labels-annotations-taints/#topologykubernetesioregion) -- [区域](https://kubernetes.io/docs/reference/kubernetes-api/labels-annotations-taints/#topologykubernetesiozone) +- [实例类型](/zh/docs/reference/labels-annotations-taints/#nodekubernetesioinstance-type) +- [地区](/zh/docs/reference/labels-annotations-taints/#topologykubernetesioregion) +- [区域](/zh/docs/reference/labels-annotations-taints/#topologykubernetesiozone) ## 卷快照进入公开测试版 -
    - -

    Kubernetes 社区行为规范

    - +
    +

    - Kubernetes 遵循 CNCF 行为规范。 CNCF 社区规范文本如下链接 commit 0ce4694。 如果您发现这个 CNCF 社区规范文本已经过时，请 提交 issue。 +

    +

    如果你在活动、会议、Slack 或是其它场合发现有任何违反行为规范的行为，请联系[Kubernetes 行为规范委员会](https://github.com/kubernetes/community/tree/master/committee-code-of-conduct)。 我们会确保您的匿名性。 +

    +
    -
    +
    {{< include "/static/cncf-code-of-conduct.md" >}}
    -
    From 63313c68dc48625744ca96b93c781076d6b0c993 Mon Sep 17 00:00:00 2001 From: "Mr. Erlison" Date: Thu, 21 Apr 2022 14:23:01 -0300 Subject: [PATCH 038/101] Add content/pt-br/docs/reference/glossary/wg.md --- content/pt-br/docs/reference/glossary/wg.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 content/pt-br/docs/reference/glossary/wg.md diff --git a/content/pt-br/docs/reference/glossary/wg.md b/content/pt-br/docs/reference/glossary/wg.md new file mode 100644 index 0000000000..008a88ecc8 --- /dev/null +++ b/content/pt-br/docs/reference/glossary/wg.md @@ -0,0 +1,19 @@ +--- +title: WG (Grupo de Trabalho) +id: wg +date: 2018-04-12 +full_link: https://github.com/kubernetes/community/blob/master/sig-list.md#master-working-group-list +short_description: > + Facilita a discussão e/ou implementação de um projeto de curta duração, curto ou dissociado para um comitê, SIG ou cross-SIG. + +aka: +tags: +- community +--- + Facilita a discussão e/ou implementação de um projeto de curta duração, curto ou dissociado para um comitê, {{< glossary_tooltip text="SIG" term_id="sig" >}} ou cross-SIG. + + + +Grupos de trabalho (do inglês - Working Group, WG) são uma maneira de organizar as pessoas para realizar uma tarefa. + +Para mais informações, consulte o repositório [kubernetes/community](https://github.com/kubernetes/community) e a lista atual de [SIGs e grupos de trabalho](https://github.com/kubernetes/community/blob/master/sig-list.md). From a3638c4fdec8970335de7d34a856674827dffe06 Mon Sep 17 00:00:00 2001 From: CJ Cullen Date: Thu, 21 Apr 2022 14:07:32 -0700 Subject: [PATCH 039/101] Update rbac.md Fix description of magic service account group. --- content/en/docs/reference/access-authn-authz/rbac.md | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/content/en/docs/reference/access-authn-authz/rbac.md b/content/en/docs/reference/access-authn-authz/rbac.md index a37d8c2649..57a074a29a 100644 --- a/content/en/docs/reference/access-authn-authz/rbac.md +++ b/content/en/docs/reference/access-authn-authz/rbac.md @@ -517,7 +517,7 @@ subjects: namespace: kube-system ``` -For all service accounts in the "qa" group in any namespace: +For all service accounts in the "qa" namespace: ```yaml subjects: @@ -525,15 +525,6 @@ subjects: name: system:serviceaccounts:qa apiGroup: rbac.authorization.k8s.io ``` -For all service accounts in the "dev" group in the "development" namespace: - -```yaml -subjects: -- kind: Group - name: system:serviceaccounts:dev - apiGroup: rbac.authorization.k8s.io - namespace: development -``` For all service accounts in any namespace: From 83d77e1682851fff1bdb81027f83755fa51899a2 Mon Sep 17 00:00:00 2001 From: Arhell Date: Fri, 22 Apr 2022 01:04:09 +0300 Subject: [PATCH 040/101] [id] use for_k8s_version not for_kubernetes_version --- content/id/docs/concepts/workloads/controllers/daemonset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/id/docs/concepts/workloads/controllers/daemonset.md b/content/id/docs/concepts/workloads/controllers/daemonset.md index c1921a50a1..ea21a7b268 100644 --- a/content/id/docs/concepts/workloads/controllers/daemonset.md +++ b/content/id/docs/concepts/workloads/controllers/daemonset.md @@ -106,7 +106,7 @@ membuat Pod pada semua Node. ### Dijadwalkan oleh _default scheduler_ -{{< feature-state for_kubernetes_version="1.17" state="stable" >}} +{{< feature-state for_k8s_version="1.17" state="stable" >}} DaemonSet memastikan bahwa semua Node yang memenuhi syarat menjalankan salinan Pod. Normalnya, Node yang menjalankan Pod dipilih oleh _scheduler_ Kubernetes. From f2c44002ffd8e652216cf3b3d99643c08a11a1d8 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Wed, 20 Apr 2022 09:21:14 +0800 Subject: [PATCH 041/101] [zh] Update authentication-resouces/tokern-review-v1.md Signed-off-by: xin.li --- .../token-review-v1.md | 222 ++++++++++++++++++ 1 file changed, 222 insertions(+) create mode 100644 content/zh/docs/reference/kubernetes-api/authentication-resources/token-review-v1.md diff --git a/content/zh/docs/reference/kubernetes-api/authentication-resources/token-review-v1.md b/content/zh/docs/reference/kubernetes-api/authentication-resources/token-review-v1.md new file mode 100644 index 0000000000..c440a7de35 --- /dev/null +++ b/content/zh/docs/reference/kubernetes-api/authentication-resources/token-review-v1.md @@ -0,0 +1,222 @@ +--- +api_metadata: + apiVersion: "authentication.k8s.io/v1" + import: "k8s.io/api/authentication/v1" + kind: "TokenReview" +content_type: "api_reference" +description: "TokenReview 尝试通过验证令牌来确认已知用户。" +title: "TokenReview" +weight: 3 +auto_generated: true +--- + + + +`apiVersion: authentication.k8s.io/v1` + +`import "k8s.io/api/authentication/v1"` + + +## TokenReview {#TokenReview} + +TokenReview 尝试通过验证令牌来确认已知用户。 +注意：TokenReview 请求可能会被 kube-apiserver 中的 webhook 令牌验证器插件缓存。 + +
    + +- **apiVersion**: authentication.k8s.io/v1 + + +- **kind**: TokenReview + + +- **metadata** (}}">ObjectMeta) + + + 标准对象的元数据，更多信息：https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + +- **spec** (}}">TokenReviewSpec), required + + + spec 保存有关正在评估的请求的信息 + +- **status** (}}">TokenReviewStatus) + + + status 由服务器填写，指示请求是否可以通过身份验证。 + + +## TokenReviewSpec {#TokenReviewSpec} + + +TokenReviewPec 是对令牌身份验证请求的描述。 + +
    + +- **audiences** ([]string) + + + audiences 是带有令牌的资源服务器标识为受众的标识符列表。 + 受众感知令牌身份验证器将验证令牌是否适用于此列表中的至少一个受众。 + 如果未提供受众，受众将默认为 Kubernetes API 服务器的受众。 + +- **token** (string) + + + token 是不透明的持有者令牌（Bearer Token）。 + +## TokenReviewStatus {#TokenReviewStatus} + + +TokenReviewStatus 是令牌认证请求的结果。 + +
    + +- **audiences** ([]string) + + + audiences 是身份验证者选择的与 TokenReview 和令牌兼容的受众标识符。 标识符是 + TokenReviewSpec 受众和令牌受众的交集中的任何标识符。 设置 spec.audiences + 字段的 TokenReview API 的客户端应验证在 status.audiences 字段中返回了兼容的受众标识符， + 以确保 TokenReview 服务器能够识别受众。 如果 TokenReview + 返回一个空的 status.audience 字段，其中 status.authenticated 为 “true”， + 则该令牌对 Kubernetes API 服务器的受众有效。 + +- **authenticated** (boolean) + + authenticated 表示令牌与已知用户相关联。 + +- **error** (string) + + + error 表示无法检查令牌 + +- **user** (UserInfo) + + + user 是与提供的令牌关联的 UserInfo。 + + + <-- + *UserInfo holds the information about the user needed to implement the user.Info interface.* + --> + **UserInfo 保存实现 user.Info 接口所需的用户信息** + + - **user.extra** (map[string][]string) + + + 验证者提供的任何附加信息。 + + - **user.groups** ([]string) + + + 此用户所属的组的名称。 + + - **user.uid** (string) + + + 跨时间标识此用户的唯一值。如果删除此用户并添加另一个同名用户，他们将拥有不同的 UID。 + + - **user.username** (string) + + + 在所有活动用户中唯一标识此用户的名称。 + + +## 操作 {#Operations} + +
    + + +### `create` 创建一个TokenReview + +#### HTTP 请求 + +POST /apis/authentication.k8s.io/v1/tokenreviews + + +#### 参数 + +- **body**: }}">TokenReview, 必需 + +- **dryRun** (*in query*): string + + }}">dryRun + +- **fieldManager** (*in query*): string + + }}">fieldManager + +- **fieldValidation** (*in query*): string + + }}">fieldValidation + +- **pretty** (*in query*): string + + }}">pretty + + +#### 响应 + +200 (}}">TokenReview): OK + +201 (}}">TokenReview): Created + +202 (}}">TokenReview): Accepted + +401: Unauthorized + From 04e30709f9d5bef18b2056c1da94483438029467 Mon Sep 17 00:00:00 2001 From: jpanda Date: Fri, 22 Apr 2022 13:02:12 +0800 Subject: [PATCH 042/101] Fix hyperlink to CNCF on https://k8s.io/docs/home/ (#33038) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * [bugfix/fix-cncf-hyperlink-on-home] fix🐛: Explicitly set the margin-top property * [bugfix/fix-cncf-hyperlink-on-home] fix🐛: remove important * [bugfix/fix-cncf-hyperlink-on-home] format🥚: Add comments to indicate the role of css --- static/css/gridpage.css | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/static/css/gridpage.css b/static/css/gridpage.css index 7da7f1973d..4069185e0e 100644 --- a/static/css/gridpage.css +++ b/static/css/gridpage.css @@ -21,6 +21,15 @@ padding: 0 30px 0 0; margin-bottom: 50px; min-height: 152px; + +} +/* + * Remove the height of the H2 element pseudo-class and set the appropriate spacing + * to avoid mistakenly overriding the styles of other elements + */ +.launch-card h2::before { + margin-top: 1rem ; + height: 0 ; } .gridPage p { From 359c7607e785af71302432e02edb0821dba35ef1 Mon Sep 17 00:00:00 2001 From: kinzhi Date: Fri, 22 Apr 2022 13:16:12 +0800 Subject: [PATCH 043/101] [zh]Update content/zh/docs/reference/access-authn-authz/rbac.md (#33108) * [zh]Update content/zh/docs/reference/access-authn-authz/rbac.md * [zh]Update content/zh/docs/reference/access-authn-authz/rbac.md --- .../docs/reference/access-authn-authz/rbac.md | 17 ++--------------- 1 file changed, 2 insertions(+), 15 deletions(-) diff --git a/content/zh/docs/reference/access-authn-authz/rbac.md b/content/zh/docs/reference/access-authn-authz/rbac.md index 85a982786c..454d81f86a 100644 --- a/content/zh/docs/reference/access-authn-authz/rbac.md +++ b/content/zh/docs/reference/access-authn-authz/rbac.md @@ -758,9 +758,9 @@ subjects: ``` -对于任何名称空间中的 "qa" 组中所有的服务账户： +对于 "qa" 名称空间中的所有服务账户： ```yaml subjects: @@ -769,19 +769,6 @@ subjects: apiGroup: rbac.authorization.k8s.io ``` - -对于 "development" 名称空间中 "dev" 组中的所有服务帐户： - -```yaml -subjects: -- kind: Group - name: system:serviceaccounts:dev - apiGroup: rbac.authorization.k8s.io - namespace: development -``` - From d63dbd782ef11d4b84732b1742e5d9f1c2f65d4a Mon Sep 17 00:00:00 2001 From: kinzhi Date: Fri, 22 Apr 2022 14:32:12 +0800 Subject: [PATCH 044/101] [zh]update file content/zh/docs/reference/labels-annotations-taints/_index.md (#33068) * [zh]update file content/zh/docs/reference/labels-annotations-taints/_index.md * [zh]update file content/zh/docs/reference/labels-annotations-taints/_index.md * [zh]update file content/zh/docs/reference/labels-annotations-taints/_index.md * [zh]update file content/zh/docs/reference/labels-annotations-taints/_index.md * [zh]update file content/zh/docs/reference/labels-annotations-taints/_index.md * [zh]update file content/zh/docs/reference/labels-annotations-taints/_index.md * [zh]update file content/zh/docs/reference/labels-annotations-taints/_index.md * [zh]update file content/zh/docs/reference/labels-annotations-taints/_index.md * [zh]update file content/zh/docs/reference/labels-annotations-taints/_index.md * [zh]update file content/zh/docs/reference/labels-annotations-taints/_index.md --- .../labels-annotations-taints/_index.md | 235 +++++++++++++++++- 1 file changed, 225 insertions(+), 10 deletions(-) diff --git a/content/zh/docs/reference/labels-annotations-taints/_index.md b/content/zh/docs/reference/labels-annotations-taints/_index.md index 1fd14e8b6d..faca42d237 100644 --- a/content/zh/docs/reference/labels-annotations-taints/_index.md +++ b/content/zh/docs/reference/labels-annotations-taints/_index.md @@ -26,15 +26,151 @@ Kubernetes 将所有标签和注解保留在 kubernetes.io Namespace中。 +## API 对象上使用的标签、注解和污点 + +### app.kubernetes.io/component + +例子: `app.kubernetes.io/component=database` + +用于: 所有对象 + +架构中的组件。 + +[推荐标签](/zh/docs/concepts/overview/working-with-objects/common-labels/#labels)之一。 + + +### app.kubernetes.io/created-by + +示例：`app.kubernetes.io/created-by=controller-manager` + +用于：所有对象 + +创建此资源的控制器/用户。 + +[推荐标签](/zh/docs/concepts/overview/working-with-objects/common-labels/#labels)之一。 + + +### app.kubernetes.io/instance + +示例：`app.kubernetes.io/instance=mysql-abcxzy` + +用于：所有对象 + +标识应用实例的唯一名称。 + +[推荐标签](/zh/docs/concepts/overview/working-with-objects/common-labels/#labels)之一。 + + +### app.kubernetes.io/managed-by + +示例：`app.kubernetes.io/managed-by=helm` + +用于：所有对象 + +用于管理应用操作的工具。 + +[推荐标签](/zh/docs/concepts/overview/working-with-objects/common-labels/#labels)之一。 + + + +### app.kubernetes.io/name + +示例：`app.kubernetes.io/name=mysql` + +用于：所有对象 + +应用的名称。 + +[推荐标签](/zh/docs/concepts/overview/working-with-objects/common-labels/#labels)之一。 + + +### app.kubernetes.io/part-of + +示例：`app.kubernetes.io/part-of=wordpress` + +用于：所有对象 + +此应用所属的更高级别应用的名称。 + +[推荐标签](/zh/docs/concepts/overview/working-with-objects/common-labels/#labels)之一。 + + +### app.kubernetes.io/version + +示例：`app.kubernetes.io/version="5.7.21"` + +用于：所有对象 + +应用的当前版本（例如，语义版本、修订哈希等）。 + +[推荐标签](/zh/docs/concepts/overview/working-with-objects/common-labels/#labels)之一。 + + -## API 对象上使用的标签、注解和污点 +The Kubelet populates this with `runtime.GOARCH` as defined by Go. This can be handy if you are mixing arm and x86 nodes. --> ### kubernetes.io/arch {#kubernetes-io-arch} @@ -185,8 +321,6 @@ Used on: Pod This annotation is used to set [Pod Deletion Cost](/docs/concepts/workloads/controllers/replicaset/#pod-deletion-cost) which allows users to influence ReplicaSet downscaling order. The annotation parses into an `int32` type. - -### beta.kubernetes.io/instance-type (deprecated) --> ### controller.kubernetes.io/pod-deletion-cost {#pod-deletion-cost} @@ -194,8 +328,85 @@ which allows users to influence ReplicaSet downscaling order. The annotation par 用于：Pod -该注解用于设置 [Pod 删除成本](/docs/concepts/workloads/controllers/replicaset/#pod-deletion-cost) 允许用户影响 ReplicaSet 缩减顺序。注解解析为 `int32` 类型。 +该注解用于设置 [Pod 删除成本](/docs/concepts/workloads/controllers/replicaset/#pod-deletion-cost)允许用户影响 ReplicaSet 缩减顺序。注解解析为 `int32` 类型。 + + +### kubernetes.io/ingress-bandwidth + +{{< note >}} +入站流量控制注解是一项实验性功能。 +如果要启用流量控制支持，必须将`bandwidth`插件添加到 CNI 配置文件（默认为`/etc/cni/net.d`） +并确保二进制文件包含在你的 CNI bin 目录中（默认为`/opt/cni/bin`）。 +{{< /note >}} + +示例：`kubernetes.io/ingress-bandwidth: 10M` + +用于：Pod + +你可以对 Pod 应用服务质量流量控制并有效限制其可用带宽。 +入站流量（到 Pod）通过控制排队的数据包来处理，以有效地处理数据。 +要限制 Pod 的带宽，请编写对象定义 JSON 文件并使用 `kubernetes.io/ingress-bandwidth` +注解指定数据流量速度。 用于指定入站的速率单位是每秒， +作为[量纲（Quantity）](/zh/docs/reference/kubernetes-api/common-definitions/quantity/)。 +例如，`10M`表示每秒 10 兆比特。 + + + +### kubernetes.io/egress-bandwidth + +{{< note >}} +出站流量控制注解是一项实验性功能。 +如果要启用流量控制支持，必须将`bandwidth`插件添加到 CNI 配置文件（默认为`/etc/cni/net.d`） +并确保二进制文件包含在你的 CNI bin 目录中（默认为`/opt/cni/bin`）。 +{{< /note >}} + +示例：`kubernetes.io/egress-bandwidth: 10M` + +用于：Pod + +出站流量（来自 pod）由策略控制，策略只是丢弃超过配置速率的数据包。 +你为一个 Pod 所设置的限制不会影响其他 Pod 的带宽。 +要限制 Pod 的带宽，请编写对象定义 JSON 文件并使用 `kubernetes.io/egress-bandwidth` 注解指定数据流量速度。 +用于指定出站的速率单位是每秒比特数， +以[量纲（Quantity）](/zh/docs/reference/kubernetes-api/common-definitions/quantity/)的形式给出。 +例如，`10M` 表示每秒 10 兆比特。 + + ### beta.kubernetes.io/instance-type (已弃用) {#beta-kubernetes-io-instance-type} ## 用于审计的注解 {#annonations-used-for-audit} -- [`pod-security.kubernetes.io/exempt`](/zh/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-exempt) -- [`pod-security.kubernetes.io/enforce-policy`](/zh/zh/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-enforce-policy) +- [`authorization.k8s.io/decision`](/zh/docs/reference/labels-annotations-taints/audit-annotations/#authorization-k8s-io-decision) +- [`authorization.k8s.io/reason`](/zh/docs/reference/labels-annotations-taints/audit-annotations/#authorization-k8s-io-reason) - [`pod-security.kubernetes.io/audit-violations`](/zh/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-audit-violations) +- [`pod-security.kubernetes.io/enforce-policy`](/zh/zh/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-enforce-policy) +- [`pod-security.kubernetes.io/exempt`](/zh/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-exempt) 在[审计注解](/zh/docs/reference/labels-annotations-taints/audit-annotations/)页面上查看更多详细信息。 \ No newline at end of file From a6266075395830bcf2a43dda3daf754550b2a458 Mon Sep 17 00:00:00 2001 From: "Mr. Erlison" Date: Fri, 22 Apr 2022 09:34:59 -0300 Subject: [PATCH 045/101] Add /pt-br/docs/reference/glossary/api-group.md --- .../docs/reference/glossary/api-group.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 content/pt-br/docs/reference/glossary/api-group.md diff --git a/content/pt-br/docs/reference/glossary/api-group.md b/content/pt-br/docs/reference/glossary/api-group.md new file mode 100644 index 0000000000..14529f0fca --- /dev/null +++ b/content/pt-br/docs/reference/glossary/api-group.md @@ -0,0 +1,19 @@ +--- +title: Grupo de APIs +id: api-group +date: 2019-09-02 +full_link: /docs/concepts/overview/kubernetes-api/#api-groups-and-versioning +short_description: > + Um conjunto de caminhos relacionados da API Kubernetes. + +aka: +tags: +- fundamental +- architecture +--- +Um conjunto de caminhos relacionados da API Kubernetes. + + +Você pode ativar ou desativar cada grupo de APIs alterando a configuração do seu servidor de API. Você também pode desativar ou ativar caminhos para recursos específicos. O grupo de APIs facilita a extensão da API do Kubernetes. O grupo de APIs é especificado em um caminho REST e no campo `apiVersion` de um objeto serializado. + +* Leia o [Grupo de API](/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning) para obter mais informações. \ No newline at end of file From 30f16e5fef601a3d1edcd5e9a9052de5e7f7f164 Mon Sep 17 00:00:00 2001 From: "Mr. Erlison" Date: Fri, 22 Apr 2022 13:54:57 -0300 Subject: [PATCH 046/101] Translate cross-SIG term --- content/pt-br/docs/reference/glossary/wg.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/pt-br/docs/reference/glossary/wg.md b/content/pt-br/docs/reference/glossary/wg.md index 008a88ecc8..56fb60dfe4 100644 --- a/content/pt-br/docs/reference/glossary/wg.md +++ b/content/pt-br/docs/reference/glossary/wg.md @@ -4,13 +4,13 @@ id: wg date: 2018-04-12 full_link: https://github.com/kubernetes/community/blob/master/sig-list.md#master-working-group-list short_description: > - Facilita a discussão e/ou implementação de um projeto de curta duração, curto ou dissociado para um comitê, SIG ou cross-SIG. + Facilita a discussão e/ou implementação de um projeto de curta duração, pontual ou dissociado para um comitê, envolvendo um ou mais SIG (grupos de interesse especial). aka: tags: - community --- - Facilita a discussão e/ou implementação de um projeto de curta duração, curto ou dissociado para um comitê, {{< glossary_tooltip text="SIG" term_id="sig" >}} ou cross-SIG. + Facilita a discussão e/ou implementação de um projeto de curta duração, pontual ou dissociado para um comitê, envolvendo um ou mais {{< glossary_tooltip text="SIG" term_id="sig" >}} (grupos de interesse especial). From 6613b13b65602284a27a78b180f8468a7dbab144 Mon Sep 17 00:00:00 2001 From: Wang Date: Sat, 23 Apr 2022 03:39:36 +0900 Subject: [PATCH 047/101] [ja] Translate tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you into Japanese (#31285) * done * change back * done * Update content/ja/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md Co-authored-by: nasa9084 * fix * Update content/ja/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md Co-authored-by: inductor(Kohei) * Update content/ja/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md Co-authored-by: inductor(Kohei) * Update content/ja/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md Co-authored-by: Ryota Yamada * Update content/ja/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md Co-authored-by: Ryota Yamada * Update content/ja/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md Co-authored-by: Ryota Yamada Co-authored-by: nasa9084 Co-authored-by: inductor(Kohei) Co-authored-by: Ryota Yamada --- ...k-if-dockershim-deprecation-affects-you.md | 62 +++++++++++++++++++ 1 file changed, 62 insertions(+) create mode 100644 content/ja/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md diff --git a/content/ja/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md b/content/ja/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md new file mode 100644 index 0000000000..f854f051f7 --- /dev/null +++ b/content/ja/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you.md @@ -0,0 +1,62 @@ +--- +title: Dockershim非推奨の影響範囲を確認する +content_type: task +weight: 20 +--- + + +Kubernetesの`dockershim`コンポーネントは、DockerをKubernetesの{{< glossary_tooltip text="コンテナランタイム" term_id="container-runtime" >}}として使用することを可能にします。 + +Kubernetesの組み込みコンポーネントである`dockershim`はリリースv1.20で非推奨となりました。 + +このページでは、あなたのクラスターがどのようにDockerをコンテナランタイムとして使用しているか、使用中の`dockershim`が果たす役割について詳しく説明し、`dockershim`の廃止によって影響を受けるワークロードがあるかどうかをチェックするためのステップを示します。 + +## 自分のアプリがDockerに依存しているかどうかの確認 {#find-docker-dependencies} + +アプリケーションコンテナの構築にDockerを使用している場合でも、これらのコンテナを任意のコンテナランタイム上で実行することができます。このようなDockerの使用は、コンテナランタイムとしてのDockerへの依存とはみなされません。 + +代替のコンテナランタイムが使用されている場合、Dockerコマンドを実行しても動作しないか、予期せぬ出力が得られる可能性があります。 + +このように、Dockerへの依存があるかどうかを調べることができます: + +1. 特権を持つPodがDockerコマンド(`docker ps`など)を実行したり、Dockerサービスを再起動したり(`systemctl restart docker.service`などのコマンド)、Docker固有のファイル(`/etc/docker/daemon.json`など)を変更しないことを確認すること。 +1. Dockerの設定ファイル(`/etc/docker/daemon.json` など)にプライベートレジストリやイメージミラーの設定がないか確認します。これらは通常、別のコンテナランタイムのために再設定する必要があります。 +1. Kubernetesインフラストラクチャーの外側のノードで実行される以下のようなスクリプトやアプリがDockerコマンドを実行しないことを確認します。 + - トラブルシューティングのために人間がノードにSSHで接続 + - ノードのスタートアップスクリプト + - ノードに直接インストールされた監視エージェントやセキュリティエージェント +1. 上記のような特権的な操作を行うサードパーティツール。詳しくは[Migrating telemetry and security agents from dockershim](/docs/tasks/administer-cluster/migrating-from-dockershim/migrating-telemetry-and-security-agents) を参照してください。 +1. dockershimの動作に間接的な依存性がないことを確認します。 + これはエッジケースであり、あなたのアプリケーションに影響を与える可能性は低いです。ツールによっては、Docker固有の動作に反応するように設定されている場合があります。例えば、特定のメトリクスでアラートを上げたり、トラブルシューティングの指示の一部として特定のログメッセージを検索したりします。そのようなツールを設定している場合、移行前にテストクラスターで動作をテストしてください。 + +## Dockerへの依存について解説 {#role-of-dockershim} + +[コンテナランタイム](/ja/docs/concepts/containers/#container-runtimes)とは、Kubernetes Podを構成するコンテナを実行できるソフトウェアです。 + +KubernetesはPodのオーケストレーションとスケジューリングを担当し、各ノードでは{{< glossary_tooltip text="kubelet" term_id="kubelet" >}}がコンテナランタイムインターフェイスを抽象化して使用するので、互換性があればどのコンテナランタイムでも使用することができます。 +初期のリリースでは、Kubernetesは1つのコンテナランタイムと互換性を提供していました: Dockerです。 +その後、Kubernetesプロジェクトの歴史の中で、クラスター運用者は追加のコンテナランタイムを採用することを希望しました。 +CRIはこのような柔軟性を可能にするために設計され、kubeletはCRIのサポートを開始しました。 +しかし、DockerはCRI仕様が考案される前から存在していたため、Kubernetesプロジェクトはアダプタコンポーネント「dockershim」を作成しました。 + +dockershimアダプターは、DockerがCRI互換ランタイムであるかのように、kubeletがDockerと対話することを可能にします。 +[Kubernetes Containerd integration goes GA](/blog/2018/05/24/kubernetes-containerd-integration-goes-ga/)ブログ記事で紹介されています。 + +![Dockershim vs. CRI with Containerd](/images/blog/2018-05-24-kubernetes-containerd-integration-goes-ga/cri-containerd.png) + +コンテナランタイムとしてContainerdに切り替えることで、中間マージンを排除することができます。 +これまでと同じように、Containerdのようなコンテナランタイムですべてのコンテナを実行できます。 +しかし今は、コンテナはコンテナランタイムで直接スケジュールするので、Dockerからは見えません。 +そのため、これらのコンテナをチェックするために以前使っていたかもしれないDockerツールや派手なUIは、もはや利用できません。 +`docker ps`や`docker inspect`を使用してコンテナ情報を取得することはできません。 +コンテナを一覧表示できないので、ログを取得したり、コンテナを停止したり、`docker exec`を使用してコンテナ内で何かを実行したりすることもできません。 + +{{< note >}} + +Kubernetes経由でワークロードを実行している場合、コンテナを停止する最善の方法は、コンテナランタイムを直接経由するよりもKubernetes APIを経由することです(このアドバイスはDockerだけでなく、すべてのコンテナランタイムに適用されます)。 + +{{< /note >}} + +この場合でも、イメージを取得したり、`docker build`コマンドを使用してビルドすることは可能です。 +しかし、Dockerによってビルドまたはプルされたイメージは、コンテナランタイムとKubernetesからは見えません。 +Kubernetesで使用できるようにするには、何らかのレジストリにプッシュする必要がありました。 From 4b85c7b058258d2fd7ca57dbbaf942d146a22d78 Mon Sep 17 00:00:00 2001 From: Wang Date: Sat, 23 Apr 2022 03:41:36 +0900 Subject: [PATCH 048/101] [ja] Translate tasks/debug-application-cluster/debug-cluster into Japanese #30874 (#31087) * done * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update debug-cluster.md * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: nasa9084 * Apply suggestions from code review Co-authored-by: nasa9084 * Update debug-cluster.md * Update content/ja/docs/tasks/debug-application-cluster/debug-cluster.md Co-authored-by: Ryota Yamada Co-authored-by: nasa9084 Co-authored-by: Ryota Yamada --- .../debug-cluster.md | 114 ++++++++++++++++++ 1 file changed, 114 insertions(+) create mode 100644 content/ja/docs/tasks/debug-application-cluster/debug-cluster.md diff --git a/content/ja/docs/tasks/debug-application-cluster/debug-cluster.md b/content/ja/docs/tasks/debug-application-cluster/debug-cluster.md new file mode 100644 index 0000000000..34803b2b6b --- /dev/null +++ b/content/ja/docs/tasks/debug-application-cluster/debug-cluster.md @@ -0,0 +1,114 @@ +--- +title: クラスターのトラブルシューティング +content_type: concept +--- + + + +このドキュメントはクラスターのトラブルシューティングに関するもので、あなたが経験している問題の根本原因として、アプリケーションをすでに除外していることを前提としています。 +アプリケーションのデバッグのコツは、[application troubleshooting guide](/docs/tasks/debug-application-cluster/debug-application)をご覧ください。 +また、[troubleshooting document](/docs/tasks/debug-application-cluster/troubleshooting/)にも詳しい情報があります。 + + + +## クラスターのリストアップ + +クラスターで最初にデバッグするのは、ノードがすべて正しく登録されているかどうかです。 + +```shell +kubectl get nodes +``` + +そして、期待するノードがすべて存在し、それらがすべて `Ready` 状態であることを確認します。 + +クラスター全体の健全性に関する詳細な情報を得るには、以下を実行します。 + +```shell +kubectl cluster-info dump +``` +## ログの確認 + +今のところ、クラスターをより深く掘り下げるには、関連するマシンにログインする必要があります。 +以下は、関連するログファイルの場所です。 +(systemdベースのシステムでは、代わりに `journalctl` を使う必要があるかもしれないことに注意してください) + +### マスターノード + + * `/var/log/kube-apiserver.log` - APIの提供を担当するAPIサーバーのログ + * `/var/log/kube-scheduler.log` - スケジューリング決定責任者であるスケジューラーのログ + * `/var/log/kube-controller-manager.log` - レプリケーションコントローラーを管理するコントローラーのログ + +### ワーカーノード + + * `/var/log/kubelet.log` - ノード上でコンテナの実行を担当するKubeletのログ + * `/var/log/kube-proxy.log` - サービスのロードバランシングを担うKube Proxyのログ + +## クラスター障害モードの一般的な概要 + +これは、問題が発生する可能性のある事柄と、問題を軽減するためにクラスターのセットアップを調整する方法の不完全なリストです。 + +### 根本的な原因 + + - VMのシャットダウン + - クラスター内、またはクラスターとユーザー間のネットワークパーティション + - Kubernetesソフトウェアのクラッシュ + - データの損失や永続的ストレージ(GCE PDやAWS EBSボリュームなど)の使用不能 + - Kubernetesソフトウェアやアプリケーションソフトウェアの設定ミスなど、オペレーターのミス + +### 具体的なシナリオ + + - apiserver VMのシャットダウンまたはapiserverのクラッシュ + - 新しいPod、サービス、レプリケーションコントローラの停止、更新、起動ができない + - Kubernetes APIに依存していない限り、既存のPodやサービスは正常に動作し続けるはずです + - apiserverのバックアップストレージが失われた + - apiserverが立ち上がらない + - kubeletsは到達できなくなりますが、同じPodを実行し、同じサービスのプロキシを提供し続けます + - apiserverを再起動する前に、手動でapiserverの状態を回復または再現する必要がある + - サポートサービス(ノードコントローラ、レプリケーションコントローラーマネージャー、スケジューラーなど)VMのシャットダウンまたはクラッシュ + - 現在、これらはapiserverとコロケーションしており、使用できない場合はapiserverと同様の影響があります + - 将来的には、これらも複製されるようになり、同じ場所に配置されない可能性があります + - 独自の永続的な状態を持っていない。 + + - 個別ノード(VMまたは物理マシン)のシャットダウン + - そのノード上のPodの実行を停止 + - ネットワークパーティション + - パーティションAはパーティションBのノードがダウンしていると考え、パーティションBはapiserverがダウンしていると考えています。(マスターVMがパーティションAで終了したと仮定) + - Kubeletソフトウェア障害 + - クラッシュしたkubeletがノード上で新しいPodを起動できない + - kubeletがPodを削除するかどうか + - ノードが不健全と判定される + - レプリケーションコントローラーが別の場所で新しいPodを起動する + - クラスターオペレーターエラー + - PodやServiceなどの損失 + - apiserverのバックエンドストレージの紛失 + - ユーザーがAPIを読めなくなる + - その他 + +### 軽減策 + +- 対処法: IaaSプロバイダーの自動VM再起動機能をIaaS VMに使用する + - 異常: Apiserver VMのシャットダウンまたはApiserverのクラッシュ + - 異常: サポートサービスのVMシャットダウンまたはクラッシュ + +- 対処法: IaaSプロバイダーの信頼できるストレージ(GCE PDやAWS EBSボリュームなど)をapiserver+etcdを使用するVMに使用する + - 異常: Apiserverのバックエンドストレージが失われる + +- 対処法: [高可用性](/docs/setup/production-environment/tools/kubeadm/high-availability/)構成を使用します + - 異常: コントロールプレーンノードのシャットダウンまたはコントロールプレーンコンポーネント(スケジューラー、APIサーバー、コントローラーマネージャー)のクラッシュ + - 1つ以上のノードまたはコンポーネントの同時故障に耐えることができる + - 異常: APIサーバーのバックアップストレージ(etcdのデータディレクトリーなど)が消失 + - HA(高可用性) etcdの構成を想定しています + +- 対処法: apiserver PDs/EBS-volumesを定期的にスナップショットする + - 異常: Apiserver のバックエンドストレージが失われる + - 異常: 操作ミスが発生する場合がある + - 異常: Kubernetesのソフトウェアに障害が発生する場合がある + +- 対処法：レプリケーションコントローラーとServiceをPodの前に使用する + - 異常: ノードのシャットダウン + - 異常: Kubeletソフトウェア障害 + +- 対処法: 予期せぬ再起動に耐えられるように設計されたアプリケーション(コンテナ) + - 異常: ノードのシャットダウン + - 異常: Kubeletソフトウェア障害 + From e71768592e5b438da293b8fa03ecdbcfd3f69c68 Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Sat, 23 Apr 2022 10:56:34 +0800 Subject: [PATCH 049/101] Tweak the Nodes page Field names like `NodeReady`, `ConditionUnknown` etc are only meaningful for developers, rather than users. --- content/en/docs/concepts/architecture/nodes.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/content/en/docs/concepts/architecture/nodes.md b/content/en/docs/concepts/architecture/nodes.md index 4d3534492e..bc266c3597 100644 --- a/content/en/docs/concepts/architecture/nodes.md +++ b/content/en/docs/concepts/architecture/nodes.md @@ -312,16 +312,18 @@ controller deletes the node from its list of nodes. The third is monitoring the nodes' health. The node controller is responsible for: -- In the case that a node becomes unreachable, updating the NodeReady condition - of within the Node's `.status`. In this case the node controller sets the - NodeReady condition to `ConditionUnknown`. +- In the case that a node becomes unreachable, updating the `Ready` condition + in the Node's `.status` field. In this case the node controller sets the + `Ready` condition to `Unknown`. - If a node remains unreachable: triggering [API-initiated eviction](/docs/concepts/scheduling-eviction/api-eviction/) for all of the Pods on the unreachable node. By default, the node controller - waits 5 minutes between marking the node as `ConditionUnknown` and submitting + waits 5 minutes between marking the node as `Unknown` and submitting the first eviction request. -The node controller checks the state of each node every `--node-monitor-period` seconds. +By default, the node controller checks the state of each node every 5 seconds. +This period can be configured using the `--node-monitor-period` flag on the +`kube-controller-manager` component. ### Rate limits on eviction @@ -331,7 +333,7 @@ from more than 1 node per 10 seconds. The node eviction behavior changes when a node in a given availability zone becomes unhealthy. The node controller checks what percentage of nodes in the zone -are unhealthy (NodeReady condition is `ConditionUnknown` or `ConditionFalse`) at +are unhealthy (the `Ready` condition is `Unknown` or `False`) at the same time: - If the fraction of unhealthy nodes is at least `--unhealthy-zone-threshold` @@ -384,7 +386,7 @@ If you want to explicitly reserve resources for non-Pod processes, see ## Node topology -{{< feature-state state="alpha" for_k8s_version="v1.16" >}} +{{< feature-state state="beta" for_k8s_version="v1.18" >}} If you have enabled the `TopologyManager` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/), then @@ -412,7 +414,7 @@ enabled by default in 1.21. Note that by default, both configuration options described below, `shutdownGracePeriod` and `shutdownGracePeriodCriticalPods` are set to zero, -thus not activating Graceful node shutdown functionality. +thus not activating the graceful node shutdown functionality. To activate the feature, the two kubelet config settings should be configured appropriately and set to non-zero values. From a27c23e081fd76306120a1d8adc2dfb8c3356d56 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Sat, 23 Apr 2022 11:13:02 +0800 Subject: [PATCH 050/101] [en] fix wrong link Signed-off-by: xin.li --- .../blog/_posts/2021-12-16-StatefulSet-PVC-Auto-Deletion.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/en/blog/_posts/2021-12-16-StatefulSet-PVC-Auto-Deletion.md b/content/en/blog/_posts/2021-12-16-StatefulSet-PVC-Auto-Deletion.md index 56e0df7416..a436694640 100644 --- a/content/en/blog/_posts/2021-12-16-StatefulSet-PVC-Auto-Deletion.md +++ b/content/en/blog/_posts/2021-12-16-StatefulSet-PVC-Auto-Deletion.md @@ -8,8 +8,8 @@ slug: kubernetes-1-23-statefulset-pvc-auto-deletion **Author:** Matthew Cary (Google) Kubernetes v1.23 introduced a new, alpha-level policy for -[StatefulSets](docs/concepts/workloads/controllers/statefulset/) that controls the lifetime of -[PersistentVolumeClaims](docs/concepts/storage/persistent-volumes/) (PVCs) generated from the +[StatefulSets](/docs/concepts/workloads/controllers/statefulset/) that controls the lifetime of +[PersistentVolumeClaims](/docs/concepts/storage/persistent-volumes/) (PVCs) generated from the StatefulSet spec template for cases when they should be deleted automatically when the StatefulSet is deleted or pods in the StatefulSet are scaled down. @@ -82,7 +82,7 @@ This policy forms a matrix with four cases. I’ll walk through and give an exam new replicas will automatically use them. Visit the -[documentation](docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-policies) to +[documentation](/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-policies) to see all the details. ## What’s next? From 1ab38bbaa1a12107bf3b065078453c1f4e5a8fb1 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Sat, 23 Apr 2022 11:33:52 +0800 Subject: [PATCH 051/101] [en] fix wrong link Signed-off-by: xin.li --- .../en/docs/tasks/configure-pod-container/migrate-from-psp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/configure-pod-container/migrate-from-psp.md b/content/en/docs/tasks/configure-pod-container/migrate-from-psp.md index d8251158b2..1879ba5ba7 100644 --- a/content/en/docs/tasks/configure-pod-container/migrate-from-psp.md +++ b/content/en/docs/tasks/configure-pod-container/migrate-from-psp.md @@ -312,7 +312,7 @@ appropriate Pod Security profile is applied to new namespaces. You can also statically configure the Pod Security admission controller to set a default enforce, audit, and/or warn level for unlabeled namespaces. See -[Configure the Admission Controller](docs/tasks/configure-pod-container/enforce-standards-admission-controller/#configure-the-admission-controller) +[Configure the Admission Controller](/docs/tasks/configure-pod-container/enforce-standards-admission-controller/#configure-the-admission-controller) for more information. ## 5. Disable PodSecurityPolicy {#disable-psp} From c43e1ddb8f4a6b85208e3ed5c4ddf3acc0779b5b Mon Sep 17 00:00:00 2001 From: kinzhi Date: Sat, 23 Apr 2022 12:51:36 +0800 Subject: [PATCH 052/101] [zh]Update content/zh/docs/concepts/workloads/controllers/daemonset.md (#33120) * [zh]Update content/zh/docs/concepts/workloads/controllers/daemonset.md * Update content/zh/docs/concepts/workloads/controllers/daemonset.md Co-authored-by: Qiming Teng * Update content/zh/docs/concepts/workloads/controllers/daemonset.md Co-authored-by: Qiming Teng Co-authored-by: Qiming Teng --- .../workloads/controllers/daemonset.md | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/content/zh/docs/concepts/workloads/controllers/daemonset.md b/content/zh/docs/concepts/workloads/controllers/daemonset.md index db07f5e8a7..d8acb65797 100644 --- a/content/zh/docs/concepts/workloads/controllers/daemonset.md +++ b/content/zh/docs/concepts/workloads/controllers/daemonset.md @@ -136,9 +136,9 @@ A Pod Template in a DaemonSet must have a [`RestartPolicy`](/docs/concepts/workl The `.spec.selector` field is a pod selector. It works the same as the `.spec.selector` of a [Job](/docs/concepts/jobs/run-to-completion-finite-workloads/). -As of Kubernetes 1.8, you must specify a pod selector that matches the labels of the -`.spec.template`. The pod selector will no longer be defaulted when left empty. Selector -defaulting was not compatible with `kubectl apply`. Also, once a DaemonSet is created, +You must specify a pod selector that matches the labels of the +`.spec.template`. +Also, once a DaemonSet is created, its `.spec.selector` can not be mutated. Mutating the pod selector can lead to the unintentional orphaning of Pods, and it was found to be confusing to users. --> @@ -147,9 +147,7 @@ unintentional orphaning of Pods, and it was found to be confusing to users. `.spec.selector` 字段表示 Pod 选择算符，它与 [Job](/zh/docs/concepts/workloads/controllers/job/) 的 `.spec.selector` 的作用是相同的。 -从 Kubernetes 1.8 开始，您必须指定与 `.spec.template` 的标签匹配的 Pod 选择算符。 -用户不指定 Pod 选择算符时，该字段不再有默认值。 -选择算符的默认值生成结果与 `kubectl apply` 不兼容。 +你必须指定与 `.spec.template` 的标签匹配的 Pod 选择算符。 此外，一旦创建了 DaemonSet，它的 `.spec.selector` 就不能修改。 修改 Pod 选择算符可能导致 Pod 意外悬浮，并且这对用户来说是费解的。 @@ -175,11 +173,11 @@ When the two are specified the result is ANDed. 当上述两个字段都指定时，结果会按逻辑与（AND）操作处理。 -如果指定了 `.spec.selector`，必须与 `.spec.template.metadata.labels` 相匹配。 -如果与后者不匹配，则 DeamonSet 会被 API 拒绝。 +`.spec.selector` 必须与 `.spec.template.metadata.labels` 相匹配。 +如果配置中这两个字段不匹配，则会被 API 拒绝。 -1. [创建一个 Deployment 示例](zh/docs/tasks/run-application/run-stateless-application-deployment/#creating-and-exploring-an-nginx-deployment)。 +1. [创建一个 Deployment 示例](/zh/docs/tasks/run-application/run-stateless-application-deployment/#creating-and-exploring-an-nginx-deployment)。 1. 基于你的集群所运行的 Kubernetes 版本，使用 `kubectl` 或者 Kubernetes API 来删除 Deployment。 {{}} From 49114042bcc67f64d3ba63daead75362c69aca84 Mon Sep 17 00:00:00 2001 From: Arhell Date: Sat, 23 Apr 2022 13:08:45 +0300 Subject: [PATCH 055/101] [en] remove trailing whitespaces install-kubectl-windows.md --- content/en/docs/tasks/tools/install-kubectl-windows.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/tools/install-kubectl-windows.md b/content/en/docs/tasks/tools/install-kubectl-windows.md index 3fde98c309..4c2f175e89 100644 --- a/content/en/docs/tasks/tools/install-kubectl-windows.md +++ b/content/en/docs/tasks/tools/install-kubectl-windows.md @@ -69,7 +69,7 @@ The following methods exist for installing kubectl on Windows: Or use this for detailed view of version: ```cmd - kubectl version --client --output=yaml + kubectl version --client --output=yaml ``` {{< note >}} From 7007e5049a966936a5807ac19d08e68dcca4e497 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Sat, 23 Apr 2022 18:40:57 +0800 Subject: [PATCH 056/101] [zh] Update migrate-from-psp.md Signed-off-by: xin.li --- .../zh/docs/tasks/configure-pod-container/migrate-from-psp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/tasks/configure-pod-container/migrate-from-psp.md b/content/zh/docs/tasks/configure-pod-container/migrate-from-psp.md index 9c0715c99f..29d3396de7 100644 --- a/content/zh/docs/tasks/configure-pod-container/migrate-from-psp.md +++ b/content/zh/docs/tasks/configure-pod-container/migrate-from-psp.md @@ -608,7 +608,7 @@ appropriate Pod Security profile is applied to new namespaces. 你也可以静态配置 Pod 安全性准入控制器，为尚未打标签的名字空间设置默认的 From b31b7f86afd4c6de6a5ff86f71820818dd36f52b Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Sat, 23 Apr 2022 18:44:16 +0800 Subject: [PATCH 057/101] [zh] Update blog/2021-12-16-StatefulSet-PVC-Auto-Deletion.md Signed-off-by: xin.li --- .../blog/_posts/2021-12-16-StatefulSet-PVC-Auto-Deletion.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/zh/blog/_posts/2021-12-16-StatefulSet-PVC-Auto-Deletion.md b/content/zh/blog/_posts/2021-12-16-StatefulSet-PVC-Auto-Deletion.md index e5d592c4e6..6722e9bd4e 100644 --- a/content/zh/blog/_posts/2021-12-16-StatefulSet-PVC-Auto-Deletion.md +++ b/content/zh/blog/_posts/2021-12-16-StatefulSet-PVC-Auto-Deletion.md @@ -18,8 +18,8 @@ slug: kubernetes-1-23-statefulset-pvc-auto-deletion @@ -165,7 +165,7 @@ This policy forms a matrix with four cases. I’ll walk through and give an exam 查阅[文档](/zh/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-policies) From 0aca1901e35c8142126d2a42a03d773589730332 Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Sat, 23 Apr 2022 19:00:43 +0800 Subject: [PATCH 058/101] [zh]adjust the layout --- .../blog/_posts/2021-12-16-StatefulSet-PVC-Auto-Deletion.md | 6 +++--- .../blog/_posts/2022-05-03-dockershim-historical-context.md | 2 +- .../docs/tasks/configure-pod-container/migrate-from-psp.md | 2 +- content/zh/docs/tasks/tools/install-kubectl-windows.md | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/content/zh/blog/_posts/2021-12-16-StatefulSet-PVC-Auto-Deletion.md b/content/zh/blog/_posts/2021-12-16-StatefulSet-PVC-Auto-Deletion.md index e5d592c4e6..6722e9bd4e 100644 --- a/content/zh/blog/_posts/2021-12-16-StatefulSet-PVC-Auto-Deletion.md +++ b/content/zh/blog/_posts/2021-12-16-StatefulSet-PVC-Auto-Deletion.md @@ -18,8 +18,8 @@ slug: kubernetes-1-23-statefulset-pvc-auto-deletion @@ -165,7 +165,7 @@ This policy forms a matrix with four cases. I’ll walk through and give an exam 查阅[文档](/zh/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-policies) diff --git a/content/zh/blog/_posts/2022-05-03-dockershim-historical-context.md b/content/zh/blog/_posts/2022-05-03-dockershim-historical-context.md index eec914eeb6..5a99445271 100644 --- a/content/zh/blog/_posts/2022-05-03-dockershim-historical-context.md +++ b/content/zh/blog/_posts/2022-05-03-dockershim-historical-context.md @@ -59,7 +59,7 @@ However, this little software shim was never intended to be a permanent solution 建议移除 dockershim。 随着 Kubernetes v1.20 的发布，正式弃用。 我们没有很好地传达这一点，不幸的是，弃用公告在社区内引起了一些恐慌。关于这对 Docker 作为 一家公司意味着什么，Docker 构建的容器镜像是否仍然可以运行，以及 Docker Engine 究竟是 diff --git a/content/zh/docs/tasks/configure-pod-container/migrate-from-psp.md b/content/zh/docs/tasks/configure-pod-container/migrate-from-psp.md index 9c0715c99f..29d3396de7 100644 --- a/content/zh/docs/tasks/configure-pod-container/migrate-from-psp.md +++ b/content/zh/docs/tasks/configure-pod-container/migrate-from-psp.md @@ -608,7 +608,7 @@ appropriate Pod Security profile is applied to new namespaces. 你也可以静态配置 Pod 安全性准入控制器，为尚未打标签的名字空间设置默认的 diff --git a/content/zh/docs/tasks/tools/install-kubectl-windows.md b/content/zh/docs/tasks/tools/install-kubectl-windows.md index 921a8e13a9..1df66e7c6b 100644 --- a/content/zh/docs/tasks/tools/install-kubectl-windows.md +++ b/content/zh/docs/tasks/tools/install-kubectl-windows.md @@ -120,7 +120,7 @@ The following methods exist for installing kubectl on Windows: ``` 或者使用下面命令来查看版本的详细信息： ```cmd - kubectl version --client --output=yaml + kubectl version --client --output=yaml ``` From b86b43d27371257514fe285bcf23df15a1a93950 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Sat, 23 Apr 2022 21:25:02 +0800 Subject: [PATCH 059/101] [zh] Sync examples/priority-and-fairness/health-for-strangers.yaml Signed-off-by: xin.li --- .../zh/examples/priority-and-fairness/health-for-strangers.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/examples/priority-and-fairness/health-for-strangers.yaml b/content/zh/examples/priority-and-fairness/health-for-strangers.yaml index 79ee80ab17..c57e2cae37 100644 --- a/content/zh/examples/priority-and-fairness/health-for-strangers.yaml +++ b/content/zh/examples/priority-and-fairness/health-for-strangers.yaml @@ -1,4 +1,4 @@ -apiVersion: flowcontrol.apiserver.k8s.io/v1alpha1 +apiVersion: flowcontrol.apiserver.k8s.io/v1beta2 kind: FlowSchema metadata: name: health-for-strangers From d239f341b2551182bff62af0ae3a47e6f5061943 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Sat, 23 Apr 2022 21:31:24 +0800 Subject: [PATCH 060/101] [zh] Sync examples/pods/resource/yaml Signed-off-by: xin.li --- content/zh/examples/pods/resource/memory-request-limit-3.yaml | 4 ++-- content/zh/examples/pods/resource/memory-request-limit.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/content/zh/examples/pods/resource/memory-request-limit-3.yaml b/content/zh/examples/pods/resource/memory-request-limit-3.yaml index 9f089c4a7a..d816393986 100644 --- a/content/zh/examples/pods/resource/memory-request-limit-3.yaml +++ b/content/zh/examples/pods/resource/memory-request-limit-3.yaml @@ -8,9 +8,9 @@ spec: - name: memory-demo-3-ctr image: polinux/stress resources: - limits: - memory: "1000Gi" requests: memory: "1000Gi" + limits: + memory: "1000Gi" command: ["stress"] args: ["--vm", "1", "--vm-bytes", "150M", "--vm-hang", "1"] diff --git a/content/zh/examples/pods/resource/memory-request-limit.yaml b/content/zh/examples/pods/resource/memory-request-limit.yaml index 985b1308d9..07ce3e7d3c 100644 --- a/content/zh/examples/pods/resource/memory-request-limit.yaml +++ b/content/zh/examples/pods/resource/memory-request-limit.yaml @@ -8,9 +8,9 @@ spec: - name: memory-demo-ctr image: polinux/stress resources: - limits: - memory: "200Mi" requests: memory: "100Mi" + limits: + memory: "200Mi" command: ["stress"] args: ["--vm", "1", "--vm-bytes", "150M", "--vm-hang", "1"] From c8e35e23f0b33a9ae94d53ac66c53d29c5bdc5e2 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Sat, 23 Apr 2022 21:35:41 +0800 Subject: [PATCH 061/101] [zh] Sync examples/pods/security/seccomp/ga Signed-off-by: xin.li --- .../zh/examples/pods/security/seccomp/ga/default-pod.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/zh/examples/pods/security/seccomp/ga/default-pod.yaml b/content/zh/examples/pods/security/seccomp/ga/default-pod.yaml index fbeec4c167..b884ec5924 100644 --- a/content/zh/examples/pods/security/seccomp/ga/default-pod.yaml +++ b/content/zh/examples/pods/security/seccomp/ga/default-pod.yaml @@ -1,9 +1,9 @@ apiVersion: v1 kind: Pod metadata: - name: audit-pod + name: default-pod labels: - app: audit-pod + app: default-pod spec: securityContext: seccompProfile: @@ -12,6 +12,6 @@ spec: - name: test-container image: hashicorp/http-echo:0.2.3 args: - - "-text=just made some syscalls!" + - "-text=just made some more syscalls!" securityContext: allowPrivilegeEscalation: false \ No newline at end of file From efb56c01ba84d6943fce391645427ac1bd3d9629 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Sat, 23 Apr 2022 21:41:01 +0800 Subject: [PATCH 062/101] [zh] Sync application/zookeeper/zookerper.yaml Signed-off-by: xin.li --- content/zh/examples/application/zookeeper/zookeeper.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/examples/application/zookeeper/zookeeper.yaml b/content/zh/examples/application/zookeeper/zookeeper.yaml index a858a72613..4d893b369b 100644 --- a/content/zh/examples/application/zookeeper/zookeeper.yaml +++ b/content/zh/examples/application/zookeeper/zookeeper.yaml @@ -27,7 +27,7 @@ spec: selector: app: zk --- -apiVersion: policy/v1beta1 +apiVersion: policy/v1 kind: PodDisruptionBudget metadata: name: zk-pdb From ff9e790f42069a8d258de32bc3938d451b7ea8fd Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Sat, 23 Apr 2022 22:42:52 +0800 Subject: [PATCH 063/101] [zh]Sync english doc format --- content/zh/docs/concepts/architecture/cloud-controller.md | 2 +- content/zh/docs/concepts/overview/what-is-kubernetes.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/zh/docs/concepts/architecture/cloud-controller.md b/content/zh/docs/concepts/architecture/cloud-controller.md index b08edad800..05caa7690f 100644 --- a/content/zh/docs/concepts/architecture/cloud-controller.md +++ b/content/zh/docs/concepts/architecture/cloud-controller.md @@ -142,7 +142,7 @@ IP 地址、网络包过滤、目标健康检查等云基础设施组件集成 ## 鉴权 {#authorization} diff --git a/content/zh/docs/concepts/overview/what-is-kubernetes.md b/content/zh/docs/concepts/overview/what-is-kubernetes.md index 97110f4f51..9d2f772089 100644 --- a/content/zh/docs/concepts/overview/what-is-kubernetes.md +++ b/content/zh/docs/concepts/overview/what-is-kubernetes.md @@ -29,7 +29,7 @@ This page is an overview of Kubernetes. Kubernetes 是一个可移植的、可扩展的开源平台，用于管理容器化的工作负载和服务，可促进声明式配置和自动化。 Kubernetes 拥有一个庞大且快速增长的生态系统。Kubernetes 的服务、支持和工具广泛可用。 