From 72267ac653724cddcd503adb97b64c5154250ad5 Mon Sep 17 00:00:00 2001 From: edsoncelio Date: Sun, 2 May 2021 10:30:34 -0300 Subject: [PATCH 001/279] Add initial files to translate the secret task --- .../docs/tasks/configmap-secret/_index.md | 6 + .../managing-secret-using-config-file.md | 198 ++++++++++++++++++ .../managing-secret-using-kubectl.md | 156 ++++++++++++++ .../managing-secret-using-kustomize.md | 128 +++++++++++ .../pt-br/includes/task-tutorial-prereqs.md | 8 + 5 files changed, 496 insertions(+) create mode 100755 content/pt-br/docs/tasks/configmap-secret/_index.md create mode 100644 content/pt-br/docs/tasks/configmap-secret/managing-secret-using-config-file.md create mode 100644 content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kubectl.md create mode 100644 content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kustomize.md create mode 100644 content/pt-br/includes/task-tutorial-prereqs.md diff --git a/content/pt-br/docs/tasks/configmap-secret/_index.md b/content/pt-br/docs/tasks/configmap-secret/_index.md new file mode 100755 index 0000000000..d80692c967 --- /dev/null +++ b/content/pt-br/docs/tasks/configmap-secret/_index.md @@ -0,0 +1,6 @@ +--- +title: "Managing Secrets" +weight: 28 +description: Managing confidential settings data using Secrets. +--- + diff --git a/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-config-file.md b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-config-file.md new file mode 100644 index 0000000000..b405d57baf --- /dev/null +++ b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-config-file.md @@ -0,0 +1,198 @@ +--- +title: Managing Secret using Configuration File +content_type: task +weight: 20 +description: Creating Secret objects using resource configuration file. +--- + + + +## {{% heading "prerequisites" %}} + +{{< include "task-tutorial-prereqs.md" >}} + + + +## Create the Config file + +You can create a Secret in a file first, in JSON or YAML format, and then +create that object. The +[Secret](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#secret-v1-core) +resource contains two maps: `data` and `stringData`. +The `data` field is used to store arbitrary data, encoded using base64. The +`stringData` field is provided for convenience, and it allows you to provide +Secret data as unencoded strings. +The keys of `data` and `stringData` must consist of alphanumeric characters, +`-`, `_` or `.`. + +For example, to store two strings in a Secret using the `data` field, convert +the strings to base64 as follows: + +```shell +echo -n 'admin' | base64 +``` + +The output is similar to: + +``` +YWRtaW4= +``` + +```shell +echo -n '1f2d1e2e67df' | base64 +``` + +The output is similar to: + +``` +MWYyZDFlMmU2N2Rm +``` + +Write a Secret config file that looks like this: + +```yaml +apiVersion: v1 +kind: Secret +metadata: + name: mysecret +type: Opaque +data: + username: YWRtaW4= + password: MWYyZDFlMmU2N2Rm +``` + +Note that the name of a Secret object must be a valid +[DNS subdomain name](/docs/concepts/overview/working-with-objects/names#dns-subdomain-names). + +{{< note >}} +The serialized JSON and YAML values of Secret data are encoded as base64 +strings. Newlines are not valid within these strings and must be omitted. When +using the `base64` utility on Darwin/macOS, users should avoid using the `-b` +option to split long lines. Conversely, Linux users *should* add the option +`-w 0` to `base64` commands or the pipeline `base64 | tr -d '\n'` if the `-w` +option is not available. +{{< /note >}} + +For certain scenarios, you may wish to use the `stringData` field instead. This +field allows you to put a non-base64 encoded string directly into the Secret, +and the string will be encoded for you when the Secret is created or updated. + +A practical example of this might be where you are deploying an application +that uses a Secret to store a configuration file, and you want to populate +parts of that configuration file during your deployment process. + +For example, if your application uses the following configuration file: + +```yaml +apiUrl: "https://my.api.com/api/v1" +username: "" +password: "" +``` + +You could store this in a Secret using the following definition: + +```yaml +apiVersion: v1 +kind: Secret +metadata: + name: mysecret +type: Opaque +stringData: + config.yaml: | + apiUrl: "https://my.api.com/api/v1" + username: + password: +``` + +## Create the Secret object + +Now create the Secret using [`kubectl apply`](/docs/reference/generated/kubectl/kubectl-commands#apply): + +```shell +kubectl apply -f ./secret.yaml +``` + +The output is similar to: + +``` +secret/mysecret created +``` + +## Check the Secret + +The `stringData` field is a write-only convenience field. It is never output when +retrieving Secrets. For example, if you run the following command: + +```shell +kubectl get secret mysecret -o yaml +``` + +The output is similar to: + +```yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: 2018-11-15T20:40:59Z + name: mysecret + namespace: default + resourceVersion: "7225" + uid: c280ad2e-e916-11e8-98f2-025000000001 +type: Opaque +data: + config.yaml: YXBpVXJsOiAiaHR0cHM6Ly9teS5hcGkuY29tL2FwaS92MSIKdXNlcm5hbWU6IHt7dXNlcm5hbWV9fQpwYXNzd29yZDoge3twYXNzd29yZH19 +``` + +The commands `kubectl get` and `kubectl describe` avoid showing the contents of a `Secret` by +default. This is to protect the `Secret` from being exposed accidentally to an onlooker, +or from being stored in a terminal log. +To check the actual content of the encoded data, please refer to +[decoding secret](/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret). + +If a field, such as `username`, is specified in both `data` and `stringData`, +the value from `stringData` is used. For example, the following Secret definition: + +```yaml +apiVersion: v1 +kind: Secret +metadata: + name: mysecret +type: Opaque +data: + username: YWRtaW4= +stringData: + username: administrator +``` + +Results in the following Secret: + +```yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: 2018-11-15T20:46:46Z + name: mysecret + namespace: default + resourceVersion: "7579" + uid: 91460ecb-e917-11e8-98f2-025000000001 +type: Opaque +data: + username: YWRtaW5pc3RyYXRvcg== +``` + +Where `YWRtaW5pc3RyYXRvcg==` decodes to `administrator`. + +## Clean Up + +To delete the Secret you have created: + +```shell +kubectl delete secret mysecret +``` + +## {{% heading "whatsnext" %}} + +- Read more about the [Secret concept](/docs/concepts/configuration/secret/) +- Learn how to [manage Secret with the `kubectl` command](/docs/tasks/configmap-secret/managing-secret-using-kubectl/) +- Learn how to [manage Secret using kustomize](/docs/tasks/configmap-secret/managing-secret-using-kustomize/) + diff --git a/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kubectl.md b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kubectl.md new file mode 100644 index 0000000000..293915736e --- /dev/null +++ b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kubectl.md @@ -0,0 +1,156 @@ +--- +title: Managing Secret using kubectl +content_type: task +weight: 10 +description: Creating Secret objects using kubectl command line. +--- + + + +## {{% heading "prerequisites" %}} + +{{< include "task-tutorial-prereqs.md" >}} + + + +## Create a Secret + +A `Secret` can contain user credentials required by Pods to access a database. +For example, a database connection string consists of a username and password. +You can store the username in a file `./username.txt` and the password in a +file `./password.txt` on your local machine. + +```shell +echo -n 'admin' > ./username.txt +echo -n '1f2d1e2e67df' > ./password.txt +``` + +The `-n` flag in the above two commands ensures that the generated files will +not contain an extra newline character at the end of the text. This is +important because when `kubectl` reads a file and encode the content into +base64 string, the extra newline character gets encoded too. + +The `kubectl create secret` command packages these files into a Secret and creates +the object on the API server. + +```shell +kubectl create secret generic db-user-pass \ + --from-file=./username.txt \ + --from-file=./password.txt +``` + +The output is similar to: + +``` +secret/db-user-pass created +``` + +Default key name is the filename. You may optionally set the key name using +`--from-file=[key=]source`. For example: + +```shell +kubectl create secret generic db-user-pass \ + --from-file=username=./username.txt \ + --from-file=password=./password.txt +``` + +You do not need to escape special characters in passwords from files +(`--from-file`). + +You can also provide Secret data using the `--from-literal==` tag. +This tag can be specified more than once to provide multiple key-value pairs. +Note that special characters such as `$`, `\`, `*`, `=`, and `!` will be +interpreted by your [shell](https://en.wikipedia.org/wiki/Shell_(computing)) +and require escaping. +In most shells, the easiest way to escape the password is to surround it with +single quotes (`'`). For example, if your actual password is `S!B\*d$zDsb=`, +you should execute the command this way: + +```shell +kubectl create secret generic dev-db-secret \ + --from-literal=username=devuser \ + --from-literal=password='S!B\*d$zDsb=' +``` + +## Verify the Secret + +You can check that the secret was created: + +```shell +kubectl get secrets +``` + +The output is similar to: + +``` +NAME TYPE DATA AGE +db-user-pass Opaque 2 51s +``` + +You can view a description of the `Secret`: + +```shell +kubectl describe secrets/db-user-pass +``` + +The output is similar to: + +``` +Name: db-user-pass +Namespace: default +Labels: +Annotations: + +Type: Opaque + +Data +==== +password: 12 bytes +username: 5 bytes +``` + +The commands `kubectl get` and `kubectl describe` avoid showing the contents +of a `Secret` by default. This is to protect the `Secret` from being exposed +accidentally to an onlooker, or from being stored in a terminal log. + +## Decoding the Secret {#decoding-secret} + +To view the contents of the Secret you created, run the following command: + +```shell +kubectl get secret db-user-pass -o jsonpath='{.data}' +``` + +The output is similar to: + +```json +{"password":"MWYyZDFlMmU2N2Rm","username":"YWRtaW4="} +``` + +Now you can decode the `password` data: + +```shell +echo 'MWYyZDFlMmU2N2Rm' | base64 --decode +``` + +The output is similar to: + +``` +1f2d1e2e67df +``` + +## Clean Up + +To delete the Secret you have created: + +```shell +kubectl delete secret db-user-pass +``` + + + +## {{% heading "whatsnext" %}} + +- Read more about the [Secret concept](/docs/concepts/configuration/secret/) +- Learn how to [manage Secret using config file](/docs/tasks/configmap-secret/managing-secret-using-config-file/) +- Learn how to [manage Secret using kustomize](/docs/tasks/configmap-secret/managing-secret-using-kustomize/) diff --git a/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kustomize.md b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kustomize.md new file mode 100644 index 0000000000..fb257a6026 --- /dev/null +++ b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kustomize.md @@ -0,0 +1,128 @@ +--- +title: Managing Secret using Kustomize +content_type: task +weight: 30 +description: Creating Secret objects using kustomization.yaml file. +--- + + + +Since Kubernetes v1.14, `kubectl` supports +[managing objects using Kustomize](/docs/tasks/manage-kubernetes-objects/kustomization/). +Kustomize provides resource Generators to create Secrets and ConfigMaps. The +Kustomize generators should be specified in a `kustomization.yaml` file inside +a directory. After generating the Secret, you can create the Secret on the API +server with `kubectl apply`. + +## {{% heading "prerequisites" %}} + +{{< include "task-tutorial-prereqs.md" >}} + + + +## Create the Kustomization file + +You can generate a Secret by defining a `secretGenerator` in a +`kustomization.yaml` file that references other existing files. +For example, the following kustomization file references the +`./username.txt` and the `./password.txt` files: + +```yaml +secretGenerator: +- name: db-user-pass + files: + - username.txt + - password.txt +``` + +You can also define the `secretGenerator` in the `kustomization.yaml` +file by providing some literals. +For example, the following `kustomization.yaml` file contains two literals +for `username` and `password` respectively: + +```yaml +secretGenerator: +- name: db-user-pass + literals: + - username=admin + - password=1f2d1e2e67df +``` + +Note that in both cases, you don't need to base64 encode the values. + +## Create the Secret + +Apply the directory containing the `kustomization.yaml` to create the Secret. + +```shell +kubectl apply -k . +``` + +The output is similar to: + +``` +secret/db-user-pass-96mffmfh4k created +``` + +Note that when a Secret is generated, the Secret name is created by hashing +the Secret data and appending the hash value to the name. This ensures that +a new Secret is generated each time the data is modified. + +## Check the Secret created + +You can check that the secret was created: + +```shell +kubectl get secrets +``` + +The output is similar to: + +``` +NAME TYPE DATA AGE +db-user-pass-96mffmfh4k Opaque 2 51s +``` + +You can view a description of the secret: + +```shell +kubectl describe secrets/db-user-pass-96mffmfh4k +``` + +The output is similar to: + +``` +Name: db-user-pass-96mffmfh4k +Namespace: default +Labels: +Annotations: + +Type: Opaque + +Data +==== +password.txt: 12 bytes +username.txt: 5 bytes +``` + +The commands `kubectl get` and `kubectl describe` avoid showing the contents of a `Secret` by +default. This is to protect the `Secret` from being exposed accidentally to an onlooker, +or from being stored in a terminal log. +To check the actual content of the encoded data, please refer to +[decoding secret](/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret). + +## Clean Up + +To delete the Secret you have created: + +```shell +kubectl delete secret db-user-pass-96mffmfh4k +``` + + +## {{% heading "whatsnext" %}} + +- Read more about the [Secret concept](/docs/concepts/configuration/secret/) +- Learn how to [manage Secret with the `kubectl` command](/docs/tasks/configmap-secret/managing-secret-using-kubectl/) +- Learn how to [manage Secret using config file](/docs/tasks/configmap-secret/managing-secret-using-config-file/) + diff --git a/content/pt-br/includes/task-tutorial-prereqs.md b/content/pt-br/includes/task-tutorial-prereqs.md new file mode 100644 index 0000000000..93195d8b9c --- /dev/null +++ b/content/pt-br/includes/task-tutorial-prereqs.md @@ -0,0 +1,8 @@ +You need to have a Kubernetes cluster, and the kubectl command-line tool must +be configured to communicate with your cluster. If you do not already have a +cluster, you can create one by using +[minikube](/docs/tasks/tools/#minikube) +or you can use one of these Kubernetes playgrounds: + +* [Katacoda](https://www.katacoda.com/courses/kubernetes/playground) +* [Play with Kubernetes](http://labs.play-with-k8s.com/) From 2c82e7d6cfa8d6de62c3822d8dfaacdf097bacf7 Mon Sep 17 00:00:00 2001 From: Jai Govindani Date: Fri, 7 May 2021 19:34:43 +0700 Subject: [PATCH 002/279] docs(manage-resources-containers): add volume and volumeMount for ephemeral storage Signed-off-by: Jai Govindani --- .../configuration/manage-resources-containers.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/content/en/docs/concepts/configuration/manage-resources-containers.md b/content/en/docs/concepts/configuration/manage-resources-containers.md index ee4669641c..e1154c5925 100644 --- a/content/en/docs/concepts/configuration/manage-resources-containers.md +++ b/content/en/docs/concepts/configuration/manage-resources-containers.md @@ -337,6 +337,9 @@ spec: ephemeral-storage: "2Gi" limits: ephemeral-storage: "4Gi" + volumeMounts: + - name: ephemeral + mountPath: "/tmp" - name: log-aggregator image: images.my-company.example/log-aggregator:v6 resources: @@ -344,6 +347,12 @@ spec: ephemeral-storage: "2Gi" limits: ephemeral-storage: "4Gi" + volumeMounts: + - name: ephemeral + mountPath: "/tmp" + volumes: + - name: ephemeral + emptyDir: {} ``` ### How Pods with ephemeral-storage requests are scheduled From 97475e7ba82c604356f4d858a443a6accc849b69 Mon Sep 17 00:00:00 2001 From: olivierk Date: Fri, 14 May 2021 13:51:40 +0400 Subject: [PATCH 003/279] French translation of workloads page Add the translated (french) page of the workload ressource. --- content/fr/docs/concepts/workloads/_index.md | 46 ++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/content/fr/docs/concepts/workloads/_index.md b/content/fr/docs/concepts/workloads/_index.md index 1d81794f7b..1d409d2a10 100644 --- a/content/fr/docs/concepts/workloads/_index.md +++ b/content/fr/docs/concepts/workloads/_index.md @@ -1,4 +1,50 @@ --- title: Workloads weight: 50 +description: > + Comprendre les Pods, Le plus petit objet déployable sur Kubernetes et les abstractions de haut niveaux vous permettant de les lancer. +no_list: true --- + + + + +Un workload (charge de travail) est une application fonctionnant sur Kubernetes. Que votre workload soit un composant unique ou un agrégat de composants, sur Kubernetes celui-ci fonctionnera dans une série de pods. Dans Kubernetes, un Pod represente un ensemble de conteneur (containers) en fonctionnement sur votre cluster. + +Les pods Kubernetes ont un cycle de vie définit (defined lifecycle). Par exemple, quand un pod est en fonction sur votre cluster et qu’une panne critique survient sur le noeud (node) où se situe ce pod, tous les pods du noeud seront en échec. Kubernetes traite ce niveau d’échec comme un état final : +Vous devez créer un nouveau Pod pour retrouver l’état initial même si le noeud redevient sain. + +Cependant, pour vous simplifier la vie, vous n’avez pas a gérer chaque Pod directement. Vous pouvez utiliser une ressource workload qui gère votre groupe de pods à votre place. Ces ressources configurent des controleurs (controllers) qui s’assurent que le bon nombre et le bon type de pod soit en fonction pour égaler l’état que vous avez spécifié. + +Kubernetes fournit plusieurs ressources workload pré-faites : + +* [`Deployment`](/docs/concepts/workloads/controllers/deployment/) et [`ReplicaSet`](/docs/concepts/workloads/controllers/replicaset/) +(qui remplacent l’ancienne ressource {{< glossary_tooltip text="ReplicationController" term_id="replication-controller" >}})). +le Déploiement (`Deployment`) est une bonne approche pour manager une application stateless sur votre cluster, tous les `Pods` d’un `Deployment` sont interchangeables et peuvent être remplacés si besoin. +* Le [`StatefulSet`](/docs/concepts/workloads/controllers/statefulset/) vous permet de lancer un ou plusieurs Pods en relation qui garde plus ou moins la trace de leurs état. +Par exemple si votre workload enregistre des données de façon persistente, vous pouvez lancer un `StatefulSet` qui fera le lien entre les `Pods` et un volume persistent ([`PersistentVolume`](/docs/concepts/storage/persistent-volumes/)). +Votre code, présent dans les `Pods` du `StatefulSet`, peut répliquer des données dans les autres `Pods` qui sont dans le même `StatefulSet`, +pour améliorer la résilience global. +* Le [`DaemonSet`](/docs/concepts/workloads/controllers/daemonset/) permet de définir les `Pods` qui effectuent des actions sur le noeud local. +Ceux-ci peuvent être fondamental aux opérations de votre cluster, comme un outil d’aide réseau, ou peuvent faire part d’un module complémentaire (add-on). +Quand un nouveau noeud est ajouté au cluster, le controle plane organise l'ajout d'un `Pod` pour ce `DeamonSet` sur le nouveau noeud. +* Les [`Job`](/docs/concepts/workloads/controllers/job/) et [`CronJob`](/docs/concepts/workloads/controllers/cron-jobs/) sont des tâchent lancées jusqu’à accomplissement puis s’arrêtent. Les `Jobs` réprésentent une tâche ponctuelle, les `CronJob` sont des tâches récurrentes planifiés. + +Dans l’écosystème étendu de Kubernetes, vous pouvez trouver des ressources workload de fournisseurs tiers qui permetent des fonctionnalités supplémentaires. L’utilisation d’un [custom resource definition](/docs/concepts/extend-kubernetes/api-extension/custom-resources/) permet d’ajouter une ressource workload d’un fournisseur tiers si vous souhaites une fonctionnalité ou un comportement spécifique qui ne fait pas partie du noyau de Kubernetes. Par exemple, si vous voulez lancer un groupe de `Pods` pour votre application mais vous devez arrêter leurs fonctionnement tant qu’ils ne sont pas tous disponibles, alors vous pouvez implémenter ou installer une extension qui permet cette fonctionnalité. + +## {{% heading "whatsnext" %}} +Vous pouvez continuer la lecture des ressources, vous pouvez aussi apprendre à connaitre les taches qui leurs sont liées : +* Lancer une [application stateless en utilisant un `Deployment`](/docs/tasks/run-application/run-stateless-application-deployment/). +* Lancer une application statefull, soit comme [instance unique](/docs/tasks/run-application/run-single-instance-stateful-application/) + ou alors comme un [ensemble répliqué](/docs/tasks/run-application/run-replicated-stateful-application/). +* Lancer une [tâche automatisée avec un `CronJob`](/docs/tasks/job/automated-tasks-with-cron-jobs/). + +Pour en apprendre plus sur les méchanismes de Kubernetes, de séparation du code et de la configuration, +allez voir [Configuration](/docs/concepts/configuration/). + +Il y a deux concepts supportés qui fournissent un contexte sur le sujet : comment Kubernetes gère les pods pour les applications : +* Le [ramasse-miettes](/docs/concepts/workloads/controllers/garbage-collection/) , fait le ménage dans votre cluster après qu’une de _vos ressource_ soit supprimé. +* Le [temps de vie d’un controlleur éteint](/docs/concepts/workloads/controllers/ttlafterfinished/) supprime les Jobs une fois qu’un temps définit soit passé après son accomplissement. + +Une fois que votre application est lancée, vous souhaitez peut etre la rendre disponible sur internet comme un [Service](/docs/concepts/services-networking/service/) ou comme une application web uniquement en utilsant un [Ingress](/docs/concepts/services-networking/ingress). + From 0a5d839101f4f4aa96963f5a406741db64daf841 Mon Sep 17 00:00:00 2001 From: edsoncelio Date: Sun, 16 May 2021 09:12:38 -0300 Subject: [PATCH 004/279] Update task secret translation --- .../pt-br/docs/tasks/configmap-secret/_index.md | 4 ++-- .../managing-secret-using-kustomize.md | 15 ++++++--------- content/pt-br/includes/task-tutorial-prereqs.md | 10 ++++------ 3 files changed, 12 insertions(+), 17 deletions(-) diff --git a/content/pt-br/docs/tasks/configmap-secret/_index.md b/content/pt-br/docs/tasks/configmap-secret/_index.md index d80692c967..81ee33267b 100755 --- a/content/pt-br/docs/tasks/configmap-secret/_index.md +++ b/content/pt-br/docs/tasks/configmap-secret/_index.md @@ -1,6 +1,6 @@ --- -title: "Managing Secrets" +title: "Gerenciando Secrets" weight: 28 -description: Managing confidential settings data using Secrets. +description: Gerenciando dados de configurações confidencias usando Secrets. --- diff --git a/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kustomize.md b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kustomize.md index fb257a6026..f926c95f30 100644 --- a/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kustomize.md +++ b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kustomize.md @@ -1,19 +1,16 @@ --- -title: Managing Secret using Kustomize +title: Gerenciando Secret usando Kustomize content_type: task weight: 30 -description: Creating Secret objects using kustomization.yaml file. +description: Criando objetos Secret usando o arquivo kustomization.yaml --- -Since Kubernetes v1.14, `kubectl` supports -[managing objects using Kustomize](/docs/tasks/manage-kubernetes-objects/kustomization/). -Kustomize provides resource Generators to create Secrets and ConfigMaps. The -Kustomize generators should be specified in a `kustomization.yaml` file inside -a directory. After generating the Secret, you can create the Secret on the API -server with `kubectl apply`. - +Desde o Kubernetes v1.14, o `kubectl` provê suporte para [gerenciamento de objetos usando Kustomize](/docs/tasks/manage-kubernetes-objects/kustomization/). +O Kustomize provê geradores de recursos para criar Secrets e ConfigMaps. +Os geradores Kustomize devem ser especificados em um arquivo `kustomization.yaml` dentro +de um diretório. Depois de gerar o Secret, você pode criar o Secret na API server com `kubectl apply`. ## {{% heading "prerequisites" %}} {{< include "task-tutorial-prereqs.md" >}} diff --git a/content/pt-br/includes/task-tutorial-prereqs.md b/content/pt-br/includes/task-tutorial-prereqs.md index 93195d8b9c..eb4177b4fd 100644 --- a/content/pt-br/includes/task-tutorial-prereqs.md +++ b/content/pt-br/includes/task-tutorial-prereqs.md @@ -1,8 +1,6 @@ -You need to have a Kubernetes cluster, and the kubectl command-line tool must -be configured to communicate with your cluster. If you do not already have a -cluster, you can create one by using -[minikube](/docs/tasks/tools/#minikube) -or you can use one of these Kubernetes playgrounds: - +Você precisa de um cluster Kubernetes e a ferramenta de linha de comando kubectl +precisa estar configurada para acessar o seu cluster. Se você ainda não tem um +cluster, pode criar um usando o [minikube](/docs/tasks/tools/#minikube) +ou você pode usar um dos seguintes ambientes: * [Katacoda](https://www.katacoda.com/courses/kubernetes/playground) * [Play with Kubernetes](http://labs.play-with-k8s.com/) From adf73902b7e1362d008e9fda0b91f6cea515a5bd Mon Sep 17 00:00:00 2001 From: olivierk Date: Thu, 20 May 2021 14:26:38 +0400 Subject: [PATCH 005/279] Update content/fr/docs/concepts/workloads/_index.md Co-authored-by: Tim Bannister --- content/fr/docs/concepts/workloads/_index.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/fr/docs/concepts/workloads/_index.md b/content/fr/docs/concepts/workloads/_index.md index 1d409d2a10..dc35e2b2ef 100644 --- a/content/fr/docs/concepts/workloads/_index.md +++ b/content/fr/docs/concepts/workloads/_index.md @@ -30,7 +30,7 @@ Ceux-ci peuvent être fondamental aux opérations de votre cluster, comme un out Quand un nouveau noeud est ajouté au cluster, le controle plane organise l'ajout d'un `Pod` pour ce `DeamonSet` sur le nouveau noeud. * Les [`Job`](/docs/concepts/workloads/controllers/job/) et [`CronJob`](/docs/concepts/workloads/controllers/cron-jobs/) sont des tâchent lancées jusqu’à accomplissement puis s’arrêtent. Les `Jobs` réprésentent une tâche ponctuelle, les `CronJob` sont des tâches récurrentes planifiés. -Dans l’écosystème étendu de Kubernetes, vous pouvez trouver des ressources workload de fournisseurs tiers qui permetent des fonctionnalités supplémentaires. L’utilisation d’un [custom resource definition](/docs/concepts/extend-kubernetes/api-extension/custom-resources/) permet d’ajouter une ressource workload d’un fournisseur tiers si vous souhaites une fonctionnalité ou un comportement spécifique qui ne fait pas partie du noyau de Kubernetes. Par exemple, si vous voulez lancer un groupe de `Pods` pour votre application mais vous devez arrêter leurs fonctionnement tant qu’ils ne sont pas tous disponibles, alors vous pouvez implémenter ou installer une extension qui permet cette fonctionnalité. +Dans l’écosystème étendu de Kubernetes, vous pouvez trouver des ressources workload de fournisseurs tiers qui permetent des fonctionnalités supplémentaires. L’utilisation d’un [`CustomResourceDefinition`](/docs/concepts/extend-kubernetes/api-extension/custom-resources/) permet d’ajouter une ressource workload d’un fournisseur tiers si vous souhaites une fonctionnalité ou un comportement spécifique qui ne fait pas partie du noyau de Kubernetes. Par exemple, si vous voulez lancer un groupe de `Pods` pour votre application mais vous devez arrêter leurs fonctionnement tant qu’ils ne sont pas tous disponibles, alors vous pouvez implémenter ou installer une extension qui permet cette fonctionnalité. ## {{% heading "whatsnext" %}} Vous pouvez continuer la lecture des ressources, vous pouvez aussi apprendre à connaitre les taches qui leurs sont liées : @@ -47,4 +47,3 @@ Il y a deux concepts supportés qui fournissent un contexte sur le sujet : comme * Le [temps de vie d’un controlleur éteint](/docs/concepts/workloads/controllers/ttlafterfinished/) supprime les Jobs une fois qu’un temps définit soit passé après son accomplissement. Une fois que votre application est lancée, vous souhaitez peut etre la rendre disponible sur internet comme un [Service](/docs/concepts/services-networking/service/) ou comme une application web uniquement en utilsant un [Ingress](/docs/concepts/services-networking/ingress). - From b2e8b6f9136a817107996ce4843493b9772da2dd Mon Sep 17 00:00:00 2001 From: olivierk Date: Thu, 20 May 2021 14:27:27 +0400 Subject: [PATCH 006/279] Update content/fr/docs/concepts/workloads/_index.md delete a non usefull space Co-authored-by: Tim Bannister --- content/fr/docs/concepts/workloads/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/fr/docs/concepts/workloads/_index.md b/content/fr/docs/concepts/workloads/_index.md index dc35e2b2ef..01efc316aa 100644 --- a/content/fr/docs/concepts/workloads/_index.md +++ b/content/fr/docs/concepts/workloads/_index.md @@ -43,7 +43,7 @@ Pour en apprendre plus sur les méchanismes de Kubernetes, de séparation du cod allez voir [Configuration](/docs/concepts/configuration/). Il y a deux concepts supportés qui fournissent un contexte sur le sujet : comment Kubernetes gère les pods pour les applications : -* Le [ramasse-miettes](/docs/concepts/workloads/controllers/garbage-collection/) , fait le ménage dans votre cluster après qu’une de _vos ressource_ soit supprimé. +* Le [ramasse-miettes](/docs/concepts/workloads/controllers/garbage-collection/), fait le ménage dans votre cluster après qu’une de _vos ressource_ soit supprimé. * Le [temps de vie d’un controlleur éteint](/docs/concepts/workloads/controllers/ttlafterfinished/) supprime les Jobs une fois qu’un temps définit soit passé après son accomplissement. Une fois que votre application est lancée, vous souhaitez peut etre la rendre disponible sur internet comme un [Service](/docs/concepts/services-networking/service/) ou comme une application web uniquement en utilsant un [Ingress](/docs/concepts/services-networking/ingress). From 1a25dc8e7380bb3d42ca83d123e101de81f0d942 Mon Sep 17 00:00:00 2001 From: olivierk Date: Thu, 20 May 2021 14:27:53 +0400 Subject: [PATCH 007/279] Update content/fr/docs/concepts/workloads/_index.md Fix DaemonSet word, and sentence Co-authored-by: Tim Bannister --- content/fr/docs/concepts/workloads/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/fr/docs/concepts/workloads/_index.md b/content/fr/docs/concepts/workloads/_index.md index 01efc316aa..e8f3911eb6 100644 --- a/content/fr/docs/concepts/workloads/_index.md +++ b/content/fr/docs/concepts/workloads/_index.md @@ -27,7 +27,7 @@ Votre code, présent dans les `Pods` du `StatefulSet`, peut répliquer des donn pour améliorer la résilience global. * Le [`DaemonSet`](/docs/concepts/workloads/controllers/daemonset/) permet de définir les `Pods` qui effectuent des actions sur le noeud local. Ceux-ci peuvent être fondamental aux opérations de votre cluster, comme un outil d’aide réseau, ou peuvent faire part d’un module complémentaire (add-on). -Quand un nouveau noeud est ajouté au cluster, le controle plane organise l'ajout d'un `Pod` pour ce `DeamonSet` sur le nouveau noeud. +Pour chaque nouveau noeud ajouté au cluster, le controle plane organise l'ajout d'un `Pod` pour ce `DaemonSet` sur le nouveau noeud. * Les [`Job`](/docs/concepts/workloads/controllers/job/) et [`CronJob`](/docs/concepts/workloads/controllers/cron-jobs/) sont des tâchent lancées jusqu’à accomplissement puis s’arrêtent. Les `Jobs` réprésentent une tâche ponctuelle, les `CronJob` sont des tâches récurrentes planifiés. Dans l’écosystème étendu de Kubernetes, vous pouvez trouver des ressources workload de fournisseurs tiers qui permetent des fonctionnalités supplémentaires. L’utilisation d’un [`CustomResourceDefinition`](/docs/concepts/extend-kubernetes/api-extension/custom-resources/) permet d’ajouter une ressource workload d’un fournisseur tiers si vous souhaites une fonctionnalité ou un comportement spécifique qui ne fait pas partie du noyau de Kubernetes. Par exemple, si vous voulez lancer un groupe de `Pods` pour votre application mais vous devez arrêter leurs fonctionnement tant qu’ils ne sont pas tous disponibles, alors vous pouvez implémenter ou installer une extension qui permet cette fonctionnalité. From 507f9347078406ff7be944d00bee09d77077e6b1 Mon Sep 17 00:00:00 2001 From: olivierk Date: Thu, 20 May 2021 14:31:40 +0400 Subject: [PATCH 008/279] Update content/fr/docs/concepts/workloads/_index.md swap definition Co-authored-by: Tim Bannister --- content/fr/docs/concepts/workloads/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/fr/docs/concepts/workloads/_index.md b/content/fr/docs/concepts/workloads/_index.md index e8f3911eb6..4cb18f6368 100644 --- a/content/fr/docs/concepts/workloads/_index.md +++ b/content/fr/docs/concepts/workloads/_index.md @@ -20,7 +20,7 @@ Kubernetes fournit plusieurs ressources workload pré-faites : * [`Deployment`](/docs/concepts/workloads/controllers/deployment/) et [`ReplicaSet`](/docs/concepts/workloads/controllers/replicaset/) (qui remplacent l’ancienne ressource {{< glossary_tooltip text="ReplicationController" term_id="replication-controller" >}})). -le Déploiement (`Deployment`) est une bonne approche pour manager une application stateless sur votre cluster, tous les `Pods` d’un `Deployment` sont interchangeables et peuvent être remplacés si besoin. +le `Deployment` (déploiement) est une bonne approche pour manager une application stateless sur votre cluster, tous les `Pods` d’un `Deployment` sont interchangeables et peuvent être remplacés si besoin. * Le [`StatefulSet`](/docs/concepts/workloads/controllers/statefulset/) vous permet de lancer un ou plusieurs Pods en relation qui garde plus ou moins la trace de leurs état. Par exemple si votre workload enregistre des données de façon persistente, vous pouvez lancer un `StatefulSet` qui fera le lien entre les `Pods` et un volume persistent ([`PersistentVolume`](/docs/concepts/storage/persistent-volumes/)). Votre code, présent dans les `Pods` du `StatefulSet`, peut répliquer des données dans les autres `Pods` qui sont dans le même `StatefulSet`, From 59d526f55c7985236502b56c2da492708b3d5887 Mon Sep 17 00:00:00 2001 From: olivierk Date: Tue, 25 May 2021 11:34:50 +0400 Subject: [PATCH 009/279] _index.md fix typo maj fix the typo of a maj on the first letter of a sentence Co-authored-by: Tim Bannister --- content/fr/docs/concepts/workloads/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/fr/docs/concepts/workloads/_index.md b/content/fr/docs/concepts/workloads/_index.md index 4cb18f6368..96704993ab 100644 --- a/content/fr/docs/concepts/workloads/_index.md +++ b/content/fr/docs/concepts/workloads/_index.md @@ -20,7 +20,7 @@ Kubernetes fournit plusieurs ressources workload pré-faites : * [`Deployment`](/docs/concepts/workloads/controllers/deployment/) et [`ReplicaSet`](/docs/concepts/workloads/controllers/replicaset/) (qui remplacent l’ancienne ressource {{< glossary_tooltip text="ReplicationController" term_id="replication-controller" >}})). -le `Deployment` (déploiement) est une bonne approche pour manager une application stateless sur votre cluster, tous les `Pods` d’un `Deployment` sont interchangeables et peuvent être remplacés si besoin. +Le `Deployment` (déploiement) est une bonne approche pour manager une application stateless sur votre cluster, tous les `Pods` d’un `Deployment` sont interchangeables et peuvent être remplacés si besoin. * Le [`StatefulSet`](/docs/concepts/workloads/controllers/statefulset/) vous permet de lancer un ou plusieurs Pods en relation qui garde plus ou moins la trace de leurs état. Par exemple si votre workload enregistre des données de façon persistente, vous pouvez lancer un `StatefulSet` qui fera le lien entre les `Pods` et un volume persistent ([`PersistentVolume`](/docs/concepts/storage/persistent-volumes/)). Votre code, présent dans les `Pods` du `StatefulSet`, peut répliquer des données dans les autres `Pods` qui sont dans le même `StatefulSet`, From 1661dbb435b3bb647a2af21bbbc0f70f8d045a07 Mon Sep 17 00:00:00 2001 From: olivierk Date: Tue, 25 May 2021 11:35:24 +0400 Subject: [PATCH 010/279] fix typo _index.md fix typo of a maj after a coma Co-authored-by: Tim Bannister --- content/fr/docs/concepts/workloads/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/fr/docs/concepts/workloads/_index.md b/content/fr/docs/concepts/workloads/_index.md index 96704993ab..df4e9d800e 100644 --- a/content/fr/docs/concepts/workloads/_index.md +++ b/content/fr/docs/concepts/workloads/_index.md @@ -2,7 +2,7 @@ title: Workloads weight: 50 description: > - Comprendre les Pods, Le plus petit objet déployable sur Kubernetes et les abstractions de haut niveaux vous permettant de les lancer. + Comprendre les Pods, le plus petit objet déployable sur Kubernetes, et les abstractions de haut niveaux vous permettant de les lancer. no_list: true --- From a16de9ee7a681c93a277b4b7d7fb26e6e5246441 Mon Sep 17 00:00:00 2001 From: vaibhav Date: Thu, 17 Jun 2021 10:01:28 +0530 Subject: [PATCH 011/279] Comment the body in docs/setup/learning-environment/_index.md --- content/en/docs/setup/learning-environment/_index.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/en/docs/setup/learning-environment/_index.md b/content/en/docs/setup/learning-environment/_index.md index 672bbd69ed..bb4aa05a07 100644 --- a/content/en/docs/setup/learning-environment/_index.md +++ b/content/en/docs/setup/learning-environment/_index.md @@ -11,7 +11,7 @@ weight: 20 {{/* If you're localizing this page, you only need to copy the front matter */}} {{/* and add a redirect into "/static/_redirects", for YOUR localization. */}} --> - +/* ## kind [`kind`](https://kind.sigs.k8s.io/docs/) lets you run Kubernetes on @@ -31,3 +31,5 @@ Kubernetes, or for daily development work. You can follow the official [Get Started!](https://minikube.sigs.k8s.io/docs/start/) guide if your focus is on getting the tool installed. + +*/ From dbcc1d550f56a3019e115146deceeb2cc0ca5929 Mon Sep 17 00:00:00 2001 From: vaibhav Date: Thu, 17 Jun 2021 10:14:23 +0530 Subject: [PATCH 012/279] Update the docs/setup/learning-environment/_index.md --- content/en/docs/setup/learning-environment/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/setup/learning-environment/_index.md b/content/en/docs/setup/learning-environment/_index.md index bb4aa05a07..6abebc3976 100644 --- a/content/en/docs/setup/learning-environment/_index.md +++ b/content/en/docs/setup/learning-environment/_index.md @@ -11,7 +11,7 @@ weight: 20 {{/* If you're localizing this page, you only need to copy the front matter */}} {{/* and add a redirect into "/static/_redirects", for YOUR localization. */}} --> -/* + -*/ From e6271ef41b0a7617d9ba2d3fb4b37f0e714c7d78 Mon Sep 17 00:00:00 2001 From: kahirokunn Date: Thu, 24 Jun 2021 21:54:12 +0900 Subject: [PATCH 013/279] fix: k8s dashboard link. k8s dashboard required https. http does not currently have a corresponding endpoint. So if you try to access it like this, you will get an error: "no endpoints available for service". --- .../docs/tasks/access-application-cluster/web-ui-dashboard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/access-application-cluster/web-ui-dashboard.md b/content/en/docs/tasks/access-application-cluster/web-ui-dashboard.md index 5c402e0304..c0413275b0 100644 --- a/content/en/docs/tasks/access-application-cluster/web-ui-dashboard.md +++ b/content/en/docs/tasks/access-application-cluster/web-ui-dashboard.md @@ -55,7 +55,7 @@ You can access Dashboard using the kubectl command-line tool by running the foll kubectl proxy ``` -Kubectl will make Dashboard available at [http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/](http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/). +Kubectl will make Dashboard available at [http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:https/proxy/](http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:https/proxy/). The UI can _only_ be accessed from the machine where the command is executed. See `kubectl proxy --help` for more options. From 9bd06e292db63cb97cbaa8f9662377758c5c37ed Mon Sep 17 00:00:00 2001 From: Zhang Yong Date: Tue, 29 Jun 2021 22:10:57 +0800 Subject: [PATCH 014/279] Update URL for Metacontroller --- content/pt-br/docs/concepts/extend-kubernetes/operator.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/pt-br/docs/concepts/extend-kubernetes/operator.md b/content/pt-br/docs/concepts/extend-kubernetes/operator.md index ba20161490..1c12947c0b 100644 --- a/content/pt-br/docs/concepts/extend-kubernetes/operator.md +++ b/content/pt-br/docs/concepts/extend-kubernetes/operator.md @@ -128,7 +128,7 @@ que pode atuar como um [cliente da API do Kubernetes](/docs/reference/using-api/ * Use ferramentes existentes para escrever os seus Operadores: * usando [KUDO](https://kudo.dev/) (Kubernetes Universal Declarative Operator) * usando [kubebuilder](https://book.kubebuilder.io/) - * usando [Metacontroller](https://metacontroller.app/) juntamente com WebHooks que + * usando [Metacontroller](https://metacontroller.github.io/metacontroller/intro.html) juntamente com WebHooks que implementa você mesmo * usando o [Operator Framework](https://github.com/operator-framework/getting-started) * [Publique](https://operatorhub.io/) o seu operador para que outras pessoas o possam usar From f37de46d6d0545d77d54e29a79f179e073db9d3f Mon Sep 17 00:00:00 2001 From: Jihoon Seo Date: Fri, 2 Jul 2021 14:57:13 +0900 Subject: [PATCH 015/279] [ru] Update Netlify link address --- README-ru.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README-ru.md b/README-ru.md index 348f92a82e..82eb96689d 100644 --- a/README-ru.md +++ b/README-ru.md @@ -1,6 +1,6 @@ # Документация по Kubernetes -[![Netlify Status](https://api.netlify.com/api/v1/badges/be93b718-a6df-402a-b4a4-855ba186c97d/deploy-status)](https://app.netlify.com/sites/kubernetes-io-master-staging/deploys) [![GitHub release](https://img.shields.io/github/release/kubernetes/website.svg)](https://github.com/kubernetes/website/releases/latest) +[![Netlify Status](https://api.netlify.com/api/v1/badges/be93b718-a6df-402a-b4a4-855ba186c97d/deploy-status)](https://app.netlify.com/sites/kubernetes-io-main-staging/deploys) [![GitHub release](https://img.shields.io/github/release/kubernetes/website.svg)](https://github.com/kubernetes/website/releases/latest) Данный репозиторий содержит все необходимые файлы для сборки [сайта Kubernetes и документации](https://kubernetes.io/). Мы благодарим вас за желание внести свой вклад! From 1134821af6e5451076dc901452c5784fb99c312a Mon Sep 17 00:00:00 2001 From: Sascha Grunert Date: Thu, 8 Jul 2021 09:06:35 +0200 Subject: [PATCH 016/279] Add seccomp tutorial to index This adds the seccomp tutorial page to the index side by side to AppArmor. Signed-off-by: Sascha Grunert --- content/en/docs/tutorials/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/en/docs/tutorials/_index.md b/content/en/docs/tutorials/_index.md index 3fc5a222c3..fdc62e11fb 100644 --- a/content/en/docs/tutorials/_index.md +++ b/content/en/docs/tutorials/_index.md @@ -51,6 +51,8 @@ Before walking through each tutorial, you may want to bookmark the * [AppArmor](/docs/tutorials/clusters/apparmor/) +* [seccomp](/docs/tutorials/clusters/seccomp/) + ## Services * [Using Source IP](/docs/tutorials/services/source-ip/) From a3b120928db25528c97172d41b511c2c86d12faf Mon Sep 17 00:00:00 2001 From: Shubham Kuchhal Date: Fri, 9 Jul 2021 17:02:58 +0530 Subject: [PATCH 017/279] Correct FQDN for DockerHub. --- .../configure-pod-container/pull-image-private-registry.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/configure-pod-container/pull-image-private-registry.md b/content/en/docs/tasks/configure-pod-container/pull-image-private-registry.md index 57c5329b7a..0886871f9c 100644 --- a/content/en/docs/tasks/configure-pod-container/pull-image-private-registry.md +++ b/content/en/docs/tasks/configure-pod-container/pull-image-private-registry.md @@ -102,7 +102,7 @@ kubectl create secret docker-registry regcred --docker-server=` is your Private Docker Registry FQDN. - Use `https://index.docker.io/v2/` for DockerHub. + Use `https://index.docker.io/v1/` for DockerHub. * `` is your Docker username. * `` is your Docker password. * `` is your Docker email. From 9822c9a4dab53e147cf4e17969d0340e455ca85a Mon Sep 17 00:00:00 2001 From: edsoncelio Date: Fri, 9 Jul 2021 15:12:29 -0300 Subject: [PATCH 018/279] feat: add configmap-secret translation --- .../managing-secret-using-config-file.md | 107 +++++++++--------- .../managing-secret-using-kubectl.md | 88 +++++++------- .../managing-secret-using-kustomize.md | 63 +++++------ 3 files changed, 123 insertions(+), 135 deletions(-) diff --git a/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-config-file.md b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-config-file.md index b405d57baf..ffbeedee9e 100644 --- a/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-config-file.md +++ b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-config-file.md @@ -1,8 +1,8 @@ --- -title: Managing Secret using Configuration File +title: Gerenciando Secret usando Arquivo de Configuração content_type: task weight: 20 -description: Creating Secret objects using resource configuration file. +description: Criando objetos Secret usando arquivos de configuração de recursos. --- @@ -13,26 +13,24 @@ description: Creating Secret objects using resource configuration file. -## Create the Config file +## Crie o arquivo de configuração -You can create a Secret in a file first, in JSON or YAML format, and then -create that object. The -[Secret](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#secret-v1-core) -resource contains two maps: `data` and `stringData`. -The `data` field is used to store arbitrary data, encoded using base64. The -`stringData` field is provided for convenience, and it allows you to provide -Secret data as unencoded strings. -The keys of `data` and `stringData` must consist of alphanumeric characters, -`-`, `_` or `.`. +Você pode criar um Secret primeiramente em um arquivo, no formato JSON ou YAML, e depois +criar o objeto. O recurso [Secret](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#secret-v1-core) +contém dois *maps*: `data` e `stringData`. +O campo `data` é usado para armazenar dados arbitrários, codificados usando base64. O +campo `stringData` é usado por conveniência, e permite que você use dados para um Secret +como *strings* não codificadas. +As chaves para `data` e `stringData` precisam ser compostas por caracteres alfanuméricos, +`_`, `-` ou `.`. -For example, to store two strings in a Secret using the `data` field, convert -the strings to base64 as follows: +Por exemplo, para armazenar duas strings em um Secret usando o campo `data`, converta +as strings para base64 da seguinte forma: ```shell echo -n 'admin' | base64 ``` - -The output is similar to: +A saída deve ser similar a: ``` YWRtaW4= @@ -42,14 +40,13 @@ YWRtaW4= echo -n '1f2d1e2e67df' | base64 ``` -The output is similar to: +A saída deve ser similar a: ``` MWYyZDFlMmU2N2Rm ``` -Write a Secret config file that looks like this: - +Escreva o arquivo de configuração do Secret, que ser parecido com: ```yaml apiVersion: v1 kind: Secret @@ -61,27 +58,26 @@ data: password: MWYyZDFlMmU2N2Rm ``` -Note that the name of a Secret object must be a valid -[DNS subdomain name](/docs/concepts/overview/working-with-objects/names#dns-subdomain-names). +Perceba que o nome do objeto Secret precisa ser um +[nome de subdomínio DNS](/docs/concepts/overview/working-with-objects/names#dns-subdomain-name) válido. {{< note >}} -The serialized JSON and YAML values of Secret data are encoded as base64 -strings. Newlines are not valid within these strings and must be omitted. When -using the `base64` utility on Darwin/macOS, users should avoid using the `-b` -option to split long lines. Conversely, Linux users *should* add the option -`-w 0` to `base64` commands or the pipeline `base64 | tr -d '\n'` if the `-w` -option is not available. +Os valores serializados dos dados JSON e YAML de um Secret são codificados em strings +base64. Novas linhas não são válidas com essas strings e devem ser omitidas. Quando +usar o utilitário `base64` em Darwin/MacOS, os usuários devem evitar usar a opção `-b` +para separar linhas grandes. Por outro lado, usuários de Linux *devem* adicionar a opção +`-w 0` ao comando `base64` ou o *pipe* `base64 | tr -d '\n'` se a opção `w` não for disponível {{< /note >}} -For certain scenarios, you may wish to use the `stringData` field instead. This -field allows you to put a non-base64 encoded string directly into the Secret, -and the string will be encoded for you when the Secret is created or updated. +Para cenários específicos, você pode querer usar o campo `stringData` ao invés de `data`. +Esse campo permite que você use strings não-base64 diretamente dentro do Secret, +e a string vai ser codificada para você quando o Secret for criado ou atualizado. -A practical example of this might be where you are deploying an application -that uses a Secret to store a configuration file, and you want to populate -parts of that configuration file during your deployment process. +Um exemplo prático para isso pode ser quando você esteja fazendo *deploy* de uma aplicação +que usa um Secret para armazenar um arquivo de configuração, e você quer popular partes desse +arquivo de configuração durante o processo de *deployment*. -For example, if your application uses the following configuration file: +Por exemplo, se sua aplicação usa o seguinte arquivo de configuração: ```yaml apiUrl: "https://my.api.com/api/v1" @@ -89,7 +85,7 @@ username: "" password: "" ``` -You could store this in a Secret using the following definition: +Você pode armazenar isso em um Secret usando a seguinte definição: ```yaml apiVersion: v1 @@ -104,30 +100,30 @@ stringData: password: ``` -## Create the Secret object +## Crie o objeto Secret -Now create the Secret using [`kubectl apply`](/docs/reference/generated/kubectl/kubectl-commands#apply): +Agora, crie o Secret usando [`kubectl apply`](/docs/reference/generated/kubectl/kubectl-commands#apply): ```shell kubectl apply -f ./secret.yaml ``` -The output is similar to: +A saída deve ser similar a: ``` secret/mysecret created ``` -## Check the Secret +## Verifique o Secret -The `stringData` field is a write-only convenience field. It is never output when -retrieving Secrets. For example, if you run the following command: +O campo `stringData` é um campo de conveniência apenas de leitura. Ele nunca vai ser exibido +ao buscar um Secret. Por exemplo, se você executar o seguinte comando: ```shell kubectl get secret mysecret -o yaml ``` -The output is similar to: +A saída deve ser similar a: ```yaml apiVersion: v1 @@ -143,14 +139,13 @@ data: config.yaml: YXBpVXJsOiAiaHR0cHM6Ly9teS5hcGkuY29tL2FwaS92MSIKdXNlcm5hbWU6IHt7dXNlcm5hbWV9fQpwYXNzd29yZDoge3twYXNzd29yZH19 ``` -The commands `kubectl get` and `kubectl describe` avoid showing the contents of a `Secret` by -default. This is to protect the `Secret` from being exposed accidentally to an onlooker, -or from being stored in a terminal log. -To check the actual content of the encoded data, please refer to -[decoding secret](/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret). +Os comandos `kubectl get` e `kubectl describe` omitem o conteúdo de um `Secret` por padrão. +Isso para proteger o `Secret` de ser exposto acidentalmente para uma pessoa não autorizada, +ou ser armazenado em um log de terminal. +Para verificar o conteúdo atual de um dado codificado, veja [decodificando secret](/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret). -If a field, such as `username`, is specified in both `data` and `stringData`, -the value from `stringData` is used. For example, the following Secret definition: +Se um campo, como `username`, é especificado em `data` e `stringData`, +o valor de `stringData` é o usado. Por exemplo, dado a seguinte definição do Secret: ```yaml apiVersion: v1 @@ -164,7 +159,7 @@ stringData: username: administrator ``` -Results in the following Secret: +Resulta no seguinte Secret: ```yaml apiVersion: v1 @@ -180,11 +175,11 @@ data: username: YWRtaW5pc3RyYXRvcg== ``` -Where `YWRtaW5pc3RyYXRvcg==` decodes to `administrator`. +Onde `YWRtaW5pc3RyYXRvcg==` é decodificado em `administrator`. -## Clean Up +## Limpeza -To delete the Secret you have created: +Para apagar o Secret que você criou: ```shell kubectl delete secret mysecret @@ -192,7 +187,7 @@ kubectl delete secret mysecret ## {{% heading "whatsnext" %}} -- Read more about the [Secret concept](/docs/concepts/configuration/secret/) -- Learn how to [manage Secret with the `kubectl` command](/docs/tasks/configmap-secret/managing-secret-using-kubectl/) -- Learn how to [manage Secret using kustomize](/docs/tasks/configmap-secret/managing-secret-using-kustomize/) +- Leia mais sobre o [conceito do Secret](/docs/concepts/configuration/secret/) +- Leia sobre como [gerenciar Secret com o comando `kubectl`](/docs/tasks/configmap-secret/managing-secret-using-kubectl/) +- Leia sobre como [gerenciar Secret usando kustomize](/docs/tasks/configmap-secret/managing-secret-using-kustomize/) diff --git a/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kubectl.md b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kubectl.md index 293915736e..d8d98e007f 100644 --- a/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kubectl.md +++ b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kubectl.md @@ -1,8 +1,8 @@ --- -title: Managing Secret using kubectl +title: kubectl Gerenciando Secret usando kubectl content_type: task weight: 10 -description: Creating Secret objects using kubectl command line. +description: Criando objetos Secret usando a linha de comando kubectl. --- @@ -13,25 +13,26 @@ description: Creating Secret objects using kubectl command line. -## Create a Secret +## Criando um Secret -A `Secret` can contain user credentials required by Pods to access a database. -For example, a database connection string consists of a username and password. -You can store the username in a file `./username.txt` and the password in a -file `./password.txt` on your local machine. +Um `Secret` pode conter credenciais de usuário requeridas por Pods para acesso a um banco de dados. +Por exemplo, uma string de conexão de banco de dados é composta por um usuário e senha. +Você pode armazenar o usuário em um arquivo `./username.txt` e a senha em um +arquivo `./password.txt` na sua máquina local. ```shell echo -n 'admin' > ./username.txt echo -n '1f2d1e2e67df' > ./password.txt ``` -The `-n` flag in the above two commands ensures that the generated files will -not contain an extra newline character at the end of the text. This is -important because when `kubectl` reads a file and encode the content into -base64 string, the extra newline character gets encoded too. +A opção `-n` nos comandos acima garante que os arquivos criados não vão conter +uma nova linha extra no final do arquivo de texto. Isso é importante porque +quando o `kubectl` lê um arquivo e codifica o conteúdo em uma string base64, +o caractere da nova linha extra também é codificado. + +O comando `kubectl create secret` empacota os arquivos em um Secret e cria um +objeto no API server. -The `kubectl create secret` command packages these files into a Secret and creates -the object on the API server. ```shell kubectl create secret generic db-user-pass \ @@ -39,32 +40,28 @@ kubectl create secret generic db-user-pass \ --from-file=./password.txt ``` -The output is similar to: +A saída deve ser similar a: ``` secret/db-user-pass created ``` -Default key name is the filename. You may optionally set the key name using -`--from-file=[key=]source`. For example: +O nome da chave padrão é o nome do arquivo. Opcionalmente, você pode definir +o nome da chave usando `--from-file=[key=]source`. Por exemplo: ```shell kubectl create secret generic db-user-pass \ --from-file=username=./username.txt \ --from-file=password=./password.txt ``` +Você não precisa escapar o caractere especial em senhas a partir de arquivos (`--from-file`). -You do not need to escape special characters in passwords from files -(`--from-file`). - -You can also provide Secret data using the `--from-literal==` tag. -This tag can be specified more than once to provide multiple key-value pairs. -Note that special characters such as `$`, `\`, `*`, `=`, and `!