From 172a9add674e8b3c6b0456e18009686eaa4f661c Mon Sep 17 00:00:00 2001 From: Jakob Karalus Date: Fri, 17 Mar 2017 15:55:13 +0100 Subject: [PATCH 01/23] Added example and docu for hostPort ranges --- docs/user-guide/pod-security-policy/index.md | 3 +++ docs/user-guide/pod-security-policy/psp.yaml | 6 ++++++ 2 files changed, 9 insertions(+) diff --git a/docs/user-guide/pod-security-policy/index.md b/docs/user-guide/pod-security-policy/index.md index d3b40902ea..47548b64c2 100644 --- a/docs/user-guide/pod-security-policy/index.md +++ b/docs/user-guide/pod-security-policy/index.md @@ -111,6 +111,9 @@ to the volume sources that are defined when creating a volume: The recommended minimum set of allowed volumes for new PSPs are configMap, downwardAPI, emptyDir, persistentVolumeClaim, and secret. +### Host Network + - *HostPorts*, default `empty`. List of `HostPortRange`, defined by `min`(inclusive) and `max`(inclusive), which define the allowed host ports. + ## Admission _Admission control_ with `PodSecurityPolicy` allows for control over the creation of resources diff --git a/docs/user-guide/pod-security-policy/psp.yaml b/docs/user-guide/pod-security-policy/psp.yaml index a16c1f350d..b2cdded9e4 100644 --- a/docs/user-guide/pod-security-policy/psp.yaml +++ b/docs/user-guide/pod-security-policy/psp.yaml @@ -17,6 +17,12 @@ "fsGroup": { "rule": "RunAsAny" }, + "HostPorts": [ + { + "min": 8000, + "max": 8080 + } + ], "volumes": ["*"] } } From bdf2b6ee49c418bc7f8363f650aa3c58f9f8dbce Mon Sep 17 00:00:00 2001 From: Eric Chiang Date: Fri, 17 Mar 2017 09:57:56 -0700 Subject: [PATCH 02/23] docs/admin: document OpenID Connect plugin's claim prefixing --- docs/admin/authentication.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/docs/admin/authentication.md b/docs/admin/authentication.md index 530201f2f5..1a7c821a9c 100644 --- a/docs/admin/authentication.md +++ b/docs/admin/authentication.md @@ -252,10 +252,20 @@ To enable the plugin, configure the following flags on the API server: | --------- | ----------- | ------- | ------- | | `--oidc-issuer-url` | URL of the provider which allows the API server to discover public signing keys. Only URLs which use the `https://` scheme are accepted. This is typically the provider's discovery URL without a path, for example "https://accounts.google.com" or "https://login.salesforce.com". This URL should point to the level below .well-known/openid-configuration | If the discovery URL is https://accounts.google.com/.well-known/openid-configuration the value should be https://accounts.google.com | Yes | | `--oidc-client-id` | A client id that all tokens must be issued for. | kubernetes | Yes | -| `--oidc-username-claim` | JWT claim to use as the user name. By default `sub`, which is expected to be a unique identifier of the end user. Admins can choose other claims, such as `email`, depending on their provider. | sub | No | +| `--oidc-username-claim` | JWT claim to use as the user name. By default `sub`, which is expected to be a unique identifier of the end user. Admins can choose other claims, such as `email` or `name`, depending on their provider. However, claims other than `email` will be prefixed with the issuer URL to prevent naming clashes with other plugins. | sub | No | | `--oidc-groups-claim` | JWT claim to use as the user's group. If the claim is present it must be an array of strings. | groups | No | | `--oidc-ca-file` | The path to the certificate for the CA that signed your identity provider's web certificate. Defaults to the host's root CAs. | `/etc/kubernetes/ssl/kc-ca.pem` | No | +If a claim other than `email` is chosen for `--oidc-username-claim`, the value +will be prefixed with the `--oidc-issuer-url` to prevent clashes with existing +Kubernetes names (such as the `system:` users). For example, if the provider +URL is `https://accounts.google.com` and the username claim maps to `jane`, the +plugin will authenticate the user as: + +``` +https://accounts.google.com#jane +``` + Importantly, the API server is not an OAuth2 client, rather it can only be configured to trust a single issuer. This allows the use of public providers, such as Google, without trusting credentials issued to third parties. Admins who From 183b19d6861f404b2f6c91b6e5c47da4fa5275fb Mon Sep 17 00:00:00 2001 From: chenhuan12 Date: Sat, 18 Mar 2017 15:01:18 +0800 Subject: [PATCH 03/23] fix the command output fix the command output --- .../run-stateless-application-deployment.