From 87772570f342ef8372654eeac3022796eb7911d4 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Sat, 23 Apr 2022 22:47:09 +0800 Subject: [PATCH 064/101] [zh] Update zookeeper.md Signed-off-by: xin.li --- .../stateful-application/zookeeper.md | 46 +++++++++++++++++-- 1 file changed, 42 insertions(+), 4 deletions(-) diff --git a/content/zh/docs/tutorials/stateful-application/zookeeper.md b/content/zh/docs/tutorials/stateful-application/zookeeper.md index afde43615a..e54ea6830f 100644 --- a/content/zh/docs/tutorials/stateful-application/zookeeper.md +++ b/content/zh/docs/tutorials/stateful-application/zookeeper.md @@ -981,6 +981,8 @@ statefulset rolling update complete 3 pods at revision zk-5db4499664... This terminates the Pods, one at a time, in reverse ordinal order, and recreates them with the new configuration. This ensures that quorum is maintained during a rolling update. Use the `kubectl rollout history` command to view a history or previous configurations. + +The output is similar to this: --> 这项操作会逆序地依次终止每一个 Pod，并用新的配置重新创建。 这样做确保了在滚动更新的过程中 quorum 依旧保持工作。 @@ -991,6 +993,8 @@ Use the `kubectl rollout history` command to view a history or previous configur kubectl rollout history sts/zk ``` +输出类似于： + ``` statefulsets "zk" REVISION @@ -1000,6 +1004,8 @@ REVISION 使用 `kubectl rollout undo` 命令撤销这次的改动。 @@ -1007,6 +1013,8 @@ Use the `kubectl rollout undo` command to roll back the modification. kubectl rollout undo sts/zk ``` +输出类似于： + ``` statefulset.apps/zk rolled back ``` @@ -1154,7 +1162,7 @@ In another window, using the following command to delete the `zookeeper-ready` s 在另一个窗口中，从 Pod `zk-0` 的文件系统中删除 `zookeeper-ready` 脚本。 ```shell -kubectl exec zk-0 -- rm /usr/bin/zookeeper-ready +kubectl exec zk-0 -- rm /opt/zookeeper/bin/zookeeper-ready ``` 使用 [`kubectl drain`](/docs/reference/generated/kubectl/kubectl-commands/#drain) @@ -1415,6 +1425,8 @@ drain the node on which the `zk-0` Pod is scheduled. kubectl drain $(kubectl get pod zk-0 --template {{.spec.nodeName}}) --ignore-daemonsets --force --delete-emptydir-data ``` +输出类似于： + ``` node "kubernetes-node-pb41" cordoned @@ -1449,14 +1461,19 @@ zk-0 1/1 Running 0 1m 在第一个终端中持续观察 `StatefulSet` 的 Pods 并腾空 `zk-1` 调度所在的节点。 ```shell -kubectl drain $(kubectl get pod zk-1 --template {{.spec.nodeName}}) --ignore-daemonsets --force -delete-emptydir-data "kubernetes-node-ixsl" cordoned +kubectl drain $(kubectl get pod zk-1 --template {{.spec.nodeName}}) --ignore-daemonsets --force --delete-emptydir-data ``` +输出类似于： + ``` +kubernetes-node-ixsl" cordoned WARNING: Deleting pods not managed by ReplicationController, ReplicaSet, Job, or DaemonSet: fluentd-cloud-logging-kubernetes-node-ixsl, kube-proxy-kubernetes-node-ixsl; Ignoring DaemonSet-managed pods: node-problem-detector-v0.1-voc74 pod "zk-1" deleted node "kubernetes-node-ixsl" drained @@ -1465,6 +1482,8 @@ node "kubernetes-node-ixsl" drained `zk-1` Pod 不能被调度，这是因为 `zk` `StatefulSet` 包含了一个防止 Pods 共存的 `PodAntiAffinity` 规则，而且只有两个节点可用于调度， @@ -1474,6 +1493,8 @@ co-location of the Pods, and as only two nodes are schedulable, the Pod will rem kubectl get pods -w -l app=zk ``` +输出类似于： + ``` NAME READY STATUS RESTARTS AGE zk-0 1/1 Running 2 1h @@ -1500,12 +1521,17 @@ zk-1 0/1 Pending 0 0s 继续观察 StatefulSet 中的 Pods 并腾空 `zk-2` 调度所在的节点。 ```shell kubectl drain $(kubectl get pod zk-2 --template {{.spec.nodeName}}) --ignore-daemonsets --force --delete-emptydir-data ``` + +输出类似于： + ``` node "kubernetes-node-i4c4" cordoned @@ -1556,6 +1582,8 @@ numChildren = 0 使用 [`kubectl uncordon`](/docs/reference/generated/kubectl/kubectl-commands/#uncordon) 来取消对第一个节点的隔离。 @@ -1564,12 +1592,16 @@ Use [`kubectl uncordon`](/docs/reference/generated/kubectl/kubectl-commands/#unc kubectl uncordon kubernetes-node-pb41 ``` +输出类似于： + ``` node "kubernetes-node-pb41" uncordoned ``` `zk-1` 被重新调度到了这个节点。等待 `zk-1` 变为 Running 和 Ready 状态。 @@ -1577,6 +1609,8 @@ node "kubernetes-node-pb41" uncordoned kubectl get pods -w -l app=zk ``` +输出类似于： + ``` NAME READY STATUS RESTARTS AGE zk-0 1/1 Running 2 1h @@ -1614,9 +1648,9 @@ kubectl drain $(kubectl get pod zk-2 --template {{.spec.nodeName}}) --ignore-dae ``` -输出： +输出类似于： ``` node "kubernetes-node-i4c4" already cordoned @@ -1630,6 +1664,8 @@ node "kubernetes-node-i4c4" drained This time `kubectl drain` succeeds. Uncordon the second node to allow `zk-2` to be rescheduled. + +The output is similar to this: --> 这次 `kubectl drain` 执行成功。 @@ -1639,6 +1675,8 @@ Uncordon the second node to allow `zk-2` to be rescheduled. kubectl uncordon kubernetes-node-ixsl ``` +输出类似于： + ``` node "kubernetes-node-ixsl" uncordoned ``` From 4759a9f652603cd83de75420969bd5571da66019 Mon Sep 17 00:00:00 2001 From: nonylene Date: Thu, 21 Apr 2022 16:08:38 +0900 Subject: [PATCH 065/101] scheduling-eviction/pod-overhaed.md: Fix a typo Bustrable -> Burstable --- content/en/docs/concepts/scheduling-eviction/pod-overhead.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/scheduling-eviction/pod-overhead.md b/content/en/docs/concepts/scheduling-eviction/pod-overhead.md index d5db85dadf..b0fd8e97b4 100644 --- a/content/en/docs/concepts/scheduling-eviction/pod-overhead.md +++ b/content/en/docs/concepts/scheduling-eviction/pod-overhead.md @@ -113,7 +113,7 @@ requests and the overhead, then looks for a node that has 2.25 CPU and 320 MiB o Once a Pod is scheduled to a node, the kubelet on that node creates a new {{< glossary_tooltip text="cgroup" term_id="cgroup" >}} for the Pod. It is within this pod that the underlying container runtime will create containers. -If the resource has a limit defined for each container (Guaranteed QoS or Bustrable QoS with limits defined), +If the resource has a limit defined for each container (Guaranteed QoS or Burstable QoS with limits defined), the kubelet will set an upper limit for the pod cgroup associated with that resource (cpu.cfs_quota_us for CPU and memory.limit_in_bytes memory). This upper limit is based on the sum of the container limits plus the `overhead` defined in the PodSpec. From ee9412445d4ab1bfc5d80d25d2557aad2ddf244c Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Sun, 24 Apr 2022 01:41:24 +0800 Subject: [PATCH 066/101] [zh]update content/zh/docs/concepts/services-networking/topology-aware-hints.md --- .../services-networking/topology-aware-hints.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/content/zh/docs/concepts/services-networking/topology-aware-hints.md b/content/zh/docs/concepts/services-networking/topology-aware-hints.md index 16c312226c..f0b28aca2a 100644 --- a/content/zh/docs/concepts/services-networking/topology-aware-hints.md +++ b/content/zh/docs/concepts/services-networking/topology-aware-hints.md @@ -32,6 +32,18 @@ _拓扑感知提示_ 包含客户怎么使用服务端点的建议，从而实 例如，你可以在一个地域内路由流量，以降低通信成本，或提高网络性能。 + + +{{< note >}} +“拓扑感知提示”特性处于 Beta 阶段，并且默认情况下**未**启用。 +要试用此特性，你必须启用 `TopologyAwareHints` +[特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/)。 +{{< /note >}} + 如果该资源对每一个容器都定义了一个限制（定义了限制值的 Guaranteed QoS 或者 -Bustrable QoS），kubelet 会为与该资源（CPU 的 `cpu.cfs_quota_us` 以及内存的 +Burstable QoS），kubelet 会为与该资源（CPU 的 `cpu.cfs_quota_us` 以及内存的 `memory.limit_in_bytes`） 相关的 Pod cgroup 设定一个上限。该上限基于 PodSpec 中定义的容器限制总量与 `overhead` 之和。 From 15926508f3a3b3144c5f7b3b6289b1660cf71382 Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Sun, 24 Apr 2022 03:30:33 +0800 Subject: [PATCH 068/101] [zh]Fix format --- .../tools/kubeadm/ha-topology.md | 2 +- .../access-application-cluster/ingress-minikube.md | 14 +++++++------- .../tasks/run-application/access-api-from-pod.md | 3 ++- 3 files changed, 10 insertions(+), 9 deletions(-) diff --git a/content/zh/docs/setup/production-environment/tools/kubeadm/ha-topology.md b/content/zh/docs/setup/production-environment/tools/kubeadm/ha-topology.md index fb41278c42..278cadea23 100644 --- a/content/zh/docs/setup/production-environment/tools/kubeadm/ha-topology.md +++ b/content/zh/docs/setup/production-environment/tools/kubeadm/ha-topology.md @@ -9,7 +9,7 @@ weight: 50 --- reviewers: - sig-cluster-lifecycle -title: Options for Highly Available topology +title: Options for Highly Available Topology content_type: concept weight: 50 --- diff --git a/content/zh/docs/tasks/access-application-cluster/ingress-minikube.md b/content/zh/docs/tasks/access-application-cluster/ingress-minikube.md index 139123e8e2..f23f138210 100644 --- a/content/zh/docs/tasks/access-application-cluster/ingress-minikube.md +++ b/content/zh/docs/tasks/access-application-cluster/ingress-minikube.md @@ -357,13 +357,13 @@ The following manifest defines an Ingress that sends traffic to your Service via ```yaml - - path: /v2 - pathType: Prefix - backend: - service: - name: web2 - port: - number: 8080 + - path: /v2 + pathType: Prefix + backend: + service: + name: web2 + port: + number: 8080 ``` + + +**作者**：Kaslin Fields + + +[2021 年指导委员会选举](https://github.com/kubernetes/community/tree/master/events/elections/2021)现已完成。 +Kubernetes 指导委员会由 7 个席位组成，其中 4 个席位将在 2021 年进行选举。 +新任委员会成员任期 2 年，所有成员均由 Kubernetes 社区选举产生。 + + +这个社区机构非常重要，因为它监督整个 Kubernetes 项目的治理。 +你可以在其[章程](https://github.com/kubernetes/steering/blob/master/charter.md)中了解更多关于指导委员会的角色。 + + +## 选举结果 + + + +祝贺当选的委员会成员，他们的两年任期即刻生效（按 GitHub handle 字母排序）: + +* **Christoph Blecker（[@cblecker](https://github.com/cblecker)）， 红帽** +* **Stephen Augustus（[@justaugustus](https://github.com/justaugustus)）， 思科** +* **Paris Pittman（[@parispittman](https://github.com/parispittman))， 苹果** +* **Tim Pepper（[@tpepper](https://github.com/tpepper)）， VMware** + + +他们加入永久成员： + + +* **Davanum Srinivas（[@dims](https://github.com/dims)）， VMware** +* **Jordan Liggitt （[@liggitt](https://github.com/liggitt)）， 谷歌** +* **Bob Killen （[@mrbobbytables](https://github.com/mrbobbytables)）， 谷歌** + + +Paris Pittman 和 Christoph Blecker 将回到指导委员会。 + + +## 非常感谢 + + +感谢并祝贺完成本轮成功选举的选举官们: + +* Alison Dowdney, ([@alisondy](https://github.com/alisondy)) +* Noah Kantrowitz ([@coderanger](https://github.com/coderanger)) +* Josh Berkus ([@jberkus](https://github.com/jberkus)) + + +特别感谢 k8s-infra 联络员 Arnaud Meukam（[@ameukam](https://github.com/ameukam)）， +他在社区的基础设施上启动了我们的投票软件。 + + +感谢荣誉退休的指导委员会成员。对你们之前对社区的贡献表示感谢: + +* Derek Carr ([@derekwaynecarr](https://github.com/derekwaynecarr)) +* Nikhita Raghunath ([@nikhita](https://github.com/nikhita)) + + +感谢所有前来参加竞选的候选人。 + + +## 参与指导委员会 + + +与所有 Kubernetes 一样，这个管理机构对所有人开放。 +你可以查看指导委员会的[待办事项](https://github.com/kubernetes/steering/projects/1)， +通过在他们的 [repo](https://github.com/kubernetes/steering) +中提交一个 issue 或创建一个 PR 来参与讨论。 +他们在[每月的第一个星期一上午 9:30](https://github.com/kubernetes/steering) 举行公开会议， +并定期参加会见我们的贡献者活动。也可以通过他们的公共邮件列表 steering@kubernetes.io 联系他们。 + + +你可以在 [YouTube 播放列表](https://www.youtube.com/playlist?list=PL69nYSiGNLP1yP1B_nd9-drjoxp0Q14qM) +上观看之前的会议视频，了解指导委员会的会议讨论内容。 + +--- + + +_本文是由[上游营销工作组](https://github.com/kubernetes/community/tree/master/communication/marketing-team#contributor-marketing)撰写的。 +如果你想撰写有关 Kubernetes 社区的故事，请了解更多关于我们的信息。_ \ No newline at end of file From b5cc85ad69e93aa39b828e7f31f856acafbde2b6 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Sat, 23 Apr 2022 22:30:19 +0800 Subject: [PATCH 071/101] [zh] Update security/apparmor.md Signed-off-by: xin.li --- .../zh/docs/tutorials/security/apparmor.md | 68 +++++-------------- 1 file changed, 16 insertions(+), 52 deletions(-) diff --git a/content/zh/docs/tutorials/security/apparmor.md b/content/zh/docs/tutorials/security/apparmor.md index 6739118c36..f287bc61c9 100644 --- a/content/zh/docs/tutorials/security/apparmor.md +++ b/content/zh/docs/tutorials/security/apparmor.md @@ -398,7 +398,7 @@ metadata: spec: containers: - name: hello - image: busybox + image: busybox:1.28 command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ] EOF pod/hello-apparmor-2 created @@ -510,10 +510,10 @@ Pod 在具有所需配置文件的节点上运行。 {{< note >}} PodSecurityPolicy 在 Kubernetes v1.21 版本中已被废弃，将在 v1.25 版本移除。 -查看 [PodSecurityPolicy 文档](/zh/docs/concepts/policy/pod-security-policy/)获取更多信息。 +查看 [PodSecurityPolicy](/zh/docs/concepts/security/pod-security-policy/) 文档获取更多信息。 {{< /note >}} 禁用时，任何包含 AppArmor 配置文件的 Pod 都将导致验证失败，且返回 “Forbidden” 错误。 -注意，默认情况下，docker 总是在非特权 Pod 上启用 “docker-default” 配置文件（如果 AppArmor 内核模块已启用）， -并且即使特性门控已禁用，也将继续启用该配置文件。 -当 AppArmor 升级到正式发布（GA）阶段时，禁用 Apparmor 的选项将被删除。 - -### 使用 AppArmor 升级到 Kubernetes v1.4 - - -不需要对 AppArmor 执行任何操作即可将集群升级到 v1.4。但是， -如果任何现有的 Pod 有一个 AppArmor 注解， -它们将无法通过合法性检查（或 PodSecurityPolicy 准入控制）。 -如果节点上加载了宽松的配置文件，恶意用户可以预先应用宽松的配置文件， -将 Pod 权限提升到 docker-default 权限之上。 -如果存在这个问题，建议清除集群中包含 `apparmor.security.beta.kubernetes.io` 注解的所有 Pod。 +即使此 Kubernetes 特性被禁用，运行时仍可能强制执行默认配置文件。 +当 AppArmor 升级为正式版 (GA) 时，禁用 AppArmor 功能的选项将被删除。 - -### 升级到正式发布的途径 {#upgrade-path-to-general-availability} +{{}} - -当 Apparmor 准备升级到正式发布（GA）状态时，当前通过注解指定的选项将转换为字段。 -通过转换支持所有升级和降级路径是非常微妙的，并将在转换发生时详细解释。 -我们将承诺在至少两个发行版本中同时支持字段和注解，并在之后的至少两个版本中显式拒绝注解。 ## 编写配置文件 {#authoring-profiles} @@ -623,14 +597,6 @@ tools to help with that: * [bane](https://github.com/jfrazelle/bane) 是一个用于 Docker的 AppArmor 配置文件生成器，它使用一种简化的画像语言（profile language） - -建议在开发工作站上通过 Docker 运行应用程序以生成配置文件， -不过在运行 Pod 的 Kubernetes 节点上运行这些工具也是可以的。 - - `runtime/default`: 指默认运行时配置文件。 - 等同于不指定配置文件（没有 PodSecurityPolicy 默认值），只是它仍然需要启用 AppArmor。 - - 对于 Docker，针对非特权容器时解析为 - [`Docker default`](https://docs.docker.com/engine/security/apparmor/) 配置文件， - 针对特权容器时解析为 unconfined（无配置文件）。 + - 实际上，许多容器运行时使用相同的 OCI 默认配置文件，在此处定义： + https://github.com/containers/common/blob/main/pkg/apparmor/apparmor_linux_template.go - `localhost/`: 按名称引用加载到节点（localhost）上的配置文件。 - 可能的配置文件名在[核心策略参考](https://gitlab.com/apparmor/apparmor/wikis/AppArmor_Core_Policy_Reference#profile-names-and-attachment-specifications)。 - `unconfined`: 这相当于为容器禁用 AppArmor。 From 649328ac2f50013d803ed5b624241405bbfd8bc5 Mon Sep 17 00:00:00 2001 From: Sean Wei Date: Sun, 24 Apr 2022 11:54:22 +0800 Subject: [PATCH 072/101] Use JavaScript instead of Javascript --- content/en/docs/contribute/style/diagram-guide.md | 2 +- content/en/docs/tasks/administer-cluster/access-cluster-api.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/contribute/style/diagram-guide.md b/content/en/docs/contribute/style/diagram-guide.md index 4024b44129..67e3ceb5e5 100644 --- a/content/en/docs/contribute/style/diagram-guide.md +++ b/content/en/docs/contribute/style/diagram-guide.md @@ -8,7 +8,7 @@ weight: 15 This guide shows you how to create, edit and share diagrams using the Mermaid -Javascript library. Mermaid.js allows you to generate diagrams using a simple +JavaScript library. Mermaid.js allows you to generate diagrams using a simple markdown-like syntax inside Markdown files. You can also use Mermaid to generate `.svg` or `.png` image files that you can add to your documentation. diff --git a/content/en/docs/tasks/administer-cluster/access-cluster-api.md b/content/en/docs/tasks/administer-cluster/access-cluster-api.md index 9abdd1c3a3..5732aed3af 100644 --- a/content/en/docs/tasks/administer-cluster/access-cluster-api.md +++ b/content/en/docs/tasks/administer-cluster/access-cluster-api.md @@ -150,7 +150,7 @@ describes how you can configure this as a cluster administrator. ### Programmatic access to the API -Kubernetes officially supports client libraries for [Go](#go-client), [Python](#python-client), [Java](#java-client), [dotnet](#dotnet-client), [Javascript](#javascript-client), and [Haskell](#haskell-client). There are other client libraries that are provided and maintained by their authors, not the Kubernetes team. See [client libraries](/docs/reference/using-api/client-libraries/) for accessing the API from other languages and how they authenticate. +Kubernetes officially supports client libraries for [Go](#go-client), [Python](#python-client), [Java](#java-client), [dotnet](#dotnet-client), [JavaScript](#javascript-client), and [Haskell](#haskell-client). There are other client libraries that are provided and maintained by their authors, not the Kubernetes team. See [client libraries](/docs/reference/using-api/client-libraries/) for accessing the API from other languages and how they authenticate. #### Go client From a0fbfe2ae7928918455d6b1174b534c2ddfa0f82 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Sat, 23 Apr 2022 22:14:56 +0800 Subject: [PATCH 073/101] [zh] Update tutorials/security/ns-level-pss.md Signed-off-by: xin.li --- .../docs/tutorials/security/ns-level-pss.md | 29 ++++++++++++------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/content/zh/docs/tutorials/security/ns-level-pss.md b/content/zh/docs/tutorials/security/ns-level-pss.md index 5b579dfc28..ae7350d9c0 100644 --- a/content/zh/docs/tutorials/security/ns-level-pss.md +++ b/content/zh/docs/tutorials/security/ns-level-pss.md @@ -16,15 +16,16 @@ weight: 10 {{% /alert %}} Pod 安全准入（PSA）在 v1.23 及更高版本默认启用， 因为它[升级到测试版（beta）](/blog/2021/12/09/pod-security-admission-beta/)。 @@ -41,12 +42,12 @@ Pod 安全准入是在创建 Pod 时应用 Install the following on your workstation: - [KinD](https://kind.sigs.k8s.io/docs/user/quick-start/#installation) -- [kubectl](https://kubernetes.io/docs/tasks/tools/) +- [kubectl](/docs/tasks/tools/) --> 在你的工作站中安装以下内容： - [KinD](https://kind.sigs.k8s.io/docs/user/quick-start/#installation) -- [kubectl](https://kubernetes.io/docs/tasks/tools/) +- [kubectl](/zh/docs/tasks/tools/) 输出类似于： + ``` namespace/example created ``` @@ -190,11 +193,14 @@ namespace/example created 1. Apply the pod spec to the cluster in `default` namespace: --> 3. 将 Pod 规约应用到集群中的 `default` 名字空间中： - ```shell - kubectl apply -n default -f /tmp/pss/nginx-pod.yaml - ``` + + ```shell + kubectl apply -n default -f /tmp/pss/nginx-pod.yaml + ``` + 输出类似于： + ``` pod/nginx created ``` @@ -222,6 +228,7 @@ Run `kind delete cluster -name psa-ns-level` to delete the cluster created. - Run a [shell script](/examples/security/kind-with-namespace-level-baseline-pod-security.sh) to perform all the preceding steps all at once. + 1. Create KinD cluster 2. Create new namespace 3. Apply `baseline` Pod Security Standard in `enforce` mode while applying @@ -232,12 +239,14 @@ Run `kind delete cluster -name psa-ns-level` to delete the cluster created. - [Apply Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss/) --> - 运行一个 [shell 脚本](/examples/security/kind-with-namespace-level-baseline-pod-security.sh) - 一次执行所有前面的步骤。 + 一次执行所有前面的步骤。 + 1. 创建 KinD 集群 2. 创建新的名字空间 3. 在 `enforce` 模式下应用 `baseline` Pod 安全标准， 同时在 `warn` 和 `audit` 模式下应用 `restricted` Pod 安全标准。 4. 创建一个应用以下 Pod 安全标准的新 Pod + - [Pod 安全准入](/zh/docs/concepts/security/pod-security-admission/) - [Pod 安全标准](/zh/docs/concepts/security/pod-security-standards/) - [在集群级别应用 Pod 安全标准](/zh/docs/tutorials/security/cluster-level-pss/) From 22c0708cdfabbf90c2c365d23d0085c8b0e754dc Mon Sep 17 00:00:00 2001 From: kinzhi Date: Sun, 24 Apr 2022 18:49:36 +0800 Subject: [PATCH 074/101] [zh]update content/zh/docs/concepts/workloads/controllers/job.md (#33157) * [zh]update content/zh/docs/concepts/workloads/controllers/job.md * [zh]update content/zh/docs/concepts/workloads/controllers/job.md * Update content/zh/docs/concepts/workloads/controllers/job.md Co-authored-by: Qiming Teng * Update content/zh/docs/concepts/workloads/controllers/job.md Co-authored-by: Qiming Teng * Update content/zh/docs/concepts/workloads/controllers/job.md Co-authored-by: Qiming Teng * Update content/zh/docs/concepts/workloads/controllers/job.md Co-authored-by: Qiming Teng * Update content/zh/docs/concepts/workloads/controllers/job.md Co-authored-by: Qiming Teng * Update content/zh/docs/concepts/workloads/controllers/job.md Co-authored-by: Qiming Teng * [zh]update content/zh/docs/concepts/workloads/controllers/job.md Co-authored-by: Qiming Teng --- .../concepts/workloads/controllers/job.md | 88 ++++++++++++++++--- 1 file changed, 75 insertions(+), 13 deletions(-) diff --git a/content/zh/docs/concepts/workloads/controllers/job.md b/content/zh/docs/concepts/workloads/controllers/job.md index a438294af6..99edfabf76 100644 --- a/content/zh/docs/concepts/workloads/controllers/job.md +++ b/content/zh/docs/concepts/workloads/controllers/job.md @@ -561,7 +561,7 @@ cleaned up by CronJobs based on the specified capacity-based cleanup policy. ### 已完成 Job 的 TTL 机制 {#ttl-mechanisms-for-finished-jobs} -{{< feature-state for_k8s_version="v1.21" state="beta" >}} +{{< feature-state for_k8s_version="v1.23" state="stable" >}} +Job 被创建时，Job 控制器会马上开始执行 Pod 创建操作以满足 Job 的需求， +并持续执行此操作直到 Job 完成为止。 +不过你可能想要暂时挂起 Job 执行，或启动处于挂起状态的job， +并拥有一个自定义控制器以后再决定什么时候开始。 + + -Job 被创建时，Job 控制器会马上开始执行 Pod 创建操作以满足 Job 的需求， -并持续执行此操作直到 Job 完成为止。 -不过你可能想要暂时挂起 Job 执行，之后再恢复其执行。 -要挂起一个 Job，你可以将 Job 的 `.spec.suspend` 字段更新为 true。 +要挂起一个 Job，你可以更新 `.spec.suspend` 字段为 true， 之后，当你希望恢复其执行时，将其更新为 false。 创建一个 `.spec.suspend` 被设置为 true 的 Job 本质上会将其创建为被挂起状态。 @@ -858,6 +864,61 @@ as soon as the Job was resumed. 字段值被改来改去造成的。在这两个事件之间，我们看到没有 Pod 被创建，不过当 Job 被恢复执行时，Pod 创建操作立即被重启执行。 + +### 可变调度指令 {#mutable-scheduling-directives} + +{{< feature-state for_k8s_version="v1.23" state="beta" >}} + + +{{< note >}} +为了使用此功能，你必须在 [API 服务器](/zh/docs/reference/command-line-tools-reference/kube-apiserver/)上启用 +`JobMutableNodeSchedulingDirectives` [特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/)。 +默认情况下启用。 +{{< /note >}} + + +在大多数情况下，并行作业会希望 Pod 在一定约束条件下运行， +比如所有的 Pod 都在同一个区域，或者所有的 Pod 都在 GPU 型号 x 或 y 上，而不是两者的混合。 + + +[suspend](#suspend-a-job) 字段是实现这些语义的第一步。 +suspend 允许自定义队列控制器，以决定工作何时开始；然而，一旦工作被取消暂停， +自定义队列控制器对 Job 中 Pods 的实际放置位置没有影响。 + + +此特性允许在 Job 开始之前更新调度指令，从而为定制队列提供影响 Pod +放置的能力，同时将 Pod 与节点间的分配关系留给 kube-scheduler 决定。 +这一特性仅适用于之前从未被暂停过的、已暂停的 Job。 +控制器能够影响 Pod 放置，同时参考实际 +pod-to-node 分配给 kube-scheduler。这仅适用于从未暂停的 Jobs。 + + +Job 的 Pod 模板中可以更新的字段是节点亲和性、节点选择器、容忍、标签和注解。 + + + 新的 Job 自身会有一个不同于 `a8f3d00d-c6d2-11e5-9f87-42010af00002` 的唯一 ID。 @@ -978,24 +1039,25 @@ In order to use this behavior, you must enable the `JobTrackingWithFinalizers` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) on the [API server](/docs/reference/command-line-tools-reference/kube-apiserver/) and the [controller manager](/docs/reference/command-line-tools-reference/kube-controller-manager/). -It is disabled by default. +It is enabled by default. When enabled, the control plane tracks new Jobs using the behavior described -below. Existing Jobs are unaffected. As a user, the only difference you would -see is that the control plane tracking of Job completion is more accurate. +below. Jobs created before the feature was enabled are unaffected. As a user, +the only difference you would see is that the control plane tracking of Job +completion is more accurate. --> ### 使用 Finalizer 追踪 Job {#job-tracking-with-finalizers} -{{< feature-state for_k8s_version="v1.22" state="alpha" >}} +{{< feature-state for_k8s_version="v1.23" state="beta" >}} {{< note >}} 要使用该行为，你必须为 [API 服务器](/zh/docs/reference/command-line-tools-reference/kube-apiserver/) 和[控制器管理器](/zh/docs/reference/command-line-tools-reference/kube-controller-manager/) 启用 `JobTrackingWithFinalizers` [特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/)。 -默认是禁用的。 +默认是启用的。 -启用后，控制面基于下述行为追踪新的 Job。现有 Job 不受影响。 +启用后，控制面基于下述行为追踪新的 Job。在启用该特性之前创建的 Job 不受影响。 作为用户，你会看到的唯一区别是控制面对 Job 完成情况的跟踪更加准确。 {{< /note >}} From 87edc6a9f8cb69d3550a1c67a46d9f359abe5de8 Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Sun, 24 Apr 2022 23:09:57 +0800 Subject: [PATCH 075/101] [zh]Update content/zh/docs/reference/glossary/api-eviction.md --- content/zh/docs/reference/glossary/api-eviction.