` will be -interpreted by your [shell](https://en.wikipedia.org/wiki/Shell_(computing)) -and require escaping. -In most shells, the easiest way to escape the password is to surround it with -single quotes (`'`). For example, if your actual password is `S!B\*d$zDsb=`, -you should execute the command this way: +Você também pode prover dados para Secret usando a tag `--from-literal==`. +Essa tag pode ser especificada mais de uma vez para prover múltiplos pares de chave-valor. +Observe que caracteres especiais como `$`, `\`, `*`, `=`, e `!` vão ser interpretados +pelo seu [shell](https://en.wikipedia.org/wiki/Shell_(computing)) e precisam ser escapados. +Na maioria dos shells, a forma mais fácil de escapar as senhas é usar aspas simples (`'`). +Por exemplo, se sua senha atual é `S!B\*d$zDsb=`, você precisa executar o comando dessa forma: ```shell kubectl create secret generic dev-db-secret \ @@ -72,28 +69,27 @@ kubectl create secret generic dev-db-secret \ --from-literal=password='S!B\*d$zDsb=' ``` -## Verify the Secret +## Verificando o Secret -You can check that the secret was created: +Você pode verificar se o secret foi criado: ```shell kubectl get secrets ``` -The output is similar to: +A saída deve ser similar a: ``` NAME TYPE DATA AGE db-user-pass Opaque 2 51s ``` -You can view a description of the `Secret`: +Você pode ver a descrição do `Secret`: ```shell kubectl describe secrets/db-user-pass ``` - -The output is similar to: +A saída deve ser similar a: ``` Name: db-user-pass @@ -109,39 +105,39 @@ password: 12 bytes username: 5 bytes ``` -The commands `kubectl get` and `kubectl describe` avoid showing the contents -of a `Secret` by default. This is to protect the `Secret` from being exposed -accidentally to an onlooker, or from being stored in a terminal log. +Os comandos `kubectl get` e `kubectl describe` omitem o conteúdo de um `Secret` por padrão. +Isso para proteger o `Secret` de ser exposto acidentalmente para uma pessoa não autorizada, +ou ser armazenado em um log de terminal. -## Decoding the Secret {#decoding-secret} +## Decodificando o Secret {#decoding-secret} -To view the contents of the Secret you created, run the following command: +Para ver o conteúdo de um Secret que você criou, execute o seguinte comando: ```shell kubectl get secret db-user-pass -o jsonpath='{.data}' ``` -The output is similar to: +A saída deve ser similar a: ```json {"password":"MWYyZDFlMmU2N2Rm","username":"YWRtaW4="} ``` -Now you can decode the `password` data: +Agora, você pode decodificar os dados de `password`: ```shell echo 'MWYyZDFlMmU2N2Rm' | base64 --decode ``` -The output is similar to: +A saída deve ser similar a: ``` 1f2d1e2e67df ``` -## Clean Up +## Limpeza -To delete the Secret you have created: +Para apagar o Secret que você criou: ```shell kubectl delete secret db-user-pass @@ -151,6 +147,6 @@ kubectl delete secret db-user-pass ## {{% heading "whatsnext" %}} -- Read more about the [Secret concept](/docs/concepts/configuration/secret/) -- Learn how to [manage Secret using config file](/docs/tasks/configmap-secret/managing-secret-using-config-file/) -- Learn how to [manage Secret using kustomize](/docs/tasks/configmap-secret/managing-secret-using-kustomize/) +- Leia mais sobre o [conceito do Secret](/docs/concepts/configuration/secret/) +- Leia sobre como [gerenciar Secret com o comando `kubectl`](/docs/tasks/configmap-secret/managing-secret-using-kubectl/) +- Leia sobre como [gerenciar Secret usando kustomize](/docs/tasks/configmap-secret/managing-secret-using-kustomize/) diff --git a/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kustomize.md b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kustomize.md index f926c95f30..271a535de5 100644 --- a/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kustomize.md +++ b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kustomize.md @@ -17,12 +17,11 @@ de um diretório. Depois de gerar o Secret, você pode criar o Secret na API ser -## Create the Kustomization file - -You can generate a Secret by defining a `secretGenerator` in a -`kustomization.yaml` file that references other existing files. -For example, the following kustomization file references the -`./username.txt` and the `./password.txt` files: +## Criando um arquivo de Kustomization +Você pode criar um Secret definindo um `secretGenerator` em um +arquivo `kustomization.yaml` que referencia outros arquivos existentes. +Por exemplo, o seguinte arquivo kustomization referencia os +arquivos `./username.txt` e `./password.txt`: ```yaml secretGenerator: @@ -32,10 +31,10 @@ secretGenerator: - password.txt ``` -You can also define the `secretGenerator` in the `kustomization.yaml` -file by providing some literals. -For example, the following `kustomization.yaml` file contains two literals -for `username` and `password` respectively: +Você também pode definir o `secretGenerator`no arquivo `kustomization.yaml` +por meio de alguns *literais*. +Por exemplo, o seguinte arquivo `kustomization.yaml` contém dois literais +para `username` e `password` respectivamente: ```yaml secretGenerator: @@ -45,48 +44,47 @@ secretGenerator: - password=1f2d1e2e67df ``` -Note that in both cases, you don't need to base64 encode the values. +Observe que nos dois casos, você não precisa codificar os valores em base64. -## Create the Secret +## Criando o Secret -Apply the directory containing the `kustomization.yaml` to create the Secret. +Aplique o diretório que contém o arquivo `kustomization.yaml` para criar o Secret. ```shell kubectl apply -k . ``` -The output is similar to: +A saída deve ser similar a: ``` secret/db-user-pass-96mffmfh4k created ``` -Note that when a Secret is generated, the Secret name is created by hashing -the Secret data and appending the hash value to the name. This ensures that -a new Secret is generated each time the data is modified. +Observe que quando um Secret é gerado, o nome do segredo é criado usando o hash +dos dados do Secret mais o valor do hash. Isso garante que +um novo Secret é gerado cada vez que os dados são modificados. -## Check the Secret created +## Verifique o Secret criado -You can check that the secret was created: +Você pode verificar que o secret foi criado: ```shell kubectl get secrets ``` -The output is similar to: +A saída deve ser similar a: ``` NAME TYPE DATA AGE db-user-pass-96mffmfh4k Opaque 2 51s ``` -You can view a description of the secret: +Você pode ver a descrição de um secret: ```shell kubectl describe secrets/db-user-pass-96mffmfh4k ``` - -The output is similar to: +A saída deve ser similar a: ``` Name: db-user-pass-96mffmfh4k @@ -102,15 +100,14 @@ password.txt: 12 bytes username.txt: 5 bytes ``` -The commands `kubectl get` and `kubectl describe` avoid showing the contents of a `Secret` by -default. This is to protect the `Secret` from being exposed accidentally to an onlooker, -or from being stored in a terminal log. -To check the actual content of the encoded data, please refer to -[decoding secret](/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret). +Os comandos `kubectl get` e `kubectl describe` omitem o conteúdo de um `Secret` por padrão. +Isso para proteger o `Secret` de ser exposto acidentalmente para uma pessoa não autorizada, +ou ser armazenado em um log de terminal. +Para verificar o conteúdo atual de um dado codificado, veja [decodificando secret](/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret). -## Clean Up +## Limpeza -To delete the Secret you have created: +Para apagar o Secret que você criou: ```shell kubectl delete secret db-user-pass-96mffmfh4k @@ -119,7 +116,7 @@ kubectl delete secret db-user-pass-96mffmfh4k ## {{% heading "whatsnext" %}} -- Read more about the [Secret concept](/docs/concepts/configuration/secret/) -- Learn how to [manage Secret with the `kubectl` command](/docs/tasks/configmap-secret/managing-secret-using-kubectl/) -- Learn how to [manage Secret using config file](/docs/tasks/configmap-secret/managing-secret-using-config-file/) +- Leia mais sobre o [conceito do Secret](/docs/concepts/configuration/secret/) +- Leia sobre como [gerenciar Secret com o comando `kubectl`](/docs/tasks/configmap-secret/managing-secret-using-kubectl/) +- Leia sobre como [gerenciar Secret usando kustomize](/docs/tasks/configmap-secret/managing-secret-using-kustomize/) From 7a0c7cae4693e20298150a90fefec95f4c8c195d Mon Sep 17 00:00:00 2001 From: edsoncelio Date: Fri, 9 Jul 2021 22:52:21 -0300 Subject: [PATCH 019/279] fix: fix typo in doc title --- .../tasks/configmap-secret/managing-secret-using-kubectl.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kubectl.md b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kubectl.md index d8d98e007f..7e6ca6dc7c 100644 --- a/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kubectl.md +++ b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kubectl.md @@ -1,5 +1,5 @@ --- -title: kubectl Gerenciando Secret usando kubectl +title: Gerenciando Secret usando kubectl content_type: task weight: 10 description: Criando objetos Secret usando a linha de comando kubectl. From 2c360ea3c6b386e77e25c675803d30d9c4809a30 Mon Sep 17 00:00:00 2001 From: Nitesh Seram Date: Tue, 13 Jul 2021 15:40:18 +0530 Subject: [PATCH 020/279] fixing redirect and chnaging some links in blog fixing redirects Fixing few redirects changing few redirects and links fixing redirect Update content/en/blog/_posts/2016-08-00-Kubernetes-Namespaces-Use-Cases-Insights.md Co-authored-by: Jihoon Seo <46767780+jihoon-seo@users.noreply.github.com> Update content/en/blog/_posts/2016-12-00-Statefulset-Run-Scale-Stateful-Applications-In-Kubernetes.md Co-authored-by: Jihoon Seo <46767780+jihoon-seo@users.noreply.github.com> Update content/en/blog/_posts/2016-12-00-Statefulset-Run-Scale-Stateful-Applications-In-Kubernetes.md Co-authored-by: Jihoon Seo <46767780+jihoon-seo@users.noreply.github.com> --- .../2016-08-00-Kubernetes-Namespaces-Use-Cases-Insights.md | 2 +- ...efulset-Run-Scale-Stateful-Applications-In-Kubernetes.md | 4 ++-- static/_redirects | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/content/en/blog/_posts/2016-08-00-Kubernetes-Namespaces-Use-Cases-Insights.md b/content/en/blog/_posts/2016-08-00-Kubernetes-Namespaces-Use-Cases-Insights.md index 7b05c1f74c..896f2c5f84 100644 --- a/content/en/blog/_posts/2016-08-00-Kubernetes-Namespaces-Use-Cases-Insights.md +++ b/content/en/blog/_posts/2016-08-00-Kubernetes-Namespaces-Use-Cases-Insights.md @@ -125,7 +125,7 @@ You may wish to, but you cannot create a hierarchy of namespaces. Namespaces can -Namespaces are easy to create and use but it’s also easy to deploy code inadvertently into the wrong namespace. Good DevOps hygiene suggests documenting and automating processes where possible and this will help. The other way to avoid using the wrong namespace is to set a [kubectl context](/docs/user-guide/kubectl/kubectl_config_set-context/).  +Namespaces are easy to create and use but it’s also easy to deploy code inadvertently into the wrong namespace. Good DevOps hygiene suggests documenting and automating processes where possible and this will help. The other way to avoid using the wrong namespace is to set a [kubectl context](/docs/reference/generated/kubectl/kubectl-commands#-em-set-context-em-).  diff --git a/content/en/blog/_posts/2016-12-00-Statefulset-Run-Scale-Stateful-Applications-In-Kubernetes.md b/content/en/blog/_posts/2016-12-00-Statefulset-Run-Scale-Stateful-Applications-In-Kubernetes.md index 515a3aa195..6ce3bf0044 100644 --- a/content/en/blog/_posts/2016-12-00-Statefulset-Run-Scale-Stateful-Applications-In-Kubernetes.md +++ b/content/en/blog/_posts/2016-12-00-Statefulset-Run-Scale-Stateful-Applications-In-Kubernetes.md @@ -37,7 +37,7 @@ If you run your storage application on high-end hardware or extra-large instance [ZooKeeper](https://zookeeper.apache.org/doc/current/) is an interesting use case for StatefulSet for two reasons. First, it demonstrates that StatefulSet can be used to run a distributed, strongly consistent storage application on Kubernetes. Second, it's a prerequisite for running workloads like [Apache Hadoop](http://hadoop.apache.org/) and [Apache Kakfa](https://kafka.apache.org/) on Kubernetes. An [in-depth tutorial](/docs/tutorials/stateful-application/zookeeper/) on deploying a ZooKeeper ensemble on Kubernetes is available in the Kubernetes documentation, and we’ll outline a few of the key features below. **Creating a ZooKeeper Ensemble** -Creating an ensemble is as simple as using [kubectl create](/docs/user-guide/kubectl/kubectl_create/) to generate the objects stored in the manifest. +Creating an ensemble is as simple as using [kubectl create](/docs/reference/generated/kubectl/kubectl-commands#create) to generate the objects stored in the manifest. ``` @@ -297,7 +297,7 @@ zk-0 0/1 Terminating 0 15m -You can use [kubectl apply](/docs/user-guide/kubectl/kubectl_apply/) to recreate the zk StatefulSet and redeploy the ensemble. +You can use [kubectl apply](/docs/reference/generated/kubectl/kubectl-commands#apply) to recreate the zk StatefulSet and redeploy the ensemble. diff --git a/static/_redirects b/static/_redirects index daaa22d497..ccdab4e44f 100644 --- a/static/_redirects +++ b/static/_redirects @@ -204,12 +204,12 @@ /docs/reference/generated/kube-scheduler/ /docs/reference/command-line-tools-reference/kube-scheduler/ 301 /docs/reference/generated/kubectl/kubectl-options/ /docs/reference/kubectl/kubectl/ 301 /docs/reference/generated/kubectl/kubectl/ /docs/reference/generated/kubectl/kubectl-commands/ 301 -/docs/reference/generated/kubectl/kubectl/kubectl_*.md /docs/reference/generated/kubectl/kubectl-commands#:splat 301 +/docs/reference/generated/kubectl/kubectl/kubectl_* /docs/reference/generated/kubectl/kubectl-commands#:splat 301 /docs/reference/glossary/maintainer/ /docs/reference/glossary/approver/ 301 /docs/reference/kubectl/kubectl-cmds/ /docs/reference/generated/kubectl/kubectl-commands/ 301! -/docs/reference/kubectl/kubectl/kubectl_*.md /docs/reference/generated/kubectl/kubectl-commands#:splat 301 +/docs/reference/kubectl/kubectl/kubectl_* /docs/reference/generated/kubectl/kubectl-commands#:splat 301 /docs/reference/scheduling/profiles/ /docs/reference/scheduling/config/#profiles 301 /docs/reference/generated/kubernetes-api/v1.15/ https://v1-15.docs.kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/ 301 @@ -393,7 +393,7 @@ /docs/user-guide/kubectl-conventions/ /docs/reference/kubectl/conventions/ /docs/user-guide/kubectl-cheatsheet/ /docs/reference/kubectl/cheatsheet/ /cheatsheet /docs/reference/kubectl/cheatsheet/ 302 -/docs/user-guide/kubectl/kubectl_*/ /docs/reference/generated/kubectl/kubectl-commands#:splat 301 +/docs/user-guide/kubectl/kubectl_* /docs/reference/generated/kubectl/kubectl-commands#:splat 301 /docs/user-guide/labels/ /docs/concepts/overview/working-with-objects/labels/ 301 /docs/user-guide/liveness/ /docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ 301 /docs/user-guide/load-balancer/ /docs/tasks/access-application-cluster/create-external-load-balancer/ 301 From 723b94de5048dae19dde84d63cd0253c55308a8d Mon Sep 17 00:00:00 2001 From: Wesley Williams Date: Fri, 16 Jul 2021 18:10:38 +0100 Subject: [PATCH 021/279] Clarify that burstable pods also have their limit enforced by CFS quota --- .../docs/tasks/administer-cluster/cpu-management-policies.md | 3 ++- .../docs/tasks/administer-cluster/cpu-management-policies.md | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/content/en/docs/tasks/administer-cluster/cpu-management-policies.md b/content/en/docs/tasks/administer-cluster/cpu-management-policies.md index 5ffc40781a..a330668bb2 100644 --- a/content/en/docs/tasks/administer-cluster/cpu-management-policies.md +++ b/content/en/docs/tasks/administer-cluster/cpu-management-policies.md @@ -63,7 +63,8 @@ duration as `--node-status-update-frequency`. The `none` policy explicitly enables the existing default CPU affinity scheme, providing no affinity beyond what the OS scheduler does automatically.  Limits on CPU usage for -[Guaranteed pods](/docs/tasks/configure-pod-container/quality-service-pod/) +[Guaranteed pods](/docs/tasks/configure-pod-container/quality-service-pod/) and +[Burstable pods](/docs/tasks/configure-pod-container/quality-service-pod/) are enforced using CFS quota. ### Static policy diff --git a/content/zh/docs/tasks/administer-cluster/cpu-management-policies.md b/content/zh/docs/tasks/administer-cluster/cpu-management-policies.md index a264ee538a..67c8298222 100644 --- a/content/zh/docs/tasks/administer-cluster/cpu-management-policies.md +++ b/content/zh/docs/tasks/administer-cluster/cpu-management-policies.md @@ -94,7 +94,8 @@ CPU 管理器定期通过 CRI 写入资源更新，以保证内存中 CPU 分配 The `none` policy explicitly enables the existing default CPU affinity scheme, providing no affinity beyond what the OS scheduler does automatically.  Limits on CPU usage for -[Guaranteed pods](/docs/tasks/configure-pod-container/quality-service-pod/) +[Guaranteed pods](/docs/tasks/configure-pod-container/quality-service-pod/) and +[Burstable pods](/docs/tasks/configure-pod-container/quality-service-pod/) are enforced using CFS quota. --> ### none 策略 From b1fa203e3a91398f9dbc3010fefe8777a777d440 Mon Sep 17 00:00:00 2001 From: S Nitesh Singh Date: Mon, 19 Jul 2021 11:13:18 +0530 Subject: [PATCH 022/279] fixing the huge white space in sidebar --- layouts/partials/sidebar-tree.html | 108 ++++++++++++++--------------- 1 file changed, 54 insertions(+), 54 deletions(-) diff --git a/layouts/partials/sidebar-tree.html b/layouts/partials/sidebar-tree.html index 5e909e778f..f1a3c9926a 100644 --- a/layouts/partials/sidebar-tree.html +++ b/layouts/partials/sidebar-tree.html @@ -1,14 +1,14 @@ {{/* We cache this partial for bigger sites and set the active class client side. */}} -{{ $sidebarCacheLimit := cond (isset .Site.Params.ui "sidebar_cache_limit") .Site.Params.ui.sidebar_cache_limit 2000 }} -{{ $shouldDelayActive := ge (len .Site.Pages) $sidebarCacheLimit }} +{{ $sidebarCacheLimit := cond (isset .Site.Params.ui "sidebar_cache_limit") .Site.Params.ui.sidebar_cache_limit 2000 -}} +{{ $shouldDelayActive := ge (len .Site.Pages) $sidebarCacheLimit -}}
- {{ if not .Site.Params.ui.sidebar_search_disable }} + {{ if not .Site.Params.ui.sidebar_search_disable -}}
{{ partial "search-input.html" . }}
- {{ else }} + {{ else -}}
{{ partial "search-input.html" . }} @@ -17,7 +17,7 @@
- {{ end }} + {{ end -}}
-{{ define "section-tree-nav-section" }} - {{ $s := .section }} - {{ $p := .page }} - {{ $shouldDelayActive := .shouldDelayActive }} - {{ $sidebarMenuTruncate := .sidebarMenuTruncate }} - {{ $treeRoot := cond (eq .ulNr 0) true false }} - {{ $ulNr := .ulNr }} - {{ $ulShow := .ulShow }} - {{ $active := and (not $shouldDelayActive) (eq $s $p) }} - {{ $activePath := and (not $shouldDelayActive) ($p.IsDescendant $s) }} - {{ $show := cond (or (lt $ulNr $ulShow) $activePath (and (not $shouldDelayActive) (eq $s.Parent $p.Parent)) (and (not $shouldDelayActive) (eq $s.Parent $p)) (and (not $shouldDelayActive) ($p.IsDescendant $s.Parent))) true false }} - {{ $mid := printf "m-%s" ($s.RelPermalink | anchorize) }} - {{ $pages_tmp := where (union $s.Pages $s.Sections).ByWeight ".Params.toc_hide" "!=" true }} - {{ $pages := $pages_tmp | first $sidebarMenuTruncate }} - {{ $withChild := gt (len $pages) 0 }} - {{ $manualLink := cond (isset $s.Params "manuallink") $s.Params.manualLink ( cond (isset $s.Params "manuallinkrelref") (relref $s $s.Params.manualLinkRelref) $s.RelPermalink) }} - {{ $manualLinkTitle := cond (isset $s.Params "manuallinktitle") $s.Params.manualLinkTitle $s.Title }} +{{ define "section-tree-nav-section" -}} + {{ $s := .section -}} + {{ $p := .page -}} + {{ $shouldDelayActive := .shouldDelayActive -}} + {{ $sidebarMenuTruncate := .sidebarMenuTruncate -}} + {{ $treeRoot := cond (eq .ulNr 0) true false -}} + {{ $ulNr := .ulNr -}} + {{ $ulShow := .ulShow -}} + {{ $active := and (not $shouldDelayActive) (eq $s $p) -}} + {{ $activePath := and (not $shouldDelayActive) ($p.IsDescendant $s) -}} + {{ $show := cond (or (lt $ulNr $ulShow) $activePath (and (not $shouldDelayActive) (eq $s.Parent $p.Parent)) (and (not $shouldDelayActive) (eq $s.Parent $p)) (and (not $shouldDelayActive) ($p.IsDescendant $s.Parent))) true false -}} + {{ $mid := printf "m-%s" ($s.RelPermalink | anchorize) -}} + {{ $pages_tmp := where (union $s.Pages $s.Sections).ByWeight ".Params.toc_hide" "!=" true -}} + {{ $pages := $pages_tmp | first $sidebarMenuTruncate -}} + {{ $withChild := gt (len $pages) 0 -}} + {{ $manualLink := cond (isset $s.Params "manuallink") $s.Params.manualLink ( cond (isset $s.Params "manuallinkrelref") (relref $s $s.Params.manualLinkRelref) $s.RelPermalink) -}} + {{ $manualLinkTitle := cond (isset $s.Params "manuallinktitle") $s.Params.manualLinkTitle $s.Title -}}
  • - {{ if (and $p.Site.Params.ui.sidebar_menu_foldable (ge $ulNr 1)) }} + {{ if (and $p.Site.Params.ui.sidebar_menu_foldable (ge $ulNr 1)) -}} - {{ else }} + {{ else -}} {{ if not $treeRoot }} {{ with $s.Params.Icon}}{{ end }}{{ $s.LinkTitle }} - {{ end }} - {{ end }} - {{if $withChild }} - {{ $ulNr := add $ulNr 1 }} + {{ end -}} + {{ end -}} + {{ if $withChild -}} + {{ $ulNr := add $ulNr 1 -}}
      - {{ $pages := where (union $s.Pages $s.Sections).ByWeight ".Params.toc_hide" "!=" true }} - {{ with site.Params.language_alternatives }} + {{ $pages := where (union $s.Pages $s.Sections).ByWeight ".Params.toc_hide" "!=" true -}} + {{ with site.Params.language_alternatives -}} {{ range . }} - {{ with (where $.section.Translations ".Lang" . ) }} - {{ $p := index . 0 }} - {{ $pages = $pages | lang.Merge (union $p.Pages $p.Sections) }} - {{ end }} - {{ end }} - {{ end }} - {{ $pages := $pages | first 50 }} - {{ range $pages }} - {{ if (not (and (eq $s $p.Site.Home) (eq .Params.toc_root true)) ) }} - {{ $mid := printf "m-%s" (.RelPermalink | anchorize) }} - {{ $active := eq . $p }} - {{ $isForeignLanguage := (ne (string .Lang) (string $.currentLang)) }} - {{ if (and $isForeignLanguage ($p.IsDescendant $s)) }} + {{ with (where $.section.Translations ".Lang" . ) -}} + {{ $p := index . 0 -}} + {{ $pages = $pages | lang.Merge (union $p.Pages $p.Sections) -}} + {{ end -}} + {{ end -}} + {{ end -}} + {{ $pages := $pages | first 50 -}} + {{ range $pages -}} + {{ if (not (and (eq $s $p.Site.Home) (eq .Params.toc_root true)) ) -}} + {{ $mid := printf "m-%s" (.RelPermalink | anchorize) -}} + {{ $active := eq . $p -}} + {{ $isForeignLanguage := (ne (string .Lang) (string $.currentLang)) -}} + {{ if (and $isForeignLanguage ($p.IsDescendant $s)) -}} - {{ .LinkTitle }}{{ if $isForeignLanguage }} ({{ .Lang | upper }}){{ end }} + {{ .LinkTitle }}{{ if $isForeignLanguage }} ({{ .Lang | upper }}){{ end -}} - {{ else }} + {{ else -}} {{ template "section-tree-nav-section" (dict "page" $p "section" . "currentLang" $.currentLang "shouldDelayActive" $shouldDelayActive "sidebarMenuTruncate" $sidebarMenuTruncate "ulNr" $ulNr "ulShow" $ulShow) }} - {{ end }} - {{ end }} - {{ end }} + {{- end }} + {{- end }} + {{- end }}
    - {{ end }} + {{- end }}
    • -{{ end }} +{{- end }} From 4270ece858f2ec42dd437b9f961ee09f21496e38 Mon Sep 17 00:00:00 2001 From: kartik494 Date: Mon, 19 Jul 2021 15:56:27 +0530 Subject: [PATCH 023/279] Modify documentation for stable storage --- content/en/docs/concepts/workloads/controllers/statefulset.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/en/docs/concepts/workloads/controllers/statefulset.md b/content/en/docs/concepts/workloads/controllers/statefulset.md index acdb681652..55a5cea332 100644 --- a/content/en/docs/concepts/workloads/controllers/statefulset.md +++ b/content/en/docs/concepts/workloads/controllers/statefulset.md @@ -173,8 +173,7 @@ Cluster Domain will be set to `cluster.local` unless ### Stable Storage -Kubernetes creates one [PersistentVolume](/docs/concepts/storage/persistent-volumes/) for each -VolumeClaimTemplate. In the nginx example above, each Pod will receive a single PersistentVolume +Per each StatefulSet triggered pod Kubernetes creates a PersistentVolumeClaim object for each VolumeClaimTemplates entry defined in the StatefulSet object.In the nginx example above, each Pod will receive a single PersistentVolume with a StorageClass of `my-storage-class` and 1 Gib of provisioned storage. If no StorageClass is specified, then the default StorageClass will be used. When a Pod is (re)scheduled onto a node, its `volumeMounts` mount the PersistentVolumes associated with its From 5b988bd6618f58ecdca817e650a131024f0aca4e Mon Sep 17 00:00:00 2001 From: "Claudia J. Kang" Date: Mon, 19 Jul 2021 07:55:29 +0900 Subject: [PATCH 024/279] [ko] Translate docs/tasks/administer-cluster/enable-disable-api.md --- .../administer-cluster/enable-disable-api.md | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 content/ko/docs/tasks/administer-cluster/enable-disable-api.md diff --git a/content/ko/docs/tasks/administer-cluster/enable-disable-api.md b/content/ko/docs/tasks/administer-cluster/enable-disable-api.md new file mode 100644 index 0000000000..202035c291 --- /dev/null +++ b/content/ko/docs/tasks/administer-cluster/enable-disable-api.md @@ -0,0 +1,29 @@ +--- +title: 쿠버네티스 API 활성화 혹은 비활성화하기 +content_type: task +--- + + +이 페이지는 클러스터 {{< glossary_tooltip text="컨트롤 플레인" term_id="control-plane" >}}의 +특정한 API 버전을 활성화하거나 비활성화하는 방법에 대해 설명한다. + + + + +API 서버에 `--runtime-config=api/` 커맨드 라인 인자를 사용함으로서 특정한 API 버전을 +활성화하거나 비활성화할 수 있다. 이 인자에 대한 값으로는 콤마로 구분된 API 버전의 목록을 사용한다. +뒤쪽에 위치한 값은 앞쪽의 값보다 우선적으로 사용된다. + +이 `runtime-config` 커맨드 라인 인자에는 다음의 두 개의 특수 키를 사용할 수도 있다. + +- `api/all`: 사용할 수 있는 모든 API를 선택한다. +- `api/legacy`: 레거시 API만을 선택한다. 여기서 레거시 API란 명시적으로 + [사용이 중단된](/docs/reference/using-api/deprecation-policy/) 모든 API를 가리킨다. + +예를 들어서, v1을 제외한 모든 API 버전을 비활성화하기 위해서는 `kube-apiserver`에 +`--runtime-config=api/all=false,api/v1=true` 인자를 사용한다. + +## {{% heading "whatsnext" %}} + +`kube-apiserver` 컴포넌트에 대한 더 자세한 내용은 다음의 [문서](/docs/reference/command-line-tools-reference/kube-apiserver/) +를 참고한다. From e8340128d96eb628e53e720e14d6ef90e72185a7 Mon Sep 17 00:00:00 2001 From: Arhell Date: Tue, 20 Jul 2021 00:51:54 +0300 Subject: [PATCH 025/279] [ja] Operator: Exists missing --- content/ja/examples/controllers/daemonset.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/content/ja/examples/controllers/daemonset.yaml b/content/ja/examples/controllers/daemonset.yaml index 1bfa082833..375391826d 100644 --- a/content/ja/examples/controllers/daemonset.yaml +++ b/content/ja/examples/controllers/daemonset.yaml @@ -16,6 +16,7 @@ spec: spec: tolerations: - key: node-role.kubernetes.io/master + operator: Exists effect: NoSchedule containers: - name: fluentd-elasticsearch From cbc3d89fefce96fcc2cde2ad2ebfe6cc5092d73e Mon Sep 17 00:00:00 2001 From: Jihoon Seo Date: Tue, 20 Jul 2021 16:46:16 +0900 Subject: [PATCH 026/279] [ko] Translate node-pressure-eviction.md --- .../node-pressure-eviction.md | 411 ++++++++++++++++++ 1 file changed, 411 insertions(+) create mode 100644 content/ko/docs/concepts/scheduling-eviction/node-pressure-eviction.md diff --git a/content/ko/docs/concepts/scheduling-eviction/node-pressure-eviction.md b/content/ko/docs/concepts/scheduling-eviction/node-pressure-eviction.md new file mode 100644 index 0000000000..4a687cff30 --- /dev/null +++ b/content/ko/docs/concepts/scheduling-eviction/node-pressure-eviction.md @@ -0,0 +1,411 @@ +--- +title: 노드-압박 축출 +content_type: concept +weight: 60 +--- + +{{}}
    + +{{}}은 +클러스터 노드의 CPU, 메모리, 디스크 공간, 파일시스템 inode와 같은 자원을 모니터링한다. +이러한 자원 중 하나 이상이 특정 소모 수준에 도달하면, +kubelet은 하나 이상의 파드를 능동적으로 중단시켜 +자원을 회수하고 고갈 상황을 방지할 수 있다. + +노드-압박 축출 과정에서, kubelet은 축출할 파드의 `PodPhase`를 +`Failed`로 설정한다. 이로써 파드가 종료된다. + +노드-압박 축출은 +[API를 이용한 축출](/ko/docs/concepts/scheduling-eviction/api-eviction/)과는 차이가 있다. + +kubelet은 이전에 설정된 `PodDisruptionBudget` 값이나 파드의 `terminationGracePeriodSeconds` 값을 따르지 않는다. +[소프트 축출 임계값](#soft-eviction-thresholds)을 사용하는 경우, +kubelet은 이전에 설정된 `eviction-max-pod-grace-period` 값을 따른다. +[하드 축출 임계값](#hard-eviction-thresholds)을 사용하는 경우, 파드 종료 시 `0s` 만큼 기다린 후 종료한다(즉, 기다리지 않고 바로 종료한다). + +실패한 파드를 새로운 파드로 교체하는 +{{< glossary_tooltip text="워크로드" term_id="workload" >}} 리소스(예: +{{< glossary_tooltip text="스테이트풀셋(StatefulSet)" term_id="statefulset" >}} 또는 +{{< glossary_tooltip text="디플로이먼트(Deployment)" term_id="deployment" >}})가 파드를 관리하는 경우, +컨트롤 플레인이나 `kube-controller-manager`가 축출된 파드를 대신할 새 파드를 생성한다. + +{{}} +kubelet은 최종 사용자 파드를 종료하기 전에 +먼저 [노드 수준 자원을 회수](#reclaim-node-resources)하려고 시도한다. +예를 들어, 디스크 자원이 부족하면 먼저 사용하지 않는 컨테이너 이미지를 제거한다. +{{}} + +kubelet은 축출 결정을 내리기 위해 다음과 같은 다양한 파라미터를 사용한다. + + * 축출 신호 + * 축출 임계값 + * 모니터링 간격 + +### 축출 신호 {#eviction-signals} + +축출 신호는 특정 시점에서 특정 자원의 현재 상태이다. +Kubelet은 노드에서 사용할 수 있는 리소스의 최소량인 +축출 임계값과 축출 신호를 비교하여 +축출 결정을 내린다. + +Kubelet은 다음과 같은 축출 신호를 사용한다. + +| 축출 신호 | 설명 | +|----------------------|---------------------------------------------------------------------------------------| +| `memory.available` | `memory.available` := `node.status.capacity[memory]` - `node.stats.memory.workingSet` | +| `nodefs.available` | `nodefs.available` := `node.stats.fs.available` | +| `nodefs.inodesFree` | `nodefs.inodesFree` := `node.stats.fs.inodesFree` | +| `imagefs.available` | `imagefs.available` := `node.stats.runtime.imagefs.available` | +| `imagefs.inodesFree` | `imagefs.inodesFree` := `node.stats.runtime.imagefs.inodesFree` | +| `pid.available` | `pid.available` := `node.stats.rlimit.maxpid` - `node.stats.rlimit.curproc` | + +이 표에서, `설명` 열은 kubelet이 축출 신호 값을 계산하는 방법을 나타낸다. +각 축출 신호는 백분율 또는 숫자값을 지원한다. +kubelet은 총 용량 대비 축출 신호의 백분율 값을 +계산한다. + +`memory.available` 값은 `free -m`과 같은 도구가 아니라 cgroupfs로부터 도출된다. +이는 `free -m`이 컨테이너 안에서는 동작하지 않고, 또한 사용자가 +[node allocatable](/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable) +기능을 사용하는 경우 자원 부족에 대한 결정은 루트 노드뿐만 아니라 +cgroup 계층구조의 최종 사용자 파드 부분에서도 지역적으로 이루어지기 때문에 중요하다. +[이 스크립트](/examples/admin/resource/memory-available.sh)는 +kubelet이 `memory.available`을 계산하기 위해 수행하는 동일한 단계들을 재현한다. +kubelet은 메모리 압박 상황에서 메모리가 회수 가능하다고 가정하므로, +inactive_file(즉, 비활성 LRU 목록의 파일 기반 메모리 바이트 수)을 +계산에서 제외한다. + +kubelet은 다음과 같은 파일시스템 파티션을 지원한다. + +1. `nodefs`: 노드의 메인 파일시스템이며, 로컬 디스크 볼륨, emptyDir, + 로그 스토리지 등에 사용된다. 예를 들어 `nodefs`는 `/var/lib/kubelet/`을 포함한다. +1. `imagefs`: 컨테이너 런타임이 컨테이너 이미지 및 + 컨테이너 쓰기 가능 레이어를 저장하는 데 사용하는 선택적 파일시스템이다. + +Kubelet은 이러한 파일 시스템을 자동으로 검색하고 다른 파일 시스템은 무시한다. +Kubelet은 다른 구성은 지원하지 않는다. + +{{}} +일부 kubelet 가비지 수집 기능은 더 이상 사용되지 않으며 축출로 대체되었다. +사용 중지된 기능의 목록은 [kubelet 가비지 수집 사용 중단](/ko/docs/concepts/cluster-administration/kubelet-garbage-collection/#사용-중단-deprecation)을 참조한다. +{{}} + +### 축출 임계값 + +kubelet이 축출 결정을 내릴 때 사용하는 축출 임계값을 +사용자가 임의로 설정할 수 있다. + +축출 임계값은 `[eviction-signal][operator][quantity]` 형태를 갖는다. + +* `eviction-signal`에는 사용할 [축출 신호](#eviction-signals)를 적는다. +* `operator`에는 [관계연산자](https://ko.wikipedia.org/wiki/관계연산자#표준_관계연산자)를 + 적는다(예: `<` - 미만) +* `quantity`에는 `1Gi`와 같이 축출 임계값 수치를 적는다. + `quantity`에 들어가는 값은 쿠버네티스가 사용하는 수치 표현 방식과 맞아야 한다. + 숫자값 또는 백분율(`%`)을 사용할 수 있다. + +예를 들어, 노드에 총 `10Gi`의 메모리가 있고 +`1Gi` 아래로 내려갔을 때 축출이 시작되도록 만들고 싶으면, 축출 임계값을 +`memory.available<10%` 또는 `memory.available<1Gi` 형태로 정할 수 있다. 둘을 동시에 사용할 수는 없다. + +소프트 축출 임계값과 하드 축출 임계값을 설정할 수 있다. + +#### 소프트 축출 임계값 {#soft-eviction-thresholds} + +소프트 축출 임계값은 관리자가 설정하는 유예 시간(필수)과 함께 정의된다. +kubelet은 유예 시간이 초과될 때까지 파드를 제거하지 않는다. +유예 시간이 지정되지 않으면 kubelet 시작 시 +오류가 반환된다. + +kubelet이 축출 과정에서 사용할 수 있도록, +'소프트 축출 임계값'과 '최대 허용 파드 종료 유예 시간' 둘 다를 설정할 수 있다. +'최대 허용 파드 종료 유예 시간'이 설정되어 있는 상태에서 '소프트 축출 임계값'에 도달하면, +kubelet은 두 유예 시간 중 작은 쪽을 적용한다. +'최대 허용 파드 종료 유예 시간'을 설정하지 않으면, +kubelet은 축출된 파드를 유예 시간 없이 즉시 종료한다. + +소프트 축출 임계값을 설정할 때 다음과 같은 플래그를 사용할 수 있다. + +* `eviction-soft`: 축출 임계값(예: `memory.available<1.5Gi`)의 집합이며, + 지정된 유예 시간동안 이 축출 임계값 조건이 충족되면 파드 축출이 트리거된다. +* `eviction-soft-grace-period`: 축출 유예 시간의 집합이며, + 소프트 축출 임계값 조건이 이 유예 시간동안 충족되면 파드 축출이 트리거된다. +* `eviction-max-pod-grace-period`: '최대 허용 파드 종료 유예 시간(단위: 초)'이며, + 소프트 축출 임계값 조건이 충족되어 파드를 종료할 때 사용한다. + +#### 하드 축출 임계값 {#hard-eviction-thresholds} + +하드 축출 임계값에는 유예 시간이 없다. 하드 축출 임계값 조건이 충족되면, +kubelet은 고갈된 자원을 회수하기 위해 파드를 유예 시간 없이 +즉시 종료한다. + +`eviction-hard` 플래그를 사용하여 하드 축출 +임계값(예: `memory.available<1Gi`)을 설정할 수 있다. + +kubelet은 다음과 같은 하드 축출 임계값을 기본적으로 설정하고 있다. + +* `memory.available<100Mi` +* `nodefs.available<10%` +* `imagefs.available<15%` +* `nodefs.inodesFree<5%` (리눅스 노드) + +### 축출 모니터링 시간 간격 + +kubelet은 `housekeeping-interval`에 설정된 시간 간격(기본값: `10s`)마다 +축출 임계값을 확인한다. + +### 노드 컨디션 {#node-conditions} + +kubelet은 하드/소프트 축출 임계값 조건이 충족되어 +노드 압박이 발생했다는 것을 알리기 위해, +설정된 유예 시간과는 관계없이 노드 컨디션을 보고한다. + +kubelet은 다음과 같이 노드 컨디션과 축출 신호를 매핑한다. + +| 노드 컨디션 | 축출 신호 | 설명 | +|-------------------|---------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------| +| `MemoryPressure` | `memory.available` | 노드의 가용 메모리 양이 축출 임계값에 도달했다 | +| `DiskPressure` | `nodefs.available`, `nodefs.inodesFree`, `imagefs.available`, or `imagefs.inodesFree` | 노드의 루트 파일시스템 또는 이미지 파일시스템의 가용 디스크 공간 또는 inode의 수가 축출 임계값에 도달했다 | +| `PIDPressure` | `pid.available` | (리눅스) 노드의 가용 프로세스 ID(PID)가 축출 임계값 이하로 내려왔다 | + +kubelet은 `--node-status-update-frequency`에 설정된 +시간 간격(기본값: `10s`)마다 노드 컨디션을 업데이트한다. + +#### 노드 컨디션 진동(oscillation) + +경우에 따라, 노드의 축출 신호값이 사전에 설정된 유예 시간 동안 유지되지 않고 +소프트 축출 임계값을 중심으로 진동할 수 있다. 이로 인해 노드 컨디션이 계속 +`true`와 `false`로 바뀌며, 잘못된 축출 결정을 야기할 수 있다. + +이러한 진동을 방지하기 위해, `eviction-pressure-transition-period` 플래그를 +사용하여 kubelet이 노드 컨디션을 다른 상태로 바꾸기 위해 기다려야 하는 시간을 +설정할 수 있다. 기본값은 `5m`이다. + +### 노드-수준 자원 회수하기 {#reclaim-node-resources} + +kubelet은 최종 사용자 파드를 축출하기 전에 노드-수준 자원 회수를 시도한다. + +`DiskPressure` 노드 컨디션이 보고되면, +kubelet은 노드의 파일시스템을 기반으로 노드-수준 자원을 회수한다. + +#### `imagefs`가 있는 경우 + +컨테이너 런타임이 사용할 전용 `imagefs` 파일시스템이 노드에 있으면, +kubelet은 다음 작업을 수행한다. + + * `nodefs` 파일시스템이 축출 임계값 조건을 충족하면, + kubelet은 종료된 파드와 컨테이너에 대해 가비지 수집을 수행한다. + * `imagefs` 파일시스템이 축출 임계값 조건을 충족하면, + kubelet은 모든 사용중이지 않은 이미지를 삭제한다. + +#### `imagefs`가 없는 경우 + +노드에 `nodefs` 파일시스템만 있고 이것이 축출 임계값 조건을 충족한 경우, +kubelet은 다음 순서로 디스크 공간을 확보한다. + +1. 종료된 파드와 컨테이너에 대해 가비지 수집을 수행한다 +1. 사용중이지 않은 이미지를 삭제한다 + +### kubelet 축출을 위한 파드 선택 + +kubelet이 노드-수준 자원을 회수했음에도 축출 신호가 임계값 아래로 내려가지 않으면, +kubelet은 최종 사용자 파드 축출을 시작한다. + +kubelet은 파드 축출 순서를 결정하기 위해 다음의 파라미터를 활용한다. + +1. 파드의 자원 사용량이 요청량을 초과했는지 여부 +1. [파드 우선순위](/ko/docs/concepts/scheduling-eviction/pod-priority-preemption/) +1. 파드의 자원 요청량 대비 자원 사용량 + +결과적으로, kubelet은 다음과 같은 순서로 파드의 축출 순서를 정하고 축출을 수행한다. + +1. `BestEffort` 또는 `Burstable` 파드 중 자원 사용량이 요청량을 초과한 파드. + 이 파드들은 파드들의 우선순위, 그리고 자원 사용량이 요청량을 + 얼마나 초과했는지에 따라 축출된다. +1. `Guaranteed`, `Burstable` 파드 중 자원 사용량이 요청량보다 낮은 파드는 + 우선순위에 따라 후순위로 축출된다. + +{{}} +kubelet이 파드 축출 순서를 결정할 때 파드의 QoS 클래스는 이용하지 않는다. +메모리 등의 자원을 회수할 때, QoS 클래스를 이용하여 가장 가능성이 높은 파드 축출 순서를 예측할 수는 있다. +QoS는 EphemeralStorage 요청에 적용되지 않으므로, +노드가 예를 들어 'DiskPressure' 아래에 있는 경우 위의 시나리오가 적용되지 않는다. +{{}} + +`Guaranteed` 파드는 모든 컨테이너에 대해 자원 요청량과 제한이 명시되고 +그 둘이 동일할 때에만 보장(guaranteed)된다. 다른 파드의 자원 사용으로 인해 +`Guaranteed` 파드가 축출되는 일은 발생하지 않는다. 만약 시스템 데몬(예: +`kubelet`, `docker`, `journald`)이 `system-reserved` 또는 `kube-reserved` +할당을 통해 예약된 것보다 더 많은 자원을 소비하고, 노드에는 요청량보다 적은 양의 +자원을 사용하고 있는 `Guaranteed` / `Burstable` 파드만 존재한다면, +kubelet은 노드 안정성을 유지하고 자원 고갈이 다른 파드에 미칠 영향을 통제하기 위해 +이러한 파드 중 하나를 골라 축출해야 한다. +이 경우, 가장 낮은 `Priority`를 갖는 파드가 선택된다. + +`inodes`와 `PIDs`에 대한 요청량은 정의하고 있지 않기 때문에, kubelet이 `inode` +또는 `PID` 고갈 때문에 파드를 축출할 때에는 파드의 `Priority`를 이용하여 축출 +순위를 정한다. + +노드에 전용 'imagefs' 파일 시스템이 있는지 여부에 따라 kubelet이 파드 축출 순서를 +정하는 방식에 차이가 있다. + +#### `imagefs`가 있는 경우 + +`nodefs`로 인한 축출의 경우, kubelet은 `nodefs` +사용량(`모든 컨테이너의 로컬 볼륨 + 로그`)을 기준으로 축출 순서를 정한다. + +`imagefs`로 인한 축출의 경우, kubelet은 모든 컨테이너의 +쓰기 가능한 레이어(writable layer) 사용량을 기준으로 축출 순서를 정한다. + +#### `imagefs`가 없는 경우 + +`nodefs`로 인한 축출의 경우, kubelet은 각 파드의 총 +디스크 사용량(`모든 컨테이너의 로컬 볼륨 + 로그 + 쓰기 가능한 레이어`)을 기준으로 축출 순서를 정한다. + +### 최소 축출 회수량 + +경우에 따라, 파드를 축출했음에도 적은 양의 자원만이 회수될 수 있다. +이로 인해 kubelet이 반복적으로 축출 임계값 도달을 감지하고 +여러 번의 축출을 수행할 수 있다. + +`--eviction-minimum-reclaim` 플래그 또는 +[kubelet 설정 파일](/docs/tasks/administer-cluster/kubelet-config-file/)을 이용하여 +각 자원에 대한 최소 회수량을 설정할 수 있다. kubelet이 자원 부족 상황을 감지하면, +앞서 설정한 최소 회수량에 도달할때까지 회수를 계속 진행한다. + +예를 들어, 다음 YAML은 최소 회수량을 정의하고 있다. + +```yaml +apiVersion: kubelet.config.k8s.io/v1beta1 +kind: KubeletConfiguration +evictionHard: + memory.available: "500Mi" + nodefs.available: "1Gi" + imagefs.available: "100Gi" +evictionMinimumReclaim: + memory.available: "0Mi" + nodefs.available: "500Mi" + imagefs.available: "2Gi" +``` + +이 예제에서, 만약 `nodefs.available` 축출 신호가 축출 임계값 조건에 도달하면, +kubelet은 축출 신호가 임계값인 `1Gi`에 도달할 때까지 자원을 회수하며, +이어서 축출 신호가 `1.5Gi`에 도달할 때까지 최소 `500Mi` 이상의 자원을 +회수한다. + +유사한 방식으로, kubelet은 `imagefs.available` 축출 신호가 +`102Gi`에 도달할 때까지 `imagefs` 자원을 회수한다. + +모든 자원에 대해 `eviction-minimum-reclaim`의 기본값은 `0`이다. + +### 노드 메모리 부족 시의 동작 + +kubelet의 메모리 회수가 가능하기 이전에 +노드에 메모리 부족(out of memory, 이하 OOM) 이벤트가 발생하면, +노드는 [oom_killer](https://lwn.net/Articles/391222/)에 의존한다. + +kubelet은 각 파드에 설정된 QoS를 기반으로 각 컨테이너에 `oom_score_adj` 값을 설정한다. + +| Quality of Service | oom_score_adj | +|--------------------|-----------------------------------------------------------------------------------| +| `Guaranteed` | -997 | +| `BestEffort` | 1000 | +| `Burstable` | min(max(2, 1000 - (1000 * memoryRequestBytes) / machineMemoryCapacityBytes), 999) | + +{{}} +또한, kubelet은 `system-node-critical` {{}}를 갖는 파드의 컨테이너에 +`oom_score_adj` 값을 `-997`로 설정한다. +{{}} + +노드가 OOM을 겪기 전에 kubelet이 메모리를 회수하지 못하면, `oom_killer`가 노드의 +메모리 사용률 백분율을 이용하여 `oom_score`를 계산하고, 각 컨테이너의 실질 +`oom_score`를 구하기 위해 `oom_score_adj`를 더한다. 그 뒤 `oom_score`가 가장 높은 +컨테이너부터 종료시킨다. + +이는 곧, 스케줄링 요청에 비해 많은 양의 메모리를 사용하면서 +QoS가 낮은 파드에 속한 컨테이너가 먼저 종료됨을 의미한다. + +파드 축출과 달리, 컨테이너가 OOM으로 인해 종료되면, +`kubelet`이 컨테이너의 `RestartPolicy`를 기반으로 컨테이너를 다시 실행할 수 있다. + +### 추천 예시 {#node-pressure-eviction-good-practices} + +아래 섹션에서 축출 설정에 대한 추천 예시를 소개한다. + +#### 스케줄 가능한 자원과 축출 정책 + +kubelet에 축출 정책을 설정할 때, 만약 어떤 파드 배치가 즉시 메모리 압박을 +야기하기 때문에 축출을 유발한다면 스케줄러가 그 파드 배치를 수행하지 않도록 +설정해야 한다. + +다음 시나리오를 가정한다. + +* 노드 메모리 용량: `10Gi` +* 운영자는 시스템 데몬(커널, `kubelet` 등)을 위해 메모리 용량의 10%를 확보해 놓고 싶어 한다. +* 운영자는 시스템 OOM 발생을 줄이기 위해 메모리 사용률이 95%인 상황에서 파드를 축출하고 싶어한다. + +이것이 실현되도록, kubelet이 다음과 같이 실행된다. + +``` +--eviction-hard=memory.available<500Mi +--system-reserved=memory=1.5Gi +``` + +이 환경 설정에서, `--system-reserved` 플래그는 시스템 용으로 `1.5Gi` 메모리를 +확보하는데, 이는 `총 메모리의 10% + 축출 임계값`에 해당된다. + +파드가 요청량보다 많은 메모리를 사용하거나 시스템이 `1Gi` 이상의 메모리를 +사용하여, `memory.available` 축출 신호가 `500Mi` 아래로 내려가면 노드가 축출 +임계값에 도달할 수 있다. + +#### 데몬셋(DaemonSet) + +파드 우선 순위(Priority)는 파드 축출 결정을 내릴 때의 주요 요소이다. +kubelet이 `DaemonSet`에 속하는 파드를 축출하지 않도록 하려면 +해당 파드의 파드 스펙에 충분히 높은 `priorityClass`를 지정한다. +또는 낮은 `priorityClass`나 기본값을 사용하여 +리소스가 충분할 때만 `DaemonSet` 파드가 실행되도록 허용할 수도 있다. + +### 알려진 이슈 + +다음 섹션에서는 리소스 부족 처리와 관련된 알려진 이슈에 대해 다룬다. + +#### kubelet이 메모리 압박을 즉시 감지하지 못할 수 있음 + +기본적으로 kubelet은 'cAdvisor'를 폴링하여 +일정한 간격으로 메모리 사용량 통계를 수집한다. +해당 타임 윈도우 내에서 메모리 사용량이 빠르게 증가하면 kubelet이 +`MemoryPressure`를 충분히 빠르게 감지하지 못해 `OOMKiller`가 계속 호출될 수 있다. + +`--kernel-memcg-notification` 플래그를 사용하여 +kubelet의 `memcg` 알림 API가 임계값을 초과할 때 즉시 알림을 받도록 +할 수 있다. + +극도의 활용도를 달성하려는 것이 아니라 오버커밋에 대한 합리적인 조치를 원하는 경우, +이 문제에 대한 현실적인 해결 방법은 `--kube-reserved` 및 +`--system-reserved` 플래그를 사용하여 시스템에 메모리를 할당하는 것이다. + +#### `active_file` 메모리가 사용 가능한 메모리로 간주되지 않음 + +리눅스에서, 커널은 활성 LRU 목록의 파일 지원 메모리 바이트 수를 `active_file` +통계로 추적한다. kubelet은 `active_file` 메모리 영역을 회수할 수 없는 것으로 +취급한다. 임시 로컬 스토리지를 포함하여 블록 지원 로컬 스토리지를 집중적으로 +사용하는 워크로드의 경우 파일 및 블록 데이터의 커널 수준 캐시는 최근에 액세스한 +많은 캐시 페이지가 `active_file`로 계산될 가능성이 있음을 의미한다. 활성 LRU +목록에 이러한 커널 블록 버퍼가 충분히 많으면, kubelet은 이를 높은 자원 사용 +상태로 간주하고 노드가 메모리 압박을 겪고 있다고 테인트를 표시할 수 있으며, 이는 +파드 축출을 유발한다. + +더 자세한 사항은 [https://github.com/kubernetes/kubernetes/issues/43916](https://github.com/kubernetes/kubernetes/issues/43916)를 참고한다. + +집중적인 I/O 작업을 수행할 가능성이 있는 컨테이너에 대해 메모리 제한량 및 메모리 +요청량을 동일하게 설정하여 이 문제를 해결할 수 있다. 해당 컨테이너에 대한 최적의 +메모리 제한량을 추정하거나 측정해야 한다. + +## {{% heading "whatsnext" %}} + +* [API를 이용한 축출](/ko/docs/concepts/scheduling-eviction/api-eviction/)에 대해 알아본다. +* [파드 우선순위와 선점](/ko/docs/concepts/scheduling-eviction/pod-priority-preemption/)에 대해 알아본다. +* [PodDisruptionBudgets](/docs/tasks/run-application/configure-pdb/)에 대해 알아본다. +* [서비스 품질](/ko/docs/tasks/configure-pod-container/quality-service-pod/)(QoS)에 대해 알아본다. +* [축출 API](/docs/reference/generated/kubernetes-api/{{}}/#create-eviction-pod-v1-core)를 확인한다. From 05a45db49c08ab43cd3b54685f080315ea645928 Mon Sep 17 00:00:00 2001 From: sgpinkus Date: Tue, 20 Jul 2021 21:47:16 +1000 Subject: [PATCH 027/279] Update _index.md "Understand the basics" to "Understand Kubernetes". There is no place in the entire docs really to go "Understand the *non* basics". There is one section "Concepts" for better or worse. Don't give the impression there is something else somewhere else. And anyway, this section should aspire to be that cardinal. Also change name of weird button to "Learn" -> "View" to make it clear this is just a link to a section of the documentation. --- content/en/docs/home/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/home/_index.md b/content/en/docs/home/_index.md index 68f4bfd3c9..b2ebb004a7 100644 --- a/content/en/docs/home/_index.md +++ b/content/en/docs/home/_index.md @@ -22,9 +22,9 @@ overview: > Kubernetes is an open source container orchestration engine for automating deployment, scaling, and management of containerized applications. The open source project is hosted by the Cloud Native Computing Foundation (CNCF). cards: - name: concepts - title: "Understand the basics" + title: "Understand Kubernetes" description: "Learn about Kubernetes and its fundamental concepts." - button: "Learn Concepts" + button: "View Concepts" button_path: "/docs/concepts" - name: tutorials title: "Try Kubernetes" From 875cb1a3d701d3fde1e19d7341c5be4676bbf3dd Mon Sep 17 00:00:00 2001 From: "able.lv" Date: Tue, 20 Jul 2021 23:27:07 +0800 Subject: [PATCH 028/279] fix typos ja --- content/ja/docs/concepts/workloads/pods/pod-overview.md | 2 +- content/ja/docs/reference/tools.md | 2 +- content/ja/docs/setup/learning-environment/minikube.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/content/ja/docs/concepts/workloads/pods/pod-overview.md b/content/ja/docs/concepts/workloads/pods/pod-overview.md index 4d286fdbcf..6e053f9ab1 100644 --- a/content/ja/docs/concepts/workloads/pods/pod-overview.md +++ b/content/ja/docs/concepts/workloads/pods/pod-overview.md @@ -61,7 +61,7 @@ Podは、Podによって構成されたコンテナ群のために2種類の共 ## Podを利用する -ユーザーはまれに、Kubenetes内で独立したPodを直接作成する場合があります(シングルトンPodなど)。 +ユーザーはまれに、Kubernetes内で独立したPodを直接作成する場合があります(シングルトンPodなど)。 これはPodが比較的、一時的な使い捨てエンティティとしてデザインされているためです。Podが作成された時(ユーザーによって直接的、またはコントローラーによって間接的に作成された場合)、ユーザーのクラスター内の単一の{{< glossary_tooltip term_id="node" >}}上で稼働するようにスケジューリングされます。そのPodはプロセスが停止されたり、Podオブジェクトが削除されたり、Podがリソースの欠如のために*追い出され* たり、ノードが故障するまでノード上に残り続けます。 {{< note >}} diff --git a/content/ja/docs/reference/tools.md b/content/ja/docs/reference/tools.md index 0fedb1cf9d..c64b1e74f7 100644 --- a/content/ja/docs/reference/tools.md +++ b/content/ja/docs/reference/tools.md @@ -11,7 +11,7 @@ Kubernetesには、Kubernetesシステムの操作に役立ついくつかの組 [`kubectl`](/docs/tasks/tools/install-kubectl/)は、Kubernetesのためのコマンドラインツールです。このコマンドはKubernetes cluster managerを操作します。 ## Kubeadm -[`kubeadm`](docs/setup/production-environment/tools/kubeadm/install-kubeadm/)は、物理サーバやクラウドサーバ、仮想マシン上にKubenetesクラスタを容易にプロビジョニングするためのコマンドラインツールです(現在はアルファ版です)。 +[`kubeadm`](docs/setup/production-environment/tools/kubeadm/install-kubeadm/)は、物理サーバやクラウドサーバ、仮想マシン上にKubernetesクラスタを容易にプロビジョニングするためのコマンドラインツールです(現在はアルファ版です)。 ## Minikube [`minikube`](https://minikube.sigs.k8s.io/docs/)は、開発やテストのためにワークステーション上でシングルノードのKubernetesクラスタをローカルで実行するツールです。 diff --git a/content/ja/docs/setup/learning-environment/minikube.md b/content/ja/docs/setup/learning-environment/minikube.md index c197a03081..171d2b1b1e 100644 --- a/content/ja/docs/setup/learning-environment/minikube.md +++ b/content/ja/docs/setup/learning-environment/minikube.md @@ -342,7 +342,7 @@ Could not read CA certificate "/etc/docker/ca.pem": open /etc/docker/ca.pem: no ### Kubernetesの設定 -Minikubeにはユーザーが任意の値でKubenetesコンポーネントを設定することを可能にする "configurator" 機能があります。 +Minikubeにはユーザーが任意の値でKubernetesコンポーネントを設定することを可能にする "configurator" 機能があります。 この機能を使うには、`minikube start` コマンドに `--extra-config` フラグを使うことができます。 このフラグは繰り返されるので、複数のオプションを設定するためにいくつかの異なる値を使って何度も渡すことができます。 From 59b4b7f494b71bfa267ad522506bd7cda34e70bc Mon Sep 17 00:00:00 2001 From: chhanz Date: Tue, 20 Jul 2021 09:36:48 +0900 Subject: [PATCH 029/279] Translate /docs/tasks/configmap-secret/ into Korean Translate /docs/tasks/configmap-secret/ into Korean - fix ver 2 --- .../ko/docs/tasks/configmap-secret/_index.md | 6 + .../managing-secret-using-config-file.md | 198 ++++++++++++++++++ .../managing-secret-using-kubectl.md | 156 ++++++++++++++ .../managing-secret-using-kustomize.md | 139 ++++++++++++ 4 files changed, 499 insertions(+) create mode 100644 content/ko/docs/tasks/configmap-secret/_index.md create mode 100644 content/ko/docs/tasks/configmap-secret/managing-secret-using-config-file.md create mode 100644 content/ko/docs/tasks/configmap-secret/managing-secret-using-kubectl.md create mode 100644 content/ko/docs/tasks/configmap-secret/managing-secret-using-kustomize.md diff --git a/content/ko/docs/tasks/configmap-secret/_index.md b/content/ko/docs/tasks/configmap-secret/_index.md new file mode 100644 index 0000000000..e63c605924 --- /dev/null +++ b/content/ko/docs/tasks/configmap-secret/_index.md @@ -0,0 +1,6 @@ +--- +title: "시크릿(Secret) 관리" +weight: 28 +description: 시크릿을 사용하여 기밀 설정 데이터 관리. +--- + diff --git a/content/ko/docs/tasks/configmap-secret/managing-secret-using-config-file.md b/content/ko/docs/tasks/configmap-secret/managing-secret-using-config-file.md new file mode 100644 index 0000000000..3248328907 --- /dev/null +++ b/content/ko/docs/tasks/configmap-secret/managing-secret-using-config-file.md @@ -0,0 +1,198 @@ +--- +title: 환경 설정 파일을 사용하여 시크릿을 관리 +content_type: task +weight: 20 +description: 환경 설정 파일을 사용하여 시크릿 오브젝트를 생성. +--- + + + +## {{% heading "prerequisites" %}} + +{{< include "task-tutorial-prereqs.md" >}} + + + +## 환경 설정 파일 생성 + +먼저 새 파일에 JSON 이나 YAML 형식으로 시크릿(Secret)에 대한 상세 사항을 기록하고, +이 파일을 이용하여 해당 시크릿 오브젝트를 생성할 수 있다. 이 +[시크릿](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#secret-v1-core) +리소스에는 `data` 와 `stringData` 의 두 가지 맵이 포함되어 있다. +`data` 필드는 base64로 인코딩된 임의의 데이터를 기입하는 데 사용된다. +`stringData` 필드는 편의를 위해 제공되며, 이를 사용해 시크릿 데이터를 인코딩되지 않은 문자열로 +기입할 수 있다. +`data` 및 `stringData`은 영숫자, +`-`, `_` 그리고 `.`로 구성되어야 한다. + +예를 들어 시크릿에 `data` 필드를 사용하여 두 개의 문자열을 저장하려면 다음과 같이 +문자열을 base64로 변환한다. + +```shell +echo -n 'admin' | base64 +``` + +출력은 다음과 유사하다. + +``` +YWRtaW4= +``` + +```shell +echo -n '1f2d1e2e67df' | base64 +``` + +출력은 다음과 유사하다. + +``` +MWYyZDFlMmU2N2Rm +``` + +다음과 같이 시크릿 구성 파일을 작성한다. + +```yaml +apiVersion: v1 +kind: Secret +metadata: + name: mysecret +type: Opaque +data: + username: YWRtaW4= + password: MWYyZDFlMmU2N2Rm +``` + +시크릿 오브젝트의 이름은 유효한 +[DNS 서브도메인 이름](/ko/docs/concepts/overview/working-with-objects/names/#dns-서브도메인-이름)이어야 한다. + +{{< note >}} +시크릿 데이터의 직렬화된(serialized) JSON 및 YAML 값은 base64 문자열로 인코딩된다. +이러한 문자열에는 개행(newline)을 사용할 수 없으므로 생략해야 한다. +Darwin/macOS에서 `base64` 도구를 사용할 경우, 사용자는 긴 줄을 분할하는 `-b` 옵션을 사용해서는 안 된다. +반대로, 리눅스 사용자는 `-w` 옵션을 사용할 수 없는 경우 +`base64` 명령어 또는 `base64 | tr -d '\n'` 파이프라인에 +`-w 0` 옵션을 *추가해야 한다*. +{{< /note >}} + +특정 시나리오의 경우 `stringData` 필드를 대신 사용할 수 있다. 