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/tutorials/stateless-application/run-stateless-application-deployment.md b/docs/tutorials/stateless-application/run-stateless-application-deployment.md index 831ed6bb45..012d217f84 100644 --- a/docs/tutorials/stateless-application/run-stateless-application-deployment.md +++ b/docs/tutorials/stateless-application/run-stateless-application-deployment.md @@ -61,6 +61,10 @@ a Deployment that runs the nginx:1.7.9 Docker image: StrategyType: RollingUpdate MinReadySeconds: 0 RollingUpdateStrategy: 1 max unavailable, 1 max surge + Conditions: + Type Status Reason + ---- ------ ------ + Available True MinimumReplicasAvailable OldReplicaSets: NewReplicaSet: nginx-deployment-1771418926 (2/2 replicas created) No events. From 0a33b3e910e98b67bba27c75d1d83b1d7a1b393e Mon Sep 17 00:00:00 2001 From: wenlxie Date: Sat, 18 Mar 2017 22:23:30 +0800 Subject: [PATCH 04/23] Update manage-compute-resources-container.md Change "he" to "The" --- .../configuration/manage-compute-resources-container.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/concepts/configuration/manage-compute-resources-container.md b/docs/concepts/configuration/manage-compute-resources-container.md index 2754260d65..5f99b966f2 100644 --- a/docs/concepts/configuration/manage-compute-resources-container.md +++ b/docs/concepts/configuration/manage-compute-resources-container.md @@ -138,7 +138,7 @@ When using Docker: - The `spec.containers[].resources.limits.cpu` is converted to its millicore value, multiplied by 100000, and then divided by 1000. This number is used as the value of the [`--cpu-quota`](https://docs.docker.com/engine/reference/run/#/cpu-quota-constraint) - flag in the `docker run` command. he [`--cpu-period`] flag is set to 100000, + flag in the `docker run` command. The [`--cpu-period`] flag is set to 100000, which represents the default 100ms period for measuring quota usage. The kubelet enforces cpu limits if it is started with the [`--cpu-cfs-quota`] flag set to true. As of Kubernetes version 1.2, this flag From 501d851eef92c2d4e87f11466bef4627322e6984 Mon Sep 17 00:00:00 2001 From: Xiaoyu Zhang Date: Sun, 19 Mar 2017 21:03:39 +0800 Subject: [PATCH 05/23] amend monitor-node-health.md Amend the url link. --- docs/tasks/debug-application-cluster/monitor-node-health.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/tasks/debug-application-cluster/monitor-node-health.md b/docs/tasks/debug-application-cluster/monitor-node-health.md index 08ca3208dd..1db42a39ab 100644 --- a/docs/tasks/debug-application-cluster/monitor-node-health.md +++ b/docs/tasks/debug-application-cluster/monitor-node-health.md @@ -36,7 +36,7 @@ it to [support other log format](/docs/admin/node-problem/#support-other-log-for ## Enable/Disable in GCE cluster -Node problem detector is [running as a cluster addon](cluster-large.md/#addon-resources) enabled by default in the +Node problem detector is [running as a cluster addon](/docs/admin/cluster-large/#addon-resources) enabled by default in the gce cluster. You can enable/disable it by setting the environment variable From 4282f695c92582b77b95563f8a7d230bfc939748 Mon Sep 17 00:00:00 2001 From: Xiaoyu Zhang Date: Mon, 20 Mar 2017 14:23:19 +0800 Subject: [PATCH 06/23] Fix monitor-node-health.md The url link does not exist. --- docs/tasks/debug-application-cluster/monitor-node-health.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/tasks/debug-application-cluster/monitor-node-health.md b/docs/tasks/debug-application-cluster/monitor-node-health.md index 08ca3208dd..7576728fc4 100644 --- a/docs/tasks/debug-application-cluster/monitor-node-health.md +++ b/docs/tasks/debug-application-cluster/monitor-node-health.md @@ -194,8 +194,8 @@ and detects known kernel issues following predefined rules. The Kernel Monitor matches kernel issues according to a set of predefined rule list in [`config/kernel-monitor.json`](https://github.com/kubernetes/node-problem-detector/blob/v0.1/config/kernel-monitor.json). -The rule list is extensible, and you can always extend it by [overwriting the -configuration](/docs/admin/node-problem/#overwrite-the-configuration). +The rule list is extensible, and you can