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/content/zh/docs/reference/glossary/api-eviction.md b/content/zh/docs/reference/glossary/api-eviction.md index fc5c87c33f..0f1aabd435 100644 --- a/content/zh/docs/reference/glossary/api-eviction.md +++ b/content/zh/docs/reference/glossary/api-eviction.md @@ -38,10 +38,21 @@ You can request eviction either by directly calling the Eviction API using a client of the kube-apiserver, like the `kubectl drain` command. When an `Eviction` object is created, the API server terminates the Pod. +API-initiated evictions respect your configured [`PodDisruptionBudgets`](/docs/tasks/run-application/configure-pdb/) +and [`terminationGracePeriodSeconds`](/docs/concepts/workloads/pods/pod-lifecycle#pod-termination). + API-initiated eviction is not the same as [node-pressure eviction](/docs/concepts/scheduling-eviction/eviction/#kubelet-eviction). --> 你可以通过 kube-apiserver 的客户端，比如 `kubectl drain` 这样的命令，直接调用 Eviction API 发起驱逐。 当 `Eviction` 对象创建出来之后，该对象将驱动 API 服务器终止选定的Pod。 +API 发起的驱逐取决于你配置的 [`PodDisruptionBudgets`](/zh/docs/tasks/run-application/configure-pdb/) +和 [`terminationGracePeriodSeconds`](/zh/docs/concepts/workloads/pods/pod-lifecycle#pod-termination)。 + API 发起的驱逐不同于 [节点压力引发的驱逐](/zh/docs/concepts/scheduling-eviction/eviction/#kubelet-eviction)。 + + +* 有关详细信息，请参阅 [API 发起的驱逐](/zh/docs/concepts/scheduling-eviction/api-eviction/)。 \ No newline at end of file From 560e16d93bdd8f75996c886ee3c05ef5d1b6453c Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Mon, 25 Apr 2022 01:52:02 +0800 Subject: [PATCH 076/101] [zh]Update content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print.md --- .../setup-tools/kubeadm/generated/kubeadm_config_print.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print.md index 9132e3a04b..145bf61fa5 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print.md @@ -21,10 +21,10 @@ Print configuration 此命令打印子命令所提供的配置信息。 -相关细节可参阅 https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta2 +相关细节可参阅: https://pkg.go.dev/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm#section-directories ``` kubeadm config print [flags] From ab63d9a54171414b3bdb105185d6140ac04ab948 Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Mon, 25 Apr 2022 02:15:45 +0800 Subject: [PATCH 077/101] [zh]Update content/zh/docs/reference/setup-tools/kubeadm/kubeadm-reset-phase.md --- .../setup-tools/kubeadm/implementation-details.md | 2 +- .../setup-tools/kubeadm/kubeadm-reset-phase.md | 14 -------------- 2 files changed, 1 insertion(+), 15 deletions(-) diff --git a/content/zh/docs/reference/setup-tools/kubeadm/implementation-details.md b/content/zh/docs/reference/setup-tools/kubeadm/implementation-details.md index 4e861960a8..e303eebfe1 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/implementation-details.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/implementation-details.md @@ -594,7 +594,7 @@ API 服务器的静态 Pod 清单会受到用户提供的以下参数的影响: #### 控制器管理器 {#controller-manager} 控制器管理器的静态 Pod 清单受用户提供的以下参数的影响: diff --git a/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-reset-phase.md b/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-reset-phase.md index 8d0f84af56..4d1d6e82d1 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-reset-phase.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-reset-phase.md @@ -43,20 +43,6 @@ Using this phase you can execute preflight checks on a node that is being reset. {{< tab name="preflight" include="generated/kubeadm_reset_phase_preflight.md" />}} {{< /tabs >}} - -## kubeadm reset phase update-cluster-status {#cmd-reset-phase-update-cluster-status} - - -使用此阶段，你可以从 ClusterStatus 对象中删除此控制平面节点。 - -{{< tabs name="tab-update-cluster-status" >}} -{{< tab name="update-cluster-status" include="generated/kubeadm_reset_phase_update-cluster-status.md" />}} -{{< /tabs >}} - From f73d046f635a125cf301d3832f75783714bc1f62 Mon Sep 17 00:00:00 2001 From: Arhell Date: Mon, 25 Apr 2022 00:33:16 +0300 Subject: [PATCH 078/101] [zh] fix feature state --- .../reference/command-line-tools-reference/feature-gates.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/zh/docs/reference/command-line-tools-reference/feature-gates.md b/content/zh/docs/reference/command-line-tools-reference/feature-gates.md index fdd88a3ad6..4d101c10cc 100644 --- a/content/zh/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/zh/docs/reference/command-line-tools-reference/feature-gates.md @@ -111,7 +111,8 @@ different Kubernetes components. | `AllowInsecureBackendProxy` | `true` | Beta | 1.17 | | | `AnyVolumeDataSource` | `false` | Alpha | 1.18 | | | `AppArmor` | `true` | Beta | 1.4 | | -| `ControllerManagerLeaderMigration` | `false` | Alpha | 1.21 | | +| `ControllerManagerLeaderMigration` | `false` | Alpha | 1.21 | 1.21 | +| `ControllerManagerLeaderMigration` | `true` | Beta | 1.22 | | | `CPUManager` | `false` | Alpha | 1.8 | 1.9 | | `CPUManager` | `true` | Beta | 1.10 | | | `CPUManagerPolicyAlphaOptions` | `false` | Alpha | 1.23 | | From 77d736f31ccd6b7f8c4833823818fc29425a8263 Mon Sep 17 00:00:00 2001 From: Guangwen Feng Date: Mon, 25 Apr 2022 16:41:29 +0800 Subject: [PATCH 079/101] [zh] Fix incorrect description Signed-off-by: Guangwen Feng --- content/zh/docs/reference/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/zh/docs/reference/_index.md b/content/zh/docs/reference/_index.md index 749f78d270..108277d9ea 100644 --- a/content/zh/docs/reference/_index.md +++ b/content/zh/docs/reference/_index.md @@ -42,8 +42,8 @@ This section of the Kubernetes documentation contains references. * [术语表](/zh/docs/reference/glossary/) - 一个全面的标准化的 Kubernetes 术语表 -* [Kubernetes API 单页参考](/zh/docs/reference/kubernetes-api/) -* [Kubernetes API 参考 {{< param "version" >}}](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/)。 +* [Kubernetes API 参考](/zh/docs/reference/kubernetes-api/) +* [Kubernetes API 单页参考 {{< param "version" >}}](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/)。 * [使用 Kubernetes API ](/zh/docs/reference/using-api/) - Kubernetes 的 API 概述 * [API 的访问控制](/zh/docs/reference/access-authn-authz/) - 关于 Kubernetes 如何控制 API 访问的详细信息 * [常见的标签、注解和污点](/zh/docs/reference/labels-annotations-taints/) From 38cbb50e5cafa1dfae6a09d656b23ea2e9fbeb87 Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Mon, 25 Apr 2022 20:14:42 +0800 Subject: [PATCH 080/101] [zh]Use JavaScript instead of Javascript --- content/zh/docs/contribute/style/diagram-guide.md | 4 ++-- .../zh/docs/tasks/administer-cluster/access-cluster-api.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/content/zh/docs/contribute/style/diagram-guide.md b/content/zh/docs/contribute/style/diagram-guide.md index 3f18282756..de9b474b43 100644 --- a/content/zh/docs/contribute/style/diagram-guide.md +++ b/content/zh/docs/contribute/style/diagram-guide.md @@ -15,7 +15,7 @@ weight: 15 -本指南为你展示如何创建、编辑和分享基于 Mermaid Javascript 库的图表。 +本指南为你展示如何创建、编辑和分享基于 Mermaid JavaScript 库的图表。 Mermaid.js 允许你使用简单的、类似于 Markdown 的语法来在 Markdown 文件中生成图表。 你也可以使用 Mermaid 来创建 `.svg` 或 `.png` 图片文件，将其添加到你的文档中。 diff --git a/content/zh/docs/tasks/administer-cluster/access-cluster-api.md b/content/zh/docs/tasks/administer-cluster/access-cluster-api.md index 37f80f26af..d67fb83d5a 100644 --- a/content/zh/docs/tasks/administer-cluster/access-cluster-api.md +++ b/content/zh/docs/tasks/administer-cluster/access-cluster-api.md @@ -228,12 +228,12 @@ describes how you can configure this as a cluster administrator. ### 编程方式访问 API Kubernetes 官方支持 [Go](#go-client)、[Python](#python-client)、[Java](#java-client)、 -[dotnet](#dotnet-client)、[Javascript](#javascript-client) 和 [Haskell](#haskell-client) +[dotnet](#dotnet-client)、[JavaScript](#javascript-client) 和 [Haskell](#haskell-client) 语言的客户端库。还有一些其他客户端库由对应作者而非 Kubernetes 团队提供并维护。 参考[客户端库](/zh/docs/reference/using-api/client-libraries/)了解如何使用其他语言 来访问 API 以及如何执行身份认证。 From 5a1b3ce971dcca061377a95baa36629432bfa3cd Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Mon, 25 Apr 2022 20:46:44 +0800 Subject: [PATCH 081/101] [zh] Update 2020-12-02-dont-panic-kubernetes-and-docker.md Signed-off-by: xin.li --- .../2020-12-02-dont-panic-kubernetes-and-docker.md | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/content/zh/blog/_posts/2020-12-02-dont-panic-kubernetes-and-docker.md b/content/zh/blog/_posts/2020-12-02-dont-panic-kubernetes-and-docker.md index e14f7cc846..65e5075cfe 100644 --- a/content/zh/blog/_posts/2020-12-02-dont-panic-kubernetes-and-docker.md +++ b/content/zh/blog/_posts/2020-12-02-dont-panic-kubernetes-and-docker.md @@ -13,6 +13,15 @@ slug: dont-panic-kubernetes-and-docker **作者：** Jorge Castro, Duffie Cooley, Kat Cosgrove, Justin Garrison, Noah Kantrowitz, Bob Killen, Rey Lejano, Dan “POP” Papandrea, Jeffrey Sica, Davanum “Dims” Srinivas + +_更新：Kubernetes 通过 `dockershim` 对 Docker 的支持现已弃用。 +有关更多信息，请阅读[弃用通知](/zh/blog/2020/12/08/kubernetes-1-20-release-announcement/#dockershim-deprecation)。 +你还可以通过专门的 [GitHub issue](https://github.com/kubernetes/kubernetes/issues/106917) 讨论弃用。_ + 还在寻求更多答案吗？请参考我们附带的 -[弃用 Dockershim 的常见问题](/zh/blog/2020/12/02/dockershim-faq/)。 +[移除 Dockershim 的常见问题](/zh/blog/2020/12/02/dockershim-faq/) _(2022年2月更新)_。 From 6f9f2b8efacb362d969829a33b129df834699afb Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Mon, 25 Apr 2022 20:58:21 +0800 Subject: [PATCH 082/101] [zh] Update blog/2020-12-02-dockershim-faq.md Signed-off-by: xin.li --- content/zh/blog/_posts/2020-12-02-dockershim-faq.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/content/zh/blog/_posts/2020-12-02-dockershim-faq.md b/content/zh/blog/_posts/2020-12-02-dockershim-faq.md index d873fab049..5b8d896a96 100644 --- a/content/zh/blog/_posts/2020-12-02-dockershim-faq.md +++ b/content/zh/blog/_posts/2020-12-02-dockershim-faq.md @@ -3,6 +3,7 @@ layout: blog title: "弃用 Dockershim 的常见问题" date: 2020-12-02 slug: dockershim-faq +aliases: [ '/dockershim' ] --- + +_**更新**：本文有[较新版本](/zh/blog/2022/02/17/dockershim-faq/)。_ + 本文回顾了自 Kubernetes v1.20 版宣布弃用 Dockershim 以来所引发的一些常见问题。 关于 Kubernetes kubelets 从容器运行时的角度弃用 Docker 的细节以及这些细节背后的含义，请参考博文 [别慌: Kubernetes 和 Docker](/blog/2020/12/02/dont-panic-kubernetes-and-docker/)。 +此外，你可以阅读 [检查 Dockershim 弃用是否影响你](/zh/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you/) +以检查它是否会影响你。 + From 248cf890a340d46864e2ac03701511ebeff5ce6d Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Mon, 25 Apr 2022 21:17:55 +0800 Subject: [PATCH 083/101] Update storage/volumes.md Signed-off-by: xin.li --- content/zh/docs/concepts/storage/volumes.md | 30 +++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/content/zh/docs/concepts/storage/volumes.md b/content/zh/docs/concepts/storage/volumes.md index e264fb4b38..2d92dbf79c 100644 --- a/content/zh/docs/concepts/storage/volumes.md +++ b/content/zh/docs/concepts/storage/volumes.md @@ -273,6 +273,21 @@ features must be enabled. [Azure 磁盘 CSI 驱动程序](https://github.com/kubernetes-sigs/azuredisk-csi-driver)， 并且 `CSIMigration` 和 `CSIMigrationAzureDisk` 功能必须被启用。 + +#### azureDisk CSI 迁移完成 + +{{< feature-state for_k8s_version="v1.21" state="alpha" >}} + +要禁止控制器管理器和 kubelet 加载 `azureDisk` 存储插件， +请将 `InTreePluginAzureDiskUnregister` 标志设置为 `true`。 + ### azureFile {#azurefile} +#### azureDisk CSI 迁移完成 + +{{< feature-state for_k8s_version="v1.21" state="alpha" >}} + +要禁止控制器管理器和 kubelet 加载 `azureDisk` 存储插件， +请将 `InTreePluginAzureDiskUnregister` 标志设置为 `true`。 + ### cephfs {#cephfs} @@ -57,21 +57,21 @@ address, protocol, and source and destination port. That simple hash-based scheme has the property that any high-intensity flow will crowd out all the low-intensity flows that hash to the same queue. Providing good insulation for a large number of flows requires a large -number of queues, which is problematic. Shuffle sharding is a more +number of queues, which is problematic. Shuffle sharding is a more nimble technique that can do a better job of insulating the low-intensity -flows from the high-intensity flows. The terminology of shuffle sharding uses +flows from the high-intensity flows. The terminology of shuffle sharding uses the metaphor of dealing a hand from a deck of cards; each queue is a -metaphorical card. The shuffle sharding technique starts with hashing +metaphorical card. The shuffle sharding technique starts with hashing the flow-identifying characteristics of the request, to produce a hash -value with dozens or more of bits. Then the hash value is used as a +value with dozens or more of bits. Then the hash value is used as a source of entropy to shuffle the deck and deal a hand of cards -(queues). All the dealt queues are examined, and the request is put -into one of the examined queues with the shortest length. With a +(queues). All the dealt queues are examined, and the request is put +into one of the examined queues with the shortest length. With a modest hand size, it does not cost much to examine all the dealt cards and a given low-intensity flow has a good chance to dodge the effects of a -given high-intensity flow. With a large hand size it is expensive to examine +given high-intensity flow. With a large hand size it is expensive to examine the dealt queues and more difficult for the low-intensity flows to dodge the -collective effects of a set of high-intensity flows. Thus, the hand size +collective effects of a set of high-intensity flows. Thus, the hand size should be chosen judiciously. --> 这种简单的基于哈希的模式有一种特性，高密度的请求序列（流）会湮没那些被 From 3af7b0a15f435895e50ed3a99286a59a26b5af0f Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Mon, 25 Apr 2022 22:05:52 +0800 Subject: [PATCH 086/101] [zh]Update content/zh/examples/service/networking/minimal-ingress.yaml --- .../zh/docs/tutorials/stateless-application/guestbook.md | 6 +++++- content/zh/examples/service/networking/minimal-ingress.yaml | 1 + 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/content/zh/docs/tutorials/stateless-application/guestbook.md b/content/zh/docs/tutorials/stateless-application/guestbook.md index 7482890aa2..b5b9003db5 100644 --- a/content/zh/docs/tutorials/stateless-application/guestbook.md +++ b/content/zh/docs/tutorials/stateless-application/guestbook.md @@ -362,7 +362,11 @@ The `Redis` Services you applied is only accessible within the Kubernetes cluste `ClusterIP` 为服务指向的 Pod 集提供一个 IP 地址。这个 IP 地址只能在集群中访问。 如果你希望访客能够访问你的 Guestbook，你必须将前端服务配置为外部可见的， 以便客户端可以从 Kubernetes 集群之外请求服务。 diff --git a/content/zh/examples/service/networking/minimal-ingress.yaml b/content/zh/examples/service/networking/minimal-ingress.yaml index 76640b9447..55a5837510 100644 --- a/content/zh/examples/service/networking/minimal-ingress.yaml +++ b/content/zh/examples/service/networking/minimal-ingress.yaml @@ -5,6 +5,7 @@ metadata: annotations: nginx.ingress.kubernetes.io/rewrite-target: / spec: + ingressClassName: nginx-example rules: - http: paths: From e4e09e7241fa12e94b71a81e3bde7e3dd334eaab Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Mon, 25 Apr 2022 22:12:25 +0800 Subject: [PATCH 087/101] [zh]Update content/zh/examples/service/access/Dockerfile --- content/zh/examples/service/access/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/examples/service/access/Dockerfile b/content/zh/examples/service/access/Dockerfile index b7b09d492a..75a0fd63a9 100644 --- a/content/zh/examples/service/access/Dockerfile +++ b/content/zh/examples/service/access/Dockerfile @@ -1,4 +1,4 @@ FROM nginx:1.17.3 RUN rm /etc/nginx/conf.d/default.conf -COPY frontend.conf /etc/nginx/conf.d +COPY frontend-nginx.conf /etc/nginx/conf.d \ No newline at end of file From 82517757987142b7380969a2426aebae6eaf8fc9 Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Mon, 25 Apr 2022 23:24:52 +0800 Subject: [PATCH 088/101] [zh]Remove excess whitespace --- content/en/examples/pods/security/security-context-3.yaml | 2 +- content/zh/examples/pods/security/security-context-3.yaml | 5 +---- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/content/en/examples/pods/security/security-context-3.yaml b/content/en/examples/pods/security/security-context-3.yaml index d68b2a783e..926846081f 100644 --- a/content/en/examples/pods/security/security-context-3.yaml +++ b/content/en/examples/pods/security/security-context-3.yaml @@ -5,4 +5,4 @@ metadata: spec: containers: - name: sec-ctx-3 - image: gcr.io/google-samples/node-hello:1.0 + image: gcr.io/google-samples/node-hello:1.0 \ No newline at end of file diff --git a/content/zh/examples/pods/security/security-context-3.yaml b/content/zh/examples/pods/security/security-context-3.yaml index 05295e1a03..926846081f 100644 --- a/content/zh/examples/pods/security/security-context-3.yaml +++ b/content/zh/examples/pods/security/security-context-3.yaml @@ -5,7 +5,4 @@ metadata: spec: containers: - name: sec-ctx-3 - image: gcr.io/google-samples/node-hello:1.0 - - - + image: gcr.io/google-samples/node-hello:1.0 \ No newline at end of file From 0182438cfa0a9bfdcaaf62d33a2dfb1425899ae9 Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Mon, 25 Apr 2022 23:29:03 +0800 Subject: [PATCH 089/101] [zh]Sync from the English format --- content/zh/examples/application/php-apache.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/content/zh/examples/application/php-apache.yaml b/content/zh/examples/application/php-apache.yaml index 5eb04cfb89..e8e1b5aeb4 100644 --- a/content/zh/examples/application/php-apache.yaml +++ b/content/zh/examples/application/php-apache.yaml @@ -22,9 +22,7 @@ spec: cpu: 500m requests: cpu: 200m - --- - apiVersion: v1 kind: Service metadata: @@ -36,4 +34,3 @@ spec: - port: 80 selector: run: php-apache - From 97dbcfbb9f85d2d036fb0f7fdfecdb3b24eb32e8 Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Mon, 25 Apr 2022 23:30:56 +0800 Subject: [PATCH 090/101] [zh]Remove excess whitespace --- content/en/examples/pods/security/security-context-3.yaml | 2 +- content/zh/examples/pods/security/security-context-3.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/examples/pods/security/security-context-3.yaml b/content/en/examples/pods/security/security-context-3.yaml index 926846081f..d68b2a783e 100644 --- a/content/en/examples/pods/security/security-context-3.yaml +++ b/content/en/examples/pods/security/security-context-3.yaml @@ -5,4 +5,4 @@ metadata: spec: containers: - name: sec-ctx-3 - image: gcr.io/google-samples/node-hello:1.0 \ No newline at end of file + image: gcr.io/google-samples/node-hello:1.0 diff --git a/content/zh/examples/pods/security/security-context-3.yaml b/content/zh/examples/pods/security/security-context-3.yaml index 926846081f..d68b2a783e 100644 --- a/content/zh/examples/pods/security/security-context-3.yaml +++ b/content/zh/examples/pods/security/security-context-3.yaml @@ -5,4 +5,4 @@ metadata: spec: containers: - name: sec-ctx-3 - image: gcr.io/google-samples/node-hello:1.0 \ No newline at end of file + image: gcr.io/google-samples/node-hello:1.0 From d12411891804507a4ca7d6c90029f47c78ce60a5 Mon Sep 17 00:00:00 2001 From: Sean Wei Date: Mon, 25 Apr 2022 23:31:29 +0800 Subject: [PATCH 091/101] [zh] Fix feature state --- .../docs/reference/command-line-tools-reference/feature-gates.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/zh/docs/reference/command-line-tools-reference/feature-gates.md b/content/zh/docs/reference/command-line-tools-reference/feature-gates.md index fdd88a3ad6..55fd401c41 100644 --- a/content/zh/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/zh/docs/reference/command-line-tools-reference/feature-gates.md @@ -485,6 +485,7 @@ different Kubernetes components. | `ServerSideApply` | `false` | Alpha | 1.14 | 1.15 | | `ServerSideApply` | `true` | Beta | 1.16 | 1.21 | | `ServerSideApply` | `true` | GA | 1.22 | - | +| `ServerSideFieldValidation` | `false` | Alpha | 1.23 | - | | `ServiceAccountIssuerDiscovery` | `false` | Alpha | 1.18 | 1.19 | | `ServiceAccountIssuerDiscovery` | `true` | Beta | 1.20 | 1.20 | | `ServiceAccountIssuerDiscovery` | `true` | GA | 1.21 | - | From 68dbecde3ac08c308380e316bb8e2702112f2d37 Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Mon, 25 Apr 2022 23:36:20 +0800 Subject: [PATCH 092/101] [zh]Update content/zh/examples/application/mysql/mysql-services.yaml --- content/en/examples/application/mysql/mysql-services.yaml | 1 - content/zh/examples/application/mysql/mysql-services.yaml | 3 +-- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/content/en/examples/application/mysql/mysql-services.yaml b/content/en/examples/application/mysql/mysql-services.yaml index 0cd76d91c6..6743cf707a 100644 --- a/content/en/examples/application/mysql/mysql-services.yaml +++ b/content/en/examples/application/mysql/mysql-services.yaml @@ -27,4 +27,3 @@ spec: port: 3306 selector: app: mysql - diff --git a/content/zh/examples/application/mysql/mysql-services.yaml b/content/zh/examples/application/mysql/mysql-services.yaml index f538992566..6743cf707a 100644 --- a/content/zh/examples/application/mysql/mysql-services.yaml +++ b/content/zh/examples/application/mysql/mysql-services.yaml @@ -14,7 +14,7 @@ spec: app: mysql --- # Client service for connecting to any MySQL instance for reads. -# For writes, you must instead connect to the master: mysql-0.mysql. +# For writes, you must instead connect to the primary: mysql-0.mysql. apiVersion: v1 kind: Service metadata: @@ -27,4 +27,3 @@ spec: port: 3306 selector: app: mysql - From 6dbf0cfaf89afd20bd644d8d2eea8b9b7d0c326f Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Mon, 25 Apr 2022 23:50:10 +0800 Subject: [PATCH 093/101] [zh]Update content/zh/examples/README.md --- content/en/examples/README.md | 1 - content/zh/examples/README.md | 24 ++++++++++++------------ 2 files changed, 12 insertions(+), 13 deletions(-) diff --git a/content/en/examples/README.md b/content/en/examples/README.md index 6a5f3ceea7..cb364850cc 100644 --- a/content/en/examples/README.md +++ b/content/en/examples/README.md @@ -9,4 +9,3 @@ where `` is the two character representation of a language. For example: ``` go test k8s.io/website/content/en/examples ``` - diff --git a/content/zh/examples/README.md b/content/zh/examples/README.md index dac0f47105..dcc4443c3d 100644 --- a/content/zh/examples/README.md +++ b/content/zh/examples/README.md @@ -1,17 +1,17 @@ -注意：这些测试是从 kubernetes 导入的代码实际上并不打算在存储库之外使用。 -这就导致了供应商依赖问题。因此，我们必须在 travis 配置这些行: +要运行本地化测试，请使用以下命令: ``` -- rm $GOPATH/src/k8s.io/kubernetes/vendor/k8s.io/apimachinery -- rm $GOPATH/src/k8s.io/kubernetes/vendor/k8s.io/apiserver -- rm $GOPATH/src/k8s.io/kubernetes/vendor/k8s.io/client-go -- cp -r $GOPATH/src/k8s.io/kubernetes/vendor/* $GOPATH/src/ -- rm -rf $GOPATH/src/k8s.io/kubernetes/vendor/* -- cp -r $GOPATH/src/k8s.io/kubernetes/staging/src/* $GOPATH/src/ +go test k8s.io/website/content//examples +``` + + +其中 `` 是用两个字符表示一种语言。例如: + +``` +go test k8s.io/website/content/en/examples ``` From c0739ad6ef42725ff7eb346dbf668d2462273040 Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Tue, 26 Apr 2022 00:59:24 +0800 Subject: [PATCH 094/101] [zh]Sync content/zh/training/_index.html --- .../zh/case-studies/ibm/ibm_featured_logo.svg | 2 +- content/zh/training/_index.html | 16 +++++++++++++++- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/content/zh/case-studies/ibm/ibm_featured_logo.svg b/content/zh/case-studies/ibm/ibm_featured_logo.svg index 577d8e97d9..f79fd7847b 100644 --- a/content/zh/case-studies/ibm/ibm_featured_logo.svg +++ b/content/zh/case-studies/ibm/ibm_featured_logo.svg @@ -1 +1 @@ -ibm_featured_logo \ No newline at end of file +ibm_featured_logo \ No newline at end of file diff --git a/content/zh/training/_index.html b/content/zh/training/_index.html index 15ec4b0556..7ee7fbde6f 100644 --- a/content/zh/training/_index.html +++ b/content/zh/training/_index.html @@ -24,6 +24,9 @@ class: training