이 +필드를 사용하면 base64로 인코딩되지 않은 문자열을 시크릿에 직접 넣을 수 있으며, +시크릿이 생성되거나 업데이트될 때 문자열이 인코딩된다. + +이에 대한 실제적인 예로, +시크릿을 사용하여 구성 파일을 저장하는 애플리케이션을 배포하면서, +배포 프로세스 중에 해당 구성 파일의 일부를 채우려는 경우를 들 수 있다. + +예를 들어 애플리케이션에서 다음 구성 파일을 사용하는 경우: + +```yaml +apiUrl: "https://my.api.com/api/v1" +username: "" +password: "" +``` + +다음 정의를 사용하여 이를 시크릿에 저장할 수 있다. + +```yaml +apiVersion: v1 +kind: Secret +metadata: + name: mysecret +type: Opaque +stringData: + config.yaml: | + apiUrl: "https://my.api.com/api/v1" + username: + password: +``` + +## 시크릿 오브젝트 생성 + +[`kubectl apply`](/docs/reference/generated/kubectl/kubectl-commands#apply)를 이용하여 시크릿 오브젝트를 생성한다. + +```shell +kubectl apply -f ./secret.yaml +``` + +출력은 다음과 유사하다. + +``` +secret/mysecret created +``` + +## 시크릿 확인 + +`stringData` 필드는 쓰기 전용 편의 필드이다. 시크릿을 조회할 때 절대 출력되지 않는다. +예를 들어 다음 명령을 실행하는 경우: + +```shell +kubectl get secret mysecret -o yaml +``` + +출력은 다음과 유사하다. + +```yaml +apiVersion: v1 +data: + config.yaml: YXBpVXJsOiAiaHR0cHM6Ly9teS5hcGkuY29tL2FwaS92MSIKdXNlcm5hbWU6IHt7dXNlcm5hbWV9fQpwYXNzd29yZDoge3twYXNzd29yZH19 +kind: Secret +metadata: + creationTimestamp: 2018-11-15T20:40:59Z + name: mysecret + namespace: default + resourceVersion: "7225" + uid: c280ad2e-e916-11e8-98f2-025000000001 +type: Opaque +``` + +`kubectl get` 및 `kubectl describe` 명령은 기본적으로 `시크릿`의 내용을 표시하지 않는다. +이는 `시크릿`이 실수로 구경꾼에게 노출되거나 +터미널 로그에 저장되는 것을 방지하기 위한 것이다. +인코딩된 데이터의 실제 내용을 확인하려면 다음을 참조한다. +[시크릿 디코딩](/ko/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret). + +하나의 필드(예: `username`)가 `data`와 `stringData`에 모두 명시되면, `stringData`에 명시된 값이 사용된다. +예를 들어 다음과 같은 시크릿인 경우: + +```yaml +apiVersion: v1 +kind: Secret +metadata: + name: mysecret +type: Opaque +data: + username: YWRtaW4= +stringData: + username: administrator +``` + +결과는 다음과 같은 시크릿이다. + +```yaml +apiVersion: v1 +data: + username: YWRtaW5pc3RyYXRvcg== +kind: Secret +metadata: + creationTimestamp: 2018-11-15T20:46:46Z + name: mysecret + namespace: default + resourceVersion: "7579" + uid: 91460ecb-e917-11e8-98f2-025000000001 +type: Opaque +``` + +여기서 `YWRtaW5pc3RyYXRvcg==`는 `administrator`으로 디코딩된다. + +## 삭제 + +생성한 시크릿을 삭제하려면 다음 명령을 실행한다. + +```shell +kubectl delete secret mysecret +``` + +## {{% heading "whatsnext" %}} + +- [시크릿 개념](/ko/docs/concepts/configuration/secret/)에 대해 자세히 알아보기 +- [`kubectl` 커맨드를 사용하여 시크릿을 관리](/ko/docs/tasks/configmap-secret/managing-secret-using-kubectl/)하는 방법 알아보기 +- [kustomize를 사용하여 시크릿을 관리](/ko/docs/tasks/configmap-secret/managing-secret-using-kustomize/)하는 방법 알아보기 + diff --git a/content/ko/docs/tasks/configmap-secret/managing-secret-using-kubectl.md b/content/ko/docs/tasks/configmap-secret/managing-secret-using-kubectl.md new file mode 100644 index 0000000000..8b3f62217e --- /dev/null +++ b/content/ko/docs/tasks/configmap-secret/managing-secret-using-kubectl.md @@ -0,0 +1,156 @@ +--- +title: kubectl을 사용한 시크릿 관리 +content_type: task +weight: 10 +description: kubectl 커맨드를 사용하여 시크릿 오브젝트를 생성. +--- + + + +## {{% heading "prerequisites" %}} + +{{< include "task-tutorial-prereqs.md" >}} + + + +## 시크릿 생성 + +`시크릿`에는 파드가 데이터베이스에 접근하는 데 필요한 사용자 자격 증명이 포함될 수 있다. +예를 들어 데이터베이스 연결 문자열은 사용자 이름과 암호로 구성된다. +사용자 이름은 로컬 컴퓨터의 `./username.txt` 파일에, 비밀번호는 +`./password.txt` 파일에 저장할 수 있다. + +```shell +echo -n 'admin' > ./username.txt +echo -n '1f2d1e2e67df' > ./password.txt +``` +이 명령에서 `-n` 플래그는 생성된 파일의 +텍스트 끝에 추가 개행 문자가 포함되지 않도록 해 준다. 이는 `kubectl`이 파일을 읽고 +내용을 base64 문자열로 인코딩할 때 개행 문자도 함께 인코딩될 수 있기 때문에 +중요하다. + +`kubectl create secret` 명령은 이러한 파일들을 시크릿으로 패키징하고 +API 서버에 오브젝트를 생성한다. + +```shell +kubectl create secret generic db-user-pass \ + --from-file=./username.txt \ + --from-file=./password.txt +``` + +출력은 다음과 유사하다. + +``` +secret/db-user-pass created +``` + +기본 키 이름은 파일 이름이다. 선택적으로 `--from-file=[key=]source`를 사용하여 키 이름을 설정할 수 있다. +예제: + +```shell +kubectl create secret generic db-user-pass \ + --from-file=username=./username.txt \ + --from-file=password=./password.txt +``` + +파일에 포함하는 암호 문자열에서 +특수 문자를 이스케이프하지 않아도 된다. + +`--from-literal==` 태그를 사용하여 시크릿 데이터를 제공할 수도 있다. +이 태그는 여러 키-값 쌍을 제공하기 위해 두 번 이상 지정할 수 있다. +`$`, `\`, `*`, `=` 및 `!`와 같은 특수 문자는 +[shell](https://en.wikipedia.org/wiki/Shell_(computing))에 해석하고 처리하기 때문에 +이스케이프할 필요가 있다. + +대부분의 셸에서 암호를 이스케이프하는 가장 쉬운 방법은 암호를 작은따옴표(`'`)로 둘러싸는 것이다. +예를 들어, 비밀번호가 `S!B\*d$zDsb=`인 경우, +다음 커맨드를 실행한다. + +```shell +kubectl create secret generic dev-db-secret \ + --from-literal=username=devuser \ + --from-literal=password='S!B\*d$zDsb=' +``` + +## 시크릿 확인 + +시크릿이 생성되었는지 확인한다. + +```shell +kubectl get secrets +``` + +출력은 다음과 유사하다. + +``` +NAME TYPE DATA AGE +db-user-pass Opaque 2 51s +``` + +다음 명령을 실행하여 `시크릿`에 대한 상세 사항을 볼 수 있다. + +```shell +kubectl describe secrets/db-user-pass +``` + +출력은 다음과 유사하다. + +``` +Name: db-user-pass +Namespace: default +Labels: +Annotations: + +Type: Opaque + +Data +==== +password: 12 bytes +username: 5 bytes +``` + +`kubectl get` 및 `kubectl describe` 명령은 +기본적으로 `시크릿`의 내용을 표시하지 않는다. 이는 `시크릿`이 실수로 노출되거나 +터미널 로그에 저장되는 것을 방지하기 위한 것이다. + +## 시크릿 디코딩 {#decoding-secret} + +생성한 시크릿을 보려면 다음 명령을 실행한다. + +```shell +kubectl get secret db-user-pass -o jsonpath='{.data}' +``` + +출력은 다음과 유사하다. + +```json +{"password":"MWYyZDFlMmU2N2Rm","username":"YWRtaW4="} +``` + +이제 `password` 데이터를 디코딩할 수 있다. + +```shell +echo 'MWYyZDFlMmU2N2Rm' | base64 --decode +``` + +출력은 다음과 유사하다. + +``` +1f2d1e2e67df +``` + +## 삭제 + +생성한 시크릿을 삭제하려면 다음 명령을 실행한다. + +```shell +kubectl delete secret db-user-pass +``` + + + +## {{% heading "whatsnext" %}} + +- [시크릿 개념](/ko/docs/concepts/configuration/secret/)에 대해 자세히 알아보기 +- [환경 설정 파일을 사용하여 시크릿을 관리](/ko/docs/tasks/configmap-secret/managing-secret-using-config-file/)하는 방법 알아보기 +- [kustomize를 사용하여 시크릿을 관리](/ko/docs/tasks/configmap-secret/managing-secret-using-kustomize/)하는 방법 알아보기 diff --git a/content/ko/docs/tasks/configmap-secret/managing-secret-using-kustomize.md b/content/ko/docs/tasks/configmap-secret/managing-secret-using-kustomize.md new file mode 100644 index 0000000000..2198903885 --- /dev/null +++ b/content/ko/docs/tasks/configmap-secret/managing-secret-using-kustomize.md @@ -0,0 +1,139 @@ +--- +title: kustomize를 사용하여 시크릿 관리 +content_type: task +weight: 30 +description: kustomization.yaml 파일을 사용하여 시크릿 오브젝트 생성. +--- + + + +쿠버네티스 v1.14부터 `kubectl`은 +[Kustomize를 이용한 쿠버네티스 오브젝트의 선언형 관리](/ko/docs/tasks/manage-kubernetes-objects/kustomization/)를 지원한다. +Kustomize는 시크릿 및 컨피그맵을 생성하기 위한 리소스 생성기를 제공한다. +Kustomize 생성기는 디렉토리 내의 `kustomization.yaml` 파일에 지정되어야 한다. +시크릿 생성 후 `kubectl apply`를 통해 API +서버에 시크릿을 생성할 수 있다. + +## {{% heading "prerequisites" %}} + +{{< include "task-tutorial-prereqs.md" >}} + + + +## Kustomization 파일 생성 + +`kustomization.yaml` 파일에 다른 기존 파일을 참조하는 +`secretGenerator`를 정의하여 시크릿을 생성할 수 있다. +예를 들어 다음 kustomization 파일은 +`./username.txt` 및 `./password.txt` 파일을 참조한다. + +```yaml +secretGenerator: +- name: db-user-pass + files: + - username.txt + - password.txt +``` + +`kustomization.yaml` 파일에 리터럴을 명시하여 `secretGenerator`를 +정의할 수도 있다. +예를 들어 다음 `kustomization.yaml` 파일에는 +각각 `username`과 `password`에 대한 두 개의 리터럴이 포함되어 있다. + +```yaml +secretGenerator: +- name: db-user-pass + literals: + - username=admin + - password=1f2d1e2e67df +``` + +`kustomization.yaml` 파일에 `.env` 파일을 명시하여 +`secretGenerator`를 정의할 수도 있다. +예를 들어 다음 `kustomization.yaml` 파일은 +`.env.secret` 파일에서 데이터를 가져온다. + +```yaml +secretGenerator: +- name: db-user-pass + envs: + - .env.secret +``` + +모든 경우에 대해, 값을 base64로 인코딩하지 않아도 된다. + +## 시크릿 생성 + +다음 명령을 실행하여 시크릿을 생성한다. + +```shell +kubectl apply -k . +``` + +출력은 다음과 유사하다. + +``` +secret/db-user-pass-96mffmfh4k created +``` + +시크릿이 생성되면 시크릿 데이터를 해싱하고 +이름에 해시 값을 추가하여 시크릿 이름이 생성된다. 이렇게 함으로써 +데이터가 수정될 때마다 시크릿이 새롭게 생성된다. + +## 생성된 시크릿 확인 + +시크릿이 생성된 것을 확인할 수 있다. + +```shell +kubectl get secrets +``` + +출력은 다음과 유사하다. + +``` +NAME TYPE DATA AGE +db-user-pass-96mffmfh4k Opaque 2 51s +``` + +다음 명령을 실행하여 시크릿에 대한 상세 사항을 볼 수 있다. + +```shell +kubectl describe secrets/db-user-pass-96mffmfh4k +``` + +출력은 다음과 유사하다. + +``` +Name: db-user-pass-96mffmfh4k +Namespace: default +Labels: +Annotations: + +Type: Opaque + +Data +==== +password.txt: 12 bytes +username.txt: 5 bytes +``` + +`kubectl get` 및 `kubectl describe` 명령은 기본적으로 `시크릿`의 내용을 표시하지 않는다. +이는 `시크릿`이 실수로 구경꾼에게 노출되는 것을 방지하기 위한 것으로, +또는 터미널 로그에 저장되지 않는다. +인코딩된 데이터의 실제 내용을 확인하려면 다음을 참조한다. +[시크릿 디코딩](/ko/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret). + +## 삭제 + +생성한 시크릿을 삭제하려면 다음 명령을 실행한다. + +```shell +kubectl delete secret db-user-pass-96mffmfh4k +``` + + +## {{% heading "whatsnext" %}} + +- [시크릿 개념](/ko/docs/concepts/configuration/secret/)에 대해 자세히 알아보기 +- [`kubectl` 커맨드을 사용하여 시크릿 관리](/ko/docs/tasks/configmap-secret/managing-secret-using-kubectl/) 방법 알아보기 +- [환경 설정 파일을 사용하여 시크릿을 관리](/ko/docs/tasks/configmap-secret/managing-secret-using-config-file/)하는 방법 알아보기 From cee22da0c3362b0f4aa9aac0dd8fdb4c7f5170a5 Mon Sep 17 00:00:00 2001 From: Ritikaa96 Date: Thu, 22 Jul 2021 19:34:39 +0530 Subject: [PATCH 030/279] updating cilium network policy docs --- .../network-policy-provider/cilium-network-policy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy.md b/content/en/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy.md index 948893d3ea..58d0b8b74e 100644 --- a/content/en/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy.md +++ b/content/en/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy.md @@ -24,7 +24,7 @@ For background on Cilium, read the [Introduction to Cilium](https://docs.cilium. ## Deploying Cilium on Minikube for Basic Testing To get familiar with Cilium easily you can follow the -[Cilium Kubernetes Getting Started Guide](https://docs.cilium.io/en/stable/gettingstarted/minikube/) +[Cilium Kubernetes Getting Started Guide](https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/) to perform a basic DaemonSet installation of Cilium in minikube. To start minikube, minimal version required is >= v1.3.1, run the with the From b7ec60a56440e65be17c32e4ead3d87d68e095a3 Mon Sep 17 00:00:00 2001 From: Mengjiao Liu Date: Fri, 23 Jul 2021 10:35:50 +0800 Subject: [PATCH 031/279] [ja] Fix secret name to be consistent with examples --- .../tasks/configmap-secret/managing-secret-using-kubectl.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/ja/docs/tasks/configmap-secret/managing-secret-using-kubectl.md b/content/ja/docs/tasks/configmap-secret/managing-secret-using-kubectl.md index fbc427469e..7be8c0b890 100644 --- a/content/ja/docs/tasks/configmap-secret/managing-secret-using-kubectl.md +++ b/content/ja/docs/tasks/configmap-secret/managing-secret-using-kubectl.md @@ -58,7 +58,7 @@ kubectl create secret generic db-user-pass \ たとえば、実際のパスワードが`S!B\*d$zDsb=`の場合、次のようにコマンドを実行します: ```shell -kubectl create secret generic dev-db-secret \ +kubectl create secret generic db-user-pass \ --from-literal=username=devuser \ --from-literal=password='S!B\*d$zDsb=' ``` From 39f2c3860da11d0650849798878bf71872ee48c9 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Tue, 23 Mar 2021 23:30:03 +0000 Subject: [PATCH 032/279] =?UTF-8?q?Reword=20=E2=80=9CCreate=20an=20Externa?= =?UTF-8?q?l=20Load=20Balancer=E2=80=9D=20task?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - general cleanup - update sample output - use more tooltips - avoid specifying specific cloud providers The website repo doesn't maintain a definitive list of cloud providers that pass Kubernetes conformance tests. It's certainly more than AWS and GCP as the previous revision stated. --- .../create-external-load-balancer.md | 170 +++++++++--------- 1 file changed, 85 insertions(+), 85 deletions(-) diff --git a/content/en/docs/tasks/access-application-cluster/create-external-load-balancer.md b/content/en/docs/tasks/access-application-cluster/create-external-load-balancer.md index 7dcc613232..23f6f91a2c 100644 --- a/content/en/docs/tasks/access-application-cluster/create-external-load-balancer.md +++ b/content/en/docs/tasks/access-application-cluster/create-external-load-balancer.md @@ -4,47 +4,44 @@ content_type: task weight: 80 --- - -This page shows how to create an External Load Balancer. +This page shows how to create an external load balancer. -{{< note >}} -This feature is only available for cloud providers or environments which support external load balancers. -{{< /note >}} - -When creating a service, you have the option of automatically creating a -cloud network load balancer. This provides an externally-accessible IP address -that sends traffic to the correct port on your cluster nodes +When creating a {{< glossary_tooltip text="Service" term_id="service" >}}, you have +the option of automatically creating a cloud load balancer. This provides an +externally-accessible IP address that sends traffic to the correct port on your cluster +nodes, _provided your cluster runs in a supported environment and is configured with the correct cloud load balancer provider package_. -For information on provisioning and using an Ingress resource that can give -services externally-reachable URLs, load balance the traffic, terminate SSL etc., -please check the [Ingress](/docs/concepts/services-networking/ingress/) +You can also use an {{< glossary_tooltip term_id="ingress" >}} in place of Service. +For more information, check the [Ingress](/docs/concepts/services-networking/ingress/) documentation. - - ## {{% heading "prerequisites" %}} -* {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} +{{< include "task-tutorial-prereqs.md" >}} +Your cluster must be running in a cloud or other environment that already has support +for configuring external load balancers. -## Configuration file +## Create a Service + +### Create a Service from a manifest To create an external load balancer, add the following line to your -[service configuration file](/docs/concepts/services-networking/service/#loadbalancer): +Service manifest: ```yaml type: LoadBalancer ``` -Your configuration file might look like: +Your manifest might then look like: ```yaml apiVersion: v1 @@ -60,19 +57,19 @@ spec: type: LoadBalancer ``` -## Using kubectl +### Create a Service using kubectl You can alternatively create the service with the `kubectl expose` command and its `--type=LoadBalancer` flag: ```bash -kubectl expose rc example --port=8765 --target-port=9376 \ +kubectl expose deployment example --port=8765 --target-port=9376 \ --name=example-service --type=LoadBalancer ``` -This command creates a new service using the same selectors as the referenced -resource (in the case of the example above, a replication controller named -`example`). +This command creates a new Service using the same selectors as the referenced +resource (in the case of the example above, a +{{< glossary_tooltip text="Deployment" term_id="deployment" >}} named `example`). For more information, including optional flags, refer to the [`kubectl expose` reference](/docs/reference/generated/kubectl/kubectl-commands/#expose). @@ -86,59 +83,63 @@ information through `kubectl`: kubectl describe services example-service ``` -which should produce output like this: +which should produce output similar to: -```bash - Name: example-service - Namespace: default - Labels: - Annotations: - Selector: app=example - Type: LoadBalancer - IP: 10.67.252.103 - LoadBalancer Ingress: 192.0.2.89 - Port: 80/TCP - NodePort: 32445/TCP - Endpoints: 10.64.0.4:80,10.64.1.5:80,10.64.2.4:80 - Session Affinity: None - Events: +``` +Name: example-service +Namespace: default +Labels: app=example +Annotations: +Selector: app=example +Type: LoadBalancer +IP Families: +IP: 10.3.22.96 +IPs: 10.3.22.96 +LoadBalancer Ingress: 192.0.2.89 +Port: 8765/TCP +TargetPort: 9376/TCP +NodePort: 30593/TCP +Endpoints: 172.17.0.3:9376 +Session Affinity: None +External Traffic Policy: Cluster +Events: ``` -The IP address is listed next to `LoadBalancer Ingress`. +The load balancer's IP address is listed next to `LoadBalancer Ingress`. {{< note >}} If you are running your service on Minikube, you can find the assigned IP address and port with: -{{< /note >}} ```bash minikube service example-service --url ``` +{{< /note >}} ## Preserving the client source IP -Due to the implementation of this feature, the source IP seen in the target -container is *not the original source IP* of the client. To enable -preservation of the client IP, the following fields can be configured in the -service spec (supported in GCE/Google Kubernetes Engine environments): +By default, the source IP seen in the target container is *not the original +source IP* of the client. To enable preservation of the client IP, the following +fields can be configured in the `.spec` of the Service: -* `service.spec.externalTrafficPolicy` - denotes if this Service desires to route -external traffic to node-local or cluster-wide endpoints. There are two available -options: Cluster (default) and Local. Cluster obscures the client source -IP and may cause a second hop to another node, but should have good overall -load-spreading. Local preserves the client source IP and avoids a second hop -for LoadBalancer and NodePort type services, but risks potentially imbalanced -traffic spreading. -* `service.spec.healthCheckNodePort` - specifies the health check node port -(numeric port number) for the service. If `healthCheckNodePort` isn't specified, -the service controller allocates a port from your cluster's NodePort range. You -can configure that range by setting an API server command line option, -`--service-node-port-range`. It will use the -user-specified `healthCheckNodePort` value if specified by the client. It only has an -effect when `type` is set to LoadBalancer and `externalTrafficPolicy` is set -to Local. +* `.spec.externalTrafficPolicy` - denotes if this Service desires to route + external traffic to node-local or cluster-wide endpoints. There are two available + options: `Cluster` (default) and `Local`. `Cluster` obscures the client source + IP and may cause a second hop to another node, but should have good overall + load-spreading. `Local` preserves the client source IP and avoids a second hop + for LoadBalancer and NodePort type Services, but risks potentially imbalanced + traffic spreading. +* `.spec.healthCheckNodePort` - specifies the health check node port + (numeric port number) for the service. If you don't specify + `healthCheckNodePort`, the service controller allocates a port from your + cluster's NodePort range. + You can configure that range by setting an API server command line option, + `--service-node-port-range`. The Service will use the user-specified + `healthCheckNodePort` value if you specify it, provided that the + Service `type` is set to LoadBalancer and `externalTrafficPolicy` is set + to `Local`. -Setting `externalTrafficPolicy` to Local in the Service configuration file -activates this feature. +Setting `externalTrafficPolicy` to Local in the Service manifest +activates this feature. For example: ```yaml apiVersion: v1 @@ -155,7 +156,20 @@ spec: type: LoadBalancer ``` -## Garbage Collecting Load Balancers +### Caveats and limitations when preserving source IPs + +Load balancing services from some cloud providers do not let you configure different weights for each target. + +With each target weighted equally in terms of sending traffic to Nodes, external +traffic is not equally load balanced across different Pods. The external load balancer +is unaware of the number of Pods on each node that are used as a target. + +Where `NumServicePods << _NumNodes` or `NumServicePods >> NumNodes`, a fairly close-to-equal +distribution will be seen, even without weights. + +Internal pod to pod traffic should behave similar to ClusterIP services, with equal probability across all pods. + +## Garbage collecting load balancers {{< feature-state for_k8s_version="v1.17" state="stable" >}} @@ -172,32 +186,18 @@ The finalizer will only be removed after the load balancer resource is cleaned u This prevents dangling load balancer resources even in corner cases such as the service controller crashing. -## External Load Balancer Providers +## External load balancer providers It is important to note that the datapath for this functionality is provided by a load balancer external to the Kubernetes cluster. When the Service `type` is set to LoadBalancer, Kubernetes provides functionality equivalent to `type` equals ClusterIP to pods -within the cluster and extends it by programming the (external to Kubernetes) load balancer with entries for the Kubernetes -pods. The Kubernetes service controller automates the creation of the external load balancer, health checks (if needed), -firewall rules (if needed) and retrieves the external IP allocated by the cloud provider and populates it in the service -object. - -## Caveats and Limitations when preserving source IPs - -GCE/AWS load balancers do not provide weights for their target pools. This was not an issue with the old LB -kube-proxy rules which would correctly balance across all endpoints. - -With the new functionality, the external traffic is not equally load balanced across pods, but rather -equally balanced at the node level (because GCE/AWS and other external LB implementations do not have the ability -for specifying the weight per node, they balance equally across all target nodes, disregarding the number of -pods on each node). - -We can, however, state that for NumServicePods << NumNodes or NumServicePods >> NumNodes, a fairly close-to-equal -distribution will be seen, even without weights. - -Once the external load balancers provide weights, this functionality can be added to the LB programming path. -*Future Work: No support for weights is provided for the 1.4 release, but may be added at a future date* - -Internal pod to pod traffic should behave similar to ClusterIP services, with equal probability across all pods. +within the cluster and extends it by programming the (external to Kubernetes) load balancer with entries for the nodes +hosting the relevant Kubernetes pods. The Kubernetes control plane automates the creation of the external load balancer, +health checks (if needed), and packet filtering rules (if needed). Once the cloud provider allocates an IP address for the load +balancer, the control plane looks up that external IP address and populates it into the Service object. +## {{% heading "whatsnext" %}} +* Read about [Service](/docs/concepts/services-networking/service/) +* Read about [Ingress](/docs/concepts/services-networking/ingress/) +* Read [Connecting Applications with Services](/docs/concepts/services-networking/connect-applications-service/) From 8c9c9c543cfb6fc78dab6407647ea18c5db3a5db Mon Sep 17 00:00:00 2001 From: chenxuc Date: Fri, 25 Jun 2021 17:08:52 +0800 Subject: [PATCH 033/279] static pod not support configmap or secret --- content/en/docs/concepts/configuration/configmap.md | 5 +++++ content/en/docs/concepts/configuration/secret.md | 5 ++++- content/en/docs/concepts/workloads/pods/_index.md | 7 +++++++ .../en/docs/tasks/configure-pod-container/static-pod.md | 7 +++++++ 4 files changed, 23 insertions(+), 1 deletion(-) diff --git a/content/en/docs/concepts/configuration/configmap.md b/content/en/docs/concepts/configuration/configmap.md index cb98bf7439..47ecaedba6 100644 --- a/content/en/docs/concepts/configuration/configmap.md +++ b/content/en/docs/concepts/configuration/configmap.md @@ -61,6 +61,11 @@ You can write a Pod `spec` that refers to a ConfigMap and configures the contain in that Pod based on the data in the ConfigMap. The Pod and the ConfigMap must be in the same {{< glossary_tooltip text="namespace" term_id="namespace" >}}. +{{< note >}} +The `spec` of a {{< glossary_tooltip text="static Pod" term_id="static-pod" >}} cannot refer to a ConfigMap +or any other API objects. +{{< /note >}} + Here's an example ConfigMap that has some keys with single values, and other keys where the value looks like a fragment of a configuration format. diff --git a/content/en/docs/concepts/configuration/secret.md b/content/en/docs/concepts/configuration/secret.md index 45792179b8..5d30c80763 100644 --- a/content/en/docs/concepts/configuration/secret.md +++ b/content/en/docs/concepts/configuration/secret.md @@ -822,7 +822,10 @@ are obtained from the API server. This includes any Pods created using `kubectl`, or indirectly via a replication controller. It does not include Pods created as a result of the kubelet `--manifest-url` flag, its `--config` flag, or its REST API (these are -not common ways to create Pods.) +not common ways to create Pods). +The `spec` of a {{< glossary_tooltip text="static Pod" term_id="static-pod" >}} cannot refer to a Secret +or any other API objects. + Secrets must be created before they are consumed in Pods as environment variables unless they are marked as optional. References to secrets that do diff --git a/content/en/docs/concepts/workloads/pods/_index.md b/content/en/docs/concepts/workloads/pods/_index.md index 20dbdcb9e8..5a46fe4e07 100644 --- a/content/en/docs/concepts/workloads/pods/_index.md +++ b/content/en/docs/concepts/workloads/pods/_index.md @@ -282,6 +282,13 @@ on the Kubernetes API server for each static Pod. This means that the Pods running on a node are visible on the API server, but cannot be controlled from there. +{{< note >}} +The `spec` of a static Pod cannot refer to other API objects +(e.g., {{< glossary_tooltip text="ServiceAccount" term_id="service-account" >}}, +{{< glossary_tooltip text="ConfigMap" term_id="configmap" >}}, +{{< glossary_tooltip text="Secret" term_id="secret" >}}, etc). +{{< /note >}} + ## Container probes A _probe_ is a diagnostic performed periodically by the kubelet on a container. To perform a diagnostic, the kubelet can invoke different actions: diff --git a/content/en/docs/tasks/configure-pod-container/static-pod.md b/content/en/docs/tasks/configure-pod-container/static-pod.md index 9126243462..cc38928199 100644 --- a/content/en/docs/tasks/configure-pod-container/static-pod.md +++ b/content/en/docs/tasks/configure-pod-container/static-pod.md @@ -31,6 +31,13 @@ Pods to run a Pod on every node, you should probably be using a instead. {{< /note >}} +{{< note >}} +The `spec` of a static Pod cannot refer to other API objects +(e.g., {{< glossary_tooltip text="ServiceAccount" term_id="service-account" >}}, +{{< glossary_tooltip text="ConfigMap" term_id="configmap" >}}, +{{< glossary_tooltip text="Secret" term_id="secret" >}}, etc). +{{< /note >}} + ## {{% heading "prerequisites" %}} {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} From a17e7b61be2b57202d7f1159a3ffee271e07c24c Mon Sep 17 00:00:00 2001 From: Maciej Filocha Date: Sat, 24 Jul 2021 13:15:04 +0200 Subject: [PATCH 034/279] Update Polish README file Update Polish translation of main README file. Synced up to 9c7d7dcdf6a987bc40b18c5a23c981ff2737ecf5. --- README-pl.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/README-pl.md b/README-pl.md index ae25b89286..06bde04303 100644 --- a/README-pl.md +++ b/README-pl.md @@ -18,7 +18,7 @@ Aby móc skorzystać z tego repozytorium, musisz lokalnie zainstalować: - [npm](https://www.npmjs.com/) - [Go](https://golang.org/) - [Hugo (Extended version)](https://gohugo.io/) -- Środowisko obsługi kontenerów, np. [Docker-a](https://www.docker.com/). +- Środowisko obsługi kontenerów, np. [Dockera](https://www.docker.com/). Przed rozpoczęciem zainstaluj niezbędne zależności. Sklonuj repozytorium i przejdź do odpowiedniego katalogu: @@ -43,7 +43,9 @@ make container-image make container-serve ``` -Aby obejrzeć zawartość serwisu otwórz w przeglądarce adres http://localhost:1313. Po każdej zmianie plików źródłowych, Hugo automatycznie aktualizuje stronę i odświeża jej widok w przeglądarce. +Jeśli widzisz błędy, prawdopodobnie kontener z Hugo nie dysponuje wystarczającymi zasobami. Aby rozwiązać ten problem, zwiększ ilość dostępnych zasobów CPU i pamięci dla Dockera na Twojej maszynie ([MacOSX](https://docs.docker.com/docker-for-mac/#resources) i [Windows](https://docs.docker.com/docker-for-windows/#resources)). + +Aby obejrzeć zawartość serwisu, otwórz w przeglądarce adres http://localhost:1313. Po każdej zmianie plików źródłowych, Hugo automatycznie aktualizuje stronę i odświeża jej widok w przeglądarce. ## Jak uruchomić lokalną kopię strony przy pomocy Hugo? From c7a44f14ea611b770d8df9170bca2d4b4d8a6188 Mon Sep 17 00:00:00 2001 From: kartik494 Date: Mon, 19 Jul 2021 16:07:05 +0530 Subject: [PATCH 035/279] Modify documentation for stablestorage --- content/en/docs/concepts/workloads/controllers/statefulset.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/en/docs/concepts/workloads/controllers/statefulset.md b/content/en/docs/concepts/workloads/controllers/statefulset.md index 55a5cea332..34d0e4ee96 100644 --- a/content/en/docs/concepts/workloads/controllers/statefulset.md +++ b/content/en/docs/concepts/workloads/controllers/statefulset.md @@ -173,8 +173,7 @@ Cluster Domain will be set to `cluster.local` unless ### Stable Storage -Per each StatefulSet triggered pod Kubernetes creates a PersistentVolumeClaim object for each VolumeClaimTemplates entry defined in the StatefulSet object.In the nginx example above, each Pod will receive a single PersistentVolume -with a StorageClass of `my-storage-class` and 1 Gib of provisioned storage. If no StorageClass +For each VolumeClaimTemplate entry defined in a StatefulSet, each Pod receives one PersistentVolumeClaim. In the nginx example above, each Podreceives a single PersistentVolume with a StorageClass of `my-storage-class` and 1 Gib of provisioned storage. If no StorageClass is specified, then the default StorageClass will be used. When a Pod is (re)scheduled onto a node, its `volumeMounts` mount the PersistentVolumes associated with its PersistentVolume Claims. Note that, the PersistentVolumes associated with the From f4e6b418405aba4946cf111b31bd4facf340bffd Mon Sep 17 00:00:00 2001 From: chenxuc Date: Thu, 1 Jul 2021 19:32:32 +0800 Subject: [PATCH 036/279] improve hello-minikube page for dashboard --- content/en/docs/tutorials/hello-minikube.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/content/en/docs/tutorials/hello-minikube.md b/content/en/docs/tutorials/hello-minikube.md index 5193372920..3911ff2de6 100644 --- a/content/en/docs/tutorials/hello-minikube.md +++ b/content/en/docs/tutorials/hello-minikube.md @@ -60,11 +60,17 @@ If you installed minikube locally, run `minikube start`. Before you run `minikub 4. Katacoda environment only: Type `30000`, and then click **Display Port**. {{< note >}} -The `dashboard` command enables the dashboard add-on and opens the proxy in the default web browser. You can create Kubernetes resources on the dashboard such as Deployment and Service. +The `dashboard` command enables the dashboard add-on and opens the proxy in the default web browser. +You can create Kubernetes resources on the dashboard such as Deployment and Service. If you are running in an environment as root, see [Open Dashboard with URL](#open-dashboard-with-url). -To stop the proxy, run `Ctrl+C` to exit the process. The dashboard remains running. +By default, the dashboard is only accessible from within the internal Kubernetes virtual network. +The `dashboard` command creates a temporary proxy to make the dashboard accessible from outside the Kubernetes virtual network. + +To stop the proxy, run `Ctrl+C` to exit the process. +After the command exits, the dashboard remains running in Kubernetes cluster. +You can run the `dashboard` command again to create another proxy to access the dashboard. {{< /note >}} ## Open Dashboard with URL From d071289f7ea1fec50cb8701181c12cb28af3d25f Mon Sep 17 00:00:00 2001 From: "Claudia J. Kang" Date: Thu, 22 Jul 2021 21:20:33 +0900 Subject: [PATCH 037/279] [ko] Translate docs/tasks/administer-cluster/enabling-topology-aware-hints.md --- .../enabling-topology-aware-hints.md | 38 +++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 content/ko/docs/tasks/administer-cluster/enabling-topology-aware-hints.md diff --git a/content/ko/docs/tasks/administer-cluster/enabling-topology-aware-hints.md b/content/ko/docs/tasks/administer-cluster/enabling-topology-aware-hints.md new file mode 100644 index 0000000000..c0342fb377 --- /dev/null +++ b/content/ko/docs/tasks/administer-cluster/enabling-topology-aware-hints.md @@ -0,0 +1,38 @@ +--- +title: 토폴로지 인지 힌트 활성화하기 +content_type: task +min-kubernetes-server-version: 1.21 +--- + + +{{< feature-state for_k8s_version="v1.21" state="alpha" >}} + +_토폴로지 인지 힌트_ 는 {{< glossary_tooltip text="엔드포인트슬라이스(EndpointSlices)" term_id="endpoint-slice" >}}에 포함되어 있는 +토폴로지 정보를 이용해 토폴로지 인지 라우팅을 가능하게 한다. +이 방법은 트래픽을 해당 트래픽이 시작된 곳과 최대한 근접하도록 라우팅하는데, +이를 통해 비용을 줄이거나 네트워크 성능을 향상시킬 수 있다. + +## {{% heading "prerequisites" %}} + + {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} + +토폴로지 인지 힌트를 활성화하기 위해서는 다음의 필수 구성 요소가 필요하다. + +* {{< glossary_tooltip text="kube-proxy" term_id="kube-proxy" >}}가 + iptables 모드 혹은 IPVS 모드로 동작하도록 설정 +* 엔드포인트슬라이스가 비활성화되지 않았는지 확인 + +## 토폴로지 인지 힌트 활성화하기 + +서비스 토폴로지 힌트를 활성화하기 위해서는 kube-apiserver, kube-controller-manager, kube-proxy에 대해 +`TopologyAwareHints` [기능 게이트](/ko/docs/reference/command-line-tools-reference/feature-gates/)를 +활성화한다. + +``` +--feature-gates="TopologyAwareHints=true" +``` + +## {{% heading "whatsnext" %}} + +* 서비스 항목 아래의 [토폴로지 인지 힌트](/docs/concepts/services-networking/topology-aware-hints)를 참고 +* [서비스와 애플리케이션 연결하기](/ko/docs/concepts/services-networking/connect-applications-service/)를 참고 From 4bfd5a6acdc087f446c28fbedb464da79f9c0f9a Mon Sep 17 00:00:00 2001 From: seokho-son Date: Fri, 30 Jul 2021 15:14:59 +0900 Subject: [PATCH 038/279] Update outdated files in dev-1.21-ko.7 (m27) --- .../stateless-application/guestbook.md | 407 ++++++++++-------- 1 file changed, 220 insertions(+), 187 deletions(-) diff --git a/content/ko/docs/tutorials/stateless-application/guestbook.md b/content/ko/docs/tutorials/stateless-application/guestbook.md index 0aea000cd7..1a5e4a6079 100644 --- a/content/ko/docs/tutorials/stateless-application/guestbook.md +++ b/content/ko/docs/tutorials/stateless-application/guestbook.md @@ -14,7 +14,10 @@ source: https://cloud.google.com/kubernetes-engine/docs/tutorials/guestbook --- -이 튜토리얼에서는 쿠버네티스와 [Docker](https://www.docker.com/)를 사용하여 간단한 _(운영 수준이 아닌)_ 멀티 티어 웹 애플리케이션을 빌드하고 배포하는 방법을 보여준다. 이 예제는 다음과 같은 구성으로 이루어져 있다. +이 튜토리얼에서는 쿠버네티스와 [Docker](https://www.docker.com/)를 사용하여 간단한 +_(운영 수준이 아닌)_ 멀티 티어 웹 애플리케이션을 빌드하고 배포하는 방법을 보여준다. +이 예제는 다음과 같은 구성으로 +이루어져 있다. * 방명록 항목을 저장하기 위한 단일 인스턴스 [Redis](https://www.redis.com/) * 여러 개의 웹 프론트엔드 인스턴스 @@ -48,142 +51,157 @@ source: https://cloud.google.com/kubernetes-engine/docs/tutorials/guestbook 1. 매니페스트 파일을 다운로드한 디렉터리에서 터미널 창을 시작한다. 1. `redis-leader-deployment.yaml` 파일을 이용하여 Redis 디플로이먼트를 생성한다. - + - ```shell - kubectl apply -f https://k8s.io/examples/application/guestbook/redis-leader-deployment.yaml - ``` + ```shell + kubectl apply -f https://k8s.io/examples/application/guestbook/redis-leader-deployment.yaml + ``` 1. 파드의 목록을 질의하여 Redis 파드가 실행 중인지 확인한다. - ```shell - kubectl get pods - ``` + ```shell + kubectl get pods + ``` - 결과는 아래와 같은 형태로 나타난다. + 결과는 아래와 같은 형태로 나타난다. - ``` - NAME READY STATUS RESTARTS AGE - redis-leader-fb76b4755-xjr2n 1/1 Running 0 13s - ``` + ``` + NAME READY STATUS RESTARTS AGE + redis-leader-fb76b4755-xjr2n 1/1 Running 0 13s + ``` 2. Redis 리더 파드의 로그를 보려면 다음 명령어를 실행한다. - ```shell - kubectl logs -f deployment/redis-leader - ``` + ```shell + kubectl logs -f deployment/redis-leader + ``` ### Redis 리더 서비스 생성하기 -방명록 애플리케이션에서 데이터를 쓰려면 Redis와 통신해야 한다. Redis 파드로 트래픽을 프록시하려면 [서비스](/ko/docs/concepts/services-networking/service/)를 생성해야 한다. 서비스는 파드에 접근하기 위한 정책을 정의한다. +방명록 애플리케이션에서 데이터를 쓰려면 Redis와 통신해야 한다. +Redis 파드로 트래픽을 프록시하려면 [서비스](/ko/docs/concepts/services-networking/service/)를 생성해야 한다. +서비스는 파드에 접근하기 위한 정책을 +정의한다. {{< codenew file="application/guestbook/redis-leader-service.yaml" >}} 1. `redis-leader-service.yaml` 파일을 이용하여 Redis 서비스를 실행한다. - + - ```shell - kubectl apply -f https://k8s.io/examples/application/guestbook/redis-leader-service.yaml - ``` + ```shell + kubectl apply -f https://k8s.io/examples/application/guestbook/redis-leader-service.yaml + ``` 1. 서비스의 목록을 질의하여 Redis 서비스가 실행 중인지 확인한다. - ```shell - kubectl get service - ``` + ```shell + kubectl get service + ``` - 결과는 아래와 같은 형태로 나타난다. + 결과는 아래와 같은 형태로 나타난다. - ``` - NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE - kubernetes ClusterIP 10.0.0.1 443/TCP 1m - redis-leader ClusterIP 10.103.78.24 6379/TCP 16s - ``` + ``` + NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE + kubernetes ClusterIP 10.0.0.1 443/TCP 1m + redis-leader ClusterIP 10.103.78.24 6379/TCP 16s + ``` {{< note >}} -이 매니페스트 파일은 이전에 정의된 레이블과 일치하는 레이블 집합을 가진 `redis-leader`라는 서비스를 생성하므로, 서비스는 네트워크 트래픽을 Redis 파드로 라우팅한다. +이 매니페스트 파일은 이전에 정의된 레이블과 일치하는 레이블 집합을 가진 +`redis-leader`라는 서비스를 생성하므로, 서비스는 네트워크 트래픽을 +Redis 파드로 라우팅한다. {{< /note >}} ### Redis 팔로워 구성하기 -Redis 리더는 단일 파드이지만, 몇 개의 Redis 팔로워 또는 복제본을 추가하여 가용성을 높이고 트래픽 요구를 충족할 수 있다. +Redis 리더는 단일 파드이지만, 몇 개의 Redis 팔로워 또는 복제본을 추가하여 +가용성을 높이고 트래픽 요구를 충족할 수 있다. {{< codenew file="application/guestbook/redis-follower-deployment.yaml" >}} 1. `redis-follower-deployment.yaml` 파일을 이용하여 Redis 서비스를 실행한다. - + - ```shell - kubectl apply -f https://k8s.io/examples/application/guestbook/redis-follower-deployment.yaml - ``` + ```shell + kubectl apply -f https://k8s.io/examples/application/guestbook/redis-follower-deployment.yaml + ``` 1. 파드의 목록을 질의하여 2개의 Redis 팔로워 레플리카가 실행 중인지 확인한다. - ```shell - kubectl get pods - ``` + ```shell + kubectl get pods + ``` - 결과는 아래와 같은 형태로 나타난다. + 결과는 아래와 같은 형태로 나타난다. - ``` - NAME READY STATUS RESTARTS AGE - redis-follower-dddfbdcc9-82sfr 1/1 Running 0 37s - redis-follower-dddfbdcc9-qrt5k 1/1 Running 0 38s - redis-leader-fb76b4755-xjr2n 1/1 Running 0 11m - ``` + ``` + NAME READY STATUS RESTARTS AGE + redis-follower-dddfbdcc9-82sfr 1/1 Running 0 37s + redis-follower-dddfbdcc9-qrt5k 1/1 Running 0 38s + redis-leader-fb76b4755-xjr2n 1/1 Running 0 11m + ``` ### Redis 팔로워 서비스 생성하기 -방명록 애플리케이션이 데이터를 읽으려면 Redis 팔로워와 통신해야 한다. Redis 팔로워를 발견 가능(discoverable)하게 만드려면, 새로운 [서비스](/ko/docs/concepts/services-networking/service/)를 구성해야 한다. +방명록 애플리케이션이 데이터를 읽으려면 Redis 팔로워와 통신해야 한다. +Redis 팔로워를 발견 가능(discoverable)하게 만드려면, 새로운 +[서비스](/ko/docs/concepts/services-networking/service/)를 구성해야 한다. {{< codenew file="application/guestbook/redis-follower-service.yaml" >}} 1. `redis-follower-service.yaml` 파일을 이용하여 Redis 서비스를 실행한다. - + - ```shell - kubectl apply -f https://k8s.io/examples/application/guestbook/redis-follower-service.yaml - ``` + ```shell + kubectl apply -f https://k8s.io/examples/application/guestbook/redis-follower-service.yaml + ``` 1. 서비스의 목록을 질의하여 Redis 서비스가 실행 중인지 확인한다. - ```shell - kubectl get service - ``` + ```shell + kubectl get service + ``` - 결과는 아래와 같은 형태로 나타난다. + 결과는 아래와 같은 형태로 나타난다. - ``` - NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE - kubernetes ClusterIP 10.96.0.1 443/TCP 3d19h - redis-follower ClusterIP 10.110.162.42 6379/TCP 9s - redis-leader ClusterIP 10.103.78.24 6379/TCP 6m10s - ``` + ``` + NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE + kubernetes ClusterIP 10.96.0.1 443/TCP 3d19h + redis-follower ClusterIP 10.110.162.42 6379/TCP 9s + redis-leader ClusterIP 10.103.78.24 6379/TCP 6m10s + ``` {{< note >}} -이 매니페스트 파일은 이전에 정의된 레이블과 일치하는 레이블 집합을 가진 `redis-follower`라는 서비스를 생성하므로, 서비스는 네트워크 트래픽을 Redis 파드로 라우팅한다. +이 매니페스트 파일은 이전에 정의된 레이블과 일치하는 레이블 집합을 가진 +`redis-follower`라는 서비스를 생성하므로, 서비스는 네트워크 트래픽을 +Redis 파드로 라우팅한다. {{< /note >}} ## 방명록 프론트엔드를 설정하고 노출하기 -방명록을 위한 Redis 저장소를 구성하고 실행했으므로, 이제 방명록 웹 서버를 실행한다. Redis 팔로워와 마찬가지로, 프론트엔드는 쿠버네티스 디플로이먼트(Deployment)를 사용하여 배포된다. +방명록을 위한 Redis 저장소를 구성하고 실행했으므로, 이제 방명록 웹 서버를 실행한다. +Redis 팔로워와 마찬가지로, 프론트엔드는 쿠버네티스 디플로이먼트(Deployment)를 +사용하여 배포된다. -방명록 앱은 PHP 프론트엔드를 사용한다. DB에 대한 요청이 읽기인지 쓰기인지에 따라, Redis 팔로워 또는 리더 서비스와 통신하도록 구성된다. 프론트엔드는 JSON 인터페이스를 노출하고, jQuery-Ajax 기반 UX를 제공한다. +방명록 앱은 PHP 프론트엔드를 사용한다. DB에 대한 요청이 읽기인지 쓰기인지에 따라, +Redis 팔로워 또는 리더 서비스와 통신하도록 구성된다. 프론트엔드는 JSON 인터페이스를 +노출하고, +jQuery-Ajax 기반 UX를 제공한다. ### 방명록 프론트엔드의 디플로이먼트 생성하기 @@ -191,195 +209,210 @@ Redis 리더는 단일 파드이지만, 몇 개의 Redis 팔로워 또는 복제 1. `frontend-deployment.yaml` 파일을 이용하여 프론트엔드 디플로이먼트를 생성한다. - + - ```shell - kubectl apply -f https://k8s.io/examples/application/guestbook/frontend-deployment.yaml - ``` + ```shell + kubectl apply -f https://k8s.io/examples/application/guestbook/frontend-deployment.yaml + ``` 1. 파드의 목록을 질의하여 세 개의 프론트엔드 복제본이 실행되고 있는지 확인한다. - ```shell - kubectl get pods -l app=guestbook -l tier=frontend - ``` + ```shell + kubectl get pods -l app=guestbook -l tier=frontend + ``` - 결과는 아래와 같은 형태로 나타난다. + 결과는 아래와 같은 형태로 나타난다. - ``` - NAME READY STATUS RESTARTS AGE - frontend-85595f5bf9-5tqhb 1/1 Running 0 47s - frontend-85595f5bf9-qbzwm 1/1 Running 0 47s - frontend-85595f5bf9-zchwc 1/1 Running 0 47s - ``` + ``` + NAME READY STATUS RESTARTS AGE + frontend-85595f5bf9-5tqhb 1/1 Running 0 47s + frontend-85595f5bf9-qbzwm 1/1 Running 0 47s + frontend-85595f5bf9-zchwc 1/1 Running 0 47s + ``` ### 프론트엔드 서비스 생성하기 -서비스의 기본 유형은 [ClusterIP](/ko/docs/concepts/services-networking/service/#publishing-services-service-types)이기 때문에 생성한 `Redis` 서비스는 컨테이너 클러스터 내에서만 접근할 수 있다. `ClusterIP`는 서비스가 가리키는 파드 집합에 대한 단일 IP 주소를 제공한다. 이 IP 주소는 클러스터 내에서만 접근할 수 있다. +서비스의 기본 유형은 +[ClusterIP](/ko/docs/concepts/services-networking/service/#publishing-services-service-types) +이기 때문에 생성한 `Redis` 서비스는 컨테이너 클러스터 내에서만 접근할 수 있다. +`ClusterIP`는 서비스가 가리키는 파드 집합에 대한 +단일 IP 주소를 제공한다. 이 IP 주소는 클러스터 내에서만 접근할 수 있다. -게스트가 방명록에 접근할 수 있도록 하려면, 외부에서 볼 수 있도록 프론트엔드 서비스를 구성해야 한다. 그렇게 하면 클라이언트가 쿠버네티스 클러스터 외부에서 서비스를 요청할 수 있다. 그러나 쿠버네티스 사용자는 `ClusterIP`를 사용하더라도 `kubectl port-forward`를 사용해서 서비스에 접근할 수 있다. +게스트가 방명록에 접근할 수 있도록 하려면, 외부에서 볼 수 있도록 프론트엔드 +서비스를 구성해야 한다. 그렇게 하면 클라이언트가 쿠버네티스 클러스터 외부에서 +서비스를 요청할 수 있다. 그러나 쿠버네티스 사용자는 `ClusterIP`를 +사용하더라도 `kubectl port-forward`를 사용해서 서비스에 +접근할 수 있다. {{< note >}} -Google Compute Engine 또는 Google Kubernetes Engine과 같은 일부 클라우드 공급자는 외부 로드 밸런서를 지원한다. 클라우드 공급자가 로드 밸런서를 지원하고 이를 사용하려면 `type : LoadBalancer`의 주석을 제거해야 한다. +Google Compute Engine 또는 Google Kubernetes Engine +과 같은 일부 클라우드 공급자는 외부 로드 밸런서를 지원한다. 클라우드 공급자가 로드 +밸런서를 지원하고 이를 사용하려면 `type : LoadBalancer`의 주석을 제거해야 한다. {{< /note >}} {{< codenew file="application/guestbook/frontend-service.yaml" >}} 1. `frontend-service.yaml` 파일을 이용하여 프론트엔드 서비스를 실행한다. - + - ```shell - kubectl apply -f https://k8s.io/examples/application/guestbook/frontend-service.yaml - ``` + ```shell + kubectl apply -f https://k8s.io/examples/application/guestbook/frontend-service.yaml + ``` 1. 서비스의 목록을 질의하여 프론트엔드 서비스가 실행 중인지 확인한다. - ```shell - kubectl get services - ``` + ```shell + kubectl get services + ``` - 결과는 아래와 같은 형태로 나타난다. + 결과는 아래와 같은 형태로 나타난다. - ``` - NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE - frontend ClusterIP 10.97.28.230 80/TCP 19s - kubernetes ClusterIP 10.96.0.1 443/TCP 3d19h - redis-follower ClusterIP 10.110.162.42 6379/TCP 5m48s - redis-leader ClusterIP 10.103.78.24 6379/TCP 11m - ``` + ``` + NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE + frontend ClusterIP 10.97.28.230 80/TCP 19s + kubernetes ClusterIP 10.96.0.1 443/TCP 3d19h + redis-follower ClusterIP 10.110.162.42 6379/TCP 5m48s + redis-leader ClusterIP 10.103.78.24 6379/TCP 11m + ``` ### `kubectl port-forward`를 통해 프론트엔드 서비스 확인하기 1. 다음 명령어를 실행해서 로컬 머신의 `8080` 포트를 서비스의 `80` 포트로 전달한다. - ```shell - kubectl port-forward svc/frontend 8080:80 - ``` + ```shell + kubectl port-forward svc/frontend 8080:80 + ``` - 결과는 아래와 같은 형태로 나타난다. + 결과는 아래와 같은 형태로 나타난다. - ``` - Forwarding from 127.0.0.1:8080 -> 80 - Forwarding from [::1]:8080 -> 80 - ``` + ``` + Forwarding from 127.0.0.1:8080 -> 80 + Forwarding from [::1]:8080 -> 80 + ``` 1. 방명록을 보기 위해 브라우저에서 [http://localhost:8080](http://localhost:8080) 페이지를 로드한다. ### `LoadBalancer`를 통해 프론트엔드 서비스 확인하기 -`frontend-service.yaml` 매니페스트를 `LoadBalancer`와 함께 배포한 경우, 방명록을 보기 위해 IP 주소를 찾아야 한다. +`frontend-service.yaml` 매니페스트를 `LoadBalancer`와 함께 배포한 경우, +방명록을 보기 위해 IP 주소를 찾아야 한다. 1. 프론트엔드 서비스의 IP 주소를 얻기 위해 아래 명령어를 실행한다. - ```shell - kubectl get service frontend - ``` + ```shell + kubectl get service frontend + ``` - 결과는 아래와 같은 형태로 나타난다. + 결과는 아래와 같은 형태로 나타난다. - ``` - NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE - frontend LoadBalancer 10.51.242.136 109.197.92.229 80:32372/TCP 1m - ``` + ``` + NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE + frontend LoadBalancer 10.51.242.136 109.197.92.229 80:32372/TCP 1m + ``` 1. IP 주소를 복사하고, 방명록을 보기 위해 브라우저에서 페이지를 로드한다. {{< note >}} -메시지를 입력하고 'Submit'을 클릭하여 방명록에 글을 작성해 본다. 입력한 메시지가 프론트엔드에 나타난다. 이 메시지는 앞서 생성한 서비스를 통해 데이터가 Redis에 성공적으로 입력되었음을 나타낸다. +메시지를 입력하고 'Submit'을 클릭하여 방명록에 글을 작성해 본다. +입력한 메시지가 프론트엔드에 나타난다. 이 메시지는 앞서 생성한 서비스를 +통해 데이터가 Redis에 성공적으로 입력되었음을 나타낸다. {{< /note >}} ## 웹 프론트엔드 확장하기 -서버가 디플로이먼트 컨트롤러를 사용하는 서비스로 정의되어 있으므로 필요에 따라 확장 또는 축소할 수 있다. +서버가 디플로이먼트 컨트롤러를 사용하는 서비스로 정의되어 있으므로 +필요에 따라 확장 또는 축소할 수 있다. 1. 프론트엔드 파드의 수를 확장하기 위해 아래 명령어를 실행한다. - ```shell - kubectl scale deployment frontend --replicas=5 - ``` + ```shell + kubectl scale deployment frontend --replicas=5 + ``` 1. 파드의 목록을 질의하여 실행 중인 프론트엔드 파드의 수를 확인한다. - ```shell - kubectl get pods - ``` + ```shell + kubectl get pods + ``` - 결과는 아래와 같은 형태로 나타난다. + 결과는 아래와 같은 형태로 나타난다. - ``` - NAME READY STATUS RESTARTS AGE - frontend-85595f5bf9-5df5m 1/1 Running 0 83s - frontend-85595f5bf9-7zmg5 1/1 Running 0 83s - frontend-85595f5bf9-cpskg 1/1 Running 0 15m - frontend-85595f5bf9-l2l54 1/1 Running 0 14m - frontend-85595f5bf9-l9c8z 1/1 Running 0 14m - redis-follower-dddfbdcc9-82sfr 1/1 Running 0 97m - redis-follower-dddfbdcc9-qrt5k 1/1 Running 0 97m - redis-leader-fb76b4755-xjr2n 1/1 Running 0 108m - ``` + ``` + NAME READY STATUS RESTARTS AGE + frontend-85595f5bf9-5df5m 1/1 Running 0 83s + frontend-85595f5bf9-7zmg5 1/1 Running 0 83s + frontend-85595f5bf9-cpskg 1/1 Running 0 15m + frontend-85595f5bf9-l2l54 1/1 Running 0 14m + frontend-85595f5bf9-l9c8z 1/1 Running 0 14m + redis-follower-dddfbdcc9-82sfr 1/1 Running 0 97m + redis-follower-dddfbdcc9-qrt5k 1/1 Running 0 97m + redis-leader-fb76b4755-xjr2n 1/1 Running 0 108m + ``` 1. 프론트엔드 파드의 수를 축소하기 위해 아래 명령어를 실행한다. - ```shell - kubectl scale deployment frontend --replicas=2 - ``` + ```shell + kubectl scale deployment frontend --replicas=2 + ``` 1. 파드의 목록을 질의하여 실행 중인 프론트엔드 파드의 수를 확인한다. - ```shell - kubectl get pods - ``` + ```shell + kubectl get pods + ``` - 결과는 아래와 같은 형태로 나타난다. + 결과는 아래와 같은 형태로 나타난다. - ``` - NAME READY STATUS RESTARTS AGE - frontend-85595f5bf9-cpskg 1/1 Running 0 16m - frontend-85595f5bf9-l9c8z 1/1 Running 0 15m - redis-follower-dddfbdcc9-82sfr 1/1 Running 0 98m - redis-follower-dddfbdcc9-qrt5k 1/1 Running 0 98m - redis-leader-fb76b4755-xjr2n 1/1 Running 0 109m - ``` + ``` + NAME READY STATUS RESTARTS AGE + frontend-85595f5bf9-cpskg 1/1 Running 0 16m + frontend-85595f5bf9-l9c8z 1/1 Running 0 15m + redis-follower-dddfbdcc9-82sfr 1/1 Running 0 98m + redis-follower-dddfbdcc9-qrt5k 1/1 Running 0 98m + redis-leader-fb76b4755-xjr2n 1/1 Running 0 109m + ``` ## {{% heading "cleanup" %}} -디플로이먼트 및 서비스를 삭제하면 실행 중인 모든 파드도 삭제된다. 레이블을 사용하여 하나의 명령어로 여러 자원을 삭제해보자. +디플로이먼트 및 서비스를 삭제하면 실행 중인 모든 파드도 삭제된다. +레이블을 사용하여 하나의 명령어로 여러 자원을 삭제해보자. 1. 모든 파드, 디플로이먼트, 서비스를 삭제하기 위해 아래 명령어를 실행한다. - ```shell - kubectl delete deployment -l app=redis - kubectl delete service -l app=redis - kubectl delete deployment frontend - kubectl delete service frontend - ``` + ```shell + kubectl delete deployment -l app=redis + kubectl delete service -l app=redis + kubectl delete deployment frontend + kubectl delete service frontend + ``` - 결과는 아래와 같은 형태로 나타난다. + 결과는 아래와 같은 형태로 나타난다. - ``` - deployment.apps "redis-follower" deleted - deployment.apps "redis-leader" deleted - deployment.apps "frontend" deleted - service "frontend" deleted - ``` + ``` + deployment.apps "redis-follower" deleted + deployment.apps "redis-leader" deleted + deployment.apps "frontend" deleted + service "frontend" deleted + ``` 1. 파드의 목록을 질의하여 실행 중인 파드가 없는지 확인한다. - ```shell - kubectl get pods - ``` + ```shell + kubectl get pods + ``` - 결과는 아래와 같은 형태로 나타난다. + 결과는 아래와 같은 형태로 나타난다. - ``` - No resources found in default namespace. - ``` + ``` + No resources found in default namespace. + ``` ## {{% heading "whatsnext" %}} From 7f9d3e3f90fc61d0c3797950442c06f63ee68833 Mon Sep 17 00:00:00 2001 From: RA489 Date: Thu, 10 Jun 2021 16:24:23 +0530 Subject: [PATCH 039/279] Update activeDeadlineSeconds with Pod page --- .../en/docs/concepts/workloads/pods/init-containers.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/content/en/docs/concepts/workloads/pods/init-containers.md b/content/en/docs/concepts/workloads/pods/init-containers.md index c73bba5517..8ffe3ac288 100644 --- a/content/en/docs/concepts/workloads/pods/init-containers.md +++ b/content/en/docs/concepts/workloads/pods/init-containers.md @@ -278,9 +278,11 @@ Init containers have all of the fields of an app container. However, Kubernetes prohibits `readinessProbe` from being used because init containers cannot define readiness distinct from completion. This is enforced during validation. -Use `activeDeadlineSeconds` on the Pod and `livenessProbe` on the container to -prevent init containers from failing forever. The active deadline includes init -containers. +Use `activeDeadlineSeconds` on the Pod to prevent init containers from failing forever. +The active deadline includes init containers. +However it is recommended to use `activeDeadlineSeconds` if user deploy their application +as a Job, because `activeDeadlineSeconds` has an effect even after initContainer finished. +The Pod which is already running correctly would be killed by `activeDeadlineSeconds` if you set. The name of each app and init container in a Pod must be unique; a validation error is thrown for any container sharing a name with another. From a850ca2fc24da59fb5f32fb7ede83954999ed92a Mon Sep 17 00:00:00 2001 From: "Claudia J. Kang" Date: Fri, 30 Jul 2021 23:16:17 +0900 Subject: [PATCH 040/279] [ko] Update outdated files in dev-1.21-ko.7 (p3) This commit fixes M20~M26 on 28963. --- .../create-cluster/cluster-interactive.html | 4 ++-- .../kubernetes-basics/deploy-app/deploy-interactive.html | 5 +++-- .../kubernetes-basics/explore/explore-interactive.html | 5 +++-- .../tutorials/kubernetes-basics/explore/explore-intro.html | 4 ++-- .../kubernetes-basics/expose/expose-interactive.html | 4 +++- .../tutorials/kubernetes-basics/scale/scale-interactive.html | 5 +++-- .../kubernetes-basics/update/update-interactive.html | 3 ++- 7 files changed, 18 insertions(+), 12 deletions(-) diff --git a/content/ko/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html b/content/ko/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html index d9d621d867..fcad9b42b3 100644 --- a/content/ko/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html +++ b/content/ko/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html @@ -25,8 +25,8 @@ weight: 20
    - - 모듈 2로 진행하기› + 홈으로 이동 + 모듈 2로 진행하기 >
    diff --git a/content/ko/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html b/content/ko/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html index 2cf9daa6e1..ce5be2cfc0 100644 --- a/content/ko/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html +++ b/content/ko/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html @@ -37,8 +37,9 @@ weight: 20
    - - 모듈 3으로 진행하기› + < 모듈 1로 돌아가기 + 홈으로 이동 + 모듈 3으로 진행하기 >
    diff --git a/content/ko/docs/tutorials/kubernetes-basics/explore/explore-interactive.html b/content/ko/docs/tutorials/kubernetes-basics/explore/explore-interactive.html index f82846a390..e3b67a1dae 100644 --- a/content/ko/docs/tutorials/kubernetes-basics/explore/explore-interactive.html +++ b/content/ko/docs/tutorials/kubernetes-basics/explore/explore-interactive.html @@ -29,8 +29,9 @@ weight: 20
    - 모듈 4로 - 진행하기› + < 모듈 2로 돌아가기 + 홈으로 이동 + 모듈 4로 진행하기 >
    diff --git a/content/ko/docs/tutorials/kubernetes-basics/explore/explore-intro.html b/content/ko/docs/tutorials/kubernetes-basics/explore/explore-intro.html index 2e34002571..e218222010 100644 --- a/content/ko/docs/tutorials/kubernetes-basics/explore/explore-intro.html +++ b/content/ko/docs/tutorials/kubernetes-basics/explore/explore-intro.html @@ -74,11 +74,11 @@ weight: 10

