Merge remote-tracking branch 'upstream/main' into dev-1.24
This commit is contained in:
Nate W
@@ -42,8 +42,8 @@ This section of the Kubernetes documentation contains references.
|
||||
|
||||
* [术语表](/zh/docs/reference/glossary/) - 一个全面的标准化的 Kubernetes 术语表
|
||||
|
||||
* [Kubernetes API 单页参考](/zh/docs/reference/kubernetes-api/)
|
||||
* [Kubernetes API 参考 {{< param "version" >}}](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/)。
|
||||
* [Kubernetes API 参考](/zh/docs/reference/kubernetes-api/)
|
||||
* [Kubernetes API 单页参考 {{< param "version" >}}](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/)。
|
||||
* [使用 Kubernetes API ](/zh/docs/reference/using-api/) - Kubernetes 的 API 概述
|
||||
* [API 的访问控制](/zh/docs/reference/access-authn-authz/) - 关于 Kubernetes 如何控制 API 访问的详细信息
|
||||
* [常见的标签、注解和污点](/zh/docs/reference/labels-annotations-taints/)
|
||||
|
||||
@@ -52,13 +52,13 @@ properties:
|
||||
- `group`, type string; if you specify `group`, it must match one of the groups of the authenticated user. `system:authenticated` matches all authenticated requests. `system:unauthenticated` matches all unauthenticated requests.
|
||||
- Resource-matching properties:
|
||||
- `apiGroup`, type string; an API group.
|
||||
- Ex: `extensions`
|
||||
- Ex: `apps`, `networking.k8s.io`
|
||||
- Wildcard: `*` matches all API groups.
|
||||
- `namespace`, type string; a namespace.
|
||||
- Ex: `kube-system`
|
||||
- Wildcard: `*` matches all resource requests.
|
||||
- `resource`, type string; a resource type
|
||||
- Ex: `pods`
|
||||
- Ex: `pods`, `deployments`
|
||||
- Wildcard: `*` matches all resource requests.
|
||||
- Non-resource-matching properties:
|
||||
- `nonResourcePath`, type string; non-resource request paths.
|
||||
@@ -86,13 +86,13 @@ properties:
|
||||
- `group`，字符串类型；如果指定 `group`，它必须与经过身份验证的用户的一个组匹配，`system:authenticated`匹配所有经过身份验证的请求。`system:unauthenticated`匹配所有未经过身份验证的请求。
|
||||
- 资源匹配属性：
|
||||
- `apiGroup`，字符串类型；一个 API 组。
|
||||
- 例： `extensions`
|
||||
- 例： `apps`, `networking.k8s.io`
|
||||
- 通配符：`*`匹配所有 API 组。
|
||||
- `namespace`，字符串类型；一个命名空间。
|
||||
- 例如：`kube-system`
|
||||
- 通配符：`*`匹配所有资源请求。
|
||||
- `resource`，字符串类型；资源类型。
|
||||
- 例：`pods`
|
||||
- 例：`pods`, `deployments`
|
||||
- 通配符：`*`匹配所有资源请求。
|
||||
- 非资源匹配属性：
|
||||
- `nonResourcePath`，字符串类型；非资源请求路径。
|
||||
|
||||
@@ -574,23 +574,23 @@ rules:
|
||||
|
||||
<!--
|
||||
Allow reading/writing Deployments (at the HTTP level: objects with `"deployments"`
|
||||
in the resource part of their URL) in both the `"extensions"` and `"apps"` API groups:
|
||||
in the resource part of their URL) in the `"apps"` API groups:
|
||||
-->
|
||||
允许读/写在 "extensions" 和 "apps" API 组中的 Deployment（在 HTTP 层面，对应
|
||||
允许读/写在 `"apps"` API 组中的 Deployment（在 HTTP 层面，对应
|
||||
URL 中资源部分为 "deployments"）：
|
||||
|
||||
```yaml
|
||||
rules:
|
||||
- apiGroups: ["extensions", "apps"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
```
|
||||
|
||||
<!--
|
||||
Allow reading Pods in the core API group, as well as reading or writing Job
|
||||
resources in the `"batch"` or `"extensions"` API groups:
|
||||
resources in the `"batch"` API group:
|
||||
-->
|
||||
允许读取核心 API 组中的 "pods" 和读/写 `"batch"` 或 `"extensions"` API 组中的
|
||||
允许读取核心 API 组中的 "pods" 和读/写 `"batch"` API 组中的
|
||||
"jobs"：
|
||||
|
||||
```yaml
|
||||
@@ -598,7 +598,7 @@ rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["batch", "extensions"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
```
|
||||
@@ -758,9 +758,9 @@ subjects:
|
||||
```
|
||||
|
||||
<!--
|
||||
For all service accounts in the "qa" group in any namespace:
|
||||
For all service accounts in the "qa" namespace:
|
||||
-->
|
||||
对于任何名称空间中的 "qa" 组中所有的服务账户：
|
||||
对于 "qa" 名称空间中的所有服务账户：
|
||||
|
||||
```yaml
|
||||
subjects:
|
||||
@@ -769,19 +769,6 @@ subjects:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
```
|
||||
|
||||
<!--
|
||||
For all service accounts in the "dev" group in the "development" namespace:
|
||||
-->
|
||||
对于 "development" 名称空间中 "dev" 组中的所有服务帐户：
|
||||
|
||||
```yaml
|
||||
subjects:
|
||||
- kind: Group
|
||||
name: system:serviceaccounts:dev
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
namespace: development
|
||||
```
|
||||
|
||||
<!--
|
||||
For all service accounts in any namespace:
|
||||
-->
|
||||
|
||||
@@ -111,7 +111,8 @@ different Kubernetes components.