    Kubernetes 是云原生运动的核心。来自 Linux 基金会和我们培训合作伙伴的培训、认证让您可以投资您的职业生涯，学习 Kubernetes，并使您的云原生项目获得成功。

    +
    + +
    @@ -31,7 +34,7 @@ class: training
    - +
    @@ -105,6 +108,17 @@ class: training

    获取 Kubernetes 认证

    +
    +
    + Kubernetes and Cloud Native Associate (KCNA) +
    + +

    Kubernetes 和云原生伙伴（KCNA）考试展示了用户在 Kubernetes 和更广泛的云原生生态系统中的基本知识和技能。

    +

    获得认证的 KCNA 将确认整个云原生生态系统的概念性知识，特别是 Kubernetes。

    +
    + Go to Certification +
    From 193abb66c472e3087223eea532584adfa0b804b2 Mon Sep 17 00:00:00 2001 From: "wei.wang" Date: Tue, 26 Apr 2022 02:28:25 +0800 Subject: [PATCH 095/101] [zh]Sync content/zh/training/_index.html --- content/zh/training/_index.html | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/zh/training/_index.html b/content/zh/training/_index.html index 7ee7fbde6f..a76d801b8d 100644 --- a/content/zh/training/_index.html +++ b/content/zh/training/_index.html @@ -117,7 +117,8 @@ class: training