    노드

    -

    파드는 언제나 노드 상에서 동작한다. 노드는 쿠버네티스에서 워커 머신을 말하며 클러스터에 따라 가상 또는 물리 머신일 수 있다. 각 노드는 마스터에 의해 관리된다. 하나의 노드는 여러 개의 파드를 가질 수 있고, 쿠버네티스 마스터는 클러스터 내 노드를 통해서 파드에 대한 스케쥴링을 자동으로 처리한다.

    +

    파드는 언제나 노드 상에서 동작한다. 노드는 쿠버네티스에서 워커 머신을 말하며 클러스터에 따라 가상 또는 물리 머신일 수 있다. 각 노드는 컨트롤 플레인에 의해 관리된다. 하나의 노드는 여러 개의 파드를 가질 수 있고, 쿠버네티스 컨트롤 플레인은 클러스터 내 노드를 통해서 파드에 대한 스케쥴링을 자동으로 처리한다. 컨트롤 플레인의 자동 스케줄링은 각 노드의 사용 가능한 리소스를 모두 고려합니다.

    모든 쿠버네티스 노드는 최소한 다음과 같이 동작한다.

      -
    • Kubelet은, 쿠버네티스 마스터와 노드 간 통신을 책임지는 프로세스이며, 하나의 머신 상에서 동작하는 파드와 컨테이너를 관리한다.
      • +
    • Kubelet은, 쿠버네티스 컨트롤 플레인과 노드 간 통신을 책임지는 프로세스이며, 하나의 머신 상에서 동작하는 파드와 컨테이너를 관리한다.
    • 컨테이너 런타임(도커와 같은)은 레지스트리에서 컨테이너 이미지를 가져와 묶여 있는 것을 풀고 애플리케이션을 동작시키는 책임을 맡는다.
    diff --git a/content/ko/docs/tutorials/kubernetes-basics/expose/expose-interactive.html b/content/ko/docs/tutorials/kubernetes-basics/expose/expose-interactive.html index bfbb0eb1c8..09dde78cb8 100644 --- a/content/ko/docs/tutorials/kubernetes-basics/expose/expose-interactive.html +++ b/content/ko/docs/tutorials/kubernetes-basics/expose/expose-interactive.html @@ -26,7 +26,9 @@ weight: 20
    - 모듈 5로 진행하기› + < 모듈 3으로 돌아가기 + 홈으로 이동 + 모듈 5로 진행하기 >
    diff --git a/content/ko/docs/tutorials/kubernetes-basics/scale/scale-interactive.html b/content/ko/docs/tutorials/kubernetes-basics/scale/scale-interactive.html index 31c1d859a2..22b5d41342 100644 --- a/content/ko/docs/tutorials/kubernetes-basics/scale/scale-interactive.html +++ b/content/ko/docs/tutorials/kubernetes-basics/scale/scale-interactive.html @@ -26,8 +26,9 @@ weight: 20
    - - 모듈 6으로 진행하기› + < 모듈 4로 돌아가기 + 홈으로 이동 + 모듈 6으로 진행하기 >
    diff --git a/content/ko/docs/tutorials/kubernetes-basics/update/update-interactive.html b/content/ko/docs/tutorials/kubernetes-basics/update/update-interactive.html index 24da082b89..4038e3b358 100644 --- a/content/ko/docs/tutorials/kubernetes-basics/update/update-interactive.html +++ b/content/ko/docs/tutorials/kubernetes-basics/update/update-interactive.html @@ -26,7 +26,8 @@ weight: 20
    - 쿠버네티스 기초로 돌아가기› + < 모듈 5로 돌아가기 + 쿠버네티스 기초로 돌아가기
    From d818691764d4afe5892044b4bb8494396d50a2a1 Mon Sep 17 00:00:00 2001 From: Anushka Mittal <55237170+anushkamittal20@users.noreply.github.com> Date: Fri, 30 Jul 2021 19:54:24 +0530 Subject: [PATCH 041/279] Update wrong link in assign-pod-node.md --- content/ko/docs/concepts/scheduling-eviction/assign-pod-node.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/ko/docs/concepts/scheduling-eviction/assign-pod-node.md b/content/ko/docs/concepts/scheduling-eviction/assign-pod-node.md index 8a7f2ccc7b..f46e075b57 100644 --- a/content/ko/docs/concepts/scheduling-eviction/assign-pod-node.md +++ b/content/ko/docs/concepts/scheduling-eviction/assign-pod-node.md @@ -72,7 +72,7 @@ spec: ## 넘어가기 전에: 내장 노드 레이블들 {#built-in-node-labels} [붙인](#1-단계-노드에-레이블-붙이기) 레이블뿐만 아니라, 노드에는 -표준 레이블 셋이 미리 채워져 있다. 이들 목록은 [잘 알려진 레이블, 어노테이션 및 테인트](/docs/reference/labels-annotations-taints/)를 참고한다. +표준 레이블 셋이 미리 채워져 있다. 이들 목록은 [잘 알려진 레이블, 어노테이션 및 테인트](/ko/docs/reference/labels-annotations-taints/)를 참고한다. {{< note >}} 이 레이블들의 값은 클라우드 공급자에 따라 다르고 신뢰성이 보장되지 않는다. From 11ded1cca1bfbe82aa0482fe5f575b4833be3f7a Mon Sep 17 00:00:00 2001 From: Aris Cahyadi Risdianto Date: Sat, 31 Jul 2021 15:16:01 +0700 Subject: [PATCH 042/279] rename "Job" Concept page. --- content/id/docs/concepts/_index.md | 2 +- content/id/docs/concepts/configuration/overview.md | 2 +- .../controllers/{jobs-run-to-completion.md => job.md} | 2 +- .../docs/concepts/workloads/controllers/ttlafterfinished.md | 4 ++-- content/id/docs/tasks/job/automated-tasks-with-cron-jobs.md | 4 ++-- static/_redirects | 6 +++++- 6 files changed, 12 insertions(+), 8 deletions(-) rename content/id/docs/concepts/workloads/controllers/{jobs-run-to-completion.md => job.md} (99%) diff --git a/content/id/docs/concepts/_index.md b/content/id/docs/concepts/_index.md index 33f4ada445..623b3fac3a 100644 --- a/content/id/docs/concepts/_index.md +++ b/content/id/docs/concepts/_index.md @@ -61,7 +61,7 @@ Kontroler merupakan objek mendasar dengan fungsi tambahan, contoh dari kontroler * [Deployment](/id/docs/concepts/workloads/controllers/deployment/) * [StatefulSet](/id/docs/concepts/workloads/controllers/statefulset/) * [DaemonSet](/id/docs/concepts/workloads/controllers/daemonset/) -* [Job](/id/docs/concepts/workloads/controllers/jobs-run-to-completion/) +* [Job](/id/docs/concepts/workloads/controllers/job/) ## *Control Plane* Kubernetes diff --git a/content/id/docs/concepts/configuration/overview.md b/content/id/docs/concepts/configuration/overview.md index 67fb2061fe..51fb10f5ef 100644 --- a/content/id/docs/concepts/configuration/overview.md +++ b/content/id/docs/concepts/configuration/overview.md @@ -34,7 +34,7 @@ Dokumentasi ini terbuka. Jika Anda menemukan sesuatu yang tidak ada dalam daftar - Jangan gunakan Pods naked (artinya, Pods tidak terikat dengan a [ReplicaSet](/id/docs/concepts/workloads/controllers/replicaset/) a [Deployment](/id/docs/concepts/workloads/controllers/deployment/)) jika kamu bisa menghindarinya. Pod naked tidak akan dijadwal ulang jika terjadi kegagalan pada node. - Deployment, yang keduanya menciptakan ReplicaSet untuk memastikan bahwa jumlah Pod yang diinginkan selalu tersedia, dan menentukan strategi untuk mengganti Pods (seperti [RollingUpdate](/id/docs/concepts/workloads/controllers/deployment/#rolling-update-deployment)), hampir selalu lebih disukai daripada membuat Pods secara langsung, kecuali untuk beberapa yang eksplisit [`restartPolicy: Never`](/id/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy) banyak skenario . A [Job](/id/docs/concepts/workloads/controllers/jobs-run-to-completion/) mungkin juga sesuai. + Deployment, yang keduanya menciptakan ReplicaSet untuk memastikan bahwa jumlah Pod yang diinginkan selalu tersedia, dan menentukan strategi untuk mengganti Pods (seperti [RollingUpdate](/id/docs/concepts/workloads/controllers/deployment/#rolling-update-deployment)), hampir selalu lebih disukai daripada membuat Pods secara langsung, kecuali untuk beberapa yang eksplisit [`restartPolicy: Never`](/id/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy) banyak skenario . A [Job](/id/docs/concepts/workloads/controllers/job/) mungkin juga sesuai. ## Services diff --git a/content/id/docs/concepts/workloads/controllers/jobs-run-to-completion.md b/content/id/docs/concepts/workloads/controllers/job.md similarity index 99% rename from content/id/docs/concepts/workloads/controllers/jobs-run-to-completion.md rename to content/id/docs/concepts/workloads/controllers/job.md index 5f4720646b..4a7cce3f2a 100644 --- a/content/id/docs/concepts/workloads/controllers/jobs-run-to-completion.md +++ b/content/id/docs/concepts/workloads/controllers/job.md @@ -1,5 +1,5 @@ --- -title: Job - Dijalankan Hingga Selesai +title: Jobs content_type: concept feature: title: Eksekusi batch diff --git a/content/id/docs/concepts/workloads/controllers/ttlafterfinished.md b/content/id/docs/concepts/workloads/controllers/ttlafterfinished.md index 97aa5a47f3..0f462008ee 100644 --- a/content/id/docs/concepts/workloads/controllers/ttlafterfinished.md +++ b/content/id/docs/concepts/workloads/controllers/ttlafterfinished.md @@ -10,7 +10,7 @@ weight: 65 Pengendali TTL menyediakan mekanisme TTL yang membatasi umur dari suatu objek sumber daya yang telah selesai digunakan. Pengendali TTL untuk saat ini hanya menangani -[Jobs](/id/docs/concepts/workloads/controllers/jobs-run-to-completion/), +{{< glossary_tooltip text="Jobs" term_id="job" >}}, dan nantinya bisa saja digunakan untuk sumber daya lain yang telah selesai digunakan misalnya saja Pod atau sumber daya khusus (_custom resource_) lainnya. @@ -32,7 +32,7 @@ Pengendali TTL untuk saat ini hanya mendukung Job. Sebuah operator klaster dapat menggunakan fitur ini untuk membersihkan Job yang telah dieksekusi (baik `Complete` atau `Failed`) secara otomatis dengan menentukan _field_ `.spec.ttlSecondsAfterFinished` pada Job, seperti yang tertera di -[contoh](/id/docs/concepts/workloads/controllers/jobs-run-to-completion/#clean-up-finished-jobs-automatically). +[contoh](/id/docs/concepts/workloads/controllers/job/#clean-up-finished-jobs-automatically). Pengendali TTL akan berasumsi bahwa sebuah sumber daya dapat dihapus apabila TTL dari sumber daya tersebut telah habis. Proses dihapusnya sumber daya ini dilakukan secara berantai, dimana sumber daya lain yang diff --git a/content/id/docs/tasks/job/automated-tasks-with-cron-jobs.md b/content/id/docs/tasks/job/automated-tasks-with-cron-jobs.md index 0e4732848e..5a850cb739 100644 --- a/content/id/docs/tasks/job/automated-tasks-with-cron-jobs.md +++ b/content/id/docs/tasks/job/automated-tasks-with-cron-jobs.md @@ -162,8 +162,8 @@ Sebuah tanda tanya (`?`) dalam penjadwalan memiliki makna yang sama dengan tanda ### Templat Job `.spec.JobTemplate` adalah templat untuk sebuah Job, dan itu wajib. -Templat Job memiliki skema yang sama dengan [Job](/id/docs/concepts/workloads/controllers/jobs-run-to-completion/), kecuali jika bersarang dan tidak memiliki sebuah `apiVersion` atau `kind`. -Untuk informasi lebih lanjut tentang menulis sebuah Job `.spec` lihat [Menulis spesifikasi Job](/id/docs/concepts/workloads/controllers/jobs-run-to-completion/#writing-a-job-spec). +Templat Job memiliki skema yang sama dengan [Job](/id/docs/concepts/workloads/controllers/job/), kecuali jika bersarang dan tidak memiliki sebuah `apiVersion` atau `kind`. +Untuk informasi lebih lanjut tentang menulis sebuah Job `.spec` lihat [Menulis spesifikasi Job](/id/docs/concepts/workloads/controllers/job/#writing-a-job-spec). ### _Starting Deadline_ diff --git a/static/_redirects b/static/_redirects index b504201d9a..a46cc64c38 100644 --- a/static/_redirects +++ b/static/_redirects @@ -92,7 +92,7 @@ /docs/concepts/cluster-administration/kubelet-garbage-collection/ /docs/concepts/architecture/garbage-collection/#containers-images 301 /docs/concepts/cluster-administration/master-node-communication/ /docs/concepts/architecture/master-node-communication/ 301 /docs/concepts/cluster-administration/network-plugins/ /docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/ 301 -/docs/concepts/cluster-administration/out-of-resource/ /docs/concepts/scheduling-eviction/node-pressure-eviction/ 301 +/docs/concepts/cluster-administration/out-of-resource/ /docs/concepts/scheduling-eviction/node-pressure-eviction/ 301 /docs/concepts/cluster-administration/resource-usage-monitoring /docs/tasks/debug-application-cluster/resource-usage-monitoring/ 301 /docs/concepts/cluster-administration/monitoring/ /docs/concepts/cluster-administration/system-metrics/ 301 /docs/concepts/cluster-administration/controller-metrics/ /docs/concepts/cluster-administration/system-metrics/ 301 @@ -116,6 +116,7 @@ /docs/concepts/extend-kubernetes/extend-cluster/ /docs/concepts/extend-kubernetes/ 301 /docs/concepts/jobs/cron-jobs/ /docs/concepts/workloads/controllers/cron-jobs/ 301 /docs/concepts/jobs/run-to-completion-finite-workloads/ /docs/concepts/workloads/controllers/job/ 301 +/id/docs/concepts/jobs/run-to-completion-finite-workloads/ /id/docs/concepts/workloads/controllers/job/ 301 /docs/concepts/nodes/node/ /docs/concepts/architecture/nodes/ 301 /docs/concepts/object-metadata/annotations/ /docs/concepts/overview/working-with-objects/annotations/ 301 /docs/concepts/overview/ /docs/concepts/overview/what-is-kubernetes/ 301 @@ -151,6 +152,7 @@ /docs/concepts/workloads/controllers/deployment/docs/concepts/workloads/pods/pod/ /docs/concepts/workloads/pods/ 301 /docs/concepts/workloads/controllers/garbage-collection/ /docs/concepts/architecture/garbage-collection/ 301 /docs/concepts/workloads/controllers/jobs-run-to-completion/ /docs/concepts/workloads/controllers/job/ 301 +/id/docs/concepts/workloads/controllers/jobs-run-to-completion/ /id/docs/concepts/workloads/controllers/job/ 301 /docs/concepts/workloads/controllers/statefulsets/ /docs/concepts/workloads/controllers/statefulset/ 301 /docs/concepts/workloads/controllers/statefulset.md /docs/concepts/workloads/controllers/statefulset/ 301! /docs/concepts/workloads/pods/pod/ /docs/concepts/workloads/pods/ 301 @@ -294,6 +296,7 @@ /docs/tasks/configure-pod-container/weave-network-policy/ /docs/tasks/administer-cluster/weave-network-policy/ 301 /docs/tasks/debug-application-cluster/sematext-logging-monitoring/ https://sematext.com/kubernetes/ 301 /docs/tasks/job/work-queue-1/ /docs/concepts/workloads/controllers/job/ 301 +/id/docs/tasks/job/work-queue-1/ /id/docs/concepts/workloads/controllers/job/ 301 /docs/tasks/setup-konnectivity/setup-konnectivity/ /docs/tasks/extend-kubernetes/setup-konnectivity/ 301 /docs/tasks/kubectl/get-shell-running-container/ /docs/tasks/debug-application-cluster/get-shell-running-container/ 301 /docs/tasks/kubectl/install/ /docs/tasks/tools/ 301 @@ -387,6 +390,7 @@ /docs/user-guide/introspection-and-debugging/ /docs/tasks/debug-application-cluster/debug-application-introspection/ 301 /docs/user-guide/jsonpath/ /docs/reference/kubectl/jsonpath/ /docs/user-guide/jobs/ /docs/concepts/workloads/controllers/job/ 301 +/id/docs/user-guide/jobs/ /id/docs/concepts/workloads/controllers/job/ 301 /docs/user-guide/jobs/expansions/ /docs/tasks/job/parallel-processing-expansion/ 301 /docs/user-guide/jobs/work-queue-1/ /docs/tasks/job/coarse-parallel-processing-work-queue/ 301 /docs/user-guide/jobs/work-queue-2/ /docs/tasks/job/fine-parallel-processing-work-queue/ 301 From 506dc498ab0b797c2ac020a19a158679fe011dfa Mon Sep 17 00:00:00 2001 From: Arhell Date: Sat, 31 Jul 2021 14:30:09 +0300 Subject: [PATCH 043/279] [ja] update link to Flannel --- content/ja/docs/concepts/cluster-administration/addons.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/ja/docs/concepts/cluster-administration/addons.md b/content/ja/docs/concepts/cluster-administration/addons.md index b50beb85f5..c07cfce07c 100644 --- a/content/ja/docs/concepts/cluster-administration/addons.md +++ b/content/ja/docs/concepts/cluster-administration/addons.md @@ -23,7 +23,7 @@ content_type: concept * [CNI-Genie](https://github.com/Huawei-PaaS/CNI-Genie)は、KubernetesをCalico、Canal、Flannel、Romana、Weaveなど選択したCNIプラグインをシームレスに接続できるようにするプラグインです。 * [Contiv](https://contiv.github.io)は、さまざまなユースケースと豊富なポリシーフレームワーク向けに設定可能なネットワーク(BGPを使用したネイティブのL3、vxlanを使用したオーバーレイ、古典的なL2、Cisco-SDN/ACI)を提供します。Contivプロジェクトは完全に[オープンソース](https://github.com/contiv)です。[インストーラ](https://github.com/contiv/install)はkubeadmとkubeadm以外の両方をベースとしたインストールオプションがあります。 * [Contrail](https://www.juniper.net/us/en/products-services/sdn/contrail/contrail-networking/)は、[Tungsten Fabric](https://tungsten.io)をベースにしている、オープンソースでマルチクラウドに対応したネットワーク仮想化およびポリシー管理プラットフォームです。ContrailおよびTungsten Fabricは、Kubernetes、OpenShift、OpenStack、Mesosなどのオーケストレーションシステムと統合されており、仮想マシン、コンテナ/Pod、ベアメタルのワークロードに隔離モードを提供します。 -* [Flannel](https://github.com/coreos/flannel/blob/master/Documentation/kubernetes.md)は、Kubernetesで使用できるオーバーレイネットワークプロバイダーです。 +* [Flannel](https://github.com/flannel-io/flannel#deploying-flannel-manually)は、Kubernetesで使用できるオーバーレイネットワークプロバイダーです。 * [Knitter](https://github.com/ZTE/Knitter/)は、1つのKubernetes Podで複数のネットワークインターフェイスをサポートするためのプラグインです。 * [Multus](https://github.com/Intel-Corp/multus-cni)は、すべてのCNIプラグイン(たとえば、Calico、Cilium、Contiv、Flannel)に加えて、SRIOV、DPDK、OVS-DPDK、VPPをベースとするKubernetes上のワークロードをサポートする、複数のネットワークサポートのためのマルチプラグインです。 * [OVN-Kubernetes](https://github.com/ovn-org/ovn-kubernetes/)は、Open vSwitch(OVS)プロジェクトから生まれた仮想ネットワーク実装である[OVN(Open Virtual Network)](https://github.com/ovn-org/ovn/)をベースとする、Kubernetesのためのネットワークプロバイダです。OVN-Kubernetesは、OVSベースのロードバランサーおよびネットワークポリシーの実装を含む、Kubernetes向けのオーバーレイベースのネットワーク実装を提供します。 From 359d239a65789e8b50d31e5e4b4214127d29cdef Mon Sep 17 00:00:00 2001 From: NamikoToriyama Date: Sun, 1 Aug 2021 02:22:23 +0900 Subject: [PATCH 044/279] Fix a non-existent link Signed-off-by: NamikoToriyama --- .../debug-pod-replication-controller.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/ja/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md b/content/ja/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md index 570134b84d..89e927aff9 100644 --- a/content/ja/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md +++ b/content/ja/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md @@ -47,7 +47,7 @@ Podをスケジュールできない理由に関するスケジューラーか クラスター内のCPUまたはメモリーの供給を使い果たした可能性があります。 この場合、いくつかのことを試すことができます。 -* クラスターに[ノードを追加します](/docs/tasks/administer-cluster/cluster-management/#resizing-a-cluster)。 +* クラスターにノードを追加します。 * [不要なPodを終了](/docs/concepts/workloads/pods/#pod-termination)して、 `Pending`状態のPodのための空きリソースを作ります。 From fe63395af0c2367fab9dd4c496106e205300fa27 Mon Sep 17 00:00:00 2001 From: edsoncelio Date: Sat, 31 Jul 2021 15:09:11 -0300 Subject: [PATCH 045/279] feat: fix typos requested by code review --- content/pt-br/docs/tasks/configmap-secret/_index.md | 2 +- .../managing-secret-using-config-file.md | 10 +++++----- .../managing-secret-using-kustomize.md | 4 ++-- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/content/pt-br/docs/tasks/configmap-secret/_index.md b/content/pt-br/docs/tasks/configmap-secret/_index.md index 81ee33267b..b12622f4fd 100755 --- a/content/pt-br/docs/tasks/configmap-secret/_index.md +++ b/content/pt-br/docs/tasks/configmap-secret/_index.md @@ -1,6 +1,6 @@ --- title: "Gerenciando Secrets" weight: 28 -description: Gerenciando dados de configurações confidencias usando Secrets. +description: Gerenciando dados de configurações usando Secrets. --- diff --git a/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-config-file.md b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-config-file.md index ffbeedee9e..0bac8410fa 100644 --- a/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-config-file.md +++ b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-config-file.md @@ -17,7 +17,7 @@ description: Criando objetos Secret usando arquivos de configuração de recurso Você pode criar um Secret primeiramente em um arquivo, no formato JSON ou YAML, e depois criar o objeto. O recurso [Secret](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#secret-v1-core) -contém dois *maps*: `data` e `stringData`. +contém dois mapas: `data` e `stringData`. O campo `data` é usado para armazenar dados arbitrários, codificados usando base64. O campo `stringData` é usado por conveniência, e permite que você use dados para um Secret como *strings* não codificadas. @@ -46,7 +46,7 @@ A saída deve ser similar a: MWYyZDFlMmU2N2Rm ``` -Escreva o arquivo de configuração do Secret, que ser parecido com: +Escreva o arquivo de configuração do Secret, que será parecido com: ```yaml apiVersion: v1 kind: Secret @@ -66,7 +66,7 @@ Os valores serializados dos dados JSON e YAML de um Secret são codificados em s base64. Novas linhas não são válidas com essas strings e devem ser omitidas. Quando usar o utilitário `base64` em Darwin/MacOS, os usuários devem evitar usar a opção `-b` para separar linhas grandes. Por outro lado, usuários de Linux *devem* adicionar a opção -`-w 0` ao comando `base64` ou o *pipe* `base64 | tr -d '\n'` se a opção `w` não for disponível +`-w 0` ao comando `base64` ou o *pipe* `base64 | tr -d '\n'` se a opção `w` não estiver disponível {{< /note >}} Para cenários específicos, você pode querer usar o campo `stringData` ao invés de `data`. @@ -75,7 +75,7 @@ e a string vai ser codificada para você quando o Secret for criado ou atualizad Um exemplo prático para isso pode ser quando você esteja fazendo *deploy* de uma aplicação que usa um Secret para armazenar um arquivo de configuração, e você quer popular partes desse -arquivo de configuração durante o processo de *deployment*. +arquivo de configuração durante o processo de implantação. Por exemplo, se sua aplicação usa o seguinte arquivo de configuração: @@ -145,7 +145,7 @@ ou ser armazenado em um log de terminal. Para verificar o conteúdo atual de um dado codificado, veja [decodificando secret](/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret). Se um campo, como `username`, é especificado em `data` e `stringData`, -o valor de `stringData` é o usado. Por exemplo, dado a seguinte definição do Secret: +o valor de `stringData` é o usado. Por exemplo, dada a seguinte definição do Secret: ```yaml apiVersion: v1 diff --git a/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kustomize.md b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kustomize.md index 271a535de5..1658afc3de 100644 --- a/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kustomize.md +++ b/content/pt-br/docs/tasks/configmap-secret/managing-secret-using-kustomize.md @@ -10,7 +10,7 @@ description: Criando objetos Secret usando o arquivo kustomization.yaml Desde o Kubernetes v1.14, o `kubectl` provê suporte para [gerenciamento de objetos usando Kustomize](/docs/tasks/manage-kubernetes-objects/kustomization/). O Kustomize provê geradores de recursos para criar Secrets e ConfigMaps. Os geradores Kustomize devem ser especificados em um arquivo `kustomization.yaml` dentro -de um diretório. Depois de gerar o Secret, você pode criar o Secret na API server com `kubectl apply`. +de um diretório. Depois de gerar o Secret, você pode criar o Secret com `kubectl apply`. ## {{% heading "prerequisites" %}} {{< include "task-tutorial-prereqs.md" >}} @@ -31,7 +31,7 @@ secretGenerator: - password.txt ``` -Você também pode definir o `secretGenerator`no arquivo `kustomization.yaml` +Você também pode definir o `secretGenerator` no arquivo `kustomization.yaml` por meio de alguns *literais*. Por exemplo, o seguinte arquivo `kustomization.yaml` contém dois literais para `username` e `password` respectivamente: From 4d330619dd56aca8a75950ece83496e4346c192d Mon Sep 17 00:00:00 2001 From: Juhee Kang Date: Sun, 1 Aug 2021 23:20:38 +0900 Subject: [PATCH 046/279] [ko] Fix CoreDNS typo on kubeadm-upgrade --- .../ko/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/ko/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md b/content/ko/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md index 2227c49c9e..c009339acc 100644 --- a/content/ko/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md +++ b/content/ko/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md @@ -38,7 +38,7 @@ weight: 20 ### 추가 정보 - kubelet 마이너 버전을 업그레이드하기 전에 [노드 드레이닝(draining)](/docs/tasks/administer-cluster/safely-drain-node/)이 - 필요하다. 컨트롤 플레인 노드의 경우 CoreNDS 파드 또는 기타 중요한 워크로드를 실행할 수 있다. + 필요하다. 컨트롤 플레인 노드의 경우 CoreDNS 파드 또는 기타 중요한 워크로드를 실행할 수 있다. - 컨테이너 사양 해시 값이 변경되므로, 업그레이드 후 모든 컨테이너가 다시 시작된다. From 473c22898518fa4f61f14542fa4785064d987097 Mon Sep 17 00:00:00 2001 From: Arhell Date: Mon, 2 Aug 2021 01:06:00 +0300 Subject: [PATCH 047/279] [ja] Fix typo in worker.py example script --- content/ja/examples/application/job/redis/worker.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/ja/examples/application/job/redis/worker.py b/content/ja/examples/application/job/redis/worker.py index 49e5dae798..87d90bde18 100644 --- a/content/ja/examples/application/job/redis/worker.py +++ b/content/ja/examples/application/job/redis/worker.py @@ -8,11 +8,11 @@ host="redis" # import os # host = os.getenv("REDIS_SERVICE_HOST") -q = rediswq.RedisWQ(name="job2", host="redis") +q = rediswq.RedisWQ(name="job2", host=host) print("Worker with sessionID: " + q.sessionID()) print("Initial queue state: empty=" + str(q.empty())) while not q.empty(): - item = q.lease(lease_secs=10, block=True, timeout=2) + item = q.lease(lease_secs=10, block=True, timeout=2) if item is not None: itemstr = item.decode("utf=8") print("Working on " + itemstr) From 9a311f4c3a10c300fddfa6fba3f7189f6f8f9e5e Mon Sep 17 00:00:00 2001 From: Jihoon Seo Date: Mon, 2 Aug 2021 15:00:07 +0900 Subject: [PATCH 048/279] Reflect review comments --- .../node-pressure-eviction.md | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/content/ko/docs/concepts/scheduling-eviction/node-pressure-eviction.md b/content/ko/docs/concepts/scheduling-eviction/node-pressure-eviction.md index 4a687cff30..a3330a1b0d 100644 --- a/content/ko/docs/concepts/scheduling-eviction/node-pressure-eviction.md +++ b/content/ko/docs/concepts/scheduling-eviction/node-pressure-eviction.md @@ -61,15 +61,15 @@ Kubelet은 다음과 같은 축출 신호를 사용한다. 이 표에서, `설명` 열은 kubelet이 축출 신호 값을 계산하는 방법을 나타낸다. 각 축출 신호는 백분율 또는 숫자값을 지원한다. -kubelet은 총 용량 대비 축출 신호의 백분율 값을 +Kubelet은 총 용량 대비 축출 신호의 백분율 값을 계산한다. `memory.available` 값은 `free -m`과 같은 도구가 아니라 cgroupfs로부터 도출된다. 이는 `free -m`이 컨테이너 안에서는 동작하지 않고, 또한 사용자가 [node allocatable](/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable) 기능을 사용하는 경우 자원 부족에 대한 결정은 루트 노드뿐만 아니라 -cgroup 계층구조의 최종 사용자 파드 부분에서도 지역적으로 이루어지기 때문에 중요하다. -[이 스크립트](/examples/admin/resource/memory-available.sh)는 +cgroup 계층 구조의 최종 사용자 파드 부분에서도 지역적으로 이루어지기 때문에 중요하다. +이 [스크립트](/examples/admin/resource/memory-available.sh)는 kubelet이 `memory.available`을 계산하기 위해 수행하는 동일한 단계들을 재현한다. kubelet은 메모리 압박 상황에서 메모리가 회수 가능하다고 가정하므로, inactive_file(즉, 비활성 LRU 목록의 파일 기반 메모리 바이트 수)을 @@ -82,7 +82,7 @@ kubelet은 다음과 같은 파일시스템 파티션을 지원한다. 1. `imagefs`: 컨테이너 런타임이 컨테이너 이미지 및 컨테이너 쓰기 가능 레이어를 저장하는 데 사용하는 선택적 파일시스템이다. -Kubelet은 이러한 파일 시스템을 자동으로 검색하고 다른 파일 시스템은 무시한다. +Kubelet은 이러한 파일시스템을 자동으로 검색하고 다른 파일시스템은 무시한다. Kubelet은 다른 구성은 지원하지 않는다. {{}} @@ -164,9 +164,9 @@ kubelet은 다음과 같이 노드 컨디션과 축출 신호를 매핑한다. | 노드 컨디션 | 축출 신호 | 설명 | |-------------------|---------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------| -| `MemoryPressure` | `memory.available` | 노드의 가용 메모리 양이 축출 임계값에 도달했다 | -| `DiskPressure` | `nodefs.available`, `nodefs.inodesFree`, `imagefs.available`, or `imagefs.inodesFree` | 노드의 루트 파일시스템 또는 이미지 파일시스템의 가용 디스크 공간 또는 inode의 수가 축출 임계값에 도달했다 | -| `PIDPressure` | `pid.available` | (리눅스) 노드의 가용 프로세스 ID(PID)가 축출 임계값 이하로 내려왔다 | +| `MemoryPressure` | `memory.available` | 노드의 가용 메모리 양이 축출 임계값에 도달함 | +| `DiskPressure` | `nodefs.available`, `nodefs.inodesFree`, `imagefs.available`, 또는 `imagefs.inodesFree` | 노드의 루트 파일시스템 또는 이미지 파일시스템의 가용 디스크 공간 또는 inode의 수가 축출 임계값에 도달함 | +| `PIDPressure` | `pid.available` | (리눅스) 노드의 가용 프로세스 ID(PID)가 축출 임계값 이하로 내려옴 | kubelet은 `--node-status-update-frequency`에 설정된 시간 간격(기본값: `10s`)마다 노드 컨디션을 업데이트한다. @@ -203,8 +203,8 @@ kubelet은 다음 작업을 수행한다. 노드에 `nodefs` 파일시스템만 있고 이것이 축출 임계값 조건을 충족한 경우, kubelet은 다음 순서로 디스크 공간을 확보한다. -1. 종료된 파드와 컨테이너에 대해 가비지 수집을 수행한다 -1. 사용중이지 않은 이미지를 삭제한다 +1. 종료된 파드와 컨테이너에 대해 가비지 수집을 수행한다. +1. 사용중이지 않은 이미지를 삭제한다. ### kubelet 축출을 위한 파드 선택 @@ -229,7 +229,7 @@ kubelet은 파드 축출 순서를 결정하기 위해 다음의 파라미터를 kubelet이 파드 축출 순서를 결정할 때 파드의 QoS 클래스는 이용하지 않는다. 메모리 등의 자원을 회수할 때, QoS 클래스를 이용하여 가장 가능성이 높은 파드 축출 순서를 예측할 수는 있다. QoS는 EphemeralStorage 요청에 적용되지 않으므로, -노드가 예를 들어 'DiskPressure' 아래에 있는 경우 위의 시나리오가 적용되지 않는다. +노드가 예를 들어 `DiskPressure` 아래에 있는 경우 위의 시나리오가 적용되지 않는다. {{}} `Guaranteed` 파드는 모든 컨테이너에 대해 자원 요청량과 제한이 명시되고 @@ -246,7 +246,7 @@ kubelet은 노드 안정성을 유지하고 자원 고갈이 다른 파드에 또는 `PID` 고갈 때문에 파드를 축출할 때에는 파드의 `Priority`를 이용하여 축출 순위를 정한다. -노드에 전용 'imagefs' 파일 시스템이 있는지 여부에 따라 kubelet이 파드 축출 순서를 +노드에 전용 `imagefs` 파일시스템이 있는지 여부에 따라 kubelet이 파드 축출 순서를 정하는 방식에 차이가 있다. #### `imagefs`가 있는 경우 @@ -306,14 +306,14 @@ kubelet의 메모리 회수가 가능하기 이전에 kubelet은 각 파드에 설정된 QoS를 기반으로 각 컨테이너에 `oom_score_adj` 값을 설정한다. -| Quality of Service | oom_score_adj | +| 서비스 품질(Quality of Service) | oom_score_adj | |--------------------|-----------------------------------------------------------------------------------| | `Guaranteed` | -997 | | `BestEffort` | 1000 | | `Burstable` | min(max(2, 1000 - (1000 * memoryRequestBytes) / machineMemoryCapacityBytes), 999) | {{}} -또한, kubelet은 `system-node-critical` {{}}를 갖는 파드의 컨테이너에 +또한, kubelet은 `system-node-critical` {{}}를 갖는 파드의 컨테이너에 `oom_score_adj` 값을 `-997`로 설정한다. {{}} @@ -372,7 +372,7 @@ kubelet이 `DaemonSet`에 속하는 파드를 축출하지 않도록 하려면 #### kubelet이 메모리 압박을 즉시 감지하지 못할 수 있음 -기본적으로 kubelet은 'cAdvisor'를 폴링하여 +기본적으로 kubelet은 `cAdvisor`를 폴링하여 일정한 간격으로 메모리 사용량 통계를 수집한다. 해당 타임 윈도우 내에서 메모리 사용량이 빠르게 증가하면 kubelet이 `MemoryPressure`를 충분히 빠르게 감지하지 못해 `OOMKiller`가 계속 호출될 수 있다. @@ -381,7 +381,7 @@ kubelet이 `DaemonSet`에 속하는 파드를 축출하지 않도록 하려면 kubelet의 `memcg` 알림 API가 임계값을 초과할 때 즉시 알림을 받도록 할 수 있다. -극도의 활용도를 달성하려는 것이 아니라 오버커밋에 대한 합리적인 조치를 원하는 경우, +사용률(utilization)을 극단적으로 높이려는 것이 아니라 오버커밋(overcommit)에 대한 합리적인 조치만 원하는 경우, 이 문제에 대한 현실적인 해결 방법은 `--kube-reserved` 및 `--system-reserved` 플래그를 사용하여 시스템에 메모리를 할당하는 것이다. From ada25d09e0ea36fce235cfaecb125817cc6702f9 Mon Sep 17 00:00:00 2001 From: Jihoon Seo Date: Mon, 2 Aug 2021 15:22:37 +0900 Subject: [PATCH 049/279] Add ko/glossary/node-pressure-eviction.md --- .../glossary/node-pressure-eviction.md | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 content/ko/docs/reference/glossary/node-pressure-eviction.md diff --git a/content/ko/docs/reference/glossary/node-pressure-eviction.md b/content/ko/docs/reference/glossary/node-pressure-eviction.md new file mode 100644 index 0000000000..b0984ab807 --- /dev/null +++ b/content/ko/docs/reference/glossary/node-pressure-eviction.md @@ -0,0 +1,24 @@ +--- +title: 노드-압박 축출 +id: node-pressure-eviction +date: 2021-05-13 +full_link: /ko/docs/concepts/scheduling-eviction/node-pressure-eviction/ +short_description: > + 노드-압박 축출은 kubelet이 노드의 자원을 회수하기 위해 + 파드를 능동적으로 중단시키는 절차이다. +aka: +- kubelet eviction +tags: +- operation +--- +노드-압박 축출은 {{}}이 노드의 자원을 회수하기 위해 +파드를 능동적으로 중단시키는 절차이다. + + + +kubelet은 클러스터 노드의 CPU, 메모리, 디스크 공간, 파일시스템 +inode와 같은 자원을 모니터링한다. 이러한 자원 중 하나 이상이 +특정 소모 수준에 도달하면, kubelet은 하나 이상의 파드를 능동적으로 중단시켜 +자원을 회수하고 고갈 상황을 방지할 수 있다. + +노드-압박 축출은 [API를 이용한 축출](/ko/docs/concepts/scheduling-eviction/api-eviction/)과는 차이가 있다. From 3bef97644cbe9dbbef55dedf85ed2b327322d23a Mon Sep 17 00:00:00 2001 From: Naka Masato Date: Mon, 2 Aug 2021 22:52:13 +0900 Subject: [PATCH 050/279] Update object-management.md --- .../concepts/overview/working-with-objects/object-management.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/ja/docs/concepts/overview/working-with-objects/object-management.md b/content/ja/docs/concepts/overview/working-with-objects/object-management.md index 49092c6dea..591a978360 100644 --- a/content/ja/docs/concepts/overview/working-with-objects/object-management.md +++ b/content/ja/docs/concepts/overview/working-with-objects/object-management.md @@ -120,7 +120,7 @@ kubectl replace -f nginx.yaml ## 宣言型オブジェクト設定 宣言型オブジェクト設定を利用する場合、ユーザーはローカルに置かれている設定ファイルを操作します。 -しかし、ユーザーは操作内容をファイルに記載しません。作成、更新、そして削除といった操作はオブジェクトごとに`kubectl`が検出します。 +しかし、ユーザーはファイルに対する操作内容を指定しません。作成、更新、そして削除といった操作はオブジェクトごとに`kubectl`が検出します。 この仕組みが、異なるオブジェクトごとに異なる操作をディレクトリに対して行うことを可能にしています。 {{< note >}} From 08e098177548d904d10fb36909e5550eae9b61ea Mon Sep 17 00:00:00 2001 From: "Claudia J. Kang" Date: Sun, 1 Aug 2021 23:14:37 +0900 Subject: [PATCH 051/279] [ko] Translate content/ko/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods.md --- ...aranteed-scheduling-critical-addon-pods.md | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 content/ko/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods.md diff --git a/content/ko/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods.md b/content/ko/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods.md new file mode 100644 index 0000000000..bbc44c94a1 --- /dev/null +++ b/content/ko/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods.md @@ -0,0 +1,25 @@ +--- + + + + +title: 중요한 애드온 파드 스케줄링 보장하기 +content_type: concept +--- + + + +API 서버, 스케줄러 및 컨트롤러 매니저와 같은 쿠버네티스 주요 컴포넌트들은 컨트롤 플레인 노드에서 동작한다. 반면, 애드온들은 일반 클러스터 노드에서 동작한다. +이러한 애드온들 중 일부(예: 메트릭 서버, DNS, UI)는 클러스터 전부가 정상적으로 동작하는 데 필수적일 수 있다. +만약, 필수 애드온이 축출되고(수동 축출, 혹은 업그레이드와 같은 동작으로 인한 의도하지 않은 축출) +pending 상태가 된다면, 클러스터가 더 이상 제대로 동작하지 않을 수 있다. (사용률이 매우 높은 클러스터에서 해당 애드온이 +축출되자마자 다른 대기중인 파드가 스케줄링되거나 다른 이유로 노드에서 사용할 수 있는 자원량이 줄어들어 pending 상태가 발생할 수 있다) + +유의할 점은, 파드를 중요(critical)로 표시하는 것은 축출을 완전히 방지하기 위함이 아니다. 이것은 단지 파드가 영구적으로 사용할 수 없게 되는 것만을 방지하기 위함이다. +중요로 표시한 스태틱(static) 파드는 축출될 수 없다. 반면, 중요로 표시한 일반적인(non-static) 파드의 경우 항상 다시 스케줄링된다. + + + +### 파드를 중요(critical)로 표시하기 + +파드를 중요로 표시하기 위해서는, 해당 파드에 대해 priorityClassName을 `system-cluster-critical`이나 `system-node-critical`로 설정한다. `system-node-critical`은 가장 높은 우선 순위를 가지며, 심지어 `system-cluster-critical`보다도 우선 순위가 높다. From b3062eb5173a10743f1cac97ce1a1ce941b09a77 Mon Sep 17 00:00:00 2001 From: Edith Date: Mon, 2 Aug 2021 23:53:45 -0500 Subject: [PATCH 052/279] Add concepts/storage/volume-snapshot-classes.md --- .../storage/volume-snapshot-classes.md | 74 +++++++++++++++++++ 1 file changed, 74 insertions(+) create mode 100644 content/es/docs/concepts/storage/volume-snapshot-classes.md diff --git a/content/es/docs/concepts/storage/volume-snapshot-classes.md b/content/es/docs/concepts/storage/volume-snapshot-classes.md new file mode 100644 index 0000000000..3264a4d4be --- /dev/null +++ b/content/es/docs/concepts/storage/volume-snapshot-classes.md @@ -0,0 +1,74 @@ +--- +reviewers: +- saad-ali +- thockin +- msau42 +- jingxu97 +- xing-yang +- yuxiangqian +title: Volume Snapshot Classes +content_type: concept +weight: 30 +--- + + + +Este documento describe el concepto de VolumeSnapshotClass en Kubernetes. Se sugiere estar familiarizado +con [volume snapshots](/docs/concepts/storage/volume-snapshots/) y +[storage classes](/docs/concepts/storage/storage-classes). + + + + +## Introducción + +Al igual que StorageClass proporciona a los administradores una forma de describir las “clases” +de almacenamiento que ofrecen al aprovisionar un volumen, VolumeSnapshotClass proporciona una +forma de describir las “clases” de almacenamiento al aprovisionar una instantánea de volumen. + +## El Recurso VolumeSnapshotClass + +Cada VolumeSnapshotClass contiene los campos `driver`, `deletionPolicy`, y `parameters`, +que se utilizan cuando un VolumeSnapshot que pertenece a la clase, necesita aprovisionarse dinámicamente. + +El nombre de un objeto VolumeSnapshotClass es significativo y es la forma en que los usuarios pueden solicitar una clase en particular. Los Administradores establecen el nombre y otros parámetros de una clase cuando crean por primera vez objetos VolumeSnapshotClass, y los objetos no se pueden actualizar una vez creados. + +```yaml +apiVersion: snapshot.storage.k8s.io/v1 +kind: VolumeSnapshotClass +metadata: + name: csi-hostpath-snapclass +driver: hostpath.csi.k8s.io +deletionPolicy: Delete +parameters: +``` + +Los administradores pueden especificar un VolumeSnapshotClass predeterminado para VolumeSnapshots que no solicitan ninguna clase en particular para vincularse agregando la anotación: `snapshot.storage.kubernetes.io/is-default-class: "true"`. + +```yaml +apiVersion: snapshot.storage.k8s.io/v1 +kind: VolumeSnapshotClass +metadata: + name: csi-hostpath-snapclass + annotations: + snapshot.storage.kubernetes.io/is-default-class: "true" +driver: hostpath.csi.k8s.io +deletionPolicy: Delete +parameters: +``` + +### Driver + +Las clases de instantáneas de volumen tienen un controlador que determina qué complemento de volumen CSI se utiliza para aprovisionar VolumeSnapshots. Este campo debe especificarse. + +### DeletionPolicy + +Las clases de instantáneas de volumen tienen un deletionPolicy. Le permite configurar lo que sucede con un VolumeSnapshotContent cuando se va a eliminar el objeto VolumeSnapshot al que está vinculado. La deletionPolicy de una clase de instantánea de volumen puede `Retain` o `Delete`. This field must be specified. + +Si la deletionPolicy es `Delete`, la instantánea de almacenamiento subyacente se eliminará junto con el objeto VolumeSnapshotContent. Si deletionPolicy es `Retain`, tanto la instantánea subyacente como VolumeSnapshotContent permanecerán. + +## Parameters + +Las clases de instantáneas de volumen tienen parámetros que describen las instantáneas de volumen que pertenecen a la clase de instantáneas de volumen. Se pueden aceptar diferentes parámetros dependiendo del `driver`. + + From 25f168f2f62e6c0ff390dc41561e24fd7c80cf77 Mon Sep 17 00:00:00 2001 From: seokho-son Date: Fri, 30 Jul 2021 14:49:06 +0900 Subject: [PATCH 053/279] Update outdated files in dev-1.21-ko.7 (p1) --- .../concepts/architecture/cloud-controller.md | 2 +- .../cluster-administration/logging.md | 7 ++++-- .../ko/docs/concepts/configuration/secret.md | 8 ++---- .../concepts/extend-kubernetes/operator.md | 3 +-- .../docs/concepts/storage/storage-classes.md | 7 +++++- .../concepts/workloads/pods/pod-lifecycle.md | 16 +++++++++--- content/ko/docs/reference/_index.md | 25 +++++++++++-------- .../feature-gates.md | 13 ++++++++-- .../glossary/kube-controller-manager.md | 10 ++++---- content/ko/docs/reference/tools/_index.md | 17 +++++-------- 10 files changed, 65 insertions(+), 43 deletions(-) diff --git a/content/ko/docs/concepts/architecture/cloud-controller.md b/content/ko/docs/concepts/architecture/cloud-controller.md index fe7fda364a..e5e7d315c5 100644 --- a/content/ko/docs/concepts/architecture/cloud-controller.md +++ b/content/ko/docs/concepts/architecture/cloud-controller.md @@ -210,7 +210,7 @@ rules: 자체 클라우드 컨트롤러 매니저를 구현하거나 기존 프로젝트를 확장하는 방법을 알고 싶은가? -클라우드 컨트롤러 매니저는 Go 인터페이스를 사용해서 모든 클라우드 플러그인을 구현할 수 있다. 구체적으로, [kubernetes/cloud-provider](https://github.com/kubernetes/cloud-provider)의 [`cloud.go`](https://github.com/kubernetes/cloud-provider/blob/release-1.17/cloud.go#L42-L62)에 정의된 `CloudProvider` 인터페이스를 사용한다. +클라우드 컨트롤러 매니저는 Go 인터페이스를 사용함으로써, 어떠한 클라우드에 대한 구현체(implementation)라도 플러그인 될 수 있도록 한다. 구체적으로는, [kubernetes/cloud-provider](https://github.com/kubernetes/cloud-provider)의 [`cloud.go`](https://github.com/kubernetes/cloud-provider/blob/release-1.21/cloud.go#L42-L69)에 정의된 `CloudProvider` 인터페이스를 사용한다. 이 문서(노드, 라우트와 서비스)에서 강조된 공유 컨트롤러의 구현과 공유 cloudprovider 인터페이스와 함께 일부 스캐폴딩(scaffolding)은 쿠버네티스 핵심의 일부이다. 클라우드 공급자 전용 구현은 쿠버네티스의 핵심 바깥에 있으며 `CloudProvider` 인터페이스를 구현한다. diff --git a/content/ko/docs/concepts/cluster-administration/logging.md b/content/ko/docs/concepts/cluster-administration/logging.md index 85f3e4efde..d4e0119c41 100644 --- a/content/ko/docs/concepts/cluster-administration/logging.md +++ b/content/ko/docs/concepts/cluster-administration/logging.md @@ -83,8 +83,11 @@ kubectl logs counter [`configure-helper` 스크립트](https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/cluster/gce/gci/configure-helper.sh)를 통해 자세히 알 수 있다. -**CRI 컨테이너 런타임** 을 사용할 때, kubelet은 로그를 로테이션하고 로깅 디렉터리 구조를 관리한다. kubelet은 -이 정보를 CRI 컨테이너 런타임에 전송하고 런타임은 컨테이너 로그를 지정된 위치에 기록한다. 두 개의 kubelet 플래그 `container-log-max-size` 및 `container-log-max-files` 를 사용하여 각 로그 파일의 최대 크기와 각 컨테이너에 허용되는 최대 파일 수를 각각 구성할 수 있다. +**CRI 컨테이너 런타임** 을 사용할 때, kubelet은 로그를 로테이션하고 로깅 디렉터리 구조를 관리한다. +kubelet은 이 정보를 CRI 컨테이너 런타임에 전송하고 런타임은 컨테이너 로그를 지정된 위치에 기록한다. +[kubelet config file](/docs/tasks/administer-cluster/kubelet-config-file/)에 있는 +두 개의 kubelet 파라미터 [`containerLogMaxSize` 및 `containerLogMaxFiles`](/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration)를 +사용하여 각 로그 파일의 최대 크기와 각 컨테이너에 허용되는 최대 파일 수를 각각 구성할 수 있다. 기본 로깅 예제에서와 같이 [`kubectl logs`](/docs/reference/generated/kubectl/kubectl-commands#logs)를 실행하면, 노드의 kubelet이 요청을 처리하고 diff --git a/content/ko/docs/concepts/configuration/secret.md b/content/ko/docs/concepts/configuration/secret.md index 1e5829b5ea..06be7d5a54 100644 --- a/content/ko/docs/concepts/configuration/secret.md +++ b/content/ko/docs/concepts/configuration/secret.md @@ -1156,8 +1156,8 @@ HTTP 요청을 처리하고, 복잡한 비즈니스 로직을 수행한 다음, ### 시크릿 API를 사용하는 클라이언트 -시크릿 API와 상호 작용하는 애플리케이션을 배포할 때, -[RBAC](/docs/reference/access-authn-authz/rbac/)과 같은 +시크릿 API와 상호 작용하는 애플리케이션을 배포할 때, +[RBAC](/docs/reference/access-authn-authz/rbac/)과 같은 [인가 정책](/ko/docs/reference/access-authn-authz/authorization/)을 사용하여 접근을 제한해야 한다. @@ -1235,10 +1235,6 @@ API 서버에서 kubelet으로의 통신은 SSL/TLS로 보호된다. - 시크릿을 사용하는 파드를 생성할 수 있는 사용자는 해당 시크릿의 값도 볼 수 있다. API 서버 정책이 해당 사용자가 시크릿을 읽을 수 있도록 허용하지 않더라도, 사용자는 시크릿을 노출하는 파드를 실행할 수 있다. - - 현재, 모든 노드에 대한 루트 권한이 있는 모든 사용자는 kubelet을 가장하여 - API 서버에서 _모든_ 시크릿을 읽을 수 있다. 단일 노드에 대한 루트 취약점 공격의 - 영향을 제한하기 위해, 실제로 필요한 노드에만 시크릿을 보내는 것이 앞으로 계획된 - 기능이다. ## {{% heading "whatsnext" %}} diff --git a/content/ko/docs/concepts/extend-kubernetes/operator.md b/content/ko/docs/concepts/extend-kubernetes/operator.md index aba13a59c2..80ed86c2ec 100644 --- a/content/ko/docs/concepts/extend-kubernetes/operator.md +++ b/content/ko/docs/concepts/extend-kubernetes/operator.md @@ -51,8 +51,7 @@ weight: 30 * 내부 멤버 선출 절차없이 분산 애플리케이션의 리더를 선택 -오퍼레이터의 모습을 더 자세하게 볼 수 있는 방법은 무엇인가? 자세한 예는 -다음과 같다. +오퍼레이터의 모습을 더 자세하게 볼 수 있는 방법은 무엇인가? 예시는 다음과 같다. 1. 클러스터에 구성할 수 있는 SampleDB라는 사용자 정의 리소스. 2. 오퍼레이터의 컨트롤러 부분이 포함된 파드의 실행을 diff --git a/content/ko/docs/concepts/storage/storage-classes.md b/content/ko/docs/concepts/storage/storage-classes.md index d8e0be153d..f4385419f1 100644 --- a/content/ko/docs/concepts/storage/storage-classes.md +++ b/content/ko/docs/concepts/storage/storage-classes.md @@ -1,4 +1,9 @@ --- + + + + + title: 스토리지 클래스 content_type: concept weight: 30 @@ -184,7 +189,7 @@ CSI | 1.14 (alpha), 1.16 (beta) CSI 드라이버에 대한 문서를 본다. {{< note >}} - `waitForFirstConsumer`를 사용한다면, 노드 어피니티를 지정하기 위해서 파드 스펙에 `nodeName`을 사용하지는 않아야 한다. + `WaitForFirstConsumer`를 사용한다면, 노드 어피니티를 지정하기 위해서 파드 스펙에 `nodeName`을 사용하지는 않아야 한다. 만약 `nodeName`을 사용한다면, 스케줄러가 바이패스되고 PVC가 `pending` 상태로 있을 것이다. 대신, 아래와 같이 호스트네임을 이용하는 노드셀렉터를 사용할 수 있다. diff --git a/content/ko/docs/concepts/workloads/pods/pod-lifecycle.md b/content/ko/docs/concepts/workloads/pods/pod-lifecycle.md index 71523e183a..11aeaa31b0 100644 --- a/content/ko/docs/concepts/workloads/pods/pod-lifecycle.md +++ b/content/ko/docs/concepts/workloads/pods/pod-lifecycle.md @@ -304,13 +304,23 @@ kubelet은 실행 중인 컨테이너들에 대해서 선택적으로 세 가지 보일 수도 있지만, 스팩에 준비성 프로브가 존재한다는 것은 파드가 트래픽을 받지 않는 상태에서 시작되고 프로브가 성공하기 시작한 이후에만 트래픽을 받는다는 뜻이다. -만약 컨테이너가 대량의 데이터, 설정 파일들, -또는 시동 중 마그레이션을 처리해야 한다면, 준비성 프로브를 지정하길 바란다. -만약 당신의 컨테이너가 유지 관리를 위해서 자체 중단되게 하려면, +만약 컨테이너가 유지 관리를 위해서 자체 중단되게 하려면, 준비성 프로브를 지정하길 바란다. 준비성 프로브는 활성 프로브와는 다르게 준비성에 특정된 엔드포인트를 확인한다. +만약 애플리케이션이 백엔드 서비스에 엄격한 의존성이 있다면, +활성 프로브와 준비성 프로브 모두 활용할 수도 있다. 활성 프로브는 애플리케이션 스스로가 건강한 상태면 +통과하지만, 준비성 프로브는 추가적으로 요구되는 각 백-엔드 서비스가 가용한지 확인한다. 이를 이용하여, +오류 메시지만 응답하는 파드로 +트래픽이 가는 것을 막을 수 있다. + +만약 컨테이너가 시동 시 대량 데이터의 로딩, 구성 파일, 또는 +마이그레이션에 대한 작업을 +수행해야 한다면, [스타트업 프로브](#언제-스타트업-프로브를-사용해야-하는가)를 사용하면 된다. 그러나, 만약 +failed 애플리케이션과 시동 중에 아직 데이터를 처리하고 있는 애플리케이션을 구분하여 탐지하고 +싶다면, 준비성 프로브를 사용하는 것이 더 적합할 것이다. + {{< note >}} 파드가 삭제될 때 요청들을 흘려 보내기(drain) 위해 준비성 프로브가 꼭 필요한 것은 아니다. 삭제 시에, 파드는 diff --git a/content/ko/docs/reference/_index.md b/content/ko/docs/reference/_index.md index 68aa8eceb8..55401988b4 100644 --- a/content/ko/docs/reference/_index.md +++ b/content/ko/docs/reference/_index.md @@ -9,6 +9,7 @@ content_type: concept no_list: true --- + 쿠버네티스 문서의 본 섹션에서는 레퍼런스를 다룬다. @@ -48,26 +49,26 @@ no_list: true ## 컴포넌트 -* [kubelet](/docs/reference/command-line-tools-reference/kubelet/) - 각 -노드에서 구동되는 주요한 에이전트. kubelet은 PodSpecs 집합을 가지며 +* [kubelet](/docs/reference/command-line-tools-reference/kubelet/) - 각 +노드에서 구동되는 주요한 에이전트. kubelet은 PodSpecs 집합을 가지며 기술된 컨테이너가 구동되고 있는지, 정상 작동하는지를 보장한다. -* [kube-apiserver](/docs/reference/command-line-tools-reference/kube-apiserver/) - -파드, 서비스, 레플리케이션 컨트롤러와 같은 API 오브젝트에 대한 검증과 구성을 +* [kube-apiserver](/docs/reference/command-line-tools-reference/kube-apiserver/) - +파드, 서비스, 레플리케이션 컨트롤러와 같은 API 오브젝트에 대한 검증과 구성을 수행하는 REST API. * [kube-controller-manager](/docs/reference/command-line-tools-reference/kube-controller-manager/) - 쿠버네티스에 탑재된 핵심 제어 루프를 포함하는 데몬. -* [kube-proxy](/ko/docs/reference/command-line-tools-reference/kube-proxy/) - 간단한 -TCP/UDP 스트림 포워딩이나 백-엔드 집합에 걸쳐서 라운드-로빈 TCP/UDP 포워딩을 +* [kube-proxy](/ko/docs/reference/command-line-tools-reference/kube-proxy/) - 간단한 +TCP/UDP 스트림 포워딩이나 백-엔드 집합에 걸쳐서 라운드-로빈 TCP/UDP 포워딩을 할 수 있다. * [kube-scheduler](/docs/reference/command-line-tools-reference/kube-scheduler/) - 가용성, 성능 및 용량을 관리하는 스케줄러. * [kube-scheduler 정책](/ko/docs/reference/scheduling/policies) * [kube-scheduler 프로파일](/ko/docs/reference/scheduling/config/#여러-프로파일) -## 환경설정 API +## API 설정 -이 섹션은 쿠버네티스 구성요소 또는 도구를 환경설정하는 데에 사용되는 -"미발표된" API를 다룬다. 