|
||||
| `AllowInsecureBackendProxy` | `true` | Beta | 1.17 | |
|
||||
| `AnyVolumeDataSource` | `false` | Alpha | 1.18 | |
|
||||
| `AppArmor` | `true` | Beta | 1.4 | |
|
||||
| `ControllerManagerLeaderMigration` | `false` | Alpha | 1.21 | |
|
||||
| `ControllerManagerLeaderMigration` | `false` | Alpha | 1.21 | 1.21 |
|
||||
| `ControllerManagerLeaderMigration` | `true` | Beta | 1.22 | |
|
||||
| `CPUManager` | `false` | Alpha | 1.8 | 1.9 |
|
||||
| `CPUManager` | `true` | Beta | 1.10 | |
|
||||
| `CPUManagerPolicyAlphaOptions` | `false` | Alpha | 1.23 | |
|
||||
@@ -485,6 +486,7 @@ different Kubernetes components.
|
||||
| `ServerSideApply` | `false` | Alpha | 1.14 | 1.15 |
|
||||
| `ServerSideApply` | `true` | Beta | 1.16 | 1.21 |
|
||||
| `ServerSideApply` | `true` | GA | 1.22 | - |
|
||||
| `ServerSideFieldValidation` | `false` | Alpha | 1.23 | - |
|
||||
| `ServiceAccountIssuerDiscovery` | `false` | Alpha | 1.18 | 1.19 |
|
||||
| `ServiceAccountIssuerDiscovery` | `true` | Beta | 1.20 | 1.20 |
|
||||
| `ServiceAccountIssuerDiscovery` | `true` | GA | 1.21 | - |
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -38,10 +38,21 @@ You can request eviction either by directly calling the Eviction API
|
||||
using a client of the kube-apiserver, like the `kubectl drain` command.
|
||||
When an `Eviction` object is created, the API server terminates the Pod.
|
||||
|
||||
API-initiated evictions respect your configured [`PodDisruptionBudgets`](/docs/tasks/run-application/configure-pdb/)
|
||||
and [`terminationGracePeriodSeconds`](/docs/concepts/workloads/pods/pod-lifecycle#pod-termination).
|
||||
|
||||
API-initiated eviction is not the same as [node-pressure eviction](/docs/concepts/scheduling-eviction/eviction/#kubelet-eviction).
|
||||
-->
|
||||
你可以通过 kube-apiserver 的客户端，比如 `kubectl drain` 这样的命令，直接调用 Eviction API 发起驱逐。
|
||||
当 `Eviction` 对象创建出来之后，该对象将驱动 API 服务器终止选定的Pod。
|
||||
|
||||
API 发起的驱逐取决于你配置的 [`PodDisruptionBudgets`](/zh/docs/tasks/run-application/configure-pdb/)
|
||||
和 [`terminationGracePeriodSeconds`](/zh/docs/concepts/workloads/pods/pod-lifecycle#pod-termination)。
|
||||
|
||||
API 发起的驱逐不同于
|
||||
[节点压力引发的驱逐](/zh/docs/concepts/scheduling-eviction/eviction/#kubelet-eviction)。
|
||||
|
||||
<!--
|
||||
* See [API-initiated eviction](/docs/concepts/scheduling-eviction/api-eviction/) for more information.
|
||||
-->
|
||||
* 有关详细信息，请参阅 [API 发起的驱逐](/zh/docs/concepts/scheduling-eviction/api-eviction/)。
|
||||
@@ -17,7 +17,7 @@ id: cadvisor
|
||||
date: 2021-12-09
|
||||
full_link: https://github.com/google/cadvisor/
|
||||
short_description: >
|
||||
Tool that provides understanding of the resource usage and perfomance characteristics for containers
|
||||
Tool that provides understanding of the resource usage and performance characteristics for containers
|
||||
aka:
|
||||
tags:
|
||||
- tool
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: 混排切片（Shuffle Sharding）
|
||||
id: shuffle-sharding
|
||||
id: shuffle sharding
|
||||
date: 2020-03-04
|
||||
full_link:
|
||||
short_description: >
|
||||
@@ -40,8 +40,8 @@ We are often concerned with insulating different flows of requests
|
||||
from each other, so that a high-intensity flow does not crowd out low-intensity flows.
|
||||
A simple way to put requests into queues is to hash some
|
||||
characteristics of the request, modulo the number of queues, to get
|
||||
the index of the queue to use. The hash function uses as input
|
||||
characteristics of the request that align with flows. For example, in
|
||||
the index of the queue to use. The hash function uses as input
|
||||
characteristics of the request that align with flows. For example, in
|
||||
the Internet this is often the 5-tuple of source and destination
|
||||
address, protocol, and source and destination port.
|
||||
-->
|
||||
@@ -57,21 +57,21 @@ address, protocol, and source and destination port.
|
||||
That simple hash-based scheme has the property that any high-intensity flow
|
||||
will crowd out all the low-intensity flows that hash to the same queue.