    Kubernetes 和云原生伙伴（KCNA）考试展示了用户在 Kubernetes 和更广泛的云原生生态系统中的基本知识和技能。

    获得认证的 KCNA 将确认整个云原生生态系统的概念性知识，特别是 Kubernetes。


    - Go to Certification + + 前往认证
    From 8e1ca057b6837c293e9712e42e86f25862df32ec Mon Sep 17 00:00:00 2001 From: Arhell Date: Tue, 26 Apr 2022 00:33:44 +0300 Subject: [PATCH 096/101] [es] use cat instead of shell built-in to read checksum --- content/es/docs/tasks/tools/included/install-kubectl-linux.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/es/docs/tasks/tools/included/install-kubectl-linux.md b/content/es/docs/tasks/tools/included/install-kubectl-linux.md index 67c802bfb2..0238b53b9d 100644 --- a/content/es/docs/tasks/tools/included/install-kubectl-linux.md +++ b/content/es/docs/tasks/tools/included/install-kubectl-linux.md @@ -51,7 +51,7 @@ Por ejemplo, para descargar la versión {{< param "fullversion" >}} en Linux, es Valide el binario kubectl con el archivo de comprobación: ```bash - echo "$( Date: Tue, 26 Apr 2022 10:34:37 +0800 Subject: [PATCH 097/101] Update labels.md add a new line --- .../zh/docs/concepts/overview/working-with-objects/labels.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/zh/docs/concepts/overview/working-with-objects/labels.md b/content/zh/docs/concepts/overview/working-with-objects/labels.md index 34b9fe0f6b..618b09eb12 100644 --- a/content/zh/docs/concepts/overview/working-with-objects/labels.md +++ b/content/zh/docs/concepts/overview/working-with-objects/labels.md @@ -231,6 +231,7 @@ partition * The second example selects all resources with key equal to `tier` and values other than `frontend` and `backend`, and all resources with no labels with the `tier` key. * The third example selects all resources including a label with key `partition`; no values are checked. * The fourth example selects all resources without a label with key `partition`; no values are checked. + Similarly the comma separator acts as an _AND_ operator. So filtering resources with a `partition` key (no matter the value) and with `environment` different than  `qa` can be achieved using `partition,environment notin (qa)`. --> @@ -238,6 +239,7 @@ Similarly the comma separator acts as an _AND_ operator. So filtering resources * 第二个示例选择了所有键等于 `tier` 并且值不等于 `frontend` 或者 `backend` 的资源，以及所有没有 `tier` 键标签的资源。 * 第三个示例选择了所有包含了有 `partition` 标签的资源；没有校验它的值。 * 第四个示例选择了所有没有 `partition` 标签的资源；没有校验它的值。 + 类似地，逗号分隔符充当 _与_ 运算符。因此，使用 `partition` 键（无论为何值）和 `environment` 不同于 `qa` 来过滤资源可以使用 `partition, environment notin（qa)` 来实现。 From f26e8eff23b5d716d8ed613d304149194bf6f42a Mon Sep 17 00:00:00 2001 From: Paul Schweigert Date: Tue, 26 Apr 2022 00:30:51 -0400 Subject: [PATCH 098/101] Reorg the monitoring task section (#32823) * reorg the monitoring task section Signed-off-by: Paul S. Schweigert * reorg from review comments Signed-off-by: Paul S. Schweigert * review comments Signed-off-by: Paul S. Schweigert * review fixes Signed-off-by: Paul S. Schweigert --- .../tasks/debug-application-cluster/_index.md | 6 - .../debug-cluster.md | 124 ----- .../debug-pod-replication-controller.md | 107 ---- .../debug-running-pod.md | 333 ------------ .../troubleshooting.md => debug/_index.md} | 9 +- .../tasks/debug/debug-application/_index.md | 8 + .../debug-init-containers.md | 1 + .../debug-application/debug-pods.md} | 13 +- .../debug-application/debug-running-pod.md} | 474 +++++++++++------- .../debug-application}/debug-service.md | 7 +- .../debug-application/debug-statefulset.md} | 5 +- .../determine-reason-pod-failure.md | 0 .../get-shell-running-container.md | 0 .../docs/tasks/debug/debug-cluster/_index.md | 316 ++++++++++++ .../debug-cluster}/audit.md | 0 .../debug-cluster}/crictl.md | 1 + .../debug-cluster}/local-debugging.md | 4 +- .../debug-cluster}/monitor-node-health.md | 1 + .../resource-metrics-pipeline.md | 1 + .../resource-usage-monitoring.md | 11 + 20 files changed, 656 insertions(+), 765 deletions(-) delete mode 100644 content/en/docs/tasks/debug-application-cluster/_index.md delete mode 100644 content/en/docs/tasks/debug-application-cluster/debug-cluster.md delete mode 100644 content/en/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md delete mode 100644 content/en/docs/tasks/debug-application-cluster/debug-running-pod.md rename content/en/docs/tasks/{debug-application-cluster/troubleshooting.md => debug/_index.md} (94%) create mode 100644 content/en/docs/tasks/debug/debug-application/_index.md rename content/en/docs/tasks/{debug-application-cluster => debug/debug-application}/debug-init-containers.md (99%) rename content/en/docs/tasks/{debug-application-cluster/debug-application.md => debug/debug-application/debug-pods.md} (92%) rename content/en/docs/tasks/{debug-application-cluster/debug-application-introspection.md => debug/debug-application/debug-running-pod.md} (54%) rename content/en/docs/tasks/{debug-application-cluster => debug/debug-application}/debug-service.md (98%) rename content/en/docs/tasks/{debug-application-cluster/debug-stateful-set.md => debug/debug-application/debug-statefulset.md} (88%) rename content/en/docs/tasks/{debug-application-cluster => debug/debug-application}/determine-reason-pod-failure.md (100%) rename content/en/docs/tasks/{debug-application-cluster => debug/debug-application}/get-shell-running-container.md (100%) create mode 100644 content/en/docs/tasks/debug/debug-cluster/_index.md rename content/en/docs/tasks/{debug-application-cluster => debug/debug-cluster}/audit.md (100%) rename content/en/docs/tasks/{debug-application-cluster => debug/debug-cluster}/crictl.md (99%) rename content/en/docs/tasks/{debug-application-cluster => debug/debug-cluster}/local-debugging.md (97%) rename content/en/docs/tasks/{debug-application-cluster => debug/debug-cluster}/monitor-node-health.md (99%) rename content/en/docs/tasks/{debug-application-cluster => debug/debug-cluster}/resource-metrics-pipeline.md (99%) rename content/en/docs/tasks/{debug-application-cluster => debug/debug-cluster}/resource-usage-monitoring.md (81%) diff --git a/content/en/docs/tasks/debug-application-cluster/_index.md b/content/en/docs/tasks/debug-application-cluster/_index.md deleted file mode 100644 index 0aa5f76478..0000000000 --- a/content/en/docs/tasks/debug-application-cluster/_index.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -title: "Monitoring, Logging, and Debugging" -description: Set up monitoring and logging to troubleshoot a cluster, or debug a containerized application. -weight: 80 ---- - diff --git a/content/en/docs/tasks/debug-application-cluster/debug-cluster.md b/content/en/docs/tasks/debug-application-cluster/debug-cluster.md deleted file mode 100644 index 391efe4376..0000000000 --- a/content/en/docs/tasks/debug-application-cluster/debug-cluster.md +++ /dev/null @@ -1,124 +0,0 @@ ---- -reviewers: -- davidopp -title: Troubleshoot Clusters -content_type: concept ---- - - - -This doc is about cluster troubleshooting; we assume you have already ruled out your application as the root cause of the -problem you are experiencing. See -the [application troubleshooting guide](/docs/tasks/debug-application-cluster/debug-application) for tips on application debugging. -You may also visit [troubleshooting document](/docs/tasks/debug-application-cluster/troubleshooting/) for more information. - - - -## Listing your cluster - -The first thing to debug in your cluster is if your nodes are all registered correctly. - -Run - -```shell -kubectl get nodes -``` - -And verify that all of the nodes you expect to see are present and that they are all in the `Ready` state. - -To get detailed information about the overall health of your cluster, you can run: - -```shell -kubectl cluster-info dump -``` -## Looking at logs - -For now, digging deeper into the cluster requires logging into the relevant machines. Here are the locations -of the relevant log files. (note that on systemd-based systems, you may need to use `journalctl` instead) - -### Master - - * `/var/log/kube-apiserver.log` - API Server, responsible for serving the API - * `/var/log/kube-scheduler.log` - Scheduler, responsible for making scheduling decisions - * `/var/log/kube-controller-manager.log` - Controller that manages replication controllers - -### Worker Nodes - - * `/var/log/kubelet.log` - Kubelet, responsible for running containers on the node - * `/var/log/kube-proxy.log` - Kube Proxy, responsible for service load balancing - -## A general overview of cluster failure modes - -This is an incomplete list of things that could go wrong, and how to adjust your cluster setup to mitigate the problems. - -### Root causes: - - - VM(s) shutdown - - Network partition within cluster, or between cluster and users - - Crashes in Kubernetes software - - Data loss or unavailability of persistent storage (e.g. GCE PD or AWS EBS volume) - - Operator error, for example misconfigured Kubernetes software or application software - -### Specific scenarios: - - - Apiserver VM shutdown or apiserver crashing - - Results - - unable to stop, update, or start new pods, services, replication controller - - existing pods and services should continue to work normally, unless they depend on the Kubernetes API - - Apiserver backing storage lost - - Results - - apiserver should fail to come up - - kubelets will not be able to reach it but will continue to run the same pods and provide the same service proxying - - manual recovery or recreation of apiserver state necessary before apiserver is restarted - - Supporting services (node controller, replication controller manager, scheduler, etc) VM shutdown or crashes - - currently those are colocated with the apiserver, and their unavailability has similar consequences as apiserver - - in future, these will be replicated as well and may not be co-located - - they do not have their own persistent state - - Individual node (VM or physical machine) shuts down - - Results - - pods on that Node stop running - - Network partition - - Results - - partition A thinks the nodes in partition B are down; partition B thinks the apiserver is down. (Assuming the master VM ends up in partition A.) - - Kubelet software fault - - Results - - crashing kubelet cannot start new pods on the node - - kubelet might delete the pods or not - - node marked unhealthy - - replication controllers start new pods elsewhere - - Cluster operator error - - Results - - loss of pods, services, etc - - lost of apiserver backing store - - users unable to read API - - etc. - -### Mitigations: - -- Action: Use IaaS provider's automatic VM restarting feature for IaaS VMs - - Mitigates: Apiserver VM shutdown or apiserver crashing - - Mitigates: Supporting services VM shutdown or crashes - -- Action: Use IaaS providers reliable storage (e.g. GCE PD or AWS EBS volume) for VMs with apiserver+etcd - - Mitigates: Apiserver backing storage lost - -- Action: Use [high-availability](/docs/setup/production-environment/tools/kubeadm/high-availability/) configuration - - Mitigates: Control plane node shutdown or control plane components (scheduler, API server, controller-manager) crashing - - Will tolerate one or more simultaneous node or component failures - - Mitigates: API server backing storage (i.e., etcd's data directory) lost - - Assumes HA (highly-available) etcd configuration - -- Action: Snapshot apiserver PDs/EBS-volumes periodically - - Mitigates: Apiserver backing storage lost - - Mitigates: Some cases of operator error - - Mitigates: Some cases of Kubernetes software fault - -- Action: use replication controller and services in front of pods - - Mitigates: Node shutdown - - Mitigates: Kubelet software fault - -- Action: applications (containers) designed to tolerate unexpected restarts - - Mitigates: Node shutdown - - Mitigates: Kubelet software fault - - diff --git a/content/en/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md b/content/en/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md deleted file mode 100644 index 56d00d5323..0000000000 --- a/content/en/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -reviewers: -- bprashanth -title: Debug Pods and ReplicationControllers -content_type: task ---- - - - -This page shows how to debug Pods and ReplicationControllers. - -## {{% heading "prerequisites" %}} - - -{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} - -* You should be familiar with the basics of - {{< glossary_tooltip text="Pods" term_id="pod" >}} and with - Pods' [lifecycles](/docs/concepts/workloads/pods/pod-lifecycle/). - - - -## Debugging Pods - -The first step in debugging a pod is taking a look at it. Check the current -state of the pod and recent events with the following command: - -```shell -kubectl describe pods ${POD_NAME} -``` - -Look at the state of the containers in the pod. Are they all `Running`? Have -there been recent restarts? - -Continue debugging depending on the state of the pods. - -### My pod stays pending - -If a pod is stuck in `Pending` it means that it can not be scheduled onto a -node. Generally this is because there are insufficient resources of one type or -another that prevent scheduling. Look at the output of the `kubectl describe -...` command above. There should be messages from the scheduler about why it -can not schedule your pod. Reasons include: - -#### Insufficient resources - -You may have exhausted the supply of CPU or Memory in your cluster. In this -case you can try several things: - -* Add more nodes to the cluster. - -* [Terminate unneeded pods](/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination) - to make room for pending pods. - -* Check that the pod is not larger than your nodes. For example, if all - nodes have a capacity of `cpu:1`, then a pod with a request of `cpu: 1.1` - will never be scheduled. - - You can check node capacities with the `kubectl get nodes -o ` - command. Here are some example command lines that extract the necessary - information: - - ```shell - kubectl get nodes -o yaml | egrep '\sname:|cpu:|memory:' - kubectl get nodes -o json | jq '.items[] | {name: .metadata.name, cap: .status.capacity}' - ``` - - The [resource quota](/docs/concepts/policy/resource-quotas/) - feature can be configured to limit the total amount of - resources that can be consumed. If used in conjunction with namespaces, it can - prevent one team from hogging all the resources. - -#### Using hostPort - -When you bind a pod to a `hostPort` there are a limited number of places that -the pod can be scheduled. In most cases, `hostPort` is unnecessary; try using a -service object to expose your pod. If you do require `hostPort` then you can -only schedule as many pods as there are nodes in your container cluster. - -### My pod stays waiting - -If a pod is stuck in the `Waiting` state, then it has been scheduled to a -worker node, but it can't run on that machine. Again, the information from -`kubectl describe ...` should be informative. The most common cause of -`Waiting` pods is a failure to pull the image. There are three things to check: - -* Make sure that you have the name of the image correct. -* Have you pushed the image to the repository? -* Try to manually pull the image to see if it can be pulled. For example, if you - use Docker on your PC, run `docker pull `. - -### My pod is crashing or otherwise unhealthy - -Once your pod has been scheduled, the methods described in [Debug Running Pods]( -/docs/tasks/debug-application-cluster/debug-running-pod/) are available for debugging. - - -## Debugging ReplicationControllers - -ReplicationControllers are fairly straightforward. They can either create pods -or they can't. If they can't create pods, then please refer to the -[instructions above](#debugging-pods) to debug your pods. - -You can also use `kubectl describe rc ${CONTROLLER_NAME}` to inspect events -related to the replication controller. - - diff --git a/content/en/docs/tasks/debug-application-cluster/debug-running-pod.md b/content/en/docs/tasks/debug-application-cluster/debug-running-pod.md deleted file mode 100644 index c3922ed0a1..0000000000 --- a/content/en/docs/tasks/debug-application-cluster/debug-running-pod.md +++ /dev/null @@ -1,333 +0,0 @@ ---- -reviewers: -- verb -- soltysh -title: Debug Running Pods -content_type: task ---- - - - -This page explains how to debug Pods running (or crashing) on a Node. - - - -## {{% heading "prerequisites" %}} - - -* Your {{< glossary_tooltip text="Pod" term_id="pod" >}} should already be - scheduled and running. If your Pod is not yet running, start with [Troubleshoot - Applications](/docs/tasks/debug-application-cluster/debug-application/). -* For some of the advanced debugging steps you need to know on which Node the - Pod is running and have shell access to run commands on that Node. You don't - need that access to run the standard debug steps that use `kubectl`. - - - - - -## Examining pod logs {#examine-pod-logs} - -First, look at the logs of the affected container: - -```shell -kubectl logs ${POD_NAME} ${CONTAINER_NAME} -``` - -If your container has previously crashed, you can access the previous container's crash log with: - -```shell -kubectl logs --previous ${POD_NAME} ${CONTAINER_NAME} -``` - -## Debugging with container exec {#container-exec} - -If the {{< glossary_tooltip text="container image" term_id="image" >}} includes -debugging utilities, as is the case with images built from Linux and Windows OS -base images, you can run commands inside a specific container with -`kubectl exec`: - -```shell -kubectl exec ${POD_NAME} -c ${CONTAINER_NAME} -- ${CMD} ${ARG1} ${ARG2} ... ${ARGN} -``` - -{{< note >}} -`-c ${CONTAINER_NAME}` is optional. You can omit it for Pods that only contain a single container. -{{< /note >}} - -As an example, to look at the logs from a running Cassandra pod, you might run - -```shell -kubectl exec cassandra -- cat /var/log/cassandra/system.log -``` - -You can run a shell that's connected to your terminal using the `-i` and `-t` -arguments to `kubectl exec`, for example: - -```shell -kubectl exec -it cassandra -- sh -``` - -For more details, see [Get a Shell to a Running Container]( -/docs/tasks/debug-application-cluster/get-shell-running-container/). - -## Debugging with an ephemeral debug container {#ephemeral-container} - -{{< feature-state state="beta" for_k8s_version="v1.23" >}} - -{{< glossary_tooltip text="Ephemeral containers" term_id="ephemeral-container" >}} -are useful for interactive troubleshooting when `kubectl exec` is insufficient -because a container has crashed or a container image doesn't include debugging -utilities, such as with [distroless images]( -https://github.com/GoogleContainerTools/distroless). - -### Example debugging using ephemeral containers {#ephemeral-container-example} - -You can use the `kubectl debug` command to add ephemeral containers to a -running Pod. First, create a pod for the example: - -```shell -kubectl run ephemeral-demo --image=k8s.gcr.io/pause:3.1 --restart=Never -``` - -The examples in this section use the `pause` container image because it does not -contain debugging utilities, but this method works with all container -images. - -If you attempt to use `kubectl exec` to create a shell you will see an error -because there is no shell in this container image. - -```shell -kubectl exec -it ephemeral-demo -- sh -``` - -``` -OCI runtime exec failed: exec failed: container_linux.go:346: starting container process caused "exec: \"sh\": executable file not found in $PATH": unknown -``` - -You can instead add a debugging container using `kubectl debug`. If you -specify the `-i`/`--interactive` argument, `kubectl` will automatically attach -to the console of the Ephemeral Container. - -```shell -kubectl debug -it ephemeral-demo --image=busybox:1.28 --target=ephemeral-demo -``` - -``` -Defaulting debug container name to debugger-8xzrl. -If you don't see a command prompt, try pressing enter. -/ # -``` - -This command adds a new busybox container and attaches to it. The `--target` -parameter targets the process namespace of another container. It's necessary -here because `kubectl run` does not enable [process namespace sharing]( -/docs/tasks/configure-pod-container/share-process-namespace/) in the pod it -creates. - -{{< note >}} -The `--target` parameter must be supported by the {{< glossary_tooltip -text="Container Runtime" term_id="container-runtime" >}}. When not supported, -the Ephemeral Container may not be started, or it may be started with an -isolated process namespace so that `ps` does not reveal processes in other -containers. -{{< /note >}} - -You can view the state of the newly created ephemeral container using `kubectl describe`: - -```shell -kubectl describe pod ephemeral-demo -``` - -``` -... -Ephemeral Containers: - debugger-8xzrl: - Container ID: docker://b888f9adfd15bd5739fefaa39e1df4dd3c617b9902082b1cfdc29c4028ffb2eb - Image: busybox - Image ID: docker-pullable://busybox@sha256:1828edd60c5efd34b2bf5dd3282ec0cc04d47b2ff9caa0b6d4f07a21d1c08084 - Port: - Host Port: - State: Running - Started: Wed, 12 Feb 2020 14:25:42 +0100 - Ready: False - Restart Count: 0 - Environment: - Mounts: -... -``` - -Use `kubectl delete` to remove the Pod when you're finished: - -```shell -kubectl delete pod ephemeral-demo -``` - -## Debugging using a copy of the Pod - -Sometimes Pod configuration options make it difficult to troubleshoot in certain -situations. For example, you can't run `kubectl exec` to troubleshoot your -container if your container image does not include a shell or if your application -crashes on startup. In these situations you can use `kubectl debug` to create a -copy of the Pod with configuration values changed to aid debugging. - -### Copying a Pod while adding a new container - -Adding a new container can be useful when your application is running but not -behaving as you expect and you'd like to add additional troubleshooting -utilities to the Pod. - -For example, maybe your application's container images are built on `busybox` -but you need debugging utilities not included in `busybox`. You can simulate -this scenario using `kubectl run`: - -```shell -kubectl run myapp --image=busybox:1.28 --restart=Never -- sleep 1d -``` - -Run this command to create a copy of `myapp` named `myapp-debug` that adds a -new Ubuntu container for debugging: - -```shell -kubectl debug myapp -it --image=ubuntu --share-processes --copy-to=myapp-debug -``` - -``` -Defaulting debug container name to debugger-w7xmf. -If you don't see a command prompt, try pressing enter. -root@myapp-debug:/# -``` - -{{< note >}} -* `kubectl debug` automatically generates a container name if you don't choose - one using the `--container` flag. -* The `-i` flag causes `kubectl debug` to attach to the new container by - default. You can prevent this by specifying `--attach=false`. If your session - becomes disconnected you can reattach using `kubectl attach`. -* The `--share-processes` allows the containers in this Pod to see processes - from the other containers in the Pod. For more information about how this - works, see [Share Process Namespace between Containers in a Pod]( - /docs/tasks/configure-pod-container/share-process-namespace/). -{{< /note >}} - -Don't forget to clean up the debugging Pod when you're finished with it: - -```shell -kubectl delete pod myapp myapp-debug -``` - -### Copying a Pod while changing its command - -Sometimes it's useful to change the command for a container, for example to -add a debugging flag or because the application is crashing. - -To simulate a crashing application, use `kubectl run` to create a container -that immediately exits: - -``` -kubectl run --image=busybox:1.28 myapp -- false -``` - -You can see using `kubectl describe pod myapp` that this container is crashing: - -``` -Containers: - myapp: - Image: busybox - ... - Args: - false - State: Waiting - Reason: CrashLoopBackOff - Last State: Terminated - Reason: Error - Exit Code: 1 -``` - -You can use `kubectl debug` to create a copy of this Pod with the command -changed to an interactive shell: - -``` -kubectl debug myapp -it --copy-to=myapp-debug --container=myapp -- sh -``` - -``` -If you don't see a command prompt, try pressing enter. -/ # -``` - -Now you have an interactive shell that you can use to perform tasks like -checking filesystem paths or running the container command manually. - -{{< note >}} -* To change the command of a specific container you must - specify its name using `--container` or `kubectl debug` will instead - create a new container to run the command you specified. -* The `-i` flag causes `kubectl debug` to attach to the container by default. - You can prevent this by specifying `--attach=false`. If your session becomes - disconnected you can reattach using `kubectl attach`. -{{< /note >}} - -Don't forget to clean up the debugging Pod when you're finished with it: - -```shell -kubectl delete pod myapp myapp-debug -``` - -### Copying a Pod while changing container images - -In some situations you may want to change a misbehaving Pod from its normal -production container images to an image containing a debugging build or -additional utilities. - -As an example, create a Pod using `kubectl run`: - -``` -kubectl run myapp --image=busybox:1.28 --restart=Never -- sleep 1d -``` - -Now use `kubectl debug` to make a copy and change its container image -to `ubuntu`: - -``` -kubectl debug myapp --copy-to=myapp-debug --set-image=*=ubuntu -``` - -The syntax of `--set-image` uses the same `container_name=image` syntax as -`kubectl set image`. `*=ubuntu` means change the image of all containers -to `ubuntu`. - -Don't forget to clean up the debugging Pod when you're finished with it: - -```shell -kubectl delete pod myapp myapp-debug -``` - -## Debugging via a shell on the node {#node-shell-session} - -If none of these approaches work, you can find the Node on which the Pod is -running and create a privileged Pod running in the host namespaces. To create -an interactive shell on a node using `kubectl debug`, run: - -```shell -kubectl debug node/mynode -it --image=ubuntu -``` - -``` -Creating debugging pod node-debugger-mynode-pdx84 with container debugger on node mynode. -If you don't see a command prompt, try pressing enter. -root@ek8s:/# -``` - -When creating a debugging session on a node, keep in mind that: - -* `kubectl debug` automatically generates the name of the new Pod based on - the name of the Node. -* The container runs in the host IPC, Network, and PID namespaces. -* The root filesystem of the Node will be mounted at `/host`. - -Don't forget to clean up the debugging Pod when you're finished with it: - -```shell -kubectl delete pod node-debugger-mynode-pdx84 -``` diff --git a/content/en/docs/tasks/debug-application-cluster/troubleshooting.md b/content/en/docs/tasks/debug/_index.md similarity index 94% rename from content/en/docs/tasks/debug-application-cluster/troubleshooting.md rename to content/en/docs/tasks/debug/_index.md index f000d019e8..da024f4af9 100644 --- a/content/en/docs/tasks/debug-application-cluster/troubleshooting.md +++ b/content/en/docs/tasks/debug/_index.md @@ -1,9 +1,12 @@ --- +title: "Monitoring, Logging, and Debugging" +description: Set up monitoring and logging to troubleshoot a cluster, or debug a containerized application. +weight: 20 reviewers: - brendandburns - davidopp content_type: concept -title: Troubleshooting +no_list: true --- @@ -11,9 +14,9 @@ title: Troubleshooting Sometimes things go wrong. This guide is aimed at making them right. It has two sections: -* [Troubleshooting your application](/docs/tasks/debug-application-cluster/debug-application/) - Useful +* [Debugging your application](/docs/tasks/debug/debug-application/) - Useful for users who are deploying code into Kubernetes and wondering why it is not working. -* [Troubleshooting your cluster](/docs/tasks/debug-application-cluster/debug-cluster/) - Useful +* [Debugging your cluster](/docs/tasks/debug/debug-cluster/) - Useful for cluster administrators and people whose Kubernetes cluster is unhappy. You should also check the known issues for the [release](https://github.com/kubernetes/kubernetes/releases) diff --git a/content/en/docs/tasks/debug/debug-application/_index.md b/content/en/docs/tasks/debug/debug-application/_index.md new file mode 100644 index 0000000000..e027ac4f49 --- /dev/null +++ b/content/en/docs/tasks/debug/debug-application/_index.md @@ -0,0 +1,8 @@ +--- +title: "Troubleshooting Applications" +description: Debugging common containerized application issues. +weight: 20 +--- + +This doc contains a set of resources for fixing issues with containerized applications. It covers things like common issues with Kubernetes resources (like Pods, Services, or StatefulSets), advice on making sense of container termination messages, and ways to debug running containers. + diff --git a/content/en/docs/tasks/debug-application-cluster/debug-init-containers.md b/content/en/docs/tasks/debug/debug-application/debug-init-containers.md similarity index 99% rename from content/en/docs/tasks/debug-application-cluster/debug-init-containers.md rename to content/en/docs/tasks/debug/debug-application/debug-init-containers.md index c3cf109ea7..6e5bafa355 100644 --- a/content/en/docs/tasks/debug-application-cluster/debug-init-containers.md +++ b/content/en/docs/tasks/debug/debug-application/debug-init-containers.md @@ -9,6 +9,7 @@ reviewers: - smarterclayton title: Debug Init Containers content_type: task +weight: 40 --- diff --git a/content/en/docs/tasks/debug-application-cluster/debug-application.md b/content/en/docs/tasks/debug/debug-application/debug-pods.md similarity index 92% rename from content/en/docs/tasks/debug-application-cluster/debug-application.md rename to content/en/docs/tasks/debug/debug-application/debug-pods.md index 179a86021b..e8e8662640 100644 --- a/content/en/docs/tasks/debug-application-cluster/debug-application.md +++ b/content/en/docs/tasks/debug/debug-application/debug-pods.md @@ -2,15 +2,16 @@ reviewers: - mikedanese - thockin -title: Troubleshoot Applications +title: Debug Pods content_type: concept +weight: 10 --- This guide is to help users debug applications that are deployed into Kubernetes and not behaving correctly. This is *not* a guide for people who want to debug their cluster. For that you should check out -[this guide](/docs/tasks/debug-application-cluster/debug-cluster). +[this guide](/docs/tasks/debug/debug-cluster). @@ -64,7 +65,7 @@ Again, the information from `kubectl describe ...` should be informative. The m #### My pod is crashing or otherwise unhealthy Once your pod has been scheduled, the methods described in [Debug Running Pods]( -/docs/tasks/debug-application-cluster/debug-running-pod/) are available for debugging. +/docs/tasks/debug/debug-applications/debug-running-pod/) are available for debugging. #### My pod is running but not doing what I told it to do @@ -145,15 +146,15 @@ Verify that the pod's `containerPort` matches up with the Service's `targetPort` #### Network traffic is not forwarded -Please see [debugging service](/docs/tasks/debug-application-cluster/debug-service/) for more information. +Please see [debugging service](/docs/tasks/debug/debug-applications/debug-service/) for more information. ## {{% heading "whatsnext" %}} If none of the above solves your problem, follow the instructions in -[Debugging Service document](/docs/tasks/debug-application-cluster/debug-service/) +[Debugging Service document](/docs/tasks/debug/debug-applications/debug-service/) to make sure that your `Service` is running, has `Endpoints`, and your `Pods` are actually serving; you have DNS working, iptables rules installed, and kube-proxy does not seem to be misbehaving. -You may also visit [troubleshooting document](/docs/tasks/debug-application-cluster/troubleshooting/) for more information. +You may also visit [troubleshooting document](/docs/tasks/debug/overview/) for more information. diff --git a/content/en/docs/tasks/debug-application-cluster/debug-application-introspection.md b/content/en/docs/tasks/debug/debug-application/debug-running-pod.md similarity index 54% rename from content/en/docs/tasks/debug-application-cluster/debug-application-introspection.md rename to content/en/docs/tasks/debug/debug-application/debug-running-pod.md index c7720ad1f6..a810c60efa 100644 --- a/content/en/docs/tasks/debug-application-cluster/debug-application-introspection.md +++ b/content/en/docs/tasks/debug/debug-application/debug-running-pod.md @@ -1,21 +1,25 @@ --- reviewers: -- janetkuo -- thockin -content_type: concept -title: Application Introspection and Debugging +- verb +- soltysh +title: Debug Running Pods +content_type: task --- -Once your application is running, you'll inevitably need to debug problems with it. -Earlier we described how you can use `kubectl get pods` to retrieve simple status information about -your pods. But there are a number of ways to get even more information about your application. +This page explains how to debug Pods running (or crashing) on a Node. +## {{% heading "prerequisites" %}} - +* Your {{< glossary_tooltip text="Pod" term_id="pod" >}} should already be + scheduled and running. If your Pod is not yet running, start with [Debugging + Pods](/docs/tasks/debug/debug-application/). +* For some of the advanced debugging steps you need to know on which Node the + Pod is running and have shell access to run commands on that Node. You don't + need that access to run the standard debug steps that use `kubectl`. ## Using `kubectl describe pod` to fetch details about pods @@ -125,6 +129,7 @@ Currently the only Condition associated with a Pod is the binary Ready condition Lastly, you see a log of recent events related to your Pod. The system compresses multiple identical events by indicating the first and last time it was seen and the number of times it was seen. "From" indicates the component that is logging the event, "SubobjectPath" tells you which object (e.g. container within the pod) is being referred to, and "Reason" and "Message" tell you what happened. + ## Example: debugging Pending Pods A common scenario that you can detect using events is when you've created a Pod that won't fit on any node. For example, the Pod might request more resources than are free on any node, or it might specify a label selector that doesn't match any nodes. Let's say we created the previous Deployment with 5 replicas (instead of 2) and requesting 600 millicores instead of 500, on a four-node cluster where each (virtual) machine has 1 CPU. In that case one of the Pods will not be able to schedule. (Note that because of the cluster addon pods such as fluentd, skydns, etc., that run on each node, if we requested 1000 millicores then none of the Pods would be able to schedule.) @@ -326,197 +331,308 @@ status: startTime: "2022-02-17T21:51:01Z" ``` -## Example: debugging a down/unreachable node +## Examining pod logs {#examine-pod-logs} -Sometimes when debugging it can be useful to look at the status of a node -- for example, because you've noticed strange behavior of a Pod that's running on the node, or to find out why a Pod won't schedule onto the node. As with Pods, you can use `kubectl describe node` and `kubectl get node -o yaml` to retrieve detailed information about nodes. For example, here's what you'll see if a node is down (disconnected from the network, or kubelet dies and won't restart, etc.). Notice the events that show the node is NotReady, and also notice that the pods are no longer running (they are evicted after five minutes of NotReady status). +First, look at the logs of the affected container: ```shell -kubectl get nodes +kubectl logs ${POD_NAME} ${CONTAINER_NAME} ``` -```none -NAME STATUS ROLES AGE VERSION -kube-worker-1 NotReady 1h v1.23.3 -kubernetes-node-bols Ready 1h v1.23.3 -kubernetes-node-st6x Ready 1h v1.23.3 -kubernetes-node-unaj Ready 1h v1.23.3 -``` +If your container has previously crashed, you can access the previous container's crash log with: ```shell -kubectl describe node kube-worker-1 +kubectl logs --previous ${POD_NAME} ${CONTAINER_NAME} ``` -```none -Name: kube-worker-1 -Roles: -Labels: beta.kubernetes.io/arch=amd64 - beta.kubernetes.io/os=linux - kubernetes.io/arch=amd64 - kubernetes.io/hostname=kube-worker-1 - kubernetes.io/os=linux -Annotations: kubeadm.alpha.kubernetes.io/cri-socket: /run/containerd/containerd.sock - node.alpha.kubernetes.io/ttl: 0 - volumes.kubernetes.io/controller-managed-attach-detach: true -CreationTimestamp: Thu, 17 Feb 2022 16:46:30 -0500 -Taints: node.kubernetes.io/unreachable:NoExecute - node.kubernetes.io/unreachable:NoSchedule -Unschedulable: false -Lease: - HolderIdentity: kube-worker-1 - AcquireTime: - RenewTime: Thu, 17 Feb 2022 17:13:09 -0500 -Conditions: - Type Status LastHeartbeatTime LastTransitionTime Reason Message - ---- ------ ----------------- ------------------ ------ ------- - NetworkUnavailable False Thu, 17 Feb 2022 17:09:13 -0500 Thu, 17 Feb 2022 17:09:13 -0500 WeaveIsUp Weave pod has set this - MemoryPressure Unknown Thu, 17 Feb 2022 17:12:40 -0500 Thu, 17 Feb 2022 17:13:52 -0500 NodeStatusUnknown Kubelet stopped posting node status. - DiskPressure Unknown Thu, 17 Feb 2022 17:12:40 -0500 Thu, 17 Feb 2022 17:13:52 -0500 NodeStatusUnknown Kubelet stopped posting node status. - PIDPressure Unknown Thu, 17 Feb 2022 17:12:40 -0500 Thu, 17 Feb 2022 17:13:52 -0500 NodeStatusUnknown Kubelet stopped posting node status. - Ready Unknown Thu, 17 Feb 2022 17:12:40 -0500 Thu, 17 Feb 2022 17:13:52 -0500 NodeStatusUnknown Kubelet stopped posting node status. -Addresses: - InternalIP: 192.168.0.113 - Hostname: kube-worker-1 -Capacity: - cpu: 2 - ephemeral-storage: 15372232Ki - hugepages-2Mi: 0 - memory: 2025188Ki - pods: 110 -Allocatable: - cpu: 2 - ephemeral-storage: 14167048988 - hugepages-2Mi: 0 - memory: 1922788Ki - pods: 110 -System Info: - Machine ID: 9384e2927f544209b5d7b67474bbf92b - System UUID: aa829ca9-73d7-064d-9019-df07404ad448 - Boot ID: 5a295a03-aaca-4340-af20-1327fa5dab5c - Kernel Version: 5.13.0-28-generic - OS Image: Ubuntu 21.10 - Operating System: linux - Architecture: amd64 - Container Runtime Version: containerd://1.5.9 - Kubelet Version: v1.23.3 - Kube-Proxy Version: v1.23.3 -Non-terminated Pods: (4 in total) - Namespace Name CPU Requests CPU Limits Memory Requests Memory Limits Age - --------- ---- ------------ ---------- --------------- ------------- --- - default nginx-deployment-67d4bdd6f5-cx2nz 500m (25%) 500m (25%) 128Mi (6%) 128Mi (6%) 23m - default nginx-deployment-67d4bdd6f5-w6kd7 500m (25%) 500m (25%) 128Mi (6%) 128Mi (6%) 23m - kube-system kube-proxy-dnxbz 0 (0%) 0 (0%) 0 (0%) 0 (0%) 28m - kube-system weave-net-gjxxp 100m (5%) 0 (0%) 200Mi (10%) 0 (0%) 28m -Allocated resources: - (Total limits may be over 100 percent, i.e., overcommitted.) - Resource Requests Limits - -------- -------- ------ - cpu 1100m (55%) 1 (50%) - memory 456Mi (24%) 256Mi (13%) - ephemeral-storage 0 (0%) 0 (0%) - hugepages-2Mi 0 (0%) 0 (0%) -Events: +## Debugging with container exec {#container-exec} + +If the {{< glossary_tooltip text="container image" term_id="image" >}} includes +debugging utilities, as is the case with images built from Linux and Windows OS +base images, you can run commands inside a specific container with +`kubectl exec`: + +```shell +kubectl exec ${POD_NAME} -c ${CONTAINER_NAME} -- ${CMD} ${ARG1} ${ARG2} ... ${ARGN} +``` + +{{< note >}} +`-c ${CONTAINER_NAME}` is optional. You can omit it for Pods that only contain a single container. +{{< /note >}} + +As an example, to look at the logs from a running Cassandra pod, you might run + +```shell +kubectl exec cassandra -- cat /var/log/cassandra/system.log +``` + +You can run a shell that's connected to your terminal using the `-i` and `-t` +arguments to `kubectl exec`, for example: + +```shell +kubectl exec -it cassandra -- sh +``` + +For more details, see [Get a Shell to a Running Container]( +/docs/tasks/debug/debug-application/get-shell-running-container/). + +## Debugging with an ephemeral debug container {#ephemeral-container} + +{{< feature-state state="beta" for_k8s_version="v1.23" >}} + +{{< glossary_tooltip