이 API들은 사용자나 관리자가 클러스터를 -사용/관리하는 데에 중요하지만, 이들 API의 대부분은 아직 API 서버가 +이 섹션은 쿠버네티스 구성요소 또는 도구를 환경설정하는 데에 사용되는 +"미발표된" API를 다룬다. 이 API들은 사용자나 관리자가 클러스터를 +사용/관리하는 데에 중요하지만, 이들 API의 대부분은 아직 API 서버가 제공하지 않는다. * [kubelet 환경설정 (v1beta1)](/docs/reference/config-api/kubelet-config.v1beta1/) @@ -78,6 +79,10 @@ TCP/UDP 스트림 포워딩이나 백-엔드 집합에 걸쳐서 라운드-로 * [클라이언트 인증 API (v1beta1)](/docs/reference/config-api/client-authentication.v1beta1/) * [WebhookAdmission 환경설정 (v1)](/docs/reference/config-api/apiserver-webhookadmission.v1/) +## kubeadm을 위한 API 설정 + +* [v1beta2](/docs/reference/config-api/kubeadm-config.v1beta2/) + ## 설계 문서 쿠버네티스 기능에 대한 설계 문서의 아카이브. diff --git a/content/ko/docs/reference/command-line-tools-reference/feature-gates.md b/content/ko/docs/reference/command-line-tools-reference/feature-gates.md index e5e6f1570d..97262073a1 100644 --- a/content/ko/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/ko/docs/reference/command-line-tools-reference/feature-gates.md @@ -61,6 +61,7 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 | `BalanceAttachedNodeVolumes` | `false` | 알파 | 1.11 | | | `BoundServiceAccountTokenVolume` | `false` | 알파 | 1.13 | 1.20 | | `BoundServiceAccountTokenVolume` | `true` | 베타 | 1.21 | | +| `ControllerManagerLeaderMigration` | `false` | 알파 | 1.21 | | | `CPUManager` | `false` | 알파 | 1.8 | 1.9 | | `CPUManager` | `true` | 베타 | 1.10 | | | `CSIInlineVolume` | `false` | 알파 | 1.15 | 1.15 | @@ -379,7 +380,6 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 | `TokenRequestProjection` | `false` | 알파 | 1.11 | 1.11 | | `TokenRequestProjection` | `true` | 베타 | 1.12 | 1.19 | | `TokenRequestProjection` | `true` | GA | 1.20 | - | -| `VolumeCapacityPriority` | `false` | 알파 | 1.21 | - | | `VolumePVCDataSource` | `false` | 알파 | 1.15 | 1.15 | | `VolumePVCDataSource` | `true` | 베타 | 1.16 | 1.17 | | `VolumePVCDataSource` | `true` | GA | 1.18 | - | @@ -479,6 +479,11 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 `kube-apiserver`를 시작하여 확장 토큰 기능을 끈다. 자세한 내용은 [바운드 서비스 계정 토큰](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/1205-bound-service-account-tokens/README.md)을 확인한다. +- `ControllerManagerLeaderMigration`: HA 클러스터에서 클러스터 오퍼레이터가 + kube-controller-manager의 컨트롤러들을 외부 controller-manager(예를 들면, + cloud-controller-manager)로 다운타임 없이 라이브 마이그레이션할 수 있도록 허용하도록 + [kube-controller-manager](/docs/tasks/administer-cluster/controller-manager-leader-migration/#initial-leader-migration-configuration)와 [cloud-controller-manager](/docs/tasks/administer-cluster/controller-manager-leader-migration/#deploy-cloud-controller-manager)의 + 리더 마이그레이션(Leader Migration)을 활성화한다. - `CPUManager`: 컨테이너 수준의 CPU 어피니티 지원을 활성화한다. [CPU 관리 정책](/docs/tasks/administer-cluster/cpu-management-policies/)을 참고한다. - `CRIContainerLogRotation`: cri 컨테이너 런타임에 컨테이너 로그 로테이션을 활성화한다. 로그 파일 사이즈 기본값은 10MB이며, @@ -637,7 +642,7 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 - `ExperimentalCriticalPodAnnotation`: 특정 파드에 *critical* 로 어노테이션을 달아서 [스케줄링이 보장되도록](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/) 한다. 이 기능은 v1.13부터 파드 우선 순위 및 선점으로 인해 사용 중단되었다. -- `ExperimentalHostUserNamespaceDefaultingGate`: 사용자 네임스페이스를 호스트로 +- `ExperimentalHostUserNamespaceDefaulting`: 사용자 네임스페이스를 호스트로 기본 활성화한다. 이것은 다른 호스트 네임스페이스, 호스트 마운트, 권한이 있는 컨테이너 또는 특정 비-네임스페이스(non-namespaced) 기능(예: `MKNODE`, `SYS_MODULE` 등)을 사용하는 컨테이너를 위한 것이다. 도커 데몬에서 사용자 네임스페이스 @@ -764,6 +769,8 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 - `RotateKubeletClientCertificate`: kubelet에서 클라이언트 TLS 인증서의 로테이션을 활성화한다. 자세한 내용은 [kubelet 구성](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#kubelet-configuration)을 참고한다. - `RotateKubeletServerCertificate`: kubelet에서 서버 TLS 인증서의 로테이션을 활성화한다. + 자세한 사항은 + [kubelet 구성](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#kubelet-configuration)을 확인한다. - `RunAsGroup`: 컨테이너의 init 프로세스에 설정된 기본 그룹 ID 제어를 활성화한다. - `RuntimeClass`: 컨테이너 런타임 구성을 선택하기 위해 [런타임클래스(RuntimeClass)](/ko/docs/concepts/containers/runtime-class/) @@ -794,6 +801,8 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 - `SetHostnameAsFQDN`: 전체 주소 도메인 이름(FQDN)을 파드의 호스트 이름으로 설정하는 기능을 활성화한다. [파드의 `setHostnameAsFQDN` 필드](/ko/docs/concepts/services-networking/dns-pod-service/#pod-sethostnameasfqdn-field)를 참고한다. +- `SizeMemoryBackedVolumes`: memory-backed 볼륨(보통 `emptyDir` 볼륨)의 크기 상한을 + 지정할 수 있도록 kubelets를 활성화한다. - `StartupProbe`: kubelet에서 [스타트업](/ko/docs/concepts/workloads/pods/pod-lifecycle/#언제-스타트업-프로브를-사용해야-하는가) 프로브를 활성화한다. diff --git a/content/ko/docs/reference/glossary/kube-controller-manager.md b/content/ko/docs/reference/glossary/kube-controller-manager.md index e327a6c285..f4cf8f1bd2 100644 --- a/content/ko/docs/reference/glossary/kube-controller-manager.md +++ b/content/ko/docs/reference/glossary/kube-controller-manager.md @@ -4,15 +4,15 @@ id: kube-controller-manager date: 2018-04-12 full_link: /docs/reference/command-line-tools-reference/kube-controller-manager/ short_description: > - {{< glossary_tooltip text="컨트롤러" term_id="controller" >}} 프로세스를 실행하는 컨트롤 플레인 컴포넌트. + 컨트롤러 프로세스를 실행하는 컨트롤 플레인 컴포넌트. -aka: +aka: tags: - architecture - fundamental --- - {{< glossary_tooltip text="컨트롤러" term_id="controller" >}}를 구동하는 마스터 상의 컴포넌트. + {{< glossary_tooltip text="컨트롤러" term_id="controller" >}} 프로세스를 실행하는 컨트롤 플레인 컴포넌트. - + -논리적으로, 각 {{< glossary_tooltip text="컨트롤러" term_id="controller" >}}는 개별 프로세스이지만, 복잡성을 낮추기 위해 모두 단일 바이너리로 컴파일되고 단일 프로세스 내에서 실행된다. +논리적으로, 각 {{< glossary_tooltip text="컨트롤러" term_id="controller" >}}는 분리된 프로세스이지만, 복잡성을 낮추기 위해 모두 단일 바이너리로 컴파일되고 단일 프로세스 내에서 실행된다. diff --git a/content/ko/docs/reference/tools/_index.md b/content/ko/docs/reference/tools/_index.md index fb017d3df2..6ac3b1dc82 100644 --- a/content/ko/docs/reference/tools/_index.md +++ b/content/ko/docs/reference/tools/_index.md @@ -1,8 +1,10 @@ --- - - title: 도구 + + content_type: concept +weight: 80 +no_list: true --- @@ -10,13 +12,6 @@ content_type: concept -## Kubectl - -[`kubectl`](/ko/docs/tasks/tools/#kubectl)은 쿠버네티스를 위한 커맨드라인 툴이며, 쿠버네티스 클러스터 매니저을 제어한다. - -## Kubeadm - -[`kubeadm`](/ko/docs/setup/production-environment/tools/kubeadm/install-kubeadm/)은 물리적 환경, 클라우드 서버, 또는 가상머신 상에서 안전한 쿠버네티스를 쉽게 프로비저닝하기 위한 커맨드라인 툴이다(현재는 알파 상태). ## Minikube @@ -31,8 +26,8 @@ content_type: concept ## Helm -[`쿠버네티스 Helm`](https://github.com/kubernetes/helm)은 사전 구성된 쿠버네티스 리소스를 관리하기위한 도구이며 -또한 Helm의 쿠버네티스 차트라고도 한다. +[Helm](https://helm.sh/)은 사전 구성된 쿠버네티스 리소스 패키지를 관리하기 위한 도구이다. +이 패키지는 _Helm charts_ 라고 알려져 있다. Helm의 용도 From e3b6ab95793744d0a87c3a943877a23449b1066e Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Tue, 3 Aug 2021 14:31:38 +0100 Subject: [PATCH 054/279] Improve Katacoda button Separate out the HTML
    for Katacoda from the in-page button to trigger it. --- layouts/partials/hooks/body-end.html | 3 +++ layouts/shortcodes/kat-button | 3 +-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/layouts/partials/hooks/body-end.html b/layouts/partials/hooks/body-end.html index 36e65f7791..e0f9d5410b 100644 --- a/layouts/partials/hooks/body-end.html +++ b/layouts/partials/hooks/body-end.html @@ -1,3 +1,6 @@ +{{ if .HasShortcode "kat-button" }} +
    +{{ end }} {{ with .Site.Params.algolia_docsearch }} {{ end }} diff --git a/layouts/shortcodes/kat-button b/layouts/shortcodes/kat-button index 3165e30150..4dcdfa5653 100644 --- a/layouts/shortcodes/kat-button +++ b/layouts/shortcodes/kat-button @@ -1,3 +1,2 @@ -
    - + From 85e6e51e9eb49a5cdce619ed70700da9af0b1e27 Mon Sep 17 00:00:00 2001 From: Arhell Date: Wed, 4 Aug 2021 00:49:24 +0300 Subject: [PATCH 055/279] [id] update annotations --- .../configure-pod-container/configure-service-account.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/id/docs/tasks/configure-pod-container/configure-service-account.md b/content/id/docs/tasks/configure-pod-container/configure-service-account.md index 4a4d5999db..e53812d65a 100644 --- a/content/id/docs/tasks/configure-pod-container/configure-service-account.md +++ b/content/id/docs/tasks/configure-pod-container/configure-service-account.md @@ -151,8 +151,8 @@ Keluarannya akan serupa dengan: Name: build-robot-secret Namespace: default Labels: -Annotations: kubernetes.io/service-account.name=build-robot - kubernetes.io/service-account.uid=da68f9c6-9d26-11e7-b84e-002dc52800da +Annotations: kubernetes.io/service-account.name: build-robot + kubernetes.io/service-account.uid: da68f9c6-9d26-11e7-b84e-002dc52800da Type: kubernetes.io/service-account-token From 81fe8fcd7fdcee0b7beaa78c1d1892e740fb2118 Mon Sep 17 00:00:00 2001 From: Elias Keis <13063245+elKei24@users.noreply.github.com> Date: Wed, 4 Aug 2021 14:47:11 +0200 Subject: [PATCH 056/279] fix broken link --- content/de/_index.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/de/_index.html b/content/de/_index.html index 838552b5c4..78d3b5e003 100644 --- a/content/de/_index.html +++ b/content/de/_index.html @@ -9,7 +9,7 @@ cid: home {{% blocks/feature image="flower" %}} ### [Kubernetes (K8s)]({{< relref "/docs/concepts/overview/what-is-kubernetes" >}}) ist ein Open-Source-System zur Automatisierung der Bereitstellung, Skalierung und Verwaltung von containerisierten Anwendungen. -Es gruppiert Container, aus denen sich eine Anwendung zusammensetzt, in logische Einheiten, um die Verwaltung und Erkennung zu erleichtern. Kubernetes baut auf [15 Jahre Erfahrung in Bewältigung von Produktions-Workloads bei Google] (http://queue.acm.org/detail.cfm?id=2898444), kombiniert mit Best-of-Breed-Ideen und Praktiken aus der Community. +Es gruppiert Container, aus denen sich eine Anwendung zusammensetzt, in logische Einheiten, um die Verwaltung und Erkennung zu erleichtern. Kubernetes baut auf [15 Jahre Erfahrung in Bewältigung von Produktions-Workloads bei Google](http://queue.acm.org/detail.cfm?id=2898444), kombiniert mit Best-of-Breed-Ideen und Praktiken aus der Community. {{% /blocks/feature %}} {{% blocks/feature image="scalable" %}} @@ -57,4 +57,4 @@ Kubernetes ist Open Source und bietet Dir die Freiheit, die Infrastruktur vor Or {{< blocks/kubernetes-features >}} -{{< blocks/case-studies >}} \ No newline at end of file +{{< blocks/case-studies >}} From 8f7c04acb9c79d0177575c5670c3378a89eb427d Mon Sep 17 00:00:00 2001 From: Jefftree Date: Thu, 15 Jul 2021 08:08:58 -0700 Subject: [PATCH 057/279] Draft blog post for SSA GA --- .../_posts/2021-07-15-server-side-apply-ga.md | 172 ++++++++++++++++++ 1 file changed, 172 insertions(+) create mode 100644 content/en/blog/_posts/2021-07-15-server-side-apply-ga.md diff --git a/content/en/blog/_posts/2021-07-15-server-side-apply-ga.md b/content/en/blog/_posts/2021-07-15-server-side-apply-ga.md new file mode 100644 index 0000000000..294b9fe8c6 --- /dev/null +++ b/content/en/blog/_posts/2021-07-15-server-side-apply-ga.md @@ -0,0 +1,172 @@ +--- +layout: blog +title: "Kubernetes 1.22: Server Side Apply moves to GA" +description: > + Server Side Apply moves to GA. +date: 2021-07-15T10:00:00-08:00 +slug: Server-Side-Apply-GA +--- + +Authors: Jeffrey Ying, Google & Joe Betz, Google + +Server-side Apply (SSA) has been promoted to GA in the Kubernetes v1.22 release. Support for Server-side Apply was introduced as alpha in Kubernetes v1.14 release, promoted to beta in the Kubernetes v1.16 release, and [promoted to beta 2](https://kubernetes.io/blog/2020/04/01/kubernetes-1.18-feature-server-side-apply-beta-2/) in the Kubernetes v1.18 release. + +The GA milestone indicates that Kubernetes users may depend on the feature and its API without fear of backwards incompatible changes in future causing regressions. GA features are protected by the [Kubernetes deprecation policy](https://kubernetes.io/docs/reference/using-api/deprecation-policy/). + +What is Server-side Apply? + +Server-side Apply helps users and controllers manage their resources through declarative configurations. Server-side Apply replaces the client side apply feature implemented by “kubectl apply” with a server-side implementation, permitting use by tools/clients other than kubectl. To learn more about why Server-side Apply is important, or to learn how to use Server-side Apply from `kubectl`, see the [Beta 2 release announcement](https://kubernetes.io/blog/2020/04/01/kubernetes-1.18-feature-server-side-apply-beta-2/). + +What’s new since Beta? + +Since the [Beta 2 release](https://kubernetes.io/blog/2020/04/01/kubernetes-1.18-feature-server-side-apply-beta-2/) subresources support has been added, and both client-go and Kubebuilder have added comprehensive support for Server-side Apply. This completes the Server-side Apply functionality required to make controller development practical. +Subresource Support +Server-side Apply now fully supports subresources like status and scale. This is particularly important for controllers, which are often responsible for writing to subresources. +Server-side Apply support in client-go +Previously, Server-side Apply could only be called from the client-go typed client using the `Patch` function, with `PatchType` set to `ApplyPatchType`. Now, `Apply` functions are included in the client to allow for a more direct and typesafe way of calling Server-side Apply. Each `Apply` function takes an "apply configuration" type as an argument, which is a structured representation of an Apply request. For example: + +```go +import ( + ... + v1ac "k8s.io/client-go/applyconfigurations/autoscaling/v1" +) + +hpaApplyConfig := v1ac.HorizontalPodAutoscaler(autoscalerName, ns). + WithSpec(v1ac.HorizontalPodAutoscalerSpec(). + WithMinReplicas(0) + ) + +return hpav1client.Apply(ctx, hpaApplyConfig, metav1.ApplyOptions{FieldManager: "mycontroller", Force: true}) +``` + +Note in this example that `HorizontalPodAutoscaler` is imported from an "applyconfigurations" package. Each "apply configuration" type represents the same Kubernetes object kind as the corresponding go struct, but where all fields are pointers to make them optional, allowing apply requests to be accurately represented. For example, this when the apply configuration in the above example is marshalled to YAML, it produces: + +```yaml +apiVersion: autoscaling/v1 +kind: HorizontalPodAutoscaler +metadata: + name: myHPA + namespace: myNamespace +spec: + minReplicas: 0 +``` + +To understand why this is needed, the above YAML cannot be produced by the v1.HorizontalPodAutoscaler go struct. Take for example: + +```go +hpa := v1.HorizontalPodAutoscaler{ + TypeMeta: metav1.TypeMeta{ + APIVersion: "autoscaling/v1", + Kind: "HorizontalPodAutoscaler", + }, + ObjectMeta: ObjectMeta{ + Namespace: ns, + Name: autoscalerName, + }, + Spec: v1.HorizontalPodAutoscalerSpec{ + MinReplicas: pointer.Int32Ptr(0), + }, +} +``` + +The above code attempts to declare the same apply configuration as shown in the previous examples, but when marshalled to YAML, produces: + +```yaml +kind: HorizontalPodAutoscaler +apiVersion: autoscaling/v1 +metadata + name: myHPA + namespace: myNamespace + creationTimestamp: null +spec: + scaleTargetRef: + kind: "" + name: "" + minReplicas: 0 + maxReplicas: 0 +``` + +Which, among other things, contains `spec.maxReplicas` set to `0`. This is almost certainly not what the caller intended (the intended apply configuration says nothing about the `maxReplicas` field), and could have serious consequences on a production system: it directs the autoscaler to downscale to zero pods. The problem here originates from the fact that the go structs contain required fields that are zero valued if not set explicitly. The go structs work as intended for create and update operations, but are fundamentally incompatible with apply, which is why we have introduced the generated "apply configuration" types. + +The "apply configurations" also have convenience `With` functions that make it easier to build apply requests. This allows developers to set fields without having to deal with the fact that all the fields in the "apply configuration" types are pointers, and are inconvenient to set using go. For example `MinReplicas: &0` is not legal go code, so without the `With` functions, developers would work around this problem by using a library, .e.g. `MinReplicas: pointer.Int32Ptr(0)`, but string enumerations like `corev1.Protocol` are still a problem since they cannot be supported by a general purpose library. In addition to the convenience, the `With` functions also isolate developers from the underlying representation, which makes it safer for the underlying representation to be changed to support additional features in the future. +How to use Server-side Apply in a controller? +The new client-go support makes it much easier to use Server-side Apply in controllers. + +When authoring new controllers to use Server-side Apply, a good approach is to have the controller recreate the apply configuration for an object each time it reconciles that object. This ensures that the controller fully reconciles all the fields that it is responsible for. Controllers typically should unconditionally set all the fields they own by setting `Force: true` in the `ApplyOptions`. Controllers must also provide a `FieldManager` name that is unique to the reconciliation loop that apply is called from. + +When upgrading existing controllers to use Server-side Apply the same approach often works well--migrate the controllers to recreate the apply configuration each time it reconciles any object. Unfortunately, the controller might have multiple code paths that update different parts of an object depending on various conditions. Migrating a controller like this to Server-side Apply can be risky because if the controller forgets to include any fields in an apply configuration that is included in a previous apply request, a field can be accidently deleted. To ease this type of migration, client-go apply support provides a way to replace any controller reconciliation code that performs a "read/modify-in-place/update" (or patch) workflow with a "extract/modify-in-place/apply" workflow. Here's an example of the new workflow: + +```go +fieldMgr := "my-field-manager" +deploymentClient := clientset.AppsV1().Deployments("default") + +// read, could also be read from a shared informer +deployment, err := deploymentClient.Get(ctx, "example-deployment", metav1.GetOptions{}) +if err != nil { + // handle error +} + +// extract +deploymentApplyConfig, err := appsv1ac.ExtractDeployment(deployment, fieldMgr) +if err != nil { + // handle error +} + +// modify-in-place +deploymentApplyConfig.Spec.Template.Spec.WithContainers(corev1ac.Container(). + WithName("modify-slice"). + WithImage("nginx:1.14.2"), +) + +// apply +applied, err := deploymentClient.Apply(ctx, extractedDeployment, metav1.ApplyOptions{FieldManager: fieldMgr}) +``` + +For developers using Custom Resource Definitions (CRDs), the Kubebuilder apply support provides the same capabilities. . +How to Use Server-side Apply with CRDs + +It is strongly recommended that all CRDs have a schema. Custom Resource Definitions (CRDs) without a schema are treated as unstructured data by Server-side Apply. Keys are treated as fields in a struct and lists are assumed to be atomic. + +CRD that specify a schema are able to specify additional annotations in the schema. Please refer to the documentation on the full list of available annotations. + +New annotations since beta: + +Defaulting: Values for fields that appliers do not express explicit interest in should be defaulted. This prevents an applier from unintentionally owning a defaulted field that might cause conflicts with other appliers. If unspecified, the default value is nil or the nil equivalent for the corresponding type. + +- Usage: see the [Defaulting Documentation](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#defaulting) for more details. +- Golang: `+default=`, +- OpenAPI extension: `default: ` + + +Atomic for maps and structs: + +Maps: By default maps are granular. A different manager is able to manage each map entry. They can also be configured to be atomic such that a single manager owns the entire map. + +- Usage: Refer to [Merge Strategy](https://kubernetes.io/docs/reference/using-api/server-side-apply/#merge-strategy) for a more detailed overview +- Golang: `+mapType=granular/atomic` +- OpenAPI extension: x-kubernetes-map-type: granular/atomic` + +Structs: By default structs are granular and a separate applier may own each field. For certain kinds of structs, atomicity may be desired. This is most commonly seen in small coordinate-like structs such as Field/Object/Namespace Selectors, Object References, RGB values, Endpoints (Protocol/Port pairs), etc. + +- Usage: Refer to [Merge Strategy](https://kubernetes.io/docs/reference/using-api/server-side-apply/#merge-strategy) for a more detailed overview +- Golang: `+structType=granular/atomic` +- OpenAPI extension: `x-kubernetes-map-type:atomic/granular` + +What's Next? + + +How to get involved? +The working-group for apply is available on slack #wg-api-expression, through the mailing list and we also meet every other Tuesday at 9.30 PT on Zoom. + +We would also like to use the opportunity to thank the hard work of all the contributors involved in making this promotion to GA possible: + +- Andrea Nodari +- Antoine Pelisse +- Daniel Smith +- Jeffrey Ying +- Jenny Buckley +- Joe Betz +- Julian Modesto +- Kevin Delgado +- Kevin Wiesmüller +- Maria Ntalla From 04e5a046f7355c40429c0d1258096ea03312b7b4 Mon Sep 17 00:00:00 2001 From: Jeffrey Ying Date: Tue, 20 Jul 2021 12:46:34 -0400 Subject: [PATCH 058/279] Apply suggestions from code review Co-authored-by: Tim Bannister --- .../_posts/2021-07-15-server-side-apply-ga.md | 20 +++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/content/en/blog/_posts/2021-07-15-server-side-apply-ga.md b/content/en/blog/_posts/2021-07-15-server-side-apply-ga.md index 294b9fe8c6..801cf6b17c 100644 --- a/content/en/blog/_posts/2021-07-15-server-side-apply-ga.md +++ b/content/en/blog/_posts/2021-07-15-server-side-apply-ga.md @@ -13,16 +13,18 @@ Server-side Apply (SSA) has been promoted to GA in the Kubernetes v1.22 release. The GA milestone indicates that Kubernetes users may depend on the feature and its API without fear of backwards incompatible changes in future causing regressions. GA features are protected by the [Kubernetes deprecation policy](https://kubernetes.io/docs/reference/using-api/deprecation-policy/). -What is Server-side Apply? +## What is Server-side Apply? Server-side Apply helps users and controllers manage their resources through declarative configurations. Server-side Apply replaces the client side apply feature implemented by “kubectl apply” with a server-side implementation, permitting use by tools/clients other than kubectl. To learn more about why Server-side Apply is important, or to learn how to use Server-side Apply from `kubectl`, see the [Beta 2 release announcement](https://kubernetes.io/blog/2020/04/01/kubernetes-1.18-feature-server-side-apply-beta-2/). -What’s new since Beta? +## What’s new since Beta? Since the [Beta 2 release](https://kubernetes.io/blog/2020/04/01/kubernetes-1.18-feature-server-side-apply-beta-2/) subresources support has been added, and both client-go and Kubebuilder have added comprehensive support for Server-side Apply. This completes the Server-side Apply functionality required to make controller development practical. -Subresource Support -Server-side Apply now fully supports subresources like status and scale. This is particularly important for controllers, which are often responsible for writing to subresources. -Server-side Apply support in client-go + +### Support for subresources + +Server-side Apply now fully supports subresources like `status` and `scale`. This is particularly important for [controllers](/docs/concepts/architecture/controller/), which are often responsible for writing to subresources. +## Server-side Apply support in client-go Previously, Server-side Apply could only be called from the client-go typed client using the `Patch` function, with `PatchType` set to `ApplyPatchType`. Now, `Apply` functions are included in the client to allow for a more direct and typesafe way of calling Server-side Apply. Each `Apply` function takes an "apply configuration" type as an argument, which is a structured representation of an Apply request. For example: ```go @@ -89,7 +91,9 @@ spec: Which, among other things, contains `spec.maxReplicas` set to `0`. This is almost certainly not what the caller intended (the intended apply configuration says nothing about the `maxReplicas` field), and could have serious consequences on a production system: it directs the autoscaler to downscale to zero pods. The problem here originates from the fact that the go structs contain required fields that are zero valued if not set explicitly. The go structs work as intended for create and update operations, but are fundamentally incompatible with apply, which is why we have introduced the generated "apply configuration" types. The "apply configurations" also have convenience `With` functions that make it easier to build apply requests. This allows developers to set fields without having to deal with the fact that all the fields in the "apply configuration" types are pointers, and are inconvenient to set using go. For example `MinReplicas: &0` is not legal go code, so without the `With` functions, developers would work around this problem by using a library, .e.g. `MinReplicas: pointer.Int32Ptr(0)`, but string enumerations like `corev1.Protocol` are still a problem since they cannot be supported by a general purpose library. In addition to the convenience, the `With` functions also isolate developers from the underlying representation, which makes it safer for the underlying representation to be changed to support additional features in the future. -How to use Server-side Apply in a controller? + +## Using Server-side Apply in a controller + The new client-go support makes it much easier to use Server-side Apply in controllers. When authoring new controllers to use Server-side Apply, a good approach is to have the controller recreate the apply configuration for an object each time it reconciles that object. This ensures that the controller fully reconciles all the fields that it is responsible for. Controllers typically should unconditionally set all the fields they own by setting `Force: true` in the `ApplyOptions`. Controllers must also provide a `FieldManager` name that is unique to the reconciliation loop that apply is called from. @@ -123,7 +127,7 @@ applied, err := deploymentClient.Apply(ctx, extractedDeployment, metav1.ApplyOpt ``` For developers using Custom Resource Definitions (CRDs), the Kubebuilder apply support provides the same capabilities. . -How to Use Server-side Apply with CRDs +## Server-side Apply and CustomResourceDefinitions It is strongly recommended that all CRDs have a schema. Custom Resource Definitions (CRDs) without a schema are treated as unstructured data by Server-side Apply. Keys are treated as fields in a struct and lists are assumed to be atomic. @@ -133,7 +137,7 @@ New annotations since beta: Defaulting: Values for fields that appliers do not express explicit interest in should be defaulted. This prevents an applier from unintentionally owning a defaulted field that might cause conflicts with other appliers. If unspecified, the default value is nil or the nil equivalent for the corresponding type. -- Usage: see the [Defaulting Documentation](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#defaulting) for more details. +- Usage: see the [CRD Defaulting](/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#defaulting) documentation for more details. - Golang: `+default=`, - OpenAPI extension: `default: ` From 437f38b0dc3b3e4846df7511ce6ab4e9c131de87 Mon Sep 17 00:00:00 2001 From: Jefftree Date: Mon, 26 Jul 2021 13:14:06 -0700 Subject: [PATCH 059/279] Address comments --- ....md => 2021-08-06-server-side-apply-ga.md} | 55 ++++++++++--------- 1 file changed, 28 insertions(+), 27 deletions(-) rename content/en/blog/_posts/{2021-07-15-server-side-apply-ga.md => 2021-08-06-server-side-apply-ga.md} (63%) diff --git a/content/en/blog/_posts/2021-07-15-server-side-apply-ga.md b/content/en/blog/_posts/2021-08-06-server-side-apply-ga.md similarity index 63% rename from content/en/blog/_posts/2021-07-15-server-side-apply-ga.md rename to content/en/blog/_posts/2021-08-06-server-side-apply-ga.md index 801cf6b17c..eca57a561e 100644 --- a/content/en/blog/_posts/2021-07-15-server-side-apply-ga.md +++ b/content/en/blog/_posts/2021-08-06-server-side-apply-ga.md @@ -1,21 +1,17 @@ --- layout: blog title: "Kubernetes 1.22: Server Side Apply moves to GA" -description: > - Server Side Apply moves to GA. -date: 2021-07-15T10:00:00-08:00 -slug: Server-Side-Apply-GA +date: 2021-08-06 +slug: server-side-apply-ga --- -Authors: Jeffrey Ying, Google & Joe Betz, Google +**Authors:** Jeffrey Ying, Google & Joe Betz, Google -Server-side Apply (SSA) has been promoted to GA in the Kubernetes v1.22 release. Support for Server-side Apply was introduced as alpha in Kubernetes v1.14 release, promoted to beta in the Kubernetes v1.16 release, and [promoted to beta 2](https://kubernetes.io/blog/2020/04/01/kubernetes-1.18-feature-server-side-apply-beta-2/) in the Kubernetes v1.18 release. - -The GA milestone indicates that Kubernetes users may depend on the feature and its API without fear of backwards incompatible changes in future causing regressions. GA features are protected by the [Kubernetes deprecation policy](https://kubernetes.io/docs/reference/using-api/deprecation-policy/). +Server-side Apply (SSA) has been promoted to GA in the Kubernetes v1.22 release. The GA milestone means you can depend on the feature and its API, without fear of future backwards-incompatible changes. GA features are protected by the Kubernetes [deprecation policy](/docs/reference/using-api/deprecation-policy/). ## What is Server-side Apply? -Server-side Apply helps users and controllers manage their resources through declarative configurations. Server-side Apply replaces the client side apply feature implemented by “kubectl apply” with a server-side implementation, permitting use by tools/clients other than kubectl. To learn more about why Server-side Apply is important, or to learn how to use Server-side Apply from `kubectl`, see the [Beta 2 release announcement](https://kubernetes.io/blog/2020/04/01/kubernetes-1.18-feature-server-side-apply-beta-2/). +Server-side Apply helps users and controllers manage their resources through declarative configurations. Server-side Apply replaces the client side apply feature implemented by “kubectl apply” with a server-side implementation, permitting use by tools/clients other than kubectl. Server-side Apply is a new merging algorithm, as well as tracking of field ownership, running on the Kubernetes api-server. Server-side Apply enables new features like conflict detection, so the system knows when two actors are trying to edit the same field. Refer to the [Server-side Apply Documentation](/docs/reference/using-api/server-side-apply/) and [Beta 2 release announcement](https://kubernetes.io/blog/2020/04/01/kubernetes-1.18-feature-server-side-apply-beta-2/) for more information. ## What’s new since Beta? @@ -24,7 +20,9 @@ Since the [Beta 2 release](https://kubernetes.io/blog/2020/04/01/kubernetes-1.18 ### Support for subresources Server-side Apply now fully supports subresources like `status` and `scale`. This is particularly important for [controllers](/docs/concepts/architecture/controller/), which are often responsible for writing to subresources. + ## Server-side Apply support in client-go + Previously, Server-side Apply could only be called from the client-go typed client using the `Patch` function, with `PatchType` set to `ApplyPatchType`. Now, `Apply` functions are included in the client to allow for a more direct and typesafe way of calling Server-side Apply. Each `Apply` function takes an "apply configuration" type as an argument, which is a structured representation of an Apply request. For example: ```go @@ -41,7 +39,7 @@ hpaApplyConfig := v1ac.HorizontalPodAutoscaler(autoscalerName, ns). return hpav1client.Apply(ctx, hpaApplyConfig, metav1.ApplyOptions{FieldManager: "mycontroller", Force: true}) ``` -Note in this example that `HorizontalPodAutoscaler` is imported from an "applyconfigurations" package. Each "apply configuration" type represents the same Kubernetes object kind as the corresponding go struct, but where all fields are pointers to make them optional, allowing apply requests to be accurately represented. For example, this when the apply configuration in the above example is marshalled to YAML, it produces: +Note in this example that `HorizontalPodAutoscaler` is imported from an "applyconfigurations" package. Each "apply configuration" type represents the same Kubernetes object kind as the corresponding go struct, but where all fields are pointers to make them optional, allowing apply requests to be accurately represented. For example, when the apply configuration in the above example is marshalled to YAML, it produces: ```yaml apiVersion: autoscaling/v1 @@ -90,11 +88,11 @@ spec: Which, among other things, contains `spec.maxReplicas` set to `0`. This is almost certainly not what the caller intended (the intended apply configuration says nothing about the `maxReplicas` field), and could have serious consequences on a production system: it directs the autoscaler to downscale to zero pods. The problem here originates from the fact that the go structs contain required fields that are zero valued if not set explicitly. The go structs work as intended for create and update operations, but are fundamentally incompatible with apply, which is why we have introduced the generated "apply configuration" types. -The "apply configurations" also have convenience `With` functions that make it easier to build apply requests. This allows developers to set fields without having to deal with the fact that all the fields in the "apply configuration" types are pointers, and are inconvenient to set using go. For example `MinReplicas: &0` is not legal go code, so without the `With` functions, developers would work around this problem by using a library, .e.g. `MinReplicas: pointer.Int32Ptr(0)`, but string enumerations like `corev1.Protocol` are still a problem since they cannot be supported by a general purpose library. In addition to the convenience, the `With` functions also isolate developers from the underlying representation, which makes it safer for the underlying representation to be changed to support additional features in the future. +The "apply configurations" also have convenience `With` functions that make it easier to build apply requests. This allows developers to set fields without having to deal with the fact that all the fields in the "apply configuration" types are pointers, and are inconvenient to set using go. For example `MinReplicas: &0` is not legal go code, so without the `With` functions, developers would work around this problem by using a library, e.g. `MinReplicas: pointer.Int32Ptr(0)`, but string enumerations like `corev1.Protocol` are still a problem since they cannot be supported by a general purpose library. In addition to the convenience, the `With` functions also isolate developers from the underlying representation, which makes it safer for the underlying representation to be changed to support additional features in the future. ## Using Server-side Apply in a controller -The new client-go support makes it much easier to use Server-side Apply in controllers. +You can use the new support for Server-side Apply no matter how you implemented your controller. However, the new client-go support makes it easier to use Server-side Apply in controllers. When authoring new controllers to use Server-side Apply, a good approach is to have the controller recreate the apply configuration for an object each time it reconciles that object. This ensures that the controller fully reconciles all the fields that it is responsible for. Controllers typically should unconditionally set all the fields they own by setting `Force: true` in the `ApplyOptions`. Controllers must also provide a `FieldManager` name that is unique to the reconciliation loop that apply is called from. @@ -126,41 +124,44 @@ deploymentApplyConfig.Spec.Template.Spec.WithContainers(corev1ac.Container(). applied, err := deploymentClient.Apply(ctx, extractedDeployment, metav1.ApplyOptions{FieldManager: fieldMgr}) ``` -For developers using Custom Resource Definitions (CRDs), the Kubebuilder apply support provides the same capabilities. . +For developers using Custom Resource Definitions (CRDs), the Kubebuilder apply support will provide the same capabilities. Documentation will be included in the Kubebuilder book when available. + ## Server-side Apply and CustomResourceDefinitions -It is strongly recommended that all CRDs have a schema. Custom Resource Definitions (CRDs) without a schema are treated as unstructured data by Server-side Apply. Keys are treated as fields in a struct and lists are assumed to be atomic. +It is strongly recommended that all [Custom Resource Definitions](/docs/concepts/extend-kubernetes/api-extension/custom-resources/) (CRDs) have a schema. CRDs without a schema are treated as unstructured data by Server-side Apply. Keys are treated as fields in a struct and lists are assumed to be atomic. -CRD that specify a schema are able to specify additional annotations in the schema. Please refer to the documentation on the full list of available annotations. +CRDs that specify a schema are able to specify additional annotations in the schema. Please refer to the documentation on the full list of available annotations. New annotations since beta: -Defaulting: Values for fields that appliers do not express explicit interest in should be defaulted. This prevents an applier from unintentionally owning a defaulted field that might cause conflicts with other appliers. If unspecified, the default value is nil or the nil equivalent for the corresponding type. +**Defaulting:** Values for fields that appliers do not express explicit interest in should be defaulted. This prevents an applier from unintentionally owning a defaulted field that might cause conflicts with other appliers. If unspecified, the default value is nil or the nil equivalent for the corresponding type. -- Usage: see the [CRD Defaulting](/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#defaulting) documentation for more details. -- Golang: `+default=`, +- Usage: see the [CRD Defaulting](/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#defaulting) documentation for more details. +- Golang: `+default=` - OpenAPI extension: `default: ` Atomic for maps and structs: -Maps: By default maps are granular. A different manager is able to manage each map entry. They can also be configured to be atomic such that a single manager owns the entire map. +**Maps:** By default maps are granular. A different manager is able to manage each map entry. They can also be configured to be atomic such that a single manager owns the entire map. -- Usage: Refer to [Merge Strategy](https://kubernetes.io/docs/reference/using-api/server-side-apply/#merge-strategy) for a more detailed overview +- Usage: Refer to [Merge Strategy](/docs/reference/using-api/server-side-apply/#merge-strategy) for a more detailed overview - Golang: `+mapType=granular/atomic` -- OpenAPI extension: x-kubernetes-map-type: granular/atomic` +- OpenAPI extension: `x-kubernetes-map-type: granular/atomic` -Structs: By default structs are granular and a separate applier may own each field. For certain kinds of structs, atomicity may be desired. This is most commonly seen in small coordinate-like structs such as Field/Object/Namespace Selectors, Object References, RGB values, Endpoints (Protocol/Port pairs), etc. +**Structs:** By default structs are granular and a separate applier may own each field. For certain kinds of structs, atomicity may be desired. This is most commonly seen in small coordinate-like structs such as Field/Object/Namespace Selectors, Object References, RGB values, Endpoints (Protocol/Port pairs), etc. -- Usage: Refer to [Merge Strategy](https://kubernetes.io/docs/reference/using-api/server-side-apply/#merge-strategy) for a more detailed overview +- Usage: Refer to [Merge Strategy](/docs/reference/using-api/server-side-apply/#merge-strategy) for a more detailed overview - Golang: `+structType=granular/atomic` - OpenAPI extension: `x-kubernetes-map-type:atomic/granular` -What's Next? +## What's Next? - -How to get involved? -The working-group for apply is available on slack #wg-api-expression, through the mailing list and we also meet every other Tuesday at 9.30 PT on Zoom. +After Server Side Apply, the next focus for the API Expression working-group is around improving the expressiveness and size of the published Kubernetes API schema. To see the full list of items we are working on, please join our working group and refer to the work items document. + +## How to get involved? + +The working-group for apply is [wg-api-expression](https://github.com/kubernetes/community/tree/master/wg-api-expression). It is available on slack [#wg-api-expression](https://kubernetes.slack.com/archives/C0123CNN8F3), through the [mailing list](https://groups.google.com/g/kubernetes-wg-api-expression) and we also meet every other Tuesday at 9.30 PT on Zoom. We would also like to use the opportunity to thank the hard work of all the contributors involved in making this promotion to GA possible: From 5a8bd9216a6aa3478cc9163530cbce363e746bf2 Mon Sep 17 00:00:00 2001 From: Dan Winship Date: Wed, 4 Aug 2021 11:50:21 -0400 Subject: [PATCH 060/279] Add a manual anchor to an interesting spot in the NetworkPolicy docs --- content/en/docs/concepts/services-networking/network-policies.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/en/docs/concepts/services-networking/network-policies.md b/content/en/docs/concepts/services-networking/network-policies.md index ec29f1d813..9c6bff5e75 100644 --- a/content/en/docs/concepts/services-networking/network-policies.md +++ b/content/en/docs/concepts/services-networking/network-policies.md @@ -154,6 +154,7 @@ contains two elements in the `from` array, and allows connections from Pods in t When in doubt, use `kubectl describe` to see how Kubernetes has interpreted the policy. + __ipBlock__: This selects particular IP CIDR ranges to allow as ingress sources or egress destinations. These should be cluster-external IPs, since Pod IPs are ephemeral and unpredictable. Cluster ingress and egress mechanisms often require rewriting the source or destination IP From de80496fcfcb64a454b8a471293531d18a27f169 Mon Sep 17 00:00:00 2001 From: Tedley Meralus Date: Wed, 4 Aug 2021 17:11:28 -0400 Subject: [PATCH 061/279] fixed small typo changed uprate to upgrade on line 12 --- content/en/docs/setup/production-environment/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/setup/production-environment/_index.md b/content/en/docs/setup/production-environment/_index.md index fc99c31a7d..ca5aa7bd50 100644 --- a/content/en/docs/setup/production-environment/_index.md +++ b/content/en/docs/setup/production-environment/_index.md @@ -9,7 +9,7 @@ no_list: true A production-quality Kubernetes cluster requires planning and preparation. If your Kubernetes cluster is to run critical workloads, it must be configured to be resilient. This page explains steps you can take to set up a production-ready cluster, -or to uprate an existing cluster for production use. +or to upgrade an existing cluster for production use. If you're already familiar with production setup and want the links, skip to [What's next](#what-s-next). From 1ca5ecbf7739ee6790516b25de42b8fb257c3513 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 4 Aug 2021 22:25:12 +0100 Subject: [PATCH 062/279] Link to new API reference page for APIService --- .../extend-kubernetes/api-extension/apiserver-aggregation.