|
||||
Providing good insulation for a large number of flows requires a large
|
||||
number of queues, which is problematic. Shuffle sharding is a more
|
||||
number of queues, which is problematic. Shuffle sharding is a more
|
||||
nimble technique that can do a better job of insulating the low-intensity
|
||||
flows from the high-intensity flows. The terminology of shuffle sharding uses
|
||||
flows from the high-intensity flows. The terminology of shuffle sharding uses
|
||||
the metaphor of dealing a hand from a deck of cards; each queue is a
|
||||
metaphorical card. The shuffle sharding technique starts with hashing
|
||||
metaphorical card. The shuffle sharding technique starts with hashing
|
||||
the flow-identifying characteristics of the request, to produce a hash
|
||||
value with dozens or more of bits. Then the hash value is used as a
|
||||
value with dozens or more of bits. Then the hash value is used as a
|
||||
source of entropy to shuffle the deck and deal a hand of cards
|
||||
(queues). All the dealt queues are examined, and the request is put
|
||||
into one of the examined queues with the shortest length. With a
|
||||
(queues). All the dealt queues are examined, and the request is put
|
||||
into one of the examined queues with the shortest length. With a
|
||||
modest hand size, it does not cost much to examine all the dealt cards
|
||||
and a given low-intensity flow has a good chance to dodge the effects of a
|
||||
given high-intensity flow. With a large hand size it is expensive to examine
|
||||
given high-intensity flow. With a large hand size it is expensive to examine
|
||||
the dealt queues and more difficult for the low-intensity flows to dodge the
|
||||
collective effects of a set of high-intensity flows. Thus, the hand size
|
||||
collective effects of a set of high-intensity flows. Thus, the hand size
|
||||
should be chosen judiciously.
|
||||
-->
|
||||
这种简单的基于哈希的模式有一种特性，高密度的请求序列（流）会湮没那些被
|
||||
|
||||
@@ -0,0 +1,222 @@
|
||||
---
|
||||
api_metadata:
|
||||
apiVersion: "authentication.k8s.io/v1"
|
||||
import: "k8s.io/api/authentication/v1"
|
||||
kind: "TokenReview"
|
||||
content_type: "api_reference"
|
||||
description: "TokenReview 尝试通过验证令牌来确认已知用户。"
|
||||
title: "TokenReview"
|
||||
weight: 3
|
||||
auto_generated: true
|
||||
---
|
||||
|
||||
<!--
|
||||
api_metadata:
|
||||
apiVersion: "authentication.k8s.io/v1"
|
||||
import: "k8s.io/api/authentication/v1"
|
||||
kind: "TokenReview"
|
||||
content_type: "api_reference"
|
||||
description: "TokenReview attempts to authenticate a token to a known user."
|
||||
title: "TokenReview"
|
||||
weight: 3
|
||||
auto_generated: true
|
||||
-->
|
||||
|
||||
`apiVersion: authentication.k8s.io/v1`
|
||||
|
||||
`import "k8s.io/api/authentication/v1"`
|
||||
|
||||
<!--
|
||||
## TokenReview {#TokenReview}
|
||||
TokenReview attempts to authenticate a token to a known user. Note: TokenReview requests may be cached by the webhook token authenticator plugin in the kube-apiserver.
|
||||
-->
|
||||
## TokenReview {#TokenReview}
|
||||
|
||||
TokenReview 尝试通过验证令牌来确认已知用户。
|
||||
注意：TokenReview 请求可能会被 kube-apiserver 中的 webhook 令牌验证器插件缓存。
|
||||
|
||||
<hr>
|
||||
|
||||
- **apiVersion**: authentication.k8s.io/v1
|
||||
|
||||
|
||||
- **kind**: TokenReview
|
||||
|
||||
|
||||
- **metadata** (<a href="{{< ref "../common-definitions/object-meta#ObjectMeta" >}}">ObjectMeta</a>)
|
||||
|
||||
<!--
|
||||
Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
-->
|
||||
标准对象的元数据，更多信息：https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
|
||||
- **spec** (<a href="{{< ref "../authentication-resources/token-review-v1#TokenReviewSpec" >}}">TokenReviewSpec</a>), required
|
||||
|
||||
<!--
|
||||
Spec holds information about the request being evaluated
|
||||
-->
|
||||
spec 保存有关正在评估的请求的信息
|
||||
|
||||
- **status** (<a href="{{< ref "../authentication-resources/token-review-v1#TokenReviewStatus" >}}">TokenReviewStatus</a>)
|
||||
|
||||
<!--
|
||||
Status is filled in by the server and indicates whether the request can be authenticated.
|
||||
-->
|
||||
status 由服务器填写，指示请求是否可以通过身份验证。
|
||||
|
||||
|
||||
## TokenReviewSpec {#TokenReviewSpec}
|
||||
|
||||
<!--
|
||||
TokenReviewSpec is a description of the token authentication request.
|
||||
-->
|
||||
TokenReviewPec 是对令牌身份验证请求的描述。
|
||||
|
||||
<hr>
|
||||
|
||||
- **audiences** ([]string)
|
||||
|
||||
<!--
|
||||
Audiences is a list of the identifiers that the resource server presented with the token identifies as. Audience-aware token authenticators will verify that the token was intended for at least one of the audiences in this list. If no audiences are provided, the audience will default to the audience of the Kubernetes apiserver.
|
||||
-->
|
||||
audiences 是带有令牌的资源服务器标识为受众的标识符列表。
|
||||
受众感知令牌身份验证器将验证令牌是否适用于此列表中的至少一个受众。
|
||||
如果未提供受众，受众将默认为 Kubernetes API 服务器的受众。
|
||||
|
||||
- **token** (string)
|
||||
|
||||
<!--
|
||||
Token is the opaque bearer token.