always extend it by overwriting the +configuration. ### Add New NodeConditions From 9c9d359fb3efe654d3ae1e62c9202fd7a086c6da Mon Sep 17 00:00:00 2001 From: Xiaoyu Zhang Date: Mon, 20 Mar 2017 14:49:37 +0800 Subject: [PATCH 07/23] fix a typo in /docs/user-guide/configmap/index.md change "value" to "values" --- docs/user-guide/configmap/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/configmap/index.md b/docs/user-guide/configmap/index.md index 1355e599f2..8249f55084 100644 --- a/docs/user-guide/configmap/index.md +++ b/docs/user-guide/configmap/index.md @@ -46,7 +46,7 @@ of configuration files. Configuration data can be consumed in pods in a variety of ways. ConfigMaps can be used to: -1. Populate the value of environment variables +1. Populate the values of environment variables 2. Set command-line arguments in a container 3. Populate config files in a volume From 17daa9837f0251bf751a7c73a379fb2e69224838 Mon Sep 17 00:00:00 2001 From: Everett Toews Date: Thu, 9 Mar 2017 09:59:38 -0600 Subject: [PATCH 08/23] Use kubectl config current-context to simplify the instructions --- docs/user-guide/namespaces.md | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/docs/user-guide/namespaces.md b/docs/user-guide/namespaces.md index d162139358..1ce6861760 100644 --- a/docs/user-guide/namespaces.md +++ b/docs/user-guide/namespaces.md @@ -64,16 +64,8 @@ $ kubectl --namespace= get pods You can permanently save the namespace for all subsequent kubectl commands in that context. -First get your current context: - ```shell -$ export CONTEXT=$(kubectl config view | awk '/current-context/ {print $2}') -``` - -Then update the default namespace: - -```shell -$ kubectl config set-context $CONTEXT --namespace= +$ kubectl config set-context $(kubectl config current-context) --namespace= # Validate it $ kubectl config view | grep namespace: ``` From d57ed65fe8184df43cbc372386b2c1aa43a676c9 Mon Sep 17 00:00:00 2001 From: tanshanshan Date: Wed, 22 Mar 2017 08:06:56 +0800 Subject: [PATCH 09/23] fix typeo (#2856) * fix typeo * Update kargo.md --- docs/getting-started-guides/kargo.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started-guides/kargo.md b/docs/getting-started-guides/kargo.md index 0a2e1d1c44..5e36713f5a 100644 --- a/docs/getting-started-guides/kargo.md +++ b/docs/getting-started-guides/kargo.md @@ -47,7 +47,7 @@ to [kubeadm](../kubeadm) and [kops](../kops). * Customize your deployment by usual Ansible meanings, which is [generating inventory](https://github.com/kubernetes-incubator/kargo/blob/master/docs/getting-started.md#building-your-own-inventory) and overriding default data [variables](https://github.com/kubernetes-incubator/kargo/blob/master/docs/vars.md). - Or just stick with default values (Kargo will choose Flannel networking plugin for you + Or just stick with default values (Kargo will choose Calico networking plugin for you then). This includes steps like deciding on the: * DNS [configuration options](https://github.com/kubernetes-incubator/kargo/blob/master/docs/dns-stack.md) * [Networking plugin](https://github.com/kubernetes-incubator/kargo#network-plugins) to use From e4af4e9898b750d4703cd519672ae0ee5bfaf302 Mon Sep 17 00:00:00 2001 From: Joe Wang Date: Fri, 10 Mar 2017 13:50:47 -0800 Subject: [PATCH 10/23] Fix typo in kubectl_completion.md evaluation --> evaluated --- docs/user-guide/kubectl/kubectl_completion.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/kubectl/kubectl_completion.md b/docs/user-guide/kubectl/kubectl_completion.md index f870bbd482..6ceabb2cb5 100644 --- a/docs/user-guide/kubectl/kubectl_completion.md +++ b/docs/user-guide/kubectl/kubectl_completion.md @@ -9,7 +9,7 @@ Output shell completion code for the given shell (bash or zsh) Output shell completion code for the given shell (bash or zsh). -This command prints shell code which must be evaluation to provide interactive completion of kubectl commands. +This command prints shell code which must be evaluated to provide interactive completion of kubectl commands. `$ source <(kubectl completion bash)` From fce57824ce6019f726b4df42548c826fd1c141a2 Mon Sep 17 00:00:00 2001 From: Andrew Chen Date: Tue, 21 Mar 2017 17:44:35 -0700 Subject: [PATCH 11/23] Apply typo fixes from #2791 (#2949) * Apply typo fixes from #2791 * remove style typos --- docs/getting-started-guides/kargo.md | 4 ---- docs/getting-started-guides/kops.md | 4 ---- docs/getting-started-guides/kubeadm.md | 4 ---- .../declarative-object-management-configuration.md | 2 +- .../imperative-object-management-configuration.md | 2 +- 5 files changed, 2 insertions(+), 14 deletions(-) diff --git a/docs/getting-started-guides/kargo.md b/docs/getting-started-guides/kargo.md index 5e36713f5a..f314870a78 100644 --- a/docs/getting-started-guides/kargo.md +++ b/docs/getting-started-guides/kargo.md @@ -2,10 +2,6 @@ title: Installing Kubernetes On-premise/Cloud Providers with Kargo --- - - ## Overview This quickstart helps to install a Kubernetes cluster hosted diff --git a/docs/getting-started-guides/kops.md b/docs/getting-started-guides/kops.md index 0b2381dd18..e2e5a952ac 100644 --- a/docs/getting-started-guides/kops.md +++ b/docs/getting-started-guides/kops.md @@ -2,10 +2,6 @@ title: Installing Kubernetes on AWS with kops --- - - ## Overview This quickstart shows you how to easily install a Kubernetes cluster on AWS. diff --git a/docs/getting-started-guides/kubeadm.md b/docs/getting-started-guides/kubeadm.md index a45c2f1319..b8c72cadee 100644 --- a/docs/getting-started-guides/kubeadm.md +++ b/docs/getting-started-guides/kubeadm.md @@ -7,10 +7,6 @@ assignees: title: Installing Kubernetes on Linux with kubeadm --- - - ## Overview This quickstart shows you how to easily install a secure Kubernetes cluster on machines running Ubuntu 16.04, CentOS 7 or HypriotOS v1.0.1+. diff --git a/docs/tutorials/object-management-kubectl/declarative-object-management-configuration.md b/docs/tutorials/object-management-kubectl/declarative-object-management-configuration.md index f0e1fea561..02ab4e485b 100644 --- a/docs/tutorials/object-management-kubectl/declarative-object-management-configuration.md +++ b/docs/tutorials/object-management-kubectl/declarative-object-management-configuration.md @@ -383,7 +383,7 @@ The `kubectl apply` command writes the contents of the configuration file to the `kubectl.kubernetes.io/last-applied-configuration` annotation. This is used to identify fields that have been removed from the configuration file and need to be cleared from the live configuration. Here are the steps used -to caluculate which fields should be deleted or set: +to calculate which fields should be deleted or set: 1. Calculate the fields to delete. These are the fields present in `last-applied-configuration` and missing from the configuration file. 2. Calculate the fields to add or set. These are the fields present in the configuration file whose values don't match the live configuration. diff --git a/docs/tutorials/object-management-kubectl/imperative-object-management-configuration.md b/docs/tutorials/object-management-kubectl/imperative-object-management-configuration.md index 196d26fa8a..72196b9fd9 100644 --- a/docs/tutorials/object-management-kubectl/imperative-object-management-configuration.md +++ b/docs/tutorials/object-management-kubectl/imperative-object-management-configuration.md @@ -62,7 +62,7 @@ The `create`, `replace`, and `delete` commands work well when each object's configuration is fully defined and recorded in its configuration file. However when a live object is updated, and the updates are not merged into its configuration file, the updates will be lost the next time a `replace` -is executed. This is can happen if a controller, such as +is executed. This can happen if a controller, such as a HorizontalPodAutoscaler, makes updates directly to a live object. Here's an example: From f6fec80790bbce2a00f923f0981edf90329037dc Mon Sep 17 00:00:00 2001 From: yupengzte Date: Wed, 15 Mar 2017 11:55:54 +0800 Subject: [PATCH 12/23] Fix the typos Signed-off-by: yupengzte --- _includes/code.html | 2 +- _layouts/docwithnav.html | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/_includes/code.html b/_includes/code.html index 59a27ebf1a..d59db08ff7 100644 --- a/_includes/code.html +++ b/_includes/code.html @@ -14,7 +14,7 @@ {% if ghlink %}{% endif %} {{include.file}} {% if ghlink %}{% endif %} - + diff --git a/_layouts/docwithnav.html b/_layouts/docwithnav.html index 3d12017366..fc5fb3350e 100755 --- a/_layouts/docwithnav.html +++ b/_layouts/docwithnav.html @@ -57,7 +57,7 @@ {{ content }} -

Analytics +

Analytics

{% if page.url != "/404.html" and page.url != "/docs/search/" %}