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation.md b/content/en/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation.md index d9fe184f85..785c8895df 100644 --- a/content/en/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation.md +++ b/content/en/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation.md @@ -34,7 +34,7 @@ If your extension API server cannot achieve that latency requirement, consider m * To get the aggregator working in your environment, [configure the aggregation layer](/docs/tasks/extend-kubernetes/configure-aggregation-layer/). * Then, [setup an extension api-server](/docs/tasks/extend-kubernetes/setup-extension-api-server/) to work with the aggregation layer. -* Also, learn how to [extend the Kubernetes API using Custom Resource Definitions](/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/). -* Read the specification for [APIService](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#apiservice-v1-apiregistration-k8s-io) +* Read about [APIService](/docs/reference/kubernetes-api/cluster-resources/api-service-v1/) in the API reference +Alternatively: learn how to [extend the Kubernetes API using Custom Resource Definitions](/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/). From 075fdf2e376c6a535a7655bef0883c17df97c6ee Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 4 Aug 2021 22:28:54 +0100 Subject: [PATCH 063/279] =?UTF-8?q?Retitle=20=E2=80=9CKubernetes=20API=20A?= =?UTF-8?q?ggregation=20Layer=E2=80=9D=20concept?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The old title “Extending the Kubernetes API with the aggregation layer” sounds more like a task page than a concept, so I reworded. --- .../extend-kubernetes/api-extension/apiserver-aggregation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation.md b/content/en/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation.md index d9fe184f85..08e147600a 100644 --- a/content/en/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation.md +++ b/content/en/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation.md @@ -1,5 +1,5 @@ --- -title: Extending the Kubernetes API with the aggregation layer +title: Kubernetes API Aggregation Layer reviewers: - lavalamp - cheftako From 97c35ce77098e2488e4698a589a4b262234e19e3 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 4 Aug 2021 22:35:56 +0100 Subject: [PATCH 064/279] Update links from Secret concept to relevant API reference --- content/en/docs/concepts/configuration/secret.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/content/en/docs/concepts/configuration/secret.md b/content/en/docs/concepts/configuration/secret.md index a0ad94da89..d4efbef365 100644 --- a/content/en/docs/concepts/configuration/secret.md +++ b/content/en/docs/concepts/configuration/secret.md @@ -75,9 +75,9 @@ precedence. ## Types of Secret {#secret-types} When creating a Secret, you can specify its type using the `type` field of -the [`Secret`](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#secret-v1-core) -resource, or certain equivalent `kubectl` command line flags (if available). -The Secret type is used to facilitate programmatic handling of the Secret data. +a Secret resource, or certain equivalent `kubectl` command line flags (if available). +The `type` of a Secret is used to facilitate programmatic handling of different +kinds of confidential data. Kubernetes provides several builtin types for some common usage scenarios. These types vary in terms of the validations performed and the constraints @@ -1252,3 +1252,4 @@ for secret data, so that the secrets are not stored in the clear into {{< glossa - Learn how to [manage Secret using `kubectl`](/docs/tasks/configmap-secret/managing-secret-using-kubectl/) - Learn how to [manage Secret using config file](/docs/tasks/configmap-secret/managing-secret-using-config-file/) - Learn how to [manage Secret using kustomize](/docs/tasks/configmap-secret/managing-secret-using-kustomize/) +- Read the [API reference](/docs/reference/kubernetes-api/config-and-storage-resources/secret-v1/) for `Secret` From cba4f57124027a299223c636042acbe8773ebf94 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 4 Aug 2021 22:42:14 +0100 Subject: [PATCH 065/279] Update link from Working With Objects to Kubernetes API Reference --- .../overview/working-with-objects/kubernetes-objects.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/content/en/docs/concepts/overview/working-with-objects/kubernetes-objects.md b/content/en/docs/concepts/overview/working-with-objects/kubernetes-objects.md index 716955ca06..38165d0024 100644 --- a/content/en/docs/concepts/overview/working-with-objects/kubernetes-objects.md +++ b/content/en/docs/concepts/overview/working-with-objects/kubernetes-objects.md @@ -81,12 +81,11 @@ In the `.yaml` file for the Kubernetes object you want to create, you'll need to * `metadata` - Data that helps uniquely identify the object, including a `name` string, `UID`, and optional `namespace` * `spec` - What state you desire for the object -The precise format of the object `spec` is different for every Kubernetes object, and contains nested fields specific to that object. The [Kubernetes API Reference](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/) can help you find the spec format for all of the objects you can create using Kubernetes. -For example, the `spec` format for a Pod can be found in -[PodSpec v1 core](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podspec-v1-core), -and the `spec` format for a Deployment can be found in -[DeploymentSpec v1 apps](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#deploymentspec-v1-apps). +The precise format of the object `spec` is different for every Kubernetes object, and contains nested fields specific to that object. The [Kubernetes API Reference](https://kubernetes.io/docs/reference/kubernetes-api/) can help you find the spec format for all of the objects you can create using Kubernetes. +For example, the reference for Pod details the [`spec` field](/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodSpec) +for a Pod in the API, and the reference for Deployment details the [`spec` field](/docs/reference/kubernetes-api/workload-resources/deployment-v1/#DeploymentSpec) for Deployents. +In those API reference pages you'll see mention of PodSpec and DeploymentSpec. These names are implementation details of the Golang code that Kubernetes uses to implement its API. ## {{% heading "whatsnext" %}} From 1b3125353d1f8adecd7151f6ad34f7caecbc6cf0 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 4 Aug 2021 22:52:27 +0100 Subject: [PATCH 066/279] Link from PV / PVC concept to new API reference --- .../docs/concepts/storage/persistent-volumes.md | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/content/en/docs/concepts/storage/persistent-volumes.md b/content/en/docs/concepts/storage/persistent-volumes.md index f45d17ff54..554e39e913 100644 --- a/content/en/docs/concepts/storage/persistent-volumes.md +++ b/content/en/docs/concepts/storage/persistent-volumes.md @@ -499,7 +499,7 @@ it will become fully deprecated in a future Kubernetes release. For most volume types, you do not need to set this field. It is automatically populated for [AWS EBS](/docs/concepts/storage/volumes/#awselasticblockstore), [GCE PD](/docs/concepts/storage/volumes/#gcepersistentdisk) and [Azure Disk](/docs/concepts/storage/volumes/#azuredisk) volume block types. You need to explicitly set this for [local](/docs/concepts/storage/volumes/#local) volumes. {{< /note >}} -A PV can specify [node affinity](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#volumenodeaffinity-v1-core) to define constraints that limit what nodes this volume can be accessed from. Pods that use a PV will only be scheduled to nodes that are selected by the node affinity. +A PV can specify node affinity to define constraints that limit what nodes this volume can be accessed from. Pods that use a PV will only be scheduled to nodes that are selected by the node affinity. To specify node affinity, set `nodeAffinity` in the `.spec` of a PV. The [PersistentVolume](/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-v1/#PersistentVolumeSpec) API reference has more details on this field. ### Phase @@ -811,16 +811,15 @@ and need persistent storage, it is recommended that you use the following patter or the cluster has no storage system (in which case the user cannot deploy config requiring PVCs). - ## {{% heading "whatsnext" %}} - +## {{% heading "whatsnext" %}} * Learn more about [Creating a PersistentVolume](/docs/tasks/configure-pod-container/configure-persistent-volume-storage/#create-a-persistentvolume). * Learn more about [Creating a PersistentVolumeClaim](/docs/tasks/configure-pod-container/configure-persistent-volume-storage/#create-a-persistentvolumeclaim). * Read the [Persistent Storage design document](https://git.k8s.io/community/contributors/design-proposals/storage/persistent-storage.md). -### Reference +### API references {#reference} -* [PersistentVolume](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#persistentvolume-v1-core) -* [PersistentVolumeSpec](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#persistentvolumespec-v1-core) -* [PersistentVolumeClaim](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#persistentvolumeclaim-v1-core) -* [PersistentVolumeClaimSpec](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#persistentvolumeclaimspec-v1-core) +Read about the APIs described in this page: + +* [`PersistentVolume`](/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-v1/) +* [`PersistentVolumeClaim`](/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/) From c1feea756fc381a62790b9a1ecd59272643d6507 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 4 Aug 2021 22:58:42 +0100 Subject: [PATCH 067/279] Update init containers concept to link to new API reference --- .../en/docs/concepts/workloads/pods/init-containers.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/content/en/docs/concepts/workloads/pods/init-containers.md b/content/en/docs/concepts/workloads/pods/init-containers.md index 619bd2d982..62eea7f233 100644 --- a/content/en/docs/concepts/workloads/pods/init-containers.md +++ b/content/en/docs/concepts/workloads/pods/init-containers.md @@ -32,9 +32,11 @@ If a Pod's init container fails, the kubelet repeatedly restarts that init conta However, if the Pod has a `restartPolicy` of Never, and an init container fails during startup of that Pod, Kubernetes treats the overall Pod as failed. To specify an init container for a Pod, add the `initContainers` field into -the Pod specification, as an array of objects of type -[Container](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#container-v1-core), -alongside the app `containers` array. +the [Pod specification](/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodSpec), +as an array of `container` items (similar to the app `containers` field and its contents). +See [Container](/docs/reference/kubernetes-api/workload-resources/pod-v1/#Container) in the +API reference for more details. + The status of the init containers is returned in `.status.initContainerStatuses` field as an array of the container statuses (similar to the `.status.containerStatuses` field). From 142177068b7598ff53e49e80ec655cf506f48e87 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Thu, 17 Jun 2021 18:31:58 +0100 Subject: [PATCH 068/279] =?UTF-8?q?Refer=20to=20the=20=E2=80=9Cdefault?= =?UTF-8?q?=E2=80=9D=20rather=20than=20=E2=80=9Cmaster=E2=80=9D=20branch?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Get ready for a switch to "main" --- .../docs/contribute/generate-ref-docs/contribute-upstream.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/contribute/generate-ref-docs/contribute-upstream.md b/content/en/docs/contribute/generate-ref-docs/contribute-upstream.md index 656f8c971b..80b14aa87a 100644 --- a/content/en/docs/contribute/generate-ref-docs/contribute-upstream.md +++ b/content/en/docs/contribute/generate-ref-docs/contribute-upstream.md @@ -91,7 +91,7 @@ will be different in your situation. Here's an example of editing a comment in the Kubernetes source code. -In your local kubernetes/kubernetes repository, check out the master branch, +In your local kubernetes/kubernetes repository, check out the default branch, and make sure it is up to date: ```shell @@ -100,7 +100,7 @@ git checkout master git pull https://github.com/kubernetes/kubernetes master ``` -Suppose this source file in the master branch has the typo "atmost": +Suppose this source file in that default branch has the typo "atmost": [kubernetes/kubernetes/staging/src/k8s.io/api/apps/v1/types.go](https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/api/apps/v1/types.go) From 191c2bf4ee1572ca0be7a7dfdb8c2efd39ce2d8a Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Thu, 17 Jun 2021 18:33:43 +0100 Subject: [PATCH 069/279] Pick example versions based on current release --- .../generate-ref-docs/contribute-upstream.md | 25 ++++++++++-------- .../contribute/generate-ref-docs/kubectl.md | 26 ++++++++++--------- 2 files changed, 28 insertions(+), 23 deletions(-) diff --git a/content/en/docs/contribute/generate-ref-docs/contribute-upstream.md b/content/en/docs/contribute/generate-ref-docs/contribute-upstream.md index 80b14aa87a..4abf2de68b 100644 --- a/content/en/docs/contribute/generate-ref-docs/contribute-upstream.md +++ b/content/en/docs/contribute/generate-ref-docs/contribute-upstream.md @@ -183,12 +183,13 @@ In the preceding section, you edited a file in the master branch and then ran sc to generate an OpenAPI spec and related files. Then you submitted your changes in a pull request to the master branch of the kubernetes/kubernetes repository. Now suppose you want to backport your change into a release branch. For example, suppose the master branch is being used to develop -Kubernetes version 1.10, and you want to backport your change into the release-1.9 branch. +Kubernetes version {{< skew latestVersion >}}, and you want to backport your change into the +release-{{< skew prevMinorVersion >}} branch. Recall that your pull request has two commits: one for editing `types.go` and one for the files generated by scripts. The next step is to propose a cherry pick of your first -commit into the release-1.9 branch. The idea is to cherry pick the commit that edited `types.go`, but not -the commit that has the results of running the scripts. For instructions, see +commit into the release-{{< skew prevMinorVersion >}} branch. The idea is to cherry pick the commit +that edited `types.go`, but not the commit that has the results of running the scripts. For instructions, see [Propose a Cherry Pick](https://git.k8s.io/community/contributors/devel/sig-release/cherry-picks.md). {{< note >}} @@ -197,8 +198,9 @@ pull request. If you don't have those permissions, you will need to work with so and milestone for you. {{< /note >}} -When you have a pull request in place for cherry picking your one commit into the release-1.9 branch, -the next step is to run these scripts in the release-1.9 branch of your local environment. +When you have a pull request in place for cherry picking your one commit into the +release-{{< skew prevMinorVersion >}} branch, the next step is to run these scripts in the +release-{{< skew prevMinorVersion >}} branch of your local environment. ```shell hack/update-generated-swagger-docs.sh @@ -208,14 +210,15 @@ hack/update-api-reference-docs.sh ``` Now add a commit to your cherry-pick pull request that has the recently generated OpenAPI spec -and related files. Monitor your pull request until it gets merged into the release-1.9 branch. +and related files. Monitor your pull request until it gets merged into the +release-{{< skew prevMinorVersion >}} branch. -At this point, both the master branch and the release-1.9 branch have your updated `types.go` +At this point, both the master branch and the release-{{< skew prevMinorVersion >}} branch have your updated `types.go` file and a set of generated files that reflect the change you made to `types.go`. Note that the -generated OpenAPI spec and other generated files in the release-1.9 branch are not necessarily -the same as the generated files in the master branch. The generated files in the release-1.9 branch -contain API elements only from Kubernetes 1.9. The generated files in the master branch might contain -API elements that are not in 1.9, but are under development for 1.10. +generated OpenAPI spec and other generated files in the release-{{< skew prevMinorVersion >}} branch are not necessarily +the same as the generated files in the master branch. The generated files in the release-{{< skew prevMinorVersion >}} branch +contain API elements only from Kubernetes {{< skew prevMinorVersion >}}. The generated files in the master branch might contain +API elements that are not in {{< skew prevMinorVersion >}}, but are under development for {{< skew latestVersion >}}. ## Generating the published reference docs diff --git a/content/en/docs/contribute/generate-ref-docs/kubectl.md b/content/en/docs/contribute/generate-ref-docs/kubectl.md index b216a0a5b7..a41c8d0df3 100644 --- a/content/en/docs/contribute/generate-ref-docs/kubectl.md +++ b/content/en/docs/contribute/generate-ref-docs/kubectl.md @@ -86,12 +86,12 @@ The remaining steps refer to your base directory as ``. In your local k8s.io/kubernetes repository, check out the branch of interest, and make sure it is up to date. For example, if you want to generate docs for -Kubernetes 1.17, you could use these commands: +Kubernetes {{< skew prevMinorVersion >}}.0, you could use these commands: ```shell cd -git checkout v1.17.0 -git pull https://github.com/kubernetes/kubernetes v1.17.0 +git checkout v{{< skew prevMinorVersion >}}.0 +git pull https://github.com/kubernetes/kubernetes {{< skew prevMinorVersion >}}.0 ``` If you do not need to edit the `kubectl` source code, follow the instructions for @@ -109,7 +109,7 @@ local kubernetes/kubernetes repository, and then submit a pull request to the ma is an example of a pull request that fixes a typo in the kubectl source code. Monitor your pull request, and respond to reviewer comments. Continue to monitor your -pull request until it is merged into the master branch of the kubernetes/kubernetes repository. +pull request until it is merged into the target branch of the kubernetes/kubernetes repository. ## Cherry picking your change into a release branch @@ -118,9 +118,10 @@ Kubernetes release. If you want your change to appear in the docs for a Kubernet version that has already been released, you need to propose that your change be cherry picked into the release branch. -For example, suppose the master branch is being used to develop Kubernetes 1.10, -and you want to backport your change to the release-1.15 branch. For instructions -on how to do this, see +For example, suppose the master branch is being used to develop Kubernetes +{{< skew currentVersion >}} +and you want to backport your change to the release-{{< skew prevMinorVersion >}} branch. For +instructions on how to do this, see [Propose a Cherry Pick](https://git.k8s.io/community/contributors/devel/sig-release/cherry-picks.md). Monitor your cherry-pick pull request until it is merged into the release branch. @@ -138,14 +139,14 @@ Go to ``. On you command line, set the following environment variabl * Set `K8S_ROOT` to ``. * Set `K8S_WEBROOT` to ``. * Set `K8S_RELEASE` to the version of the docs you want to build. - For example, if you want to build docs for Kubernetes 1.17, set `K8S_RELEASE` to 1.17. + For example, if you want to build docs for Kubernetes {{< skew prevMinorVersion >}}, set `K8S_RELEASE` to {{< skew prevMinorVersion >}}. For example: ```shell export K8S_WEBROOT=$GOPATH/src/github.com//website export K8S_ROOT=$GOPATH/src/k8s.io/kubernetes -export K8S_RELEASE=1.17 +export K8S_RELEASE={{< skew prevMinorVersion >}} ``` ## Creating a versioned directory @@ -165,13 +166,14 @@ make createversiondirs In your local `` repository, checkout the branch that has the version of Kubernetes that you want to document. For example, if you want -to generate docs for Kubernetes 1.17, checkout the `v1.17.0` tag. Make sure +to generate docs for Kubernetes {{< skew prevMinorVersion >}}.0, check out the +`v{{< skew prevMinorVersion >}}` tag. Make sure you local branch is up to date. ```shell cd -git checkout v1.17.0 -git pull https://github.com/kubernetes/kubernetes v1.17.0 +git checkout v{{< skew prevMinorVersion >}}.0 +git pull https://github.com/kubernetes/kubernetes v{{< skew prevMinorVersion >}}.0 ``` ## Running the doc generation code From b20979dbc443504c5089fa7c89b320b612b96fff Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 4 Aug 2021 23:48:38 +0100 Subject: [PATCH 070/279] Link to kubeadm v1beta3 config API https://k8s.io/docs/reference/config-api/kubeadm-config.v1beta3/ exists, so let's link to it. --- content/en/blog/_posts/2021-08-04-kubernetes-release-1.22.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/blog/_posts/2021-08-04-kubernetes-release-1.22.md b/content/en/blog/_posts/2021-08-04-kubernetes-release-1.22.md index 4b742f33b3..76972dae80 100644 --- a/content/en/blog/_posts/2021-08-04-kubernetes-release-1.22.md +++ b/content/en/blog/_posts/2021-08-04-kubernetes-release-1.22.md @@ -54,7 +54,7 @@ An alpha feature for default seccomp profiles has been added to the kubelet, alo A new alpha feature allows running the `kubeadm` control plane components as non-root users. This is a long requested security measure in `kubeadm`. To try it you must enable the `kubeadm` specific RootlessControlPlane feature gate. When you deploy a cluster using this alpha feature, your control plane runs with lower privileges. -For `kubeadm`, Kubernetes 1.22 also brings a new [v1beta3 configuration API](https://github.com/kubernetes/kubeadm/issues/1796). This iteration adds some long requested features and deprecates some existing ones. The v1beta3 version is now the preferred API version; the v1beta2 API also remains available and is not yet deprecated. +For `kubeadm`, Kubernetes 1.22 also brings a new [v1beta3 configuration API](/docs/reference/config-api/kubeadm-config.v1beta3/). This iteration adds some long requested features and deprecates some existing ones. The v1beta3 version is now the preferred API version; the v1beta2 API also remains available and is not yet deprecated. ## Major Changes From af24e943619a6e9149def1c1208b1f1c8a207871 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 4 Aug 2021 23:54:40 +0100 Subject: [PATCH 071/279] Update tense for v1.22 API removals These removals have happened, so refer to them in the past. --- .../reference/using-api/deprecation-guide.md | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/content/en/docs/reference/using-api/deprecation-guide.md b/content/en/docs/reference/using-api/deprecation-guide.md index aa5ad18fee..579e4c04ac 100644 --- a/content/en/docs/reference/using-api/deprecation-guide.md +++ b/content/en/docs/reference/using-api/deprecation-guide.md @@ -86,11 +86,11 @@ RuntimeClass in the **node.k8s.io/v1beta1** API version will no longer be served ### v1.22 -The **v1.22** release will stop serving the following deprecated API versions: +The **v1.22** release stopped serving the following deprecated API versions: #### Webhook resources {#webhook-resources-v122} -The **admissionregistration.k8s.io/v1beta1** API version of MutatingWebhookConfiguration and ValidatingWebhookConfiguration will no longer be served in v1.22. +The **admissionregistration.k8s.io/v1beta1** API version of MutatingWebhookConfiguration and ValidatingWebhookConfiguration is no longer served as of v1.22. * Migrate manifests and API clients to use the **admissionregistration.k8s.io/v1** API version, available since v1.16. * All existing persisted objects are accessible via the new APIs @@ -104,7 +104,7 @@ The **admissionregistration.k8s.io/v1beta1** API version of MutatingWebhookConfi #### CustomResourceDefinition {#customresourcedefinition-v122} -The **apiextensions.k8s.io/v1beta1** API version of CustomResourceDefinition will no longer be served in v1.22. +The **apiextensions.k8s.io/v1beta1** API version of CustomResourceDefinition is no longer served as of v1.22. * Migrate manifests and API clients to use the **apiextensions.k8s.io/v1** API version, available since v1.16. * All existing persisted objects are accessible via the new API @@ -122,7 +122,7 @@ The **apiextensions.k8s.io/v1beta1** API version of CustomResourceDefinition wil #### APIService {#apiservice-v122} -The **apiregistration.k8s.io/v1beta1** API version of APIService will no longer be served in v1.22. +The **apiregistration.k8s.io/v1beta1** API version of APIService is no longer served as of v1.22. * Migrate manifests and API clients to use the **apiregistration.k8s.io/v1** API version, available since v1.10. * All existing persisted objects are accessible via the new API @@ -130,14 +130,14 @@ The **apiregistration.k8s.io/v1beta1** API version of APIService will no longer #### TokenReview {#tokenreview-v122} -The **authentication.k8s.io/v1beta1** API version of TokenReview will no longer be served in v1.22. +The **authentication.k8s.io/v1beta1** API version of TokenReview is no longer served as of v1.22. * Migrate manifests and API clients to use the **authentication.k8s.io/v1** API version, available since v1.6. * No notable changes #### SubjectAccessReview resources {#subjectaccessreview-resources-v122} -The **authorization.k8s.io/v1beta1** API version of LocalSubjectAccessReview, SelfSubjectAccessReview, and SubjectAccessReview will no longer be served in v1.22. +The **authorization.k8s.io/v1beta1** API version of LocalSubjectAccessReview, SelfSubjectAccessReview, and SubjectAccessReview is no longer served as of v1.22. * Migrate manifests and API clients to use the **authorization.k8s.io/v1** API version, available since v1.6. * Notable changes: @@ -145,7 +145,7 @@ The **authorization.k8s.io/v1beta1** API version of LocalSubjectAccessReview, Se #### CertificateSigningRequest {#certificatesigningrequest-v122} -The **certificates.k8s.io/v1beta1** API version of CertificateSigningRequest will no longer be served in v1.22. +The **certificates.k8s.io/v1beta1** API version of CertificateSigningRequest is no longer served as of v1.22. * Migrate manifests and API clients to use the **certificates.k8s.io/v1** API version, available since v1.19. * All existing persisted objects are accessible via the new API @@ -160,7 +160,7 @@ The **certificates.k8s.io/v1beta1** API version of CertificateSigningRequest wil #### Lease {#lease-v122} -The **coordination.k8s.io/v1beta1** API version of Lease will no longer be served in v1.22. +The **coordination.k8s.io/v1beta1** API version of Lease is no longer served as of v1.22. * Migrate manifests and API clients to use the **coordination.k8s.io/v1** API version, available since v1.14. * All existing persisted objects are accessible via the new API @@ -168,7 +168,7 @@ The **coordination.k8s.io/v1beta1** API version of Lease will no longer be serve #### Ingress {#ingress-v122} -The **extensions/v1beta1** and **networking.k8s.io/v1beta1** API versions of Ingress will no longer be served in v1.22. +The **extensions/v1beta1** and **networking.k8s.io/v1beta1** API versions of Ingress is no longer served as of v1.22. * Migrate manifests and API clients to use the **networking.k8s.io/v1** API version, available since v1.19. * All existing persisted objects are accessible via the new API @@ -181,7 +181,7 @@ The **extensions/v1beta1** and **networking.k8s.io/v1beta1** API versions of Ing #### IngressClass {#ingressclass-v122} -The **networking.k8s.io/v1beta1** API version of IngressClass will no longer be served in v1.22. +The **networking.k8s.io/v1beta1** API version of IngressClass is no longer served as of v1.22. * Migrate manifests and API clients to use the **networking.k8s.io/v1** API version, available since v1.19. * All existing persisted objects are accessible via the new API @@ -189,7 +189,7 @@ The **networking.k8s.io/v1beta1** API version of IngressClass will no longer be #### RBAC resources {#rbac-resources-v122} -The **rbac.authorization.k8s.io/v1beta1** API version of ClusterRole, ClusterRoleBinding, Role, and RoleBinding will no longer be served in v1.22. +The **rbac.authorization.k8s.io/v1beta1** API version of ClusterRole, ClusterRoleBinding, Role, and RoleBinding is no longer served as of v1.22. * Migrate manifests and API clients to use the **rbac.authorization.k8s.io/v1** API version, available since v1.8. * All existing persisted objects are accessible via the new APIs @@ -197,7 +197,7 @@ The **rbac.authorization.k8s.io/v1beta1** API version of ClusterRole, ClusterRol #### PriorityClass {#priorityclass-v122} -The **scheduling.k8s.io/v1beta1** API version of PriorityClass will no longer be served in v1.22. +The **scheduling.k8s.io/v1beta1** API version of PriorityClass is no longer served as of v1.22. * Migrate manifests and API clients to use the **scheduling.k8s.io/v1** API version, available since v1.14. * All existing persisted objects are accessible via the new API @@ -205,7 +205,7 @@ The **scheduling.k8s.io/v1beta1** API version of PriorityClass will no longer be #### Storage resources {#storage-resources-v122} -The **storage.k8s.io/v1beta1** API version of CSIDriver, CSINode, StorageClass, and VolumeAttachment will no longer be served in v1.22. +The **storage.k8s.io/v1beta1** API version of CSIDriver, CSINode, StorageClass, and VolumeAttachment is no longer served as of v1.22. * Migrate manifests and API clients to use the **storage.k8s.io/v1** API version * CSIDriver is available in **storage.k8s.io/v1** since v1.19. From a4aa4613cd08e7d07c5c348cf0f1e20015eb4d21 Mon Sep 17 00:00:00 2001 From: "Claudia J. Kang" Date: Fri, 30 Jul 2021 21:08:16 +0900 Subject: [PATCH 072/279] [ko] Update outdated files in dev-1.21-ko.7 (p2) This commit fixes M13~M19 on 28963. --- .../tools/kubeadm/control-plane-flags.md | 2 +- .../windows/intro-windows-in-kubernetes.md | 2 + .../highly-available-control-plane.md | 2 +- .../kubeadm/kubeadm-certs.md | 2 +- .../included/kubectl-convert-overview.md | 11 +++ .../docs/tasks/tools/install-kubectl-linux.md | 58 +++++++++++++- .../docs/tasks/tools/install-kubectl-macos.md | 78 ++++++++++++++++++- .../tasks/tools/install-kubectl-windows.md | 45 ++++++++++- 8 files changed, 194 insertions(+), 6 deletions(-) create mode 100644 content/ko/docs/tasks/tools/included/kubectl-convert-overview.md diff --git a/content/ko/docs/setup/production-environment/tools/kubeadm/control-plane-flags.md b/content/ko/docs/setup/production-environment/tools/kubeadm/control-plane-flags.md index f7e4a50d99..cae9a85b0a 100644 --- a/content/ko/docs/setup/production-environment/tools/kubeadm/control-plane-flags.md +++ b/content/ko/docs/setup/production-environment/tools/kubeadm/control-plane-flags.md @@ -23,7 +23,7 @@ kubeadm의 `ClusterConfiguration` 오브젝트는 API 서버, 컨트롤러매니 3. `kubeadm init`에 `--config ` 파라미터를 추가해서 실행한다. 각 필드의 구성에서 자세한 정보를 보려면, -[API 참고 문서](https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta2#ClusterConfiguration)에서 확인해 볼 수 있다. +[API 참고 문서](/docs/reference/config-api/kubeadm-config.v1beta2/)에서 확인해 볼 수 있다. {{< note >}} `kubeadm config print init-defaults`를 실행하고 원하는 파일에 출력을 저장하여 기본값인 `ClusterConfiguration` 오브젝트를 생성할 수 있다. diff --git a/content/ko/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md b/content/ko/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md index 441f6202bd..67db901778 100644 --- a/content/ko/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md +++ b/content/ko/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md @@ -102,6 +102,8 @@ weight: 65 Microsoft는 `mcr.microsoft.com/oss/kubernetes/pause:3.4.1`에서 윈도우 퍼즈 인프라 컨테이너를 유지한다. +이외에도 `k8s.gcr.io/pause:3.5`를 통해 쿠버네티스에서 관리하는 다중 아키텍처 이미지를 +사용할 수도 있는데, 이 이미지는 리눅스와 윈도우를 모두 지원한다. #### 컴퓨트 diff --git a/content/ko/docs/tasks/administer-cluster/highly-available-control-plane.md b/content/ko/docs/tasks/administer-cluster/highly-available-control-plane.md index 56cc5b3d9a..2ee11427f3 100644 --- a/content/ko/docs/tasks/administer-cluster/highly-available-control-plane.md +++ b/content/ko/docs/tasks/administer-cluster/highly-available-control-plane.md @@ -10,7 +10,7 @@ content_type: task {{< feature-state for_k8s_version="v1.5" state="alpha" >}} -구글 컴퓨트 엔진(Google Compute Engine, 이하 GCE)의 `kube-up`이나 `kube-down` 스크립트에 쿠버네티스 컨트롤 플레인 노드를 복제할 수 있다. +구글 컴퓨트 엔진(Google Compute Engine, 이하 GCE)의 `kube-up`이나 `kube-down` 스크립트에 쿠버네티스 컨트롤 플레인 노드를 복제할 수 있다. 하지만 이러한 스크립트들은 프로덕션 용도로 사용하기에 적합하지 않으며, 프로젝트의 CI에서만 주로 사용된다. 이 문서는 kube-up/down 스크립트를 사용하여 고가용(HA) 컨트롤 플레인을 관리하는 방법과 GCE와 함께 사용하기 위해 HA 컨트롤 플레인을 구현하는 방법에 관해 설명한다. diff --git a/content/ko/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md b/content/ko/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md index 6287069ba0..de6feb480d 100644 --- a/content/ko/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md +++ b/content/ko/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md @@ -161,7 +161,7 @@ HA 클러스터를 실행 중인 경우, 모든 컨트롤 플레인 노드에서 빌트인 서명자를 활성화하려면, `--cluster-signing-cert-file` 와 `--cluster-signing-key-file` 플래그를 전달해야 한다. -새 클러스터를 생성하는 경우, kubeadm [구성 파일](https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta2)을 사용할 수 있다. +새 클러스터를 생성하는 경우, kubeadm [구성 파일](/docs/reference/config-api/kubeadm-config.v1beta2/)을 사용할 수 있다. ```yaml apiVersion: kubeadm.k8s.io/v1beta2 diff --git a/content/ko/docs/tasks/tools/included/kubectl-convert-overview.md b/content/ko/docs/tasks/tools/included/kubectl-convert-overview.md new file mode 100644 index 0000000000..cec8b3f55b --- /dev/null +++ b/content/ko/docs/tasks/tools/included/kubectl-convert-overview.md @@ -0,0 +1,11 @@ +--- +title: "kubectl-convert 개요" +description: >- + 특정 버전의 쿠버네티스 API로 작성된 매니페스트를 다른 버전으로 변환하는 + kubectl 플러그인. +headless: true +--- + +이것은 쿠버네티스 커맨드 라인 도구인 `kubectl`의 플러그인으로서, 특정 버전의 쿠버네티스 API로 작성된 매니페스트를 다른 버전으로 +변환할 수 있도록 한다. 이것은 매니페스트를 최신 쿠버네티스 릴리스의 사용 중단되지 않은 API로 마이그레이션하는 데 특히 유용하다. +더 많은 정보는 다음의 [사용 중단되지 않은 API로 마이그레이션](/docs/reference/using-api/deprecation-guide/#migrate-to-non-deprecated-apis)을 참고한다. diff --git a/content/ko/docs/tasks/tools/install-kubectl-linux.md b/content/ko/docs/tasks/tools/install-kubectl-linux.md index 0ad5b7fc20..77717372d1 100644 --- a/content/ko/docs/tasks/tools/install-kubectl-linux.md +++ b/content/ko/docs/tasks/tools/install-kubectl-linux.md @@ -82,6 +82,7 @@ card: 대상 시스템에 root 접근 권한을 가지고 있지 않더라도, `~/.local/bin` 디렉터리에 kubectl을 설치할 수 있다. ```bash + chmod +x kubectl mkdir -p ~/.local/bin/kubectl mv ./kubectl ~/.local/bin/kubectl # 그리고 ~/.local/bin/kubectl을 $PATH에 추가 @@ -171,7 +172,7 @@ kubectl version --client {{< include "included/verify-kubectl.md" >}} -## 선택적 kubectl 구성 +## 선택적 kubectl 구성 및 플러그인 ### 셸 자동 완성 활성화 @@ -184,6 +185,61 @@ kubectl은 Bash 및 Zsh에 대한 자동 완성 지원을 제공하므로 입력 {{< tab name="Zsh" include="included/optional-kubectl-configs-zsh.md" />}} {{< /tabs >}} +### `kubectl convert` 플러그인 설치 + +{{< include "included/kubectl-convert-overview.md" >}} + +1. 다음 명령으로 최신 릴리스를 다운로드한다. + + ```bash + curl -LO https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl-convert + ``` + +1. 바이너리를 검증한다. (선택 사항) + + kubectl-convert 체크섬(checksum) 파일을 다운로드한다. + + ```bash + curl -LO "https://dl.k8s.io/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl-convert.sha256" + ``` + + kubectl-convert 바이너리를 체크섬 파일을 통해 검증한다. + + ```bash + echo "$(}} + 동일한 버전의 바이너리와 체크섬을 다운로드한다. + {{< /note >}} + +1. kubectl-convert 설치 + + ```bash + sudo install -o root -g root -m 0755 kubectl-convert /usr/local/bin/kubectl-convert + ``` + +1. 플러그인이 정상적으로 설치되었는지 확인한다. + + ```shell + kubectl convert --help + ``` + + 에러가 출력되지 않는다면, 플러그인이 정상적으로 설치된 것이다. + ## {{% heading "whatsnext" %}} {{< include "included/kubectl-whats-next.md" >}} diff --git a/content/ko/docs/tasks/tools/install-kubectl-macos.md b/content/ko/docs/tasks/tools/install-kubectl-macos.md index 91e42f553b..90fefb0c3a 100644 --- a/content/ko/docs/tasks/tools/install-kubectl-macos.md +++ b/content/ko/docs/tasks/tools/install-kubectl-macos.md @@ -155,7 +155,7 @@ macOS에서 [Macports](https://macports.org/) 패키지 관리자를 사용하 {{< include "included/verify-kubectl.md" >}} -## 선택적 kubectl 구성 +## 선택적 kubectl 구성 및 플러그인 ### 셸 자동 완성 활성화 @@ -168,6 +168,82 @@ kubectl은 Bash 및 Zsh에 대한 자동 완성 지원을 제공하므로 입력 {{< tab name="Zsh" include="included/optional-kubectl-configs-zsh.md" />}} {{< /tabs >}} +### `kubectl convert` 플러그인 설치 + +{{< include "included/kubectl-convert-overview.md" >}} + +1. 다음 명령으로 최신 릴리스를 다운로드한다. + + {{< tabs name="download_convert_binary_macos" >}} + {{< tab name="Intel" codelang="bash" >}} + curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/amd64/kubectl-convert" + {{< /tab >}} + {{< tab name="Apple Silicon" codelang="bash" >}} + curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/arm64/kubectl-convert" + {{< /tab >}} + {{< /tabs >}} + +1. 바이너리를 검증한다. (선택 사항) + + kubectl-convert 체크섬(checksum) 파일을 다운로드한다. + + {{< tabs name="download_convert_checksum_macos" >}} + {{< tab name="Intel" codelang="bash" >}} + curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/amd64/kubectl-convert.sha256" + {{< /tab >}} + {{< tab name="Apple Silicon" codelang="bash" >}} + curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/arm64/kubectl-convert.sha256" + {{< /tab >}} + {{< /tabs >}} + + kubectl-convert 바이너리를 체크섬 파일을 통해 검증한다. + + ```bash + echo "$(}} + 동일한 버전의 바이너리와 체크섬을 다운로드한다. + {{< /note >}} + +1. kubectl-convert 바이너리를 실행 가능하게 한다. + + ```bash + chmod +x ./kubectl-convert + ``` + +1. kubectl-convert 바이너리를 시스템 `PATH` 의 파일 위치로 옮긴다. + + ```bash + sudo mv ./kubectl /usr/local/bin/kubectl-convert + sudo chown root: /usr/local/bin/kubectl-convert + ``` + + {{< note >}} + `PATH` 환경 변수 안에 `/usr/local/bin` 이 있는지 확인한다. + {{< /note >}} + +1. 플러그인이 정상적으로 설치되었는지 확인한다. + + ```shell + kubectl convert --help + ``` + + 에러가 출력되지 않는다면, 플러그인이 정상적으로 설치된 것이다. + ## {{% heading "whatsnext" %}} {{< include "included/kubectl-whats-next.md" >}} diff --git a/content/ko/docs/tasks/tools/install-kubectl-windows.md b/content/ko/docs/tasks/tools/install-kubectl-windows.md index 28e03cfef4..bb5b45831e 100644 --- a/content/ko/docs/tasks/tools/install-kubectl-windows.md +++ b/content/ko/docs/tasks/tools/install-kubectl-windows.md @@ -130,7 +130,7 @@ card: {{< include "included/verify-kubectl.md" >}} -## 선택적 kubectl 구성 +## 선택적 kubectl 구성 및 플러그인 ### 셸 자동 완성 활성화 @@ -140,6 +140,49 @@ kubectl은 Bash 및 Zsh에 대한 자동 완성 지원을 제공하므로 입력 {{< include "included/optional-kubectl-configs-zsh.md" >}} +### `kubectl convert` 플러그인 설치 + +{{< include "included/kubectl-convert-overview.md" >}} + +1. 다음 명령으로 최신 릴리스를 다운로드한다. + + ```powershell + curl -LO https://dl.k8s.io/release/{{< param "fullversion" >}}/bin/windows/amd64/kubectl-convert.exe + ``` + +1. 바이너리를 검증한다. (선택 사항) + + kubectl-convert 체크섬(checksum) 파일을 다운로드한다. + + ```powershell + curl -LO https://dl.k8s.io/{{< param "fullversion" >}}/bin/windows/amd64/kubectl-convert.exe.sha256 + ``` + + kubectl-convert 바이너리를 체크섬 파일을 통해 검증한다. + + - 수동으로 `CertUtil` 의 출력과 다운로드한 체크섬 파일을 비교하기 위해서 커맨드 프롬프트를 사용한다. + + ```cmd + CertUtil -hashfile kubectl-convert.exe SHA256 + type kubectl-convert.exe.sha256 + ``` + + - `-eq` 연산자를 통해 `True` 또는 `False` 결과를 얻는 자동 검증을 위해서 PowerShell을 사용한다. + + ```powershell + $($(CertUtil -hashfile .\kubectl-convert.exe SHA256)[1] -replace " ", "") -eq $(type .\kubectl-convert.exe.sha256) + ``` + +1. 바이너리를 `PATH` 가 설정된 디렉터리에 추가한다. + +1. 플러그인이 정상적으로 설치되었는지 확인한다. + + ```shell + kubectl convert --help + ``` + + 에러가 출력되지 않는다면, 플러그인이 정상적으로 설치된 것이다. + ## {{% heading "whatsnext" %}} {{< include "included/kubectl-whats-next.md" >}} From 8acf5d121e88403d1720c2ba7008b48d92870998 Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Thu, 5 Aug 2021 09:44:17 +0800 Subject: [PATCH 073/279] Component reference for 1.22 --- .../kube-apiserver.md | 23 ++-- .../kube-controller-manager.md | 6 +- .../kube-proxy.md | 2 +- .../kube-scheduler.md | 67 ++++-------- .../kubeadm/generated/kubeadm_alpha.md | 61 ----------- .../generated/kubeadm_alpha_kubeconfig.md | 63 ----------- .../kubeadm_alpha_kubeconfig_user.md | 102 ------------------ .../generated/kubeadm_certs_generate-csr.md | 4 +- .../kubeadm_certs_renew_admin.conf.md | 14 --- .../generated/kubeadm_certs_renew_all.md | 14 --- ...beadm_certs_renew_apiserver-etcd-client.md | 14 --- ...dm_certs_renew_apiserver-kubelet-client.md | 14 --- .../kubeadm_certs_renew_apiserver.md | 14 --- ...adm_certs_renew_controller-manager.conf.md | 14 --- ...adm_certs_renew_etcd-healthcheck-client.md | 14 --- .../kubeadm_certs_renew_etcd-peer.md | 14 --- .../kubeadm_certs_renew_etcd-server.md | 14 --- .../kubeadm_certs_renew_front-proxy-client.md | 14 --- .../kubeadm_certs_renew_scheduler.conf.md | 14 --- .../generated/kubeadm_config_images_list.md | 2 +- .../generated/kubeadm_config_images_pull.md | 2 +- .../generated/kubeadm_config_migrate.md | 4 +- .../kubeadm/generated/kubeadm_config_print.md | 2 +- .../kubeadm/generated/kubeadm_init.md | 16 +-- .../generated/kubeadm_init_phase_addon_all.md | 2 +- .../kubeadm_init_phase_addon_coredns.md | 2 +- ..._init_phase_certs_apiserver-etcd-client.md | 2 +- ...it_phase_certs_apiserver-kubelet-client.md | 2 +- .../kubeadm_init_phase_certs_apiserver.md | 4 +- .../generated/kubeadm_init_phase_certs_ca.md | 2 +- .../kubeadm_init_phase_certs_etcd-ca.md | 2 +- ...nit_phase_certs_etcd-healthcheck-client.md | 2 +- .../kubeadm_init_phase_certs_etcd-peer.md | 2 +- .../kubeadm_init_phase_certs_etcd-server.md | 2 +- ...kubeadm_init_phase_certs_front-proxy-ca.md | 2 +- ...adm_init_phase_certs_front-proxy-client.md | 2 +- .../kubeadm_init_phase_control-plane_all.md | 13 ++- ...eadm_init_phase_control-plane_apiserver.md | 13 ++- ..._phase_control-plane_controller-manager.md | 11 +- ...eadm_init_phase_control-plane_scheduler.md | 11 +- .../kubeadm_init_phase_etcd_local.md | 14 +-- .../kubeadm/generated/kubeadm_join.md | 16 +-- ...beadm_join_phase_control-plane-join_all.md | 7 ++ ...eadm_join_phase_control-plane-join_etcd.md | 14 +-- ..._phase_control-plane-join_update-status.md | 4 +- ...dm_join_phase_control-plane-prepare_all.md | 14 +-- ...ase_control-plane-prepare_control-plane.md | 14 +-- .../kubeadm/generated/kubeadm_kubeconfig.md | 2 - .../generated/kubeadm_kubeconfig_user.md | 11 +- .../kubeadm/generated/kubeadm_reset.md | 2 +- ...beadm_reset_phase_update-cluster-status.md | 4 +- .../generated/kubeadm_upgrade_apply.md | 16 +-- .../kubeadm/generated/kubeadm_upgrade_node.md | 14 +-- ...ubeadm_upgrade_node_phase_control-plane.md | 14 +-- .../kubeadm/generated/kubeadm_upgrade_plan.md | 2 +- 55 files changed, 186 insertions(+), 544 deletions(-) delete mode 100644 content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha.md delete mode 100644 content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig.md delete mode 100644 content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig_user.md diff --git a/content/en/docs/reference/command-line-tools-reference/kube-apiserver.md b/content/en/docs/reference/command-line-tools-reference/kube-apiserver.md index 9a824fd834..77b354dc70 100644 --- a/content/en/docs/reference/command-line-tools-reference/kube-apiserver.md +++ b/content/en/docs/reference/command-line-tools-reference/kube-apiserver.md @@ -477,7 +477,7 @@ kube-apiserver [flags] --disable-admission-plugins strings -