|
||||
-->
|
||||
token 是不透明的持有者令牌（Bearer Token）。
|
||||
|
||||
## TokenReviewStatus {#TokenReviewStatus}
|
||||
|
||||
<!--
|
||||
TokenReviewStatus is the result of the token authentication request.
|
||||
-->
|
||||
TokenReviewStatus 是令牌认证请求的结果。
|
||||
|
||||
<hr>
|
||||
|
||||
- **audiences** ([]string)
|
||||
|
||||
<!--
|
||||
Audiences are audience identifiers chosen by the authenticator that are compatible with both the TokenReview and token. An identifier is any identifier in the intersection of the TokenReviewSpec audiences and the token's audiences. A client of the TokenReview API that sets the spec.audiences field should validate that a compatible audience identifier is returned in the status.audiences field to ensure that the TokenReview server is audience aware. If a TokenReview returns an empty status.audience field where status.authenticated is "true", the token is valid against the audience of the Kubernetes API server.
|
||||
-->
|
||||
audiences 是身份验证者选择的与 TokenReview 和令牌兼容的受众标识符。 标识符是
|
||||
TokenReviewSpec 受众和令牌受众的交集中的任何标识符。 设置 spec.audiences
|
||||
字段的 TokenReview API 的客户端应验证在 status.audiences 字段中返回了兼容的受众标识符，
|
||||
以确保 TokenReview 服务器能够识别受众。 如果 TokenReview
|
||||
返回一个空的 status.audience 字段，其中 status.authenticated 为 “true”，
|
||||
则该令牌对 Kubernetes API 服务器的受众有效。
|
||||
|
||||
- **authenticated** (boolean)
|
||||
<!--
|
||||
Authenticated indicates that the token was associated with a known user.
|
||||
-->
|
||||
authenticated 表示令牌与已知用户相关联。
|
||||
|
||||
- **error** (string)
|
||||
|
||||
<!--
|
||||
Error indicates that the token couldn't be checked
|
||||
-->
|
||||
error 表示无法检查令牌
|
||||
|
||||
- **user** (UserInfo)
|
||||
|
||||
<!--
|
||||
User is the UserInfo associated with the provided token.
|
||||
-->
|
||||
user 是与提供的令牌关联的 UserInfo。
|
||||
|
||||
<a name="UserInfo"></a>
|
||||
<--
|
||||
*UserInfo holds the information about the user needed to implement the user.Info interface.*
|
||||
-->
|
||||
**UserInfo 保存实现 user.Info 接口所需的用户信息**
|
||||
|
||||
- **user.extra** (map[string][]string)
|
||||
|
||||
<!--
|
||||
Any additional information provided by the authenticator.
|
||||
-->
|
||||
验证者提供的任何附加信息。
|
||||
|
||||
- **user.groups** ([]string)
|
||||
|
||||
<!--
|
||||
The names of groups this user is a part of.
|
||||
-->
|
||||
此用户所属的组的名称。
|
||||
|
||||
- **user.uid** (string)
|
||||
|
||||
<!--
|
||||
A unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs.
|
||||
-->
|
||||
跨时间标识此用户的唯一值。如果删除此用户并添加另一个同名用户，他们将拥有不同的 UID。
|
||||
|
||||
- **user.username** (string)
|
||||
|
||||
<!--
|
||||
The name that uniquely identifies this user among all active users.
|
||||
-->
|
||||
在所有活动用户中唯一标识此用户的名称。
|
||||
|
||||
<!--
|
||||
## Operations {#Operations}
|
||||
-->
|
||||
## 操作 {#Operations}
|
||||
|
||||
<hr>
|
||||
|
||||
<!--
|
||||
### `create` create a TokenReview
|
||||
|
||||
#### HTTP Request
|
||||
-->
|
||||
### `create` 创建一个TokenReview
|
||||
|
||||
#### HTTP 请求
|
||||
|
||||
POST /apis/authentication.k8s.io/v1/tokenreviews
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **body**: <a href="{{< ref "../authentication-resources/token-review-v1#TokenReview" >}}">TokenReview</a>, required
|
||||
-->
|
||||
#### 参数
|
||||
|
||||
- **body**: <a href="{{< ref "../authentication-resources/token-review-v1#TokenReview" >}}">TokenReview</a>, 必需
|
||||
|
||||
- **dryRun** (*in query*): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#dryRun" >}}">dryRun</a>
|
||||
|
||||
- **fieldManager** (*in query*): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldManager" >}}">fieldManager</a>
|
||||
|
||||
- **fieldValidation** (*in query*): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldValidation" >}}">fieldValidation</a>
|
||||
|
||||
- **pretty** (*in query*): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
|
||||
200 (<a href="{{< ref "../authentication-resources/token-review-v1#TokenReview" >}}">TokenReview</a>): OK
|
||||
|
||||
201 (<a href="{{< ref "../authentication-resources/token-review-v1#TokenReview" >}}">TokenReview</a>): Created
|
||||
|
||||
202 (<a href="{{< ref "../authentication-resources/token-review-v1#TokenReview" >}}">TokenReview</a>): Accepted
|
||||
|
||||
401: Unauthorized
|
||||
|
||||
@@ -26,15 +26,151 @@ Kubernetes 将所有标签和注解保留在 kubernetes.io Namespace中。
|
||||
<!--
|
||||
## Labels, annotations and taints used on API objects
|
||||
|
||||
### app.kubernetes.io/component
|
||||
|
||||
Example: `app.kubernetes.io/component=database`
|
||||
|
||||
Used on: All Objects
|
||||
|
||||
The component within the architecture.