text="Ephemeral containers" term_id="ephemeral-container" >}} +are useful for interactive troubleshooting when `kubectl exec` is insufficient +because a container has crashed or a container image doesn't include debugging +utilities, such as with [distroless images]( +https://github.com/GoogleContainerTools/distroless). + +### Example debugging using ephemeral containers {#ephemeral-container-example} + +You can use the `kubectl debug` command to add ephemeral containers to a +running Pod. First, create a pod for the example: + +```shell +kubectl run ephemeral-demo --image=k8s.gcr.io/pause:3.1 --restart=Never +``` + +The examples in this section use the `pause` container image because it does not +contain debugging utilities, but this method works with all container +images. + +If you attempt to use `kubectl exec` to create a shell you will see an error +because there is no shell in this container image. + +```shell +kubectl exec -it ephemeral-demo -- sh +``` + +``` +OCI runtime exec failed: exec failed: container_linux.go:346: starting container process caused "exec: \"sh\": executable file not found in $PATH": unknown +``` + +You can instead add a debugging container using `kubectl debug`. If you +specify the `-i`/`--interactive` argument, `kubectl` will automatically attach +to the console of the Ephemeral Container. + +```shell +kubectl debug -it ephemeral-demo --image=busybox:1.28 --target=ephemeral-demo +``` + +``` +Defaulting debug container name to debugger-8xzrl. +If you don't see a command prompt, try pressing enter. +/ # +``` + +This command adds a new busybox container and attaches to it. The `--target` +parameter targets the process namespace of another container. It's necessary +here because `kubectl run` does not enable [process namespace sharing]( +/docs/tasks/configure-pod-container/share-process-namespace/) in the pod it +creates. + +{{< note >}} +The `--target` parameter must be supported by the {{< glossary_tooltip +text="Container Runtime" term_id="container-runtime" >}}. When not supported, +the Ephemeral Container may not be started, or it may be started with an +isolated process namespace so that `ps` does not reveal processes in other +containers. +{{< /note >}} + +You can view the state of the newly created ephemeral container using `kubectl describe`: + +```shell +kubectl describe pod ephemeral-demo +``` + +``` +... +Ephemeral Containers: + debugger-8xzrl: + Container ID: docker://b888f9adfd15bd5739fefaa39e1df4dd3c617b9902082b1cfdc29c4028ffb2eb + Image: busybox + Image ID: docker-pullable://busybox@sha256:1828edd60c5efd34b2bf5dd3282ec0cc04d47b2ff9caa0b6d4f07a21d1c08084 + Port: + Host Port: + State: Running + Started: Wed, 12 Feb 2020 14:25:42 +0100 + Ready: False + Restart Count: 0 + Environment: + Mounts: ... ``` +Use `kubectl delete` to remove the Pod when you're finished: + ```shell -kubectl get node kube-worker-1 -o yaml +kubectl delete pod ephemeral-demo ``` -```yaml -apiVersion: v1 -kind: Node -metadata: - annotations: - kubeadm.alpha.kubernetes.io/cri-socket: /run/containerd/containerd.sock - node.alpha.kubernetes.io/ttl: "0" - volumes.kubernetes.io/controller-managed-attach-detach: "true" - creationTimestamp: "2022-02-17T21:46:30Z" - labels: - beta.kubernetes.io/arch: amd64 - beta.kubernetes.io/os: linux - kubernetes.io/arch: amd64 - kubernetes.io/hostname: kube-worker-1 - kubernetes.io/os: linux - name: kube-worker-1 - resourceVersion: "4026" - uid: 98efe7cb-2978-4a0b-842a-1a7bf12c05f8 -spec: {} -status: - addresses: - - address: 192.168.0.113 - type: InternalIP - - address: kube-worker-1 - type: Hostname - allocatable: - cpu: "2" - ephemeral-storage: "14167048988" - hugepages-2Mi: "0" - memory: 1922788Ki - pods: "110" - capacity: - cpu: "2" - ephemeral-storage: 15372232Ki - hugepages-2Mi: "0" - memory: 2025188Ki - pods: "110" - conditions: - - lastHeartbeatTime: "2022-02-17T22:20:32Z" - lastTransitionTime: "2022-02-17T22:20:32Z" - message: Weave pod has set this - reason: WeaveIsUp - status: "False" - type: NetworkUnavailable - - lastHeartbeatTime: "2022-02-17T22:20:15Z" - lastTransitionTime: "2022-02-17T22:13:25Z" - message: kubelet has sufficient memory available - reason: KubeletHasSufficientMemory - status: "False" - type: MemoryPressure - - lastHeartbeatTime: "2022-02-17T22:20:15Z" - lastTransitionTime: "2022-02-17T22:13:25Z" - message: kubelet has no disk pressure - reason: KubeletHasNoDiskPressure - status: "False" - type: DiskPressure - - lastHeartbeatTime: "2022-02-17T22:20:15Z" - lastTransitionTime: "2022-02-17T22:13:25Z" - message: kubelet has sufficient PID available - reason: KubeletHasSufficientPID - status: "False" - type: PIDPressure - - lastHeartbeatTime: "2022-02-17T22:20:15Z" - lastTransitionTime: "2022-02-17T22:15:15Z" - message: kubelet is posting ready status. AppArmor enabled - reason: KubeletReady - status: "True" - type: Ready - daemonEndpoints: - kubeletEndpoint: - Port: 10250 - nodeInfo: - architecture: amd64 - bootID: 22333234-7a6b-44d4-9ce1-67e31dc7e369 - containerRuntimeVersion: containerd://1.5.9 - kernelVersion: 5.13.0-28-generic - kubeProxyVersion: v1.23.3 - kubeletVersion: v1.23.3 - machineID: 9384e2927f544209b5d7b67474bbf92b - operatingSystem: linux - osImage: Ubuntu 21.10 - systemUUID: aa829ca9-73d7-064d-9019-df07404ad448 +## Debugging using a copy of the Pod + +Sometimes Pod configuration options make it difficult to troubleshoot in certain +situations. For example, you can't run `kubectl exec` to troubleshoot your +container if your container image does not include a shell or if your application +crashes on startup. In these situations you can use `kubectl debug` to create a +copy of the Pod with configuration values changed to aid debugging. + +### Copying a Pod while adding a new container + +Adding a new container can be useful when your application is running but not +behaving as you expect and you'd like to add additional troubleshooting +utilities to the Pod. + +For example, maybe your application's container images are built on `busybox` +but you need debugging utilities not included in `busybox`. You can simulate +this scenario using `kubectl run`: + +```shell +kubectl run myapp --image=busybox:1.28 --restart=Never -- sleep 1d ``` +Run this command to create a copy of `myapp` named `myapp-debug` that adds a +new Ubuntu container for debugging: -## {{% heading "whatsnext" %}} +```shell +kubectl debug myapp -it --image=ubuntu --share-processes --copy-to=myapp-debug +``` +``` +Defaulting debug container name to debugger-w7xmf. +If you don't see a command prompt, try pressing enter. +root@myapp-debug:/# +``` -Learn about additional debugging tools, including: +{{< note >}} +* `kubectl debug` automatically generates a container name if you don't choose + one using the `--container` flag. +* The `-i` flag causes `kubectl debug` to attach to the new container by + default. You can prevent this by specifying `--attach=false`. If your session + becomes disconnected you can reattach using `kubectl attach`. +* The `--share-processes` allows the containers in this Pod to see processes + from the other containers in the Pod. For more information about how this + works, see [Share Process Namespace between Containers in a Pod]( + /docs/tasks/configure-pod-container/share-process-namespace/). +{{< /note >}} -* [Logging](/docs/concepts/cluster-administration/logging/) -* [Monitoring](/docs/tasks/debug-application-cluster/resource-usage-monitoring/) -* [Getting into containers via `exec`](/docs/tasks/debug-application-cluster/get-shell-running-container/) -* [Connecting to containers via proxies](/docs/tasks/extend-kubernetes/http-proxy-access-api/) -* [Connecting to containers via port forwarding](/docs/tasks/access-application-cluster/port-forward-access-application-cluster/) -* [Inspect Kubernetes node with crictl](/docs/tasks/debug-application-cluster/crictl/) +Don't forget to clean up the debugging Pod when you're finished with it: +```shell +kubectl delete pod myapp myapp-debug +``` +### Copying a Pod while changing its command + +Sometimes it's useful to change the command for a container, for example to +add a debugging flag or because the application is crashing. + +To simulate a crashing application, use `kubectl run` to create a container +that immediately exits: + +``` +kubectl run --image=busybox:1.28 myapp -- false +``` + +You can see using `kubectl describe pod myapp` that this container is crashing: + +``` +Containers: + myapp: + Image: busybox + ... + Args: + false + State: Waiting + Reason: CrashLoopBackOff + Last State: Terminated + Reason: Error + Exit Code: 1 +``` + +You can use `kubectl debug` to create a copy of this Pod with the command +changed to an interactive shell: + +``` +kubectl debug myapp -it --copy-to=myapp-debug --container=myapp -- sh +``` + +``` +If you don't see a command prompt, try pressing enter. +/ # +``` + +Now you have an interactive shell that you can use to perform tasks like +checking filesystem paths or running the container command manually. + +{{< note >}} +* To change the command of a specific container you must + specify its name using `--container` or `kubectl debug` will instead + create a new container to run the command you specified. +* The `-i` flag causes `kubectl debug` to attach to the container by default. + You can prevent this by specifying `--attach=false`. If your session becomes + disconnected you can reattach using `kubectl attach`. +{{< /note >}} + +Don't forget to clean up the debugging Pod when you're finished with it: + +```shell +kubectl delete pod myapp myapp-debug +``` + +### Copying a Pod while changing container images + +In some situations you may want to change a misbehaving Pod from its normal +production container images to an image containing a debugging build or +additional utilities. + +As an example, create a Pod using `kubectl run`: + +``` +kubectl run myapp --image=busybox:1.28 --restart=Never -- sleep 1d +``` + +Now use `kubectl debug` to make a copy and change its container image +to `ubuntu`: + +``` +kubectl debug myapp --copy-to=myapp-debug --set-image=*=ubuntu +``` + +The syntax of `--set-image` uses the same `container_name=image` syntax as +`kubectl set image`. `*=ubuntu` means change the image of all containers +to `ubuntu`. + +Don't forget to clean up the debugging Pod when you're finished with it: + +```shell +kubectl delete pod myapp myapp-debug +``` + +## Debugging via a shell on the node {#node-shell-session} + +If none of these approaches work, you can find the Node on which the Pod is +running and create a privileged Pod running in the host namespaces. To create +an interactive shell on a node using `kubectl debug`, run: + +```shell +kubectl debug node/mynode -it --image=ubuntu +``` + +``` +Creating debugging pod node-debugger-mynode-pdx84 with container debugger on node mynode. +If you don't see a command prompt, try pressing enter. +root@ek8s:/# +``` + +When creating a debugging session on a node, keep in mind that: + +* `kubectl debug` automatically generates the name of the new Pod based on + the name of the Node. +* The container runs in the host IPC, Network, and PID namespaces. +* The root filesystem of the Node will be mounted at `/host`. + +Don't forget to clean up the debugging Pod when you're finished with it: + +```shell +kubectl delete pod node-debugger-mynode-pdx84 +``` diff --git a/content/en/docs/tasks/debug-application-cluster/debug-service.md b/content/en/docs/tasks/debug/debug-application/debug-service.md similarity index 98% rename from content/en/docs/tasks/debug-application-cluster/debug-service.md rename to content/en/docs/tasks/debug/debug-application/debug-service.md index 4ff1a610b1..42d615dca9 100644 --- a/content/en/docs/tasks/debug-application-cluster/debug-service.md +++ b/content/en/docs/tasks/debug/debug-application/debug-service.md @@ -4,6 +4,7 @@ reviewers: - bowei content_type: concept title: Debug Services +weight: 20 --- @@ -441,7 +442,7 @@ they are running fine and not crashing. The "RESTARTS" column says that these pods are not crashing frequently or being restarted. Frequent restarts could lead to intermittent connectivity issues. -If the restart count is high, read more about how to [debug pods](/docs/tasks/debug-application-cluster/debug-pod-replication-controller/#debugging-pods). +If the restart count is high, read more about how to [debug pods](/docs/tasks/debug/debug-application/debug-pods). Inside the Kubernetes system is a control loop which evaluates the selector of every Service and saves the results into a corresponding Endpoints object. @@ -727,13 +728,13 @@ Service is not working. Please let us know what is going on, so we can help investigate! Contact us on -[Slack](/docs/tasks/debug-application-cluster/troubleshooting/#slack) or +[Slack](/docs/tasks/debug/overview/#slack) or [Forum](https://discuss.kubernetes.io) or [GitHub](https://github.com/kubernetes/kubernetes). ## {{% heading "whatsnext" %}} -Visit [troubleshooting document](/docs/tasks/debug-application-cluster/troubleshooting/) +Visit the [troubleshooting overview document](/docs/tasks/debug/overview/) for more information. diff --git a/content/en/docs/tasks/debug-application-cluster/debug-stateful-set.md b/content/en/docs/tasks/debug/debug-application/debug-statefulset.md similarity index 88% rename from content/en/docs/tasks/debug-application-cluster/debug-stateful-set.md rename to content/en/docs/tasks/debug/debug-application/debug-statefulset.md index bd7ce6e951..73c0d0c78a 100644 --- a/content/en/docs/tasks/debug-application-cluster/debug-stateful-set.md +++ b/content/en/docs/tasks/debug/debug-application/debug-statefulset.md @@ -9,6 +9,7 @@ reviewers: - smarterclayton title: Debug a StatefulSet content_type: task +weight: 30 --- @@ -34,9 +35,9 @@ If you find that any Pods listed are in `Unknown` or `Terminating` state for an refer to the [Deleting StatefulSet Pods](/docs/tasks/run-application/delete-stateful-set/) task for instructions on how to deal with them. You can debug individual Pods in a StatefulSet using the -[Debugging Pods](/docs/tasks/debug-application-cluster/debug-pod-replication-controller/) guide. +[Debugging Pods](/docs/tasks/debug/debug-application/debug-pods/) guide. ## {{% heading "whatsnext" %}} -Learn more about [debugging an init-container](/docs/tasks/debug-application-cluster/debug-init-containers/). +Learn more about [debugging an init-container](/docs/tasks/debug/debug-application/debug-init-containers/). diff --git a/content/en/docs/tasks/debug-application-cluster/determine-reason-pod-failure.md b/content/en/docs/tasks/debug/debug-application/determine-reason-pod-failure.md similarity index 100% rename from content/en/docs/tasks/debug-application-cluster/determine-reason-pod-failure.md rename to content/en/docs/tasks/debug/debug-application/determine-reason-pod-failure.md diff --git a/content/en/docs/tasks/debug-application-cluster/get-shell-running-container.md b/content/en/docs/tasks/debug/debug-application/get-shell-running-container.md similarity index 100% rename from content/en/docs/tasks/debug-application-cluster/get-shell-running-container.md rename to content/en/docs/tasks/debug/debug-application/get-shell-running-container.md diff --git a/content/en/docs/tasks/debug/debug-cluster/_index.md b/content/en/docs/tasks/debug/debug-cluster/_index.md new file mode 100644 index 0000000000..9c0ad56a4c --- /dev/null +++ b/content/en/docs/tasks/debug/debug-cluster/_index.md @@ -0,0 +1,316 @@ +--- +reviewers: +- davidopp +title: "Troubleshooting Clusters" +description: Debugging common cluster issues. +weight: 20 +no_list: true +--- + + + +This doc is about cluster troubleshooting; we assume you have already ruled out your application as the root cause of the +problem you are experiencing. See +the [application troubleshooting guide](/docs/tasks/debug/debug-application/) for tips on application debugging. +You may also visit the [troubleshooting overview document](/docs/tasks/debug/) for more information. + + + +## Listing your cluster + +The first thing to debug in your cluster is if your nodes are all registered correctly. + +Run the following command: + +```shell +kubectl get nodes +``` + +And verify that all of the nodes you expect to see are present and that they are all in the `Ready` state. + +To get detailed information about the overall health of your cluster, you can run: + +```shell +kubectl cluster-info dump +``` + +### Example: debugging a down/unreachable node + +Sometimes when debugging it can be useful to look at the status of a node -- for example, because you've noticed strange behavior of a Pod that's running on the node, or to find out why a Pod won't schedule onto the node. As with Pods, you can use `kubectl describe node` and `kubectl get node -o yaml` to retrieve detailed information about nodes. For example, here's what you'll see if a node is down (disconnected from the network, or kubelet dies and won't restart, etc.). Notice the events that show the node is NotReady, and also notice that the pods are no longer running (they are evicted after five minutes of NotReady status). + +```shell +kubectl get nodes +``` + +```none +NAME STATUS ROLES AGE VERSION +kube-worker-1 NotReady 1h v1.23.3 +kubernetes-node-bols Ready 1h v1.23.3 +kubernetes-node-st6x Ready 1h v1.23.3 +kubernetes-node-unaj Ready 1h v1.23.3 +``` + +```shell +kubectl describe node kube-worker-1 +``` + +```none +Name: kube-worker-1 +Roles: +Labels: beta.kubernetes.io/arch=amd64 + beta.kubernetes.io/os=linux + kubernetes.io/arch=amd64 + kubernetes.io/hostname=kube-worker-1 + kubernetes.io/os=linux +Annotations: kubeadm.alpha.kubernetes.io/cri-socket: /run/containerd/containerd.sock + node.alpha.kubernetes.io/ttl: 0 + volumes.kubernetes.io/controller-managed-attach-detach: true +CreationTimestamp: Thu, 17 Feb 2022 16:46:30 -0500 +Taints: node.kubernetes.io/unreachable:NoExecute + node.kubernetes.io/unreachable:NoSchedule +Unschedulable: false +Lease: + HolderIdentity: kube-worker-1 + AcquireTime: + RenewTime: Thu, 17 Feb 2022 17:13:09 -0500 +Conditions: + Type Status LastHeartbeatTime LastTransitionTime Reason Message + ---- ------ ----------------- ------------------ ------ ------- + NetworkUnavailable False Thu, 17 Feb 2022 17:09:13 -0500 Thu, 17 Feb 2022 17:09:13 -0500 WeaveIsUp Weave pod has set this + MemoryPressure Unknown Thu, 17 Feb 2022 17:12:40 -0500 Thu, 17 Feb 2022 17:13:52 -0500 NodeStatusUnknown Kubelet stopped posting node status. + DiskPressure Unknown Thu, 17 Feb 2022 17:12:40 -0500 Thu, 17 Feb 2022 17:13:52 -0500 NodeStatusUnknown Kubelet stopped posting node status. + PIDPressure Unknown Thu, 17 Feb 2022 17:12:40 -0500 Thu, 17 Feb 2022 17:13:52 -0500 NodeStatusUnknown Kubelet stopped posting node status. + Ready Unknown Thu, 17 Feb 2022 17:12:40 -0500 Thu, 17 Feb 2022 17:13:52 -0500 NodeStatusUnknown Kubelet stopped posting node status. +Addresses: + InternalIP: 192.168.0.113 + Hostname: kube-worker-1 +Capacity: + cpu: 2 + ephemeral-storage: 15372232Ki + hugepages-2Mi: 0 + memory: 2025188Ki + pods: 110 +Allocatable: + cpu: 2 + ephemeral-storage: 14167048988 + hugepages-2Mi: 0 + memory: 1922788Ki + pods: 110 +System Info: + Machine ID: 9384e2927f544209b5d7b67474bbf92b + System UUID: aa829ca9-73d7-064d-9019-df07404ad448 + Boot ID: 5a295a03-aaca-4340-af20-1327fa5dab5c + Kernel Version: 5.13.0-28-generic + OS Image: Ubuntu 21.10 + Operating System: linux + Architecture: amd64 + Container Runtime Version: containerd://1.5.9 + Kubelet Version: v1.23.3 + Kube-Proxy Version: v1.23.3 +Non-terminated Pods: (4 in total) + Namespace Name CPU Requests CPU Limits Memory Requests Memory Limits Age + --------- ---- ------------ ---------- --------------- ------------- --- + default nginx-deployment-67d4bdd6f5-cx2nz 500m (25%) 500m (25%) 128Mi (6%) 128Mi (6%) 23m + default nginx-deployment-67d4bdd6f5-w6kd7 500m (25%) 500m (25%) 128Mi (6%) 128Mi (6%) 23m + kube-system kube-proxy-dnxbz 0 (0%) 0 (0%) 0 (0%) 0 (0%) 28m + kube-system weave-net-gjxxp 100m (5%) 0 (0%) 200Mi (10%) 0 (0%) 28m +Allocated resources: + (Total limits may be over 100 percent, i.e., overcommitted.) + Resource Requests Limits + -------- -------- ------ + cpu 1100m (55%) 1 (50%) + memory 456Mi (24%) 256Mi (13%) + ephemeral-storage 0 (0%) 0 (0%) + hugepages-2Mi 0 (0%) 0 (0%) +Events: +... +``` + +```shell +kubectl get node kube-worker-1 -o yaml +``` + +```yaml +apiVersion: v1 +kind: Node +metadata: + annotations: + kubeadm.alpha.kubernetes.io/cri-socket: /run/containerd/containerd.sock + node.alpha.kubernetes.io/ttl: "0" + volumes.kubernetes.io/controller-managed-attach-detach: "true" + creationTimestamp: "2022-02-17T21:46:30Z" + labels: + beta.kubernetes.io/arch: amd64 + beta.kubernetes.io/os: linux + kubernetes.io/arch: amd64 + kubernetes.io/hostname: kube-worker-1 + kubernetes.io/os: linux + name: kube-worker-1 + resourceVersion: "4026" + uid: 98efe7cb-2978-4a0b-842a-1a7bf12c05f8 +spec: {} +status: + addresses: + - address: 192.168.0.113 + type: InternalIP + - address: kube-worker-1 + type: Hostname + allocatable: + cpu: "2" + ephemeral-storage: "14167048988" + hugepages-2Mi: "0" + memory: 1922788Ki + pods: "110" + capacity: + cpu: "2" + ephemeral-storage: 15372232Ki + hugepages-2Mi: "0" + memory: 2025188Ki + pods: "110" + conditions: + - lastHeartbeatTime: "2022-02-17T22:20:32Z" + lastTransitionTime: "2022-02-17T22:20:32Z" + message: Weave pod has set this + reason: WeaveIsUp + status: "False" + type: NetworkUnavailable + - lastHeartbeatTime: "2022-02-17T22:20:15Z" + lastTransitionTime: "2022-02-17T22:13:25Z" + message: kubelet has sufficient memory available + reason: KubeletHasSufficientMemory + status: "False" + type: MemoryPressure + - lastHeartbeatTime: "2022-02-17T22:20:15Z" + lastTransitionTime: "2022-02-17T22:13:25Z" + message: kubelet has no disk pressure + reason: KubeletHasNoDiskPressure + status: "False" + type: DiskPressure + - lastHeartbeatTime: "2022-02-17T22:20:15Z" + lastTransitionTime: "2022-02-17T22:13:25Z" + message: kubelet has sufficient PID available + reason: KubeletHasSufficientPID + status: "False" + type: PIDPressure + - lastHeartbeatTime: "2022-02-17T22:20:15Z" + lastTransitionTime: "2022-02-17T22:15:15Z" + message: kubelet is posting ready status. AppArmor enabled + reason: KubeletReady + status: "True" + type: Ready + daemonEndpoints: + kubeletEndpoint: + Port: 10250 + nodeInfo: + architecture: amd64 + bootID: 22333234-7a6b-44d4-9ce1-67e31dc7e369 + containerRuntimeVersion: containerd://1.5.9 + kernelVersion: 5.13.0-28-generic + kubeProxyVersion: v1.23.3 + kubeletVersion: v1.23.3 + machineID: 9384e2927f544209b5d7b67474bbf92b + operatingSystem: linux + osImage: Ubuntu 21.10 + systemUUID: aa829ca9-73d7-064d-9019-df07404ad448 +``` + + +## Looking at logs + +For now, digging deeper into the cluster requires logging into the relevant machines. Here are the locations +of the relevant log files. On systemd-based systems, you may need to use `journalctl` instead of examining log files. + +### Control Plane nodes + + * `/var/log/kube-apiserver.log` - API Server, responsible for serving the API + * `/var/log/kube-scheduler.log` - Scheduler, responsible for making scheduling decisions + * `/var/log/kube-controller-manager.log` - a component that runs most Kubernetes built-in {{}}, with the notable exception of scheduling (the kube-scheduler handles scheduling). + +### Worker Nodes + + * `/var/log/kubelet.log` - logs from the kubelet, responsible for running containers on the node + * `/var/log/kube-proxy.log` - logs from `kube-proxy`, which is responsible for directing traffic to Service endpoints + +## Cluster failure modes + +This is an incomplete list of things that could go wrong, and how to adjust your cluster setup to mitigate the problems. + +### Contributing causes + + - VM(s) shutdown + - Network partition within cluster, or between cluster and users + - Crashes in Kubernetes software + - Data loss or unavailability of persistent storage (e.g. GCE PD or AWS EBS volume) + - Operator error, for example misconfigured Kubernetes software or application software + +### Specific scenarios + + - API server VM shutdown or apiserver crashing + - Results + - unable to stop, update, or start new pods, services, replication controller + - existing pods and services should continue to work normally, unless they depend on the Kubernetes API + - API server backing storage lost + - Results + - the kube-apiserver component fails to start successfully and become healthy + - kubelets will not be able to reach it but will continue to run the same pods and provide the same service proxying + - manual recovery or recreation of apiserver state necessary before apiserver is restarted + - Supporting services (node controller, replication controller manager, scheduler, etc) VM shutdown or crashes + - currently those are colocated with the apiserver, and their unavailability has similar consequences as apiserver + - in future, these will be replicated as well and may not be co-located + - they do not have their own persistent state + - Individual node (VM or physical machine) shuts down + - Results + - pods on that Node stop running + - Network partition + - Results + - partition A thinks the nodes in partition B are down; partition B thinks the apiserver is down. (Assuming the master VM ends up in partition A.) + - Kubelet software fault + - Results + - crashing kubelet cannot start new pods on the node + - kubelet might delete the pods or not + - node marked unhealthy + - replication controllers start new pods elsewhere + - Cluster operator error + - Results + - loss of pods, services, etc + - lost of apiserver backing store + - users unable to read API + - etc. + +### Mitigations + +- Action: Use IaaS provider's automatic VM restarting feature for IaaS VMs + - Mitigates: Apiserver VM shutdown or apiserver crashing + - Mitigates: Supporting services VM shutdown or crashes + +- Action: Use IaaS providers reliable storage (e.g. GCE PD or AWS EBS volume) for VMs with apiserver+etcd + - Mitigates: Apiserver backing storage lost + +- Action: Use [high-availability](/docs/setup/production-environment/tools/kubeadm/high-availability/) configuration + - Mitigates: Control plane node shutdown or control plane components (scheduler, API server, controller-manager) crashing + - Will tolerate one or more simultaneous node or component failures + - Mitigates: API server backing storage (i.e., etcd's data directory) lost + - Assumes HA (highly-available) etcd configuration + +- Action: Snapshot apiserver PDs/EBS-volumes periodically + - Mitigates: Apiserver backing storage lost + - Mitigates: Some cases of operator error + - Mitigates: Some cases of Kubernetes software fault + +- Action: use replication controller and services in front of pods + - Mitigates: Node shutdown + - Mitigates: Kubelet software fault + +- Action: applications (containers) designed to tolerate unexpected restarts + - Mitigates: Node shutdown + - Mitigates: Kubelet software fault + + +## {{% heading "whatsnext" %}} + +* Learn about the metrics available in the [Resource Metrics Pipeline](resource-metrics-pipeline) +* Discover additional tools for [monitoring resource usage](resource-usage-monitoring) +* Use Node Problem Detector to [monitor node health](monitor-node-health) +* Use `crictl` to [debug Kubernetes nodes](crictl) +* Get more information about [Kubernetes auditing](audit) +* Use `telepresence` to [develop and debug services locally](local-debugging) diff --git a/content/en/docs/tasks/debug-application-cluster/audit.md b/content/en/docs/tasks/debug/debug-cluster/audit.md similarity index 100% rename from content/en/docs/tasks/debug-application-cluster/audit.md rename to content/en/docs/tasks/debug/debug-cluster/audit.md diff --git a/content/en/docs/tasks/debug-application-cluster/crictl.md b/content/en/docs/tasks/debug/debug-cluster/crictl.md similarity index 99% rename from content/en/docs/tasks/debug-application-cluster/crictl.md rename to content/en/docs/tasks/debug/debug-cluster/crictl.md index 8e649d3b27..0f911b182b 100644 --- a/content/en/docs/tasks/debug-application-cluster/crictl.md +++ b/content/en/docs/tasks/debug/debug-cluster/crictl.md @@ -5,6 +5,7 @@ reviewers: - mrunalp title: Debugging Kubernetes nodes with crictl content_type: task +weight: 30 --- diff --git a/content/en/docs/tasks/debug-application-cluster/local-debugging.md b/content/en/docs/tasks/debug/debug-cluster/local-debugging.md similarity index 97% rename from content/en/docs/tasks/debug-application-cluster/local-debugging.md rename to content/en/docs/tasks/debug/debug-cluster/local-debugging.md index 68088ac85a..a4cad902db 100644 --- a/content/en/docs/tasks/debug-application-cluster/local-debugging.md +++ b/content/en/docs/tasks/debug/debug-cluster/local-debugging.md @@ -1,5 +1,5 @@ --- -title: Developing and debugging services locally +title: Developing and debugging services locally using telepresence content_type: task --- @@ -58,4 +58,4 @@ Telepresence installs a traffic-agent sidecar next to your existing application' If you're interested in a hands-on tutorial, check out [this tutorial](https://cloud.google.com/community/tutorials/developing-services-with-k8s) that walks through locally developing the Guestbook application on Google Kubernetes Engine. -For further reading, visit the [Telepresence website](https://www.telepresence.io). \ No newline at end of file +For further reading, visit the [Telepresence website](https://www.telepresence.io). diff --git a/content/en/docs/tasks/debug-application-cluster/monitor-node-health.md b/content/en/docs/tasks/debug/debug-cluster/monitor-node-health.md similarity index 99% rename from content/en/docs/tasks/debug-application-cluster/monitor-node-health.md rename to content/en/docs/tasks/debug/debug-cluster/monitor-node-health.md index 1214a26975..34b4e0ed7d 100644 --- a/content/en/docs/tasks/debug-application-cluster/monitor-node-health.md +++ b/content/en/docs/tasks/debug/debug-cluster/monitor-node-health.md @@ -4,6 +4,7 @@ content_type: task reviewers: - Random-Liu - dchen1107 +weight: 20 --- diff --git a/content/en/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md b/content/en/docs/tasks/debug/debug-cluster/resource-metrics-pipeline.md similarity index 99% rename from content/en/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md rename to content/en/docs/tasks/debug/debug-cluster/resource-metrics-pipeline.md index 77d72e3649..ce74c03fb6 100644 --- a/content/en/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md +++ b/content/en/docs/tasks/debug/debug-cluster/resource-metrics-pipeline.md @@ -4,6 +4,7 @@ reviewers: - piosz title: Resource metrics pipeline content_type: concept +weight: 15 --- diff --git a/content/en/docs/tasks/debug-application-cluster/resource-usage-monitoring.md b/content/en/docs/tasks/debug/debug-cluster/resource-usage-monitoring.md similarity index 81% rename from content/en/docs/tasks/debug-application-cluster/resource-usage-monitoring.md rename to content/en/docs/tasks/debug/debug-cluster/resource-usage-monitoring.md index 957ee62192..9f7c4fbd3c 100644 --- a/content/en/docs/tasks/debug-application-cluster/resource-usage-monitoring.md +++ b/content/en/docs/tasks/debug/debug-cluster/resource-usage-monitoring.md @@ -3,6 +3,7 @@ reviewers: - mikedanese content_type: concept title: Tools for Monitoring Resources +weight: 15 --- @@ -58,4 +59,14 @@ then exposes them to Kubernetes via an adapter by implementing either the [Prometheus](https://prometheus.io), a CNCF project, can natively monitor Kubernetes, nodes, and Prometheus itself. Full metrics pipeline projects that are not part of the CNCF are outside the scope of Kubernetes documentation. +## {{% heading "whatsnext" %}} + +Learn about additional debugging tools, including: + +* [Logging](/docs/concepts/cluster-administration/logging/) +* [Monitoring](/docs/tasks/debug-application-cluster/resource-usage-monitoring/) +* [Getting into containers via `exec`](/docs/tasks/debug-application-cluster/applications/get-shell-running-container/) +* [Connecting to containers via proxies](/docs/tasks/extend-kubernetes/http-proxy-access-api/) +* [Connecting to containers via port forwarding](/docs/tasks/access-application-cluster/port-forward-access-application-cluster/) +* [Inspect Kubernetes node with crictl](/docs/tasks/debug-application-cluster/monitoring/crictl/) From 8f68e2cc94fb01cc9391d95c42d0e0c66cb6bc22 Mon Sep 17 00:00:00 2001 From: Guangwen Feng Date: Tue, 26 Apr 2022 16:12:42 +0800 Subject: [PATCH 099/101] Fix a typo in cadvisor.md Signed-off-by: Guangwen Feng --- content/en/docs/reference/glossary/cadvisor.md | 2 +- content/zh/docs/reference/glossary/cadvisor.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/reference/glossary/cadvisor.md b/content/en/docs/reference/glossary/cadvisor.md index 300c9f14c3..a85e572467 100644 --- a/content/en/docs/reference/glossary/cadvisor.md +++ b/content/en/docs/reference/glossary/cadvisor.md @@ -4,7 +4,7 @@ id: cadvisor date: 2021-12-09 full_link: https://github.com/google/cadvisor/ short_description: > - Tool that provides understanding of the resource usage and perfomance characteristics for containers + Tool that provides understanding of the resource usage and performance characteristics for containers aka: tags: - tool diff --git a/content/zh/docs/reference/glossary/cadvisor.md b/content/zh/docs/reference/glossary/cadvisor.md index c2d6a00e80..8545490084 100644 --- a/content/zh/docs/reference/glossary/cadvisor.md +++ b/content/zh/docs/reference/glossary/cadvisor.md @@ -17,7 +17,7 @@ id: cadvisor date: 2021-12-09 full_link: https://github.com/google/cadvisor/ short_description: > - Tool that provides understanding of the resource usage and perfomance characteristics for containers + Tool that provides understanding of the resource usage and performance characteristics for containers aka: tags: - tool From 6e35802d4c5eac09404979e8ce3af8bc64df5806 Mon Sep 17 00:00:00 2001 From: 0xff-dev Date: Tue, 26 Apr 2022 17:15:56 +0800 Subject: [PATCH 100/101] [zh] update dynamic-provisioning.md --- content/zh/docs/concepts/storage/dynamic-provisioning.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/zh/docs/concepts/storage/dynamic-provisioning.md b/content/zh/docs/concepts/storage/dynamic-provisioning.md index 14b72ac157..69b965545d 100644 --- a/content/zh/docs/concepts/storage/dynamic-provisioning.md +++ b/content/zh/docs/concepts/storage/dynamic-provisioning.md @@ -70,11 +70,15 @@ To enable dynamic provisioning, a cluster administrator needs to pre-create one or more StorageClass objects for users. StorageClass objects define which provisioner should be used and what parameters should be passed to that provisioner when dynamic provisioning is invoked. +The name of a StorageClass object must be a valid +[DNS subdomain name](/docs/concepts/overview/working-with-objects/names#dns-subdomain-names). + The following manifest creates a storage class "slow" which provisions standard disk-like persistent disks. --> 要启用动态供应功能，集群管理员需要为用户预先创建一个或多个 `StorageClass` 对象。 `StorageClass` 对象定义当动态供应被调用时，哪一个驱动将被使用和哪些参数将被传递给驱动。 +StorageClass 对象的名字必须是一个合法的 [DNS 子域名](/zh/docs/concepts/overview/working-with-objects/names#dns-subdomain-names)。 以下清单创建了一个 `StorageClass` 存储类 "slow"，它提供类似标准磁盘的永久磁盘。 ```yaml From 6b15373d6124f034efd4655a3134f3d0d343ab60 Mon Sep 17 00:00:00 2001 From: Sean Date: Tue, 26 Apr 2022 19:56:53 +0800 Subject: [PATCH 101/101] [zh] Fix the translation for "Advanced" (#33162) * [zh] Sync Hugo shortcodes with upstream * [zh] Fix the translation for "Advanced" --- content/zh/docs/contribute/advanced.md | 2 +- .../contribute/style/hugo-shortcodes/index.md | 278 ++++++++++++++---- 2 files changed, 226 insertions(+), 54 deletions(-) diff --git a/content/zh/docs/contribute/advanced.md b/content/zh/docs/contribute/advanced.md index 5fe6df4098..ccbbd6b3a0 100644 --- a/content/zh/docs/contribute/advanced.md +++ b/content/zh/docs/contribute/advanced.md @@ -1,5 +1,5 @@ --- -title: 高级贡献 +title: 进阶贡献 slug: advanced content_type: concept weight: 98 diff --git a/content/zh/docs/contribute/style/hugo-shortcodes/index.md b/content/zh/docs/contribute/style/hugo-shortcodes/index.md index 02d3dfc015..ef853710f0 100644 --- a/content/zh/docs/contribute/style/hugo-shortcodes/index.md +++ b/content/zh/docs/contribute/style/hugo-shortcodes/index.md @@ -9,10 +9,14 @@ content_type: concept - + 本页面将介绍 Hugo 自定义短代码，可以用于 Kubernetes Markdown 文档书写。 - + 关于短代码的更多信息可参见 [Hugo 文档](https://gohugo.io/content-management/shortcodes)。 @@ -20,18 +24,18 @@ content_type: concept ## 功能状态 -在本站的 Markdown 页面中，你可以加入短代码来展示所描述的功能特性的版本和状态。 +在本站的 Markdown 页面（`.md` 文件）中，你可以加入短代码来展示所描述的功能特性的版本和状态。 ### 功能状态示例 @@ -41,12 +45,16 @@ in the latest Kubernetes version. {{}} ``` - + 会转换为： {{< feature-state state="stable" >}} - + `state` 的可选值如下： * alpha @@ -69,7 +77,9 @@ feature state version by passing the `for_k8s_version` shortcode parameter. For {{}} ``` - + 会转换为： {{< feature-state for_k8s_version="v1.10" state="beta" >}} @@ -78,10 +88,10 @@ feature state version by passing the `for_k8s_version` shortcode parameter. For ## Glossary There are two glossary shortcodes: `glossary_tooltip` and `glossary_definition`. -You can reference glossary terms with an inclusion that will automatically -update and replace content with the relevant links from [our -glossary](/docs/reference/glossary/). When the glossary term is moused-over, -the glossary entry displays a tooltip. The glossary term also displays as a link. +You can reference glossary terms with an inclusion that automatically updates +and replaces content with the relevant links from [our glossary](/docs/reference/glossary/). +When the glossary term is moused-over, the glossary entry displays a tooltip. +The glossary term also displays as a link. As well as inclusions with tooltips, you can reuse the definitions from the glossary in page content. @@ -96,21 +106,24 @@ page content. 除了包含工具提示外，你还可以重用页面内容中词汇表中的定义。 -词汇术语的原始数据保存在 [https://github.com/kubernetes/website/tree/main/content/en/docs/reference/glossary](https://github.com/kubernetes/website/tree/main/content/en/docs/reference/glossary)，每个内容文件对应相应的术语解释。 +词汇术语的原始数据保存在[词汇目录](https://github.com/kubernetes/website/tree/main/content/en/docs/reference/glossary)， +每个内容文件对应相应的术语解释。 ### 词汇演示 -例如，下面的代码在 Markdown 中将会转换为 `{{< glossary_tooltip text="cluster" term_id="cluster" >}}`， -然后在提示框中显示。 +例如下面的代码在 Markdown 中将会转换为 +{{< glossary_tooltip text="cluster" term_id="cluster" >}}，然后在提示框中显示。 ``` {{}} @@ -146,10 +159,68 @@ which renders as: 呈现为： {{< glossary_definition term_id="cluster" length="all" >}} + +## 链接至 API 参考 {#links-to-api-reference} + + +你可以使用 `api-reference` 短代码链接到 Kubernetes API 参考页面，例如 +Pod +{{< api-reference page="workload-resources/pod-v1" >}} 参考文件： + +``` +{{}} +``` + + +本语句中 `page` 参数的内容是 API 参考页面的 URL 后缀。 + + + +你可以通过指定 `anchor` 参数链接到页面中的特定位置，例如到 +{{< api-reference page="workload-resources/pod-v1" anchor="PodSpec" >}} 参考，或页面的 +{{< api-reference page="workload-resources/pod-v1" anchor="environment-variables" >}} +部分。 + +``` +{{}} +{{}} +``` + + + +你可以通过指定 `text` 参数来更改链接的文本，例如通过链接到页面的 +{{< api-reference page="workload-resources/pod-v1" anchor="environment-variables" text="环境变量">}} +部分： + +``` +{{}} +``` + + * `name`： 标签页上显示的名字。 * `codelang`: 如果要在 `tab` 短代码中加入内部内容，需要告知 Hugo 使用的是什么代码语言，方便代码高亮。 @@ -245,10 +326,12 @@ The `tabs` shortcode takes these parameters: Hugo 会在包内查找文件（可以是 Hugo 所支持的任何 MIME 类型文件）。 否则，Hugo 会在当前路径的相对路径下查找所要包含的内容页面。 注意，在 `include` 页面中不能包含短代码内容，必须要使用自结束（self-closing）语法。 - 非内容文件将会被代码高亮。 + 例如 `{{}}`。 如果没有在 `codelang` 进行声明的话，Hugo 会根据文件名推测所用的语言。 + 默认情况下，非内容文件将会被代码高亮。 * 如果内部内容是 Markdown，你必须要使用 `%` 分隔符来包装标签页。 @@ -282,7 +365,9 @@ println "This is tab 2." {{< /tabs */>}} ``` - + 会转换为： {{< tabs name="tab_with_code" >}} @@ -294,41 +379,51 @@ println "This is tab 2." {{< /tab >}} {{< /tabs >}} - + ### 标签页演示：内联 Markdown 和 HTML ```go-html-template {{}} {{% tab name="Markdown" %}} -这是 **一些 markdown 。** -{{< note >}}它甚至可以包含短代码。{{< /note >}} +这是 **一些 markdown。** +{{< note >}} +它甚至可以包含短代码。 +{{< /note >}} {{% /tab %}} {{< tab name="HTML" >}}