    admission plugins that should be disabled although they are in the default enabled plugins list (NamespaceLifecycle, LimitRanger, ServiceAccount, TaintNodesByCondition, Priority, DefaultTolerationSeconds, DefaultStorageClass, StorageObjectInUseProtection, PersistentVolumeClaimResize, RuntimeClass, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, DefaultIngressClass, MutatingAdmissionWebhook, ValidatingAdmissionWebhook, ResourceQuota). Comma-delimited list of admission plugins: AlwaysAdmit, AlwaysDeny, AlwaysPullImages, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, DenyServiceExternalIPs, EventRateLimit, ExtendedResourceToleration, ImagePolicyWebhook, LimitPodHardAntiAffinityTopology, LimitRanger, MutatingAdmissionWebhook, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, PersistentVolumeLabel, PodNodeSelector, PodSecurityPolicy, PodTolerationRestriction, Priority, ResourceQuota, RuntimeClass, SecurityContextDeny, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionWebhook. The order of plugins in this flag does not matter.

    +

    admission plugins that should be disabled although they are in the default enabled plugins list (NamespaceLifecycle, LimitRanger, ServiceAccount, TaintNodesByCondition, PodSecurity, Priority, DefaultTolerationSeconds, DefaultStorageClass, StorageObjectInUseProtection, PersistentVolumeClaimResize, RuntimeClass, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, DefaultIngressClass, MutatingAdmissionWebhook, ValidatingAdmissionWebhook, ResourceQuota). Comma-delimited list of admission plugins: AlwaysAdmit, AlwaysDeny, AlwaysPullImages, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, DenyServiceExternalIPs, EventRateLimit, ExtendedResourceToleration, ImagePolicyWebhook, LimitPodHardAntiAffinityTopology, LimitRanger, MutatingAdmissionWebhook, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, PersistentVolumeLabel, PodNodeSelector, PodSecurity, PodSecurityPolicy, PodTolerationRestriction, Priority, ResourceQuota, RuntimeClass, SecurityContextDeny, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionWebhook. The order of plugins in this flag does not matter.