|
||||
|
||||
One of the [recommended labels](/docs/concepts/overview/working-with-objects/common-labels/#labels).
|
||||
-->
|
||||
## API 对象上使用的标签、注解和污点
|
||||
|
||||
### app.kubernetes.io/component
|
||||
|
||||
例子: `app.kubernetes.io/component=database`
|
||||
|
||||
用于: 所有对象
|
||||
|
||||
架构中的组件。
|
||||
|
||||
[推荐标签](/zh/docs/concepts/overview/working-with-objects/common-labels/#labels)之一。
|
||||
|
||||
<!-- ### app.kubernetes.io/created-by
|
||||
|
||||
Example: `app.kubernetes.io/created-by=controller-manager`
|
||||
|
||||
Used on: All Objects
|
||||
|
||||
The controller/user who created this resource.
|
||||
|
||||
One of the [recommended labels](/docs/concepts/overview/working-with-objects/common-labels/#labels). -->
|
||||
### app.kubernetes.io/created-by
|
||||
|
||||
示例：`app.kubernetes.io/created-by=controller-manager`
|
||||
|
||||
用于：所有对象
|
||||
|
||||
创建此资源的控制器/用户。
|
||||
|
||||
[推荐标签](/zh/docs/concepts/overview/working-with-objects/common-labels/#labels)之一。
|
||||
|
||||
<!-- ### app.kubernetes.io/instance
|
||||
|
||||
Example: `app.kubernetes.io/instance=mysql-abcxzy`
|
||||
|
||||
Used on: All Objects
|
||||
|
||||
A unique name identifying the instance of an application.
|
||||
|
||||
One of the [recommended labels](/docs/concepts/overview/working-with-objects/common-labels/#labels). -->
|
||||
### app.kubernetes.io/instance
|
||||
|
||||
示例：`app.kubernetes.io/instance=mysql-abcxzy`
|
||||
|
||||
用于：所有对象
|
||||
|
||||
标识应用实例的唯一名称。
|
||||
|
||||
[推荐标签](/zh/docs/concepts/overview/working-with-objects/common-labels/#labels)之一。
|
||||
|
||||
<!-- ### app.kubernetes.io/managed-by
|
||||
|
||||
Example: `app.kubernetes.io/managed-by=helm`
|
||||
|
||||
Used on: All Objects
|
||||
|
||||
The tool being used to manage the operation of an application.
|
||||
|
||||
One of the [recommended labels](/docs/concepts/overview/working-with-objects/common-labels/#labels). -->
|
||||
### app.kubernetes.io/managed-by
|
||||
|
||||
示例：`app.kubernetes.io/managed-by=helm`
|
||||
|
||||
用于：所有对象
|
||||
|
||||
用于管理应用操作的工具。
|
||||
|
||||
[推荐标签](/zh/docs/concepts/overview/working-with-objects/common-labels/#labels)之一。
|
||||
|
||||
<!-- ### app.kubernetes.io/name
|
||||
|
||||
Example: `app.kubernetes.io/name=mysql`
|
||||
|
||||
Used on: All Objects
|
||||
|
||||
The name of the application.
|
||||
|
||||
One of the [recommended labels](/docs/concepts/overview/working-with-objects/common-labels/#labels). -->
|
||||
|
||||
### app.kubernetes.io/name
|
||||
|
||||
示例：`app.kubernetes.io/name=mysql`
|
||||
|
||||
用于：所有对象
|
||||
|
||||
应用的名称。
|
||||
|
||||
[推荐标签](/zh/docs/concepts/overview/working-with-objects/common-labels/#labels)之一。
|
||||
|
||||
<!-- ### app.kubernetes.io/part-of
|
||||
|
||||
Example: `app.kubernetes.io/part-of=wordpress`
|
||||
|
||||
Used on: All Objects
|
||||
|
||||
The name of a higher level application this one is part of.
|
||||
|
||||
One of the [recommended labels](/docs/concepts/overview/working-with-objects/common-labels/#labels). -->
|
||||
### app.kubernetes.io/part-of
|
||||
|
||||
示例：`app.kubernetes.io/part-of=wordpress`
|
||||
|
||||
用于：所有对象
|
||||
|
||||
此应用所属的更高级别应用的名称。
|
||||
|
||||
[推荐标签](/zh/docs/concepts/overview/working-with-objects/common-labels/#labels)之一。
|
||||
|
||||
<!-- ### app.kubernetes.io/version
|
||||
|
||||
Example: `app.kubernetes.io/version="5.7.21"`
|
||||
|
||||
Used on: All Objects
|
||||
|
||||
The current version of the application (e.g., a semantic version, revision hash, etc.).
|
||||
|
||||
One of the [recommended labels](/docs/concepts/overview/working-with-objects/common-labels/#labels). -->
|
||||
### app.kubernetes.io/version
|
||||
|
||||
示例：`app.kubernetes.io/version="5.7.21"`
|
||||
|
||||
用于：所有对象
|
||||
|
||||
应用的当前版本（例如，语义版本、修订哈希等）。
|
||||
|
||||
[推荐标签](/zh/docs/concepts/overview/working-with-objects/common-labels/#labels)之一。
|
||||
|
||||
<!--
|
||||
### kubernetes.io/arch
|
||||
|
||||
Example: `kubernetes.io/arch=amd64`
|
||||
|
||||
Used on: Node
|
||||
|
||||
The Kubelet populates this with `runtime.GOARCH` as defined by Go. This can be handy if you are mixing arm and x86 nodes.