    纯 HTML

    -

    这是一些 纯 HTML 。

    +

    这是一些 纯 HTML。

    {{< /tab >}} {{< /tabs */>}} ``` - + 会转换为： {{< tabs name="tab_with_md" >}} {{% tab name="Markdown" %}} -这是 **一些 markdown 。** -{{< note >}}它甚至可以包含短代码。{{< /note >}} +这是 **一些 markdown。** +{{< note >}} +它甚至可以包含短代码。 +{{< /note >}} {{% /tab %}} {{< tab name="HTML" >}}

    纯 HTML

    -

    这是一些 纯 HTML 。

    +

    这是一些 纯 HTML。

    {{< /tab >}} {{< /tabs >}} - + ### 标签页演示：文件嵌套 ```go-text-template @@ -339,7 +434,9 @@ println "This is tab 2." {{< /tabs */>}} ``` - + 会转换为： {{< tabs name="tab_with_file_include" >}} @@ -348,6 +445,78 @@ println "This is tab 2." {{< tab name="JSON File" include="podtemplate.json" />}} {{< /tabs >}} + +## 第三方内容标记 {#third-party-content-marker} + + +运行 Kubernetes 需要第三方软件。例如：你通常需要将 +[DNS 服务器](/zh/docs/tasks/administer-cluster/dns-custom-nameservers/#introduction) +添加到集群中，以便名称解析工作。 + + +当我们链接到第三方软件或以其他方式提及它时，我们会遵循[内容指南](/zh/docs/contribute/style/content-guide/) +并标记这些第三方项目。 + + +使用这些短代码会向使用它们的任何文档页面添加免责声明。 + + +### 列表 {#third-party-content-list} + + +对于有关几个第三方项目的列表，请添加： +``` +{{%/* thirdparty-content */%}} +``` + +在包含所有项目的段落标题正下方。 + + +### 项目 {#third-party-content-item} + + +如果你有一个列表，其中大多数项目引用项目内软件（例如：Kubernetes 本身，以及单独的 +[Descheduler](https://github.com/kubernetes-sigs/descheduler) +组件），那么可以使用不同的形式。 + + +在项目之前，或在特定项目的段落下方添加此短代码： +``` +{{%/* thirdparty-content single="true" */%}} +``` + + ### `{{}}` @@ -375,10 +545,11 @@ the name of one site parameter, in this case: `version`. {{< note >}} @@ -415,7 +586,8 @@ Renders to: @@ -432,7 +604,7 @@ Renders to: The `{{}}` shortcode checks if the `min-kubernetes-server-version` page parameter is present and then uses this value to compare to `version`. - + Renders to: --> ### `{{}}` @@ -447,9 +619,9 @@ Renders to: @@ -466,14 +638,14 @@ Renders to: -* 了解[Hugo](https://gohugo.io/)。 +* 了解 [Hugo](https://gohugo.io/)。 * 了解[撰写新的话题](/zh/docs/contribute/style/write-new-topic/)。 * 了解[使用页面内容类型](/zh/docs/contribute/style/page-content-types/)。 * 了解[发起 PR](/zh/docs/contribute/new-content/open-a-pr/)。 -* 了解[高级贡献](/zh/docs/contribute/advanced/)。 +* 了解[进阶贡献](/zh/docs/contribute/advanced/)。