|
||||
-->
|
||||
## API 对象上使用的标签、注解和污点
|
||||
The Kubelet populates this with `runtime.GOARCH` as defined by Go. This can be handy if you are mixing arm and x86 nodes. -->
|
||||
|
||||
### kubernetes.io/arch {#kubernetes-io-arch}
|
||||
|
||||
@@ -185,8 +321,6 @@ Used on: Pod
|
||||
|
||||
This annotation is used to set [Pod Deletion Cost](/docs/concepts/workloads/controllers/replicaset/#pod-deletion-cost)
|
||||
which allows users to influence ReplicaSet downscaling order. The annotation parses into an `int32` type.
|
||||
|
||||
### beta.kubernetes.io/instance-type (deprecated)
|
||||
-->
|
||||
### controller.kubernetes.io/pod-deletion-cost {#pod-deletion-cost}
|
||||
|
||||
@@ -194,8 +328,85 @@ which allows users to influence ReplicaSet downscaling order. The annotation par
|
||||
|
||||
用于：Pod
|
||||
|
||||
该注解用于设置 [Pod 删除成本](/docs/concepts/workloads/controllers/replicaset/#pod-deletion-cost) 允许用户影响 ReplicaSet 缩减顺序。注解解析为 `int32` 类型。
|
||||
该注解用于设置 [Pod 删除成本](/docs/concepts/workloads/controllers/replicaset/#pod-deletion-cost)允许用户影响 ReplicaSet 缩减顺序。注解解析为 `int32` 类型。
|
||||
|
||||
<!--
|
||||
### kubernetes.io/ingress-bandwidth
|
||||
|
||||
Ingress traffic shaping annotation is an experimental feature.
|
||||
If you want to enable traffic shaping support, you must add the `bandwidth` plugin to your CNI configuration file (default `/etc/cni/net.d`) and
|
||||
ensure that the binary is included in your CNI bin dir (default `/opt/cni/bin`).
|
||||
|
||||
Example: `kubernetes.io/ingress-bandwidth: 10M`
|
||||
|
||||
Used on: Pod
|
||||
|
||||
You can apply quality-of-service traffic shaping to a pod and effectively limit its available bandwidth.
|
||||
Ingress traffic (to the pod) is handled by shaping queued packets to effectively handle data.
|
||||
To limit the bandwidth on a pod, write an object definition JSON file and specify the data traffic
|
||||
speed using `kubernetes.io/ingress-bandwidth` annotation. The unit used for specifying ingress
|
||||
rate is bits per second, as a [Quantity](/docs/reference/kubernetes-api/common-definitions/quantity/).
|
||||
For example, `10M` means 10 megabits per second.
|
||||
-->
|
||||
|
||||
### kubernetes.io/ingress-bandwidth
|
||||
|
||||
{{< note >}}
|
||||
入站流量控制注解是一项实验性功能。
|
||||
如果要启用流量控制支持，必须将`bandwidth`插件添加到 CNI 配置文件（默认为`/etc/cni/net.d`）
|
||||
并确保二进制文件包含在你的 CNI bin 目录中（默认为`/opt/cni/bin`）。
|
||||
{{< /note >}}
|
||||
|
||||
示例：`kubernetes.io/ingress-bandwidth: 10M`
|
||||
|
||||
用于：Pod
|
||||
|
||||
你可以对 Pod 应用服务质量流量控制并有效限制其可用带宽。
|
||||
入站流量（到 Pod）通过控制排队的数据包来处理，以有效地处理数据。
|
||||
要限制 Pod 的带宽，请编写对象定义 JSON 文件并使用 `kubernetes.io/ingress-bandwidth`
|
||||
注解指定数据流量速度。 用于指定入站的速率单位是每秒，
|
||||
作为[量纲（Quantity）](/zh/docs/reference/kubernetes-api/common-definitions/quantity/)。
|
||||
例如，`10M`表示每秒 10 兆比特。
|
||||
|
||||
<!--
|
||||
### kubernetes.io/egress-bandwidth
|
||||
|
||||
Egress traffic shaping annotation is an experimental feature.
|
||||
If you want to enable traffic shaping support, you must add the `bandwidth` plugin to your CNI configuration file (default `/etc/cni/net.d`) and
|
||||
ensure that the binary is included in your CNI bin dir (default `/opt/cni/bin`).
|
||||
|
||||
Example: `kubernetes.io/egress-bandwidth: 10M`
|
||||
|
||||
Used on: Pod
|
||||
|
||||
Egress traffic (from the pod) is handled by policing, which simply drops packets in excess of the configured rate.
|
||||
The limits you place on a pod do not affect the bandwidth of other pods.
|
||||
To limit the bandwidth on a pod, write an object definition JSON file and specify the data traffic
|
||||
speed using `kubernetes.io/egress-bandwidth` annotation. The unit used for specifying egress
|
||||
rate is bits per second, as a [Quantity](/docs/reference/kubernetes-api/common-definitions/quantity/).
|
||||
For example, `10M` means 10 megabits per second.
|
||||
-->
|
||||
|
||||
### kubernetes.io/egress-bandwidth
|
||||
|
||||
{{< note >}}
|
||||
出站流量控制注解是一项实验性功能。
|
||||
如果要启用流量控制支持，必须将`bandwidth`插件添加到 CNI 配置文件（默认为`/etc/cni/net.d`）
|
||||
并确保二进制文件包含在你的 CNI bin 目录中（默认为`/opt/cni/bin`）。
|
||||
{{< /note >}}
|
||||
|
||||
示例：`kubernetes.io/egress-bandwidth: 10M`
|
||||
|
||||
用于：Pod
|
||||
|
||||
出站流量（来自 pod）由策略控制，策略只是丢弃超过配置速率的数据包。
|
||||
你为一个 Pod 所设置的限制不会影响其他 Pod 的带宽。
|
||||
要限制 Pod 的带宽，请编写对象定义 JSON 文件并使用 `kubernetes.io/egress-bandwidth` 注解指定数据流量速度。
|
||||
用于指定出站的速率单位是每秒比特数，
|
||||
以[量纲（Quantity）](/zh/docs/reference/kubernetes-api/common-definitions/quantity/)的形式给出。
|
||||
例如，`10M` 表示每秒 10 兆比特。
|
||||
|
||||
<!-- ### beta.kubernetes.io/instance-type (deprecated) -->
|
||||
### beta.kubernetes.io/instance-type (已弃用) {#beta-kubernetes-io-instance-type}
|
||||
|
||||
<!--
|
||||
@@ -1025,16 +1236,20 @@ seccomp 配置文件应用于 Pod 或其容器的步骤。
|
||||
<!--
|
||||
## Annotations used for audit
|
||||
|
||||
- [`pod-security.kubernetes.io/exempt`](/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-exempt)
|
||||
- [`pod-security.kubernetes.io/enforce-policy`](/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-enforce-policy)
|
||||
- [`authorization.k8s.io/decision`](/docs/reference/labels-annotations-taints/audit-annotations/#authorization-k8s-io-decision)
|
||||
- [`authorization.k8s.io/reason`](/docs/reference/labels-annotations-taints/audit-annotations/#authorization-k8s-io-reason)
|
||||
- [`pod-security.kubernetes.io/audit-violations`](/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-audit-violations)
|
||||
- [`pod-security.kubernetes.io/enforce-policy`](/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-enforce-policy)
|
||||
- [`pod-security.kubernetes.io/exempt`](/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-exempt)
|
||||
|
||||
See more details on the [Audit Annotations](/docs/reference/labels-annotations-taints/audit-annotations/) page.
|
||||
-->
|
||||
## 用于审计的注解 {#annonations-used-for-audit}
|
||||
|
||||
- [`pod-security.kubernetes.io/exempt`](/zh/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-exempt)
|
||||
- [`pod-security.kubernetes.io/enforce-policy`](/zh/zh/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-enforce-policy)
|
||||
- [`authorization.k8s.io/decision`](/zh/docs/reference/labels-annotations-taints/audit-annotations/#authorization-k8s-io-decision)
|
||||
- [`authorization.k8s.io/reason`](/zh/docs/reference/labels-annotations-taints/audit-annotations/#authorization-k8s-io-reason)
|
||||
- [`pod-security.kubernetes.io/audit-violations`](/zh/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-audit-violations)
|
||||
- [`pod-security.kubernetes.io/enforce-policy`](/zh/zh/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-enforce-policy)
|
||||
- [`pod-security.kubernetes.io/exempt`](/zh/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-exempt)
|
||||
|
||||
在[审计注解](/zh/docs/reference/labels-annotations-taints/audit-annotations/)页面上查看更多详细信息。
|
||||
@@ -21,10 +21,10 @@ Print configuration
|
||||
|
||||
<!--
|
||||
This command prints configurations for subcommands provided.
|
||||
For details, see: https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta2
|
||||
For details, see: https://pkg.go.dev/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm#section-directories
|
||||
-->
|
||||
此命令打印子命令所提供的配置信息。
|
||||
相关细节可参阅 https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta2
|
||||
相关细节可参阅: https://pkg.go.dev/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm#section-directories
|
||||
|
||||
```
|
||||
kubeadm config print [flags]
|
||||
|
||||
@@ -594,7 +594,7 @@ API 服务器的静态 Pod 清单会受到用户提供的以下参数的影响:
|
||||
#### 控制器管理器 {#controller-manager}
|
||||
|
||||
<!--
|
||||
The static Pod manifest for the controller-manager is affected by following parameters provided by the users:
|
||||
The static Pod manifest for the controller manager is affected by following parameters provided by the users:
|
||||
-->
|
||||
控制器管理器的静态 Pod 清单受用户提供的以下参数的影响:
|
||||
|
||||
|
||||
@@ -43,20 +43,6 @@ Using this phase you can execute preflight checks on a node that is being reset.
|
||||
{{< tab name="preflight" include="generated/kubeadm_reset_phase_preflight.md" />}}
|
||||
{{< /tabs >}}
|
||||
|
||||
<!--
|
||||
## kubeadm reset phase update-cluster-status
|
||||
-->
|
||||
## kubeadm reset phase update-cluster-status {#cmd-reset-phase-update-cluster-status}
|
||||
|
||||
<!--
|
||||
Using this phase you can remove this control-plane node from the ClusterStatus object.
|
||||
-->
|
||||
使用此阶段，你可以从 ClusterStatus 对象中删除此控制平面节点。
|
||||
|
||||
{{< tabs name="tab-update-cluster-status" >}}
|
||||
{{< tab name="update-cluster-status" include="generated/kubeadm_reset_phase_update-cluster-status.md" />}}
|
||||
{{< /tabs >}}
|
||||
|
||||
<!--
|
||||
## kubeadm reset phase remove-etcd-member
|
||||
-->
|
||||
|
||||
@@ -142,37 +142,41 @@ might have to add an equivalent field or represent it as an annotation.
|
||||
添加一个新的等效字段或者将其表现为一个注解。
|
||||
|
||||
<!--
|
||||
**Rule #3: An API version in a given track may not be deprecated until a new
|
||||
API version at least as stable is released.**
|
||||
**Rule #3: An API version in a given track may not be deprecated in favor of a less stable API version.**
|
||||
|
||||
GA API versions can replace GA API versions as well as beta and alpha API
|
||||
versions. Beta API versions *may not* replace GA API versions.
|
||||
* GA API versions can replace beta and alpha API versions.
|
||||
* Beta API versions can replace earlier beta and alpha API versions, but *may not* replace GA API versions.
|
||||
* Alpha API versions can replace earlier alpha API versions, but *may not* replace GA or beta API versions.
|
||||
-->
|
||||
**规则 #3：给定类别的 API 版本在新的、稳定性未降低的 API 版本发布之前不可被废弃。**
|
||||
**规则 #3：给定类别的 API 版本不可被弃用以支持稳定性更差的 API 版本。**
|
||||
|
||||
一个正式发布的（GA）API 版本可替换现有的正式 API 版本或 alpha、beta API 版本。
|
||||
Beta API 版本 *不可以* 替代正式的 API 版本。
|
||||
* 一个正式发布的（GA）API 版本可替换 beta 或 alpha API 版本。
|
||||
* Beta API 版本可以替换早期的 beta 和 alpha API 版本，但 **不可以** 替换正式的 API 版本。
|
||||
* Alpha API 版本可以替换早期的 alpha API 版本，但 **不可以** 替换正式的或 beta API 版本。
|
||||
|
||||
<!--
|
||||
**Rule #4a: Other than the most recent API versions in each track, older API
|
||||
versions must be supported after their announced deprecation for a duration of
|
||||
no less than:**
|
||||
**Rule #4a: minimum API lifetime is determined by the API stability level**
|
||||
|
||||
* **GA: 12 months or 3 releases (whichever is longer)**
|
||||
* **Beta: 9 months or 3 releases (whichever is longer)**
|
||||
* **Alpha: 0 releases**
|
||||
* **GA API versions may be marked as deprecated, but must not be removed within a major version of Kubernetes**
|
||||
* **Beta API versions must be supported for 9 months or 3 releases (whichever is longer) after deprecation**
|
||||
* **Alpha API versions may be removed in any release without prior deprecation notice**
|
||||
|
||||
This covers the [maximum supported version skew of 2 releases](/docs/setup/release/version-skew-policy/).
|
||||
This ensures beta API support covers the [maximum supported version skew of 2 releases](/releases/version-skew-policy/).
|
||||
-->
|
||||
**规则 #4a：除了每类 API 版本中的最新版本，旧的 API 版本在其被宣布被废弃之后
|
||||
至少以下时长内仍需被支持：**
|
||||
**规则 #4a：最短 API 生命周期由 API 稳定性级别决定**
|
||||
|
||||
* **GA：12 个月或者 3 个发布版本（取其较长者）**
|
||||
* **Beta: 9 个月或者 3 个发布版本（取其较长者）**
|
||||
* **Alpha: 0 个发布版本**
|
||||
* **GA API 版本可以被标记为已弃用，但不得在 Kubernetes 的主要版本中删除**
|
||||
* **Beta API 版本必须支持 9 个月或弃用后的 3 个版本（以较长者为准）**
|
||||
* **Alpha API 版本可能会在任何版本中被删除，不另行通知**
|
||||
|
||||
这里也包含了关于[最大支持 2 个发布版本的版本偏差](/zh/docs/setup/release/version-skew-policy/)
|
||||
的约定。
|
||||
这确保了 beta API 支持涵盖了[最多 2 个版本的支持版本偏差](/zh/releases/version-skew-policy/)。
|
||||
|
||||
{{< note >}}
|
||||
<!--
|
||||
There are no current plans for a major version revision of Kubernetes that removes GA APIs.
|
||||
-->
|
||||
目前没有删除正式版本 API 的 Kubernetes 主要版本修订计划。
|
||||
{{< /note >}}
|
||||
|
||||
<!--
|
||||
Until [#52185](https://github.com/kubernetes/kubernetes/issues/52185) is
|
||||
@@ -363,9 +367,9 @@ API versions are supported in a series of subsequent releases.
|
||||
<td>
|
||||
<ul>
|
||||
<!-- li>v2beta2 is deprecated, "action required" relnote</li>
|
||||
<li>v1 is deprecated, "action required" relnote</li -->
|
||||
<li>v1 is deprecated in favor of v2, but will not be removed</li -->
|
||||
<li>v2beta2 已被弃用，发布说明中包含对应的 "action required（采取行动）" 说明</li>
|
||||
<li>v1 已被弃用，发布说明中包含对应的 "action required（采取行动）" 说明</li>
|
||||
<li>v1 已被弃用，取而代之的是 v2，但不会被删除</li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
@@ -400,23 +404,6 @@ API versions are supported in a series of subsequent releases.
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>X+16</td>
|
||||
<!-- td>v2, v1 (deprecated)</td -->
|
||||
<td>v2、v1（已弃用）</td>
|
||||
<td>v2</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>X+17</td>
|
||||
<td>v2</td>
|
||||
<td>v2</td>
|
||||
<td>
|
||||
<ul>
|
||||
<li>v1 被删除，发布说明中包含对应的 "action required（采取行动）" 说明</li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
Reference in New Issue
Block a user