    @@ -498,7 +498,7 @@ kube-apiserver [flags] --enable-admission-plugins strings -

    admission plugins that should be enabled in addition to default enabled ones (NamespaceLifecycle, LimitRanger, ServiceAccount, TaintNodesByCondition, Priority, DefaultTolerationSeconds, DefaultStorageClass, StorageObjectInUseProtection, PersistentVolumeClaimResize, RuntimeClass, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, DefaultIngressClass, MutatingAdmissionWebhook, ValidatingAdmissionWebhook, ResourceQuota). Comma-delimited list of admission plugins: AlwaysAdmit, AlwaysDeny, AlwaysPullImages, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, DenyServiceExternalIPs, EventRateLimit, ExtendedResourceToleration, ImagePolicyWebhook, LimitPodHardAntiAffinityTopology, LimitRanger, MutatingAdmissionWebhook, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, PersistentVolumeLabel, PodNodeSelector, PodSecurityPolicy, PodTolerationRestriction, Priority, ResourceQuota, RuntimeClass, SecurityContextDeny, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionWebhook. The order of plugins in this flag does not matter.

    +

    admission plugins that should be enabled in addition to default enabled ones (NamespaceLifecycle, LimitRanger, ServiceAccount, TaintNodesByCondition, PodSecurity, Priority, DefaultTolerationSeconds, DefaultStorageClass, StorageObjectInUseProtection, PersistentVolumeClaimResize, RuntimeClass, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, DefaultIngressClass, MutatingAdmissionWebhook, ValidatingAdmissionWebhook, ResourceQuota). Comma-delimited list of admission plugins: AlwaysAdmit, AlwaysDeny, AlwaysPullImages, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, DenyServiceExternalIPs, EventRateLimit, ExtendedResourceToleration, ImagePolicyWebhook, LimitPodHardAntiAffinityTopology, LimitRanger, MutatingAdmissionWebhook, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, PersistentVolumeLabel, PodNodeSelector, PodSecurity, PodSecurityPolicy, PodTolerationRestriction, Priority, ResourceQuota, RuntimeClass, SecurityContextDeny, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionWebhook. The order of plugins in this flag does not matter.

    @@ -638,7 +638,7 @@ kube-apiserver [flags] --feature-gates <comma-separated 'key=True|False' pairs> -

    A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
    APIListChunking=true|false (BETA - default=true)
    APIPriorityAndFairness=true|false (BETA - default=true)
    APIResponseCompression=true|false (BETA - default=true)
    APIServerIdentity=true|false (ALPHA - default=false)
    AllAlpha=true|false (ALPHA - default=false)
    AllBeta=true|false (BETA - default=false)
    AnyVolumeDataSource=true|false (ALPHA - default=false)
    AppArmor=true|false (BETA - default=true)
    BalanceAttachedNodeVolumes=true|false (ALPHA - default=false)
    BoundServiceAccountTokenVolume=true|false (BETA - default=true)
    CPUManager=true|false (BETA - default=true)
    CSIInlineVolume=true|false (BETA - default=true)
    CSIMigration=true|false (BETA - default=true)
    CSIMigrationAWS=true|false (BETA - default=false)
    CSIMigrationAzureDisk=true|false (BETA - default=false)
    CSIMigrationAzureFile=true|false (BETA - default=false)
    CSIMigrationGCE=true|false (BETA - default=false)
    CSIMigrationOpenStack=true|false (BETA - default=true)
    CSIMigrationvSphere=true|false (BETA - default=false)
    CSIMigrationvSphereComplete=true|false (BETA - default=false)
    CSIServiceAccountToken=true|false (BETA - default=true)
    CSIStorageCapacity=true|false (BETA - default=true)
    CSIVolumeFSGroupPolicy=true|false (BETA - default=true)
    CSIVolumeHealth=true|false (ALPHA - default=false)
    ConfigurableFSGroupPolicy=true|false (BETA - default=true)
    ControllerManagerLeaderMigration=true|false (ALPHA - default=false)
    CronJobControllerV2=true|false (BETA - default=true)
    CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
    DaemonSetUpdateSurge=true|false (ALPHA - default=false)
    DefaultPodTopologySpread=true|false (BETA - default=true)
    DevicePlugins=true|false (BETA - default=true)
    DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
    DownwardAPIHugePages=true|false (BETA - default=false)
    DynamicKubeletConfig=true|false (BETA - default=true)
    EfficientWatchResumption=true|false (BETA - default=true)
    EndpointSliceProxying=true|false (BETA - default=true)
    EndpointSliceTerminatingCondition=true|false (ALPHA - default=false)
    EphemeralContainers=true|false (ALPHA - default=false)
    ExpandCSIVolumes=true|false (BETA - default=true)
    ExpandInUsePersistentVolumes=true|false (BETA - default=true)
    ExpandPersistentVolumes=true|false (BETA - default=true)
    ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
    GenericEphemeralVolume=true|false (BETA - default=true)
    GracefulNodeShutdown=true|false (BETA - default=true)
    HPAContainerMetrics=true|false (ALPHA - default=false)
    HPAScaleToZero=true|false (ALPHA - default=false)
    HugePageStorageMediumSize=true|false (BETA - default=true)
    IPv6DualStack=true|false (BETA - default=true)
    InTreePluginAWSUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
    InTreePluginGCEUnregister=true|false (ALPHA - default=false)
    InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
    InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
    IndexedJob=true|false (ALPHA - default=false)
    IngressClassNamespacedParams=true|false (ALPHA - default=false)
    KubeletCredentialProviders=true|false (ALPHA - default=false)
    KubeletPodResources=true|false (BETA - default=true)
    KubeletPodResourcesGetAllocatable=true|false (ALPHA - default=false)
    LocalStorageCapacityIsolation=true|false (BETA - default=true)
    LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
    LogarithmicScaleDown=true|false (ALPHA - default=false)
    MemoryManager=true|false (ALPHA - default=false)
    MixedProtocolLBService=true|false (ALPHA - default=false)
    NamespaceDefaultLabelName=true|false (BETA - default=true)
    NetworkPolicyEndPort=true|false (ALPHA - default=false)
    NonPreemptingPriority=true|false (BETA - default=true)
    PodAffinityNamespaceSelector=true|false (ALPHA - default=false)
    PodDeletionCost=true|false (ALPHA - default=false)
    PodOverhead=true|false (BETA - default=true)
    PreferNominatedNode=true|false (ALPHA - default=false)
    ProbeTerminationGracePeriod=true|false (ALPHA - default=false)
    ProcMountType=true|false (ALPHA - default=false)
    QOSReserved=true|false (ALPHA - default=false)
    RemainingItemCount=true|false (BETA - default=true)
    RemoveSelfLink=true|false (BETA - default=true)
    RotateKubeletServerCertificate=true|false (BETA - default=true)
    ServerSideApply=true|false (BETA - default=true)
    ServiceInternalTrafficPolicy=true|false (ALPHA - default=false)
    ServiceLBNodePortControl=true|false (ALPHA - default=false)
    ServiceLoadBalancerClass=true|false (ALPHA - default=false)
    ServiceTopology=true|false (ALPHA - default=false)
    SetHostnameAsFQDN=true|false (BETA - default=true)
    SizeMemoryBackedVolumes=true|false (ALPHA - default=false)
    StorageVersionAPI=true|false (ALPHA - default=false)
    StorageVersionHash=true|false (BETA - default=true)
    SuspendJob=true|false (ALPHA - default=false)
    TTLAfterFinished=true|false (BETA - default=true)
    TopologyAwareHints=true|false (ALPHA - default=false)
    TopologyManager=true|false (BETA - default=true)
    ValidateProxyRedirects=true|false (BETA - default=true)
    VolumeCapacityPriority=true|false (ALPHA - default=false)
    WarningHeaders=true|false (BETA - default=true)
    WinDSR=true|false (ALPHA - default=false)
    WinOverlay=true|false (BETA - default=true)
    WindowsEndpointSliceProxying=true|false (BETA - default=true)

    +

    A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
    APIListChunking=true|false (BETA - default=true)
    APIPriorityAndFairness=true|false (BETA - default=true)
    APIResponseCompression=true|false (BETA - default=true)
    APIServerIdentity=true|false (ALPHA - default=false)
    APIServerTracing=true|false (ALPHA - default=false)
    AllAlpha=true|false (ALPHA - default=false)
    AllBeta=true|false (BETA - default=false)
    AnyVolumeDataSource=true|false (ALPHA - default=false)
    AppArmor=true|false (BETA - default=true)
    CPUManager=true|false (BETA - default=true)
    CPUManagerPolicyOptions=true|false (ALPHA - default=false)
    CSIInlineVolume=true|false (BETA - default=true)
    CSIMigration=true|false (BETA - default=true)
    CSIMigrationAWS=true|false (BETA - default=false)
    CSIMigrationAzureDisk=true|false (BETA - default=false)
    CSIMigrationAzureFile=true|false (BETA - default=false)
    CSIMigrationGCE=true|false (BETA - default=false)
    CSIMigrationOpenStack=true|false (BETA - default=true)
    CSIMigrationvSphere=true|false (BETA - default=false)
    CSIStorageCapacity=true|false (BETA - default=true)
    CSIVolumeFSGroupPolicy=true|false (BETA - default=true)
    CSIVolumeHealth=true|false (ALPHA - default=false)
    CSRDuration=true|false (BETA - default=true)
    ConfigurableFSGroupPolicy=true|false (BETA - default=true)
    ControllerManagerLeaderMigration=true|false (BETA - default=true)
    CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
    DaemonSetUpdateSurge=true|false (BETA - default=true)
    DefaultPodTopologySpread=true|false (BETA - default=true)
    DelegateFSGroupToCSIDriver=true|false (ALPHA - default=false)
    DevicePlugins=true|false (BETA - default=true)
    DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
    DisableCloudProviders=true|false (ALPHA - default=false)
    DownwardAPIHugePages=true|false (BETA - default=false)
    EfficientWatchResumption=true|false (BETA - default=true)
    EndpointSliceTerminatingCondition=true|false (BETA - default=true)
    EphemeralContainers=true|false (ALPHA - default=false)
    ExpandCSIVolumes=true|false (BETA - default=true)
    ExpandInUsePersistentVolumes=true|false (BETA - default=true)
    ExpandPersistentVolumes=true|false (BETA - default=true)
    ExpandedDNSConfig=true|false (ALPHA - default=false)
    ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
    GenericEphemeralVolume=true|false (BETA - default=true)
    GracefulNodeShutdown=true|false (BETA - default=true)
    HPAContainerMetrics=true|false (ALPHA - default=false)
    HPAScaleToZero=true|false (ALPHA - default=false)
    IPv6DualStack=true|false (BETA - default=true)
    InTreePluginAWSUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
    InTreePluginGCEUnregister=true|false (ALPHA - default=false)
    InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
    InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
    IndexedJob=true|false (BETA - default=true)
    IngressClassNamespacedParams=true|false (BETA - default=true)
    JobTrackingWithFinalizers=true|false (ALPHA - default=false)
    KubeletCredentialProviders=true|false (ALPHA - default=false)
    KubeletInUserNamespace=true|false (ALPHA - default=false)
    KubeletPodResources=true|false (BETA - default=true)
    KubeletPodResourcesGetAllocatable=true|false (ALPHA - default=false)
    LocalStorageCapacityIsolation=true|false (BETA - default=true)
    LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
    LogarithmicScaleDown=true|false (BETA - default=true)
    MemoryManager=true|false (BETA - default=true)
    MemoryQoS=true|false (ALPHA - default=false)
    MixedProtocolLBService=true|false (ALPHA - default=false)
    NetworkPolicyEndPort=true|false (BETA - default=true)
    NodeSwap=true|false (ALPHA - default=false)
    NonPreemptingPriority=true|false (BETA - default=true)
    PodAffinityNamespaceSelector=true|false (BETA - default=true)
    PodDeletionCost=true|false (BETA - default=true)
    PodOverhead=true|false (BETA - default=true)
    PodSecurity=true|false (ALPHA - default=false)
    PreferNominatedNode=true|false (BETA - default=true)
    ProbeTerminationGracePeriod=true|false (BETA - default=false)
    ProcMountType=true|false (ALPHA - default=false)
    ProxyTerminatingEndpoints=true|false (ALPHA - default=false)
    QOSReserved=true|false (ALPHA - default=false)
    ReadWriteOncePod=true|false (ALPHA - default=false)
    RemainingItemCount=true|false (BETA - default=true)
    RemoveSelfLink=true|false (BETA - default=true)
    RotateKubeletServerCertificate=true|false (BETA - default=true)
    SeccompDefault=true|false (ALPHA - default=false)
    ServiceInternalTrafficPolicy=true|false (BETA - default=true)
    ServiceLBNodePortControl=true|false (BETA - default=true)
    ServiceLoadBalancerClass=true|false (BETA - default=true)
    SizeMemoryBackedVolumes=true|false (BETA - default=true)
    StatefulSetMinReadySeconds=true|false (ALPHA - default=false)
    StorageVersionAPI=true|false (ALPHA - default=false)
    StorageVersionHash=true|false (BETA - default=true)
    SuspendJob=true|false (BETA - default=true)
    TTLAfterFinished=true|false (BETA - default=true)
    TopologyAwareHints=true|false (ALPHA - default=false)
    TopologyManager=true|false (BETA - default=true)
    VolumeCapacityPriority=true|false (ALPHA - default=false)
    WinDSR=true|false (ALPHA - default=false)
    WinOverlay=true|false (BETA - default=true)
    WindowsHostProcessContainers=true|false (ALPHA - default=false)

    @@ -771,7 +771,7 @@ kube-apiserver [flags] --logging-format string     Default: "text" -

    Sets the log format. Permitted formats: "json", "text".
    Non-default formats don't honor these flags: --add-dir-header, --alsologtostderr, --log-backtrace-at, --log-dir, --log-file, --log-file-max-size, --logtostderr, --one-output, --skip-headers, --skip-log-headers, --stderrthreshold, --vmodule, --log-flush-frequency.
    Non-default choices are currently alpha and subject to change without warning.

    +

    Sets the log format. Permitted formats: "text".
    Non-default formats don't honor these flags: --add-dir-header, --alsologtostderr, --log-backtrace-at, --log-dir, --log-file, --log-file-max-size, --logtostderr, --one-output, --skip-headers, --skip-log-headers, --stderrthreshold, --vmodule, --log-flush-frequency.
    Non-default choices are currently alpha and subject to change without warning.

    @@ -799,14 +799,14 @@ kube-apiserver [flags] --max-mutating-requests-inflight int     Default: 200 -

    The maximum number of mutating requests in flight at a given time. When the server exceeds this, it rejects requests. Zero for no limit.

    +

    This and --max-requests-inflight are summed to determine the server's total concurrency limit (which must be positive) if --enable-priority-and-fairness is true. Otherwise, this flag limits the maximum number of mutating requests in flight, or a zero value disables the limit completely.

    --max-requests-inflight int     Default: 400 -

    The maximum number of non-mutating requests in flight at a given time. When the server exceeds this, it rejects requests. Zero for no limit.

    +

    This and --max-mutating-requests-inflight are summed to determine the server's total concurrency limit (which must be positive) if --enable-priority-and-fairness is true. Otherwise, this flag limits the maximum number of non-mutating requests in flight, or a zero value disables the limit completely.

    @@ -985,10 +985,10 @@ kube-apiserver [flags] ---service-account-issuer string +--service-account-issuer strings -

    Identifier of the service account token issuer. The issuer will assert this identifier in "iss" claim of issued tokens. This value is a string or URI. If this option is not a valid URI per the OpenID Discovery 1.0 spec, the ServiceAccountIssuerDiscovery feature will remain disabled, even if the feature gate is set to true. It is highly recommended that this value comply with the OpenID spec: https://openid.net/specs/openid-connect-discovery-1_0.html. In practice, this means that service-account-issuer must be an https URL. It is also highly recommended that this URL be capable of serving OpenID discovery documents at {service-account-issuer}/.well-known/openid-configuration.

    +

    Identifier of the service account token issuer. The issuer will assert this identifier in "iss" claim of issued tokens. This value is a string or URI. If this option is not a valid URI per the OpenID Discovery 1.0 spec, the ServiceAccountIssuerDiscovery feature will remain disabled, even if the feature gate is set to true. It is highly recommended that this value comply with the OpenID spec: https://openid.net/specs/openid-connect-discovery-1_0.html. In practice, this means that service-account-issuer must be an https URL. It is also highly recommended that this URL be capable of serving OpenID discovery documents at {service-account-issuer}/.well-known/openid-configuration. When this flag is specified multiple times, the first is used to generate tokens and all are used to determine which issuers are accepted.

    @@ -1138,6 +1138,13 @@ kube-apiserver [flags]

    If set, the file that will be used to secure the secure port of the API server via token authentication.

    + +--tracing-config-file string + + +

    File with apiserver tracing configuration.

    + + -v, --v int diff --git a/content/en/docs/reference/command-line-tools-reference/kube-controller-manager.md b/content/en/docs/reference/command-line-tools-reference/kube-controller-manager.md index 29e7b1ec8e..a8389c69f0 100644 --- a/content/en/docs/reference/command-line-tools-reference/kube-controller-manager.md +++ b/content/en/docs/reference/command-line-tools-reference/kube-controller-manager.md @@ -208,7 +208,7 @@ kube-controller-manager [flags] --cluster-signing-duration duration     Default: 8760h0m0s -

    The length of duration signed certificates will be given.

    +

    The max length of duration signed certificates will be given. Individual CSRs may request shorter certs by setting spec.expirationSeconds.

    @@ -474,7 +474,7 @@ kube-controller-manager [flags] --feature-gates <comma-separated 'key=True|False' pairs> -

    A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
    APIListChunking=true|false (BETA - default=true)
    APIPriorityAndFairness=true|false (BETA - default=true)
    APIResponseCompression=true|false (BETA - default=true)
    APIServerIdentity=true|false (ALPHA - default=false)
    AllAlpha=true|false (ALPHA - default=false)
    AllBeta=true|false (BETA - default=false)
    AnyVolumeDataSource=true|false (ALPHA - default=false)
    AppArmor=true|false (BETA - default=true)
    BalanceAttachedNodeVolumes=true|false (ALPHA - default=false)
    BoundServiceAccountTokenVolume=true|false (BETA - default=true)
    CPUManager=true|false (BETA - default=true)
    CSIInlineVolume=true|false (BETA - default=true)
    CSIMigration=true|false (BETA - default=true)
    CSIMigrationAWS=true|false (BETA - default=false)
    CSIMigrationAzureDisk=true|false (BETA - default=false)
    CSIMigrationAzureFile=true|false (BETA - default=false)
    CSIMigrationGCE=true|false (BETA - default=false)
    CSIMigrationOpenStack=true|false (BETA - default=true)
    CSIMigrationvSphere=true|false (BETA - default=false)
    CSIMigrationvSphereComplete=true|false (BETA - default=false)
    CSIServiceAccountToken=true|false (BETA - default=true)
    CSIStorageCapacity=true|false (BETA - default=true)
    CSIVolumeFSGroupPolicy=true|false (BETA - default=true)
    CSIVolumeHealth=true|false (ALPHA - default=false)
    ConfigurableFSGroupPolicy=true|false (BETA - default=true)
    ControllerManagerLeaderMigration=true|false (ALPHA - default=false)
    CronJobControllerV2=true|false (BETA - default=true)
    CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
    DaemonSetUpdateSurge=true|false (ALPHA - default=false)
    DefaultPodTopologySpread=true|false (BETA - default=true)
    DevicePlugins=true|false (BETA - default=true)
    DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
    DownwardAPIHugePages=true|false (BETA - default=false)
    DynamicKubeletConfig=true|false (BETA - default=true)
    EfficientWatchResumption=true|false (BETA - default=true)
    EndpointSliceProxying=true|false (BETA - default=true)
    EndpointSliceTerminatingCondition=true|false (ALPHA - default=false)
    EphemeralContainers=true|false (ALPHA - default=false)
    ExpandCSIVolumes=true|false (BETA - default=true)
    ExpandInUsePersistentVolumes=true|false (BETA - default=true)
    ExpandPersistentVolumes=true|false (BETA - default=true)
    ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
    GenericEphemeralVolume=true|false (BETA - default=true)
    GracefulNodeShutdown=true|false (BETA - default=true)
    HPAContainerMetrics=true|false (ALPHA - default=false)
    HPAScaleToZero=true|false (ALPHA - default=false)
    HugePageStorageMediumSize=true|false (BETA - default=true)
    IPv6DualStack=true|false (BETA - default=true)
    InTreePluginAWSUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
    InTreePluginGCEUnregister=true|false (ALPHA - default=false)
    InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
    InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
    IndexedJob=true|false (ALPHA - default=false)
    IngressClassNamespacedParams=true|false (ALPHA - default=false)
    KubeletCredentialProviders=true|false (ALPHA - default=false)
    KubeletPodResources=true|false (BETA - default=true)
    KubeletPodResourcesGetAllocatable=true|false (ALPHA - default=false)
    LocalStorageCapacityIsolation=true|false (BETA - default=true)
    LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
    LogarithmicScaleDown=true|false (ALPHA - default=false)
    MemoryManager=true|false (ALPHA - default=false)
    MixedProtocolLBService=true|false (ALPHA - default=false)
    NamespaceDefaultLabelName=true|false (BETA - default=true)
    NetworkPolicyEndPort=true|false (ALPHA - default=false)
    NonPreemptingPriority=true|false (BETA - default=true)
    PodAffinityNamespaceSelector=true|false (ALPHA - default=false)
    PodDeletionCost=true|false (ALPHA - default=false)
    PodOverhead=true|false (BETA - default=true)
    PreferNominatedNode=true|false (ALPHA - default=false)
    ProbeTerminationGracePeriod=true|false (ALPHA - default=false)
    ProcMountType=true|false (ALPHA - default=false)
    QOSReserved=true|false (ALPHA - default=false)
    RemainingItemCount=true|false (BETA - default=true)
    RemoveSelfLink=true|false (BETA - default=true)
    RotateKubeletServerCertificate=true|false (BETA - default=true)
    ServerSideApply=true|false (BETA - default=true)
    ServiceInternalTrafficPolicy=true|false (ALPHA - default=false)
    ServiceLBNodePortControl=true|false (ALPHA - default=false)
    ServiceLoadBalancerClass=true|false (ALPHA - default=false)
    ServiceTopology=true|false (ALPHA - default=false)
    SetHostnameAsFQDN=true|false (BETA - default=true)
    SizeMemoryBackedVolumes=true|false (ALPHA - default=false)
    StorageVersionAPI=true|false (ALPHA - default=false)
    StorageVersionHash=true|false (BETA - default=true)
    SuspendJob=true|false (ALPHA - default=false)
    TTLAfterFinished=true|false (BETA - default=true)
    TopologyAwareHints=true|false (ALPHA - default=false)
    TopologyManager=true|false (BETA - default=true)
    ValidateProxyRedirects=true|false (BETA - default=true)
    VolumeCapacityPriority=true|false (ALPHA - default=false)
    WarningHeaders=true|false (BETA - default=true)
    WinDSR=true|false (ALPHA - default=false)
    WinOverlay=true|false (BETA - default=true)
    WindowsEndpointSliceProxying=true|false (BETA - default=true)

    +

    A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
    APIListChunking=true|false (BETA - default=true)
    APIPriorityAndFairness=true|false (BETA - default=true)
    APIResponseCompression=true|false (BETA - default=true)
    APIServerIdentity=true|false (ALPHA - default=false)
    APIServerTracing=true|false (ALPHA - default=false)
    AllAlpha=true|false (ALPHA - default=false)
    AllBeta=true|false (BETA - default=false)
    AnyVolumeDataSource=true|false (ALPHA - default=false)
    AppArmor=true|false (BETA - default=true)
    CPUManager=true|false (BETA - default=true)
    CPUManagerPolicyOptions=true|false (ALPHA - default=false)
    CSIInlineVolume=true|false (BETA - default=true)
    CSIMigration=true|false (BETA - default=true)
    CSIMigrationAWS=true|false (BETA - default=false)
    CSIMigrationAzureDisk=true|false (BETA - default=false)
    CSIMigrationAzureFile=true|false (BETA - default=false)
    CSIMigrationGCE=true|false (BETA - default=false)
    CSIMigrationOpenStack=true|false (BETA - default=true)
    CSIMigrationvSphere=true|false (BETA - default=false)
    CSIStorageCapacity=true|false (BETA - default=true)
    CSIVolumeFSGroupPolicy=true|false (BETA - default=true)
    CSIVolumeHealth=true|false (ALPHA - default=false)
    CSRDuration=true|false (BETA - default=true)
    ConfigurableFSGroupPolicy=true|false (BETA - default=true)
    ControllerManagerLeaderMigration=true|false (BETA - default=true)
    CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
    DaemonSetUpdateSurge=true|false (BETA - default=true)
    DefaultPodTopologySpread=true|false (BETA - default=true)
    DelegateFSGroupToCSIDriver=true|false (ALPHA - default=false)
    DevicePlugins=true|false (BETA - default=true)
    DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
    DisableCloudProviders=true|false (ALPHA - default=false)
    DownwardAPIHugePages=true|false (BETA - default=false)
    EfficientWatchResumption=true|false (BETA - default=true)
    EndpointSliceTerminatingCondition=true|false (BETA - default=true)
    EphemeralContainers=true|false (ALPHA - default=false)
    ExpandCSIVolumes=true|false (BETA - default=true)
    ExpandInUsePersistentVolumes=true|false (BETA - default=true)
    ExpandPersistentVolumes=true|false (BETA - default=true)
    ExpandedDNSConfig=true|false (ALPHA - default=false)
    ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
    GenericEphemeralVolume=true|false (BETA - default=true)
    GracefulNodeShutdown=true|false (BETA - default=true)
    HPAContainerMetrics=true|false (ALPHA - default=false)
    HPAScaleToZero=true|false (ALPHA - default=false)
    IPv6DualStack=true|false (BETA - default=true)
    InTreePluginAWSUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
    InTreePluginGCEUnregister=true|false (ALPHA - default=false)
    InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
    InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
    IndexedJob=true|false (BETA - default=true)
    IngressClassNamespacedParams=true|false (BETA - default=true)
    JobTrackingWithFinalizers=true|false (ALPHA - default=false)
    KubeletCredentialProviders=true|false (ALPHA - default=false)
    KubeletInUserNamespace=true|false (ALPHA - default=false)
    KubeletPodResources=true|false (BETA - default=true)
    KubeletPodResourcesGetAllocatable=true|false (ALPHA - default=false)
    LocalStorageCapacityIsolation=true|false (BETA - default=true)
    LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
    LogarithmicScaleDown=true|false (BETA - default=true)
    MemoryManager=true|false (BETA - default=true)
    MemoryQoS=true|false (ALPHA - default=false)
    MixedProtocolLBService=true|false (ALPHA - default=false)
    NetworkPolicyEndPort=true|false (BETA - default=true)
    NodeSwap=true|false (ALPHA - default=false)
    NonPreemptingPriority=true|false (BETA - default=true)
    PodAffinityNamespaceSelector=true|false (BETA - default=true)
    PodDeletionCost=true|false (BETA - default=true)
    PodOverhead=true|false (BETA - default=true)
    PodSecurity=true|false (ALPHA - default=false)
    PreferNominatedNode=true|false (BETA - default=true)
    ProbeTerminationGracePeriod=true|false (BETA - default=false)
    ProcMountType=true|false (ALPHA - default=false)
    ProxyTerminatingEndpoints=true|false (ALPHA - default=false)
    QOSReserved=true|false (ALPHA - default=false)
    ReadWriteOncePod=true|false (ALPHA - default=false)
    RemainingItemCount=true|false (BETA - default=true)
    RemoveSelfLink=true|false (BETA - default=true)
    RotateKubeletServerCertificate=true|false (BETA - default=true)
    SeccompDefault=true|false (ALPHA - default=false)
    ServiceInternalTrafficPolicy=true|false (BETA - default=true)
    ServiceLBNodePortControl=true|false (BETA - default=true)
    ServiceLoadBalancerClass=true|false (BETA - default=true)
    SizeMemoryBackedVolumes=true|false (BETA - default=true)
    StatefulSetMinReadySeconds=true|false (ALPHA - default=false)
    StorageVersionAPI=true|false (ALPHA - default=false)
    StorageVersionHash=true|false (BETA - default=true)
    SuspendJob=true|false (BETA - default=true)
    TTLAfterFinished=true|false (BETA - default=true)
    TopologyAwareHints=true|false (ALPHA - default=false)
    TopologyManager=true|false (BETA - default=true)
    VolumeCapacityPriority=true|false (ALPHA - default=false)
    WinDSR=true|false (ALPHA - default=false)
    WinOverlay=true|false (BETA - default=true)
    WindowsHostProcessContainers=true|false (ALPHA - default=false)

    @@ -663,7 +663,7 @@ kube-controller-manager [flags] --logging-format string     Default: "text" -

    Sets the log format. Permitted formats: "json", "text".
    Non-default formats don't honor these flags: --add-dir-header, --alsologtostderr, --log-backtrace-at, --log-dir, --log-file, --log-file-max-size, --logtostderr, --one-output, --skip-headers, --skip-log-headers, --stderrthreshold, --vmodule, --log-flush-frequency.
    Non-default choices are currently alpha and subject to change without warning.

    +

    Sets the log format. Permitted formats: "text".
    Non-default formats don't honor these flags: --add-dir-header, --alsologtostderr, --log-backtrace-at, --log-dir, --log-file, --log-file-max-size, --logtostderr, --one-output, --skip-headers, --skip-log-headers, --stderrthreshold, --vmodule, --log-flush-frequency.
    Non-default choices are currently alpha and subject to change without warning.

    diff --git a/content/en/docs/reference/command-line-tools-reference/kube-proxy.md b/content/en/docs/reference/command-line-tools-reference/kube-proxy.md index dc236b02e9..3306668093 100644 --- a/content/en/docs/reference/command-line-tools-reference/kube-proxy.md +++ b/content/en/docs/reference/command-line-tools-reference/kube-proxy.md @@ -179,7 +179,7 @@ kube-proxy [flags] --feature-gates <comma-separated 'key=True|False' pairs> -

    A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
    APIListChunking=true|false (BETA - default=true)
    APIPriorityAndFairness=true|false (BETA - default=true)
    APIResponseCompression=true|false (BETA - default=true)
    APIServerIdentity=true|false (ALPHA - default=false)
    AllAlpha=true|false (ALPHA - default=false)
    AllBeta=true|false (BETA - default=false)
    AnyVolumeDataSource=true|false (ALPHA - default=false)
    AppArmor=true|false (BETA - default=true)
    BalanceAttachedNodeVolumes=true|false (ALPHA - default=false)
    BoundServiceAccountTokenVolume=true|false (BETA - default=true)
    CPUManager=true|false (BETA - default=true)
    CSIInlineVolume=true|false (BETA - default=true)
    CSIMigration=true|false (BETA - default=true)
    CSIMigrationAWS=true|false (BETA - default=false)
    CSIMigrationAzureDisk=true|false (BETA - default=false)
    CSIMigrationAzureFile=true|false (BETA - default=false)
    CSIMigrationGCE=true|false (BETA - default=false)
    CSIMigrationOpenStack=true|false (BETA - default=true)
    CSIMigrationvSphere=true|false (BETA - default=false)
    CSIMigrationvSphereComplete=true|false (BETA - default=false)
    CSIServiceAccountToken=true|false (BETA - default=true)
    CSIStorageCapacity=true|false (BETA - default=true)
    CSIVolumeFSGroupPolicy=true|false (BETA - default=true)
    CSIVolumeHealth=true|false (ALPHA - default=false)
    ConfigurableFSGroupPolicy=true|false (BETA - default=true)
    ControllerManagerLeaderMigration=true|false (ALPHA - default=false)
    CronJobControllerV2=true|false (BETA - default=true)
    CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
    DaemonSetUpdateSurge=true|false (ALPHA - default=false)
    DefaultPodTopologySpread=true|false (BETA - default=true)
    DevicePlugins=true|false (BETA - default=true)
    DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
    DownwardAPIHugePages=true|false (BETA - default=false)
    DynamicKubeletConfig=true|false (BETA - default=true)
    EfficientWatchResumption=true|false (BETA - default=true)
    EndpointSliceProxying=true|false (BETA - default=true)
    EndpointSliceTerminatingCondition=true|false (ALPHA - default=false)
    EphemeralContainers=true|false (ALPHA - default=false)
    ExpandCSIVolumes=true|false (BETA - default=true)
    ExpandInUsePersistentVolumes=true|false (BETA - default=true)
    ExpandPersistentVolumes=true|false (BETA - default=true)
    ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
    GenericEphemeralVolume=true|false (BETA - default=true)
    GracefulNodeShutdown=true|false (BETA - default=true)
    HPAContainerMetrics=true|false (ALPHA - default=false)
    HPAScaleToZero=true|false (ALPHA - default=false)
    HugePageStorageMediumSize=true|false (BETA - default=true)
    IPv6DualStack=true|false (BETA - default=true)
    InTreePluginAWSUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
    InTreePluginGCEUnregister=true|false (ALPHA - default=false)
    InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
    InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
    IndexedJob=true|false (ALPHA - default=false)
    IngressClassNamespacedParams=true|false (ALPHA - default=false)
    KubeletCredentialProviders=true|false (ALPHA - default=false)
    KubeletPodResources=true|false (BETA - default=true)
    KubeletPodResourcesGetAllocatable=true|false (ALPHA - default=false)
    LocalStorageCapacityIsolation=true|false (BETA - default=true)
    LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
    LogarithmicScaleDown=true|false (ALPHA - default=false)
    MemoryManager=true|false (ALPHA - default=false)
    MixedProtocolLBService=true|false (ALPHA - default=false)
    NamespaceDefaultLabelName=true|false (BETA - default=true)
    NetworkPolicyEndPort=true|false (ALPHA - default=false)
    NonPreemptingPriority=true|false (BETA - default=true)
    PodAffinityNamespaceSelector=true|false (ALPHA - default=false)
    PodDeletionCost=true|false (ALPHA - default=false)
    PodOverhead=true|false (BETA - default=true)
    PreferNominatedNode=true|false (ALPHA - default=false)
    ProbeTerminationGracePeriod=true|false (ALPHA - default=false)
    ProcMountType=true|false (ALPHA - default=false)
    QOSReserved=true|false (ALPHA - default=false)
    RemainingItemCount=true|false (BETA - default=true)
    RemoveSelfLink=true|false (BETA - default=true)
    RotateKubeletServerCertificate=true|false (BETA - default=true)
    ServerSideApply=true|false (BETA - default=true)
    ServiceInternalTrafficPolicy=true|false (ALPHA - default=false)
    ServiceLBNodePortControl=true|false (ALPHA - default=false)
    ServiceLoadBalancerClass=true|false (ALPHA - default=false)
    ServiceTopology=true|false (ALPHA - default=false)
    SetHostnameAsFQDN=true|false (BETA - default=true)
    SizeMemoryBackedVolumes=true|false (ALPHA - default=false)
    StorageVersionAPI=true|false (ALPHA - default=false)
    StorageVersionHash=true|false (BETA - default=true)
    SuspendJob=true|false (ALPHA - default=false)
    TTLAfterFinished=true|false (BETA - default=true)
    TopologyAwareHints=true|false (ALPHA - default=false)
    TopologyManager=true|false (BETA - default=true)
    ValidateProxyRedirects=true|false (BETA - default=true)
    VolumeCapacityPriority=true|false (ALPHA - default=false)
    WarningHeaders=true|false (BETA - default=true)
    WinDSR=true|false (ALPHA - default=false)
    WinOverlay=true|false (BETA - default=true)
    WindowsEndpointSliceProxying=true|false (BETA - default=true)

    +

    A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
    APIListChunking=true|false (BETA - default=true)
    APIPriorityAndFairness=true|false (BETA - default=true)
    APIResponseCompression=true|false (BETA - default=true)
    APIServerIdentity=true|false (ALPHA - default=false)
    APIServerTracing=true|false (ALPHA - default=false)
    AllAlpha=true|false (ALPHA - default=false)
    AllBeta=true|false (BETA - default=false)
    AnyVolumeDataSource=true|false (ALPHA - default=false)
    AppArmor=true|false (BETA - default=true)
    CPUManager=true|false (BETA - default=true)
    CPUManagerPolicyOptions=true|false (ALPHA - default=false)
    CSIInlineVolume=true|false (BETA - default=true)
    CSIMigration=true|false (BETA - default=true)
    CSIMigrationAWS=true|false (BETA - default=false)
    CSIMigrationAzureDisk=true|false (BETA - default=false)
    CSIMigrationAzureFile=true|false (BETA - default=false)
    CSIMigrationGCE=true|false (BETA - default=false)
    CSIMigrationOpenStack=true|false (BETA - default=true)
    CSIMigrationvSphere=true|false (BETA - default=false)
    CSIStorageCapacity=true|false (BETA - default=true)
    CSIVolumeFSGroupPolicy=true|false (BETA - default=true)
    CSIVolumeHealth=true|false (ALPHA - default=false)
    CSRDuration=true|false (BETA - default=true)
    ConfigurableFSGroupPolicy=true|false (BETA - default=true)
    ControllerManagerLeaderMigration=true|false (BETA - default=true)
    CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
    DaemonSetUpdateSurge=true|false (BETA - default=true)
    DefaultPodTopologySpread=true|false (BETA - default=true)
    DelegateFSGroupToCSIDriver=true|false (ALPHA - default=false)
    DevicePlugins=true|false (BETA - default=true)
    DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
    DisableCloudProviders=true|false (ALPHA - default=false)
    DownwardAPIHugePages=true|false (BETA - default=false)
    EfficientWatchResumption=true|false (BETA - default=true)
    EndpointSliceTerminatingCondition=true|false (BETA - default=true)
    EphemeralContainers=true|false (ALPHA - default=false)
    ExpandCSIVolumes=true|false (BETA - default=true)
    ExpandInUsePersistentVolumes=true|false (BETA - default=true)
    ExpandPersistentVolumes=true|false (BETA - default=true)
    ExpandedDNSConfig=true|false (ALPHA - default=false)
    ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
    GenericEphemeralVolume=true|false (BETA - default=true)
    GracefulNodeShutdown=true|false (BETA - default=true)
    HPAContainerMetrics=true|false (ALPHA - default=false)
    HPAScaleToZero=true|false (ALPHA - default=false)
    IPv6DualStack=true|false (BETA - default=true)
    InTreePluginAWSUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
    InTreePluginGCEUnregister=true|false (ALPHA - default=false)
    InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
    InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
    IndexedJob=true|false (BETA - default=true)
    IngressClassNamespacedParams=true|false (BETA - default=true)
    JobTrackingWithFinalizers=true|false (ALPHA - default=false)
    KubeletCredentialProviders=true|false (ALPHA - default=false)
    KubeletInUserNamespace=true|false (ALPHA - default=false)
    KubeletPodResources=true|false (BETA - default=true)
    KubeletPodResourcesGetAllocatable=true|false (ALPHA - default=false)
    LocalStorageCapacityIsolation=true|false (BETA - default=true)
    LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
    LogarithmicScaleDown=true|false (BETA - default=true)
    MemoryManager=true|false (BETA - default=true)
    MemoryQoS=true|false (ALPHA - default=false)
    MixedProtocolLBService=true|false (ALPHA - default=false)
    NetworkPolicyEndPort=true|false (BETA - default=true)
    NodeSwap=true|false (ALPHA - default=false)
    NonPreemptingPriority=true|false (BETA - default=true)
    PodAffinityNamespaceSelector=true|false (BETA - default=true)
    PodDeletionCost=true|false (BETA - default=true)
    PodOverhead=true|false (BETA - default=true)
    PodSecurity=true|false (ALPHA - default=false)
    PreferNominatedNode=true|false (BETA - default=true)
    ProbeTerminationGracePeriod=true|false (BETA - default=false)
    ProcMountType=true|false (ALPHA - default=false)
    ProxyTerminatingEndpoints=true|false (ALPHA - default=false)
    QOSReserved=true|false (ALPHA - default=false)
    ReadWriteOncePod=true|false (ALPHA - default=false)
    RemainingItemCount=true|false (BETA - default=true)
    RemoveSelfLink=true|false (BETA - default=true)
    RotateKubeletServerCertificate=true|false (BETA - default=true)
    SeccompDefault=true|false (ALPHA - default=false)
    ServiceInternalTrafficPolicy=true|false (BETA - default=true)
    ServiceLBNodePortControl=true|false (BETA - default=true)
    ServiceLoadBalancerClass=true|false (BETA - default=true)
    SizeMemoryBackedVolumes=true|false (BETA - default=true)
    StatefulSetMinReadySeconds=true|false (ALPHA - default=false)
    StorageVersionAPI=true|false (ALPHA - default=false)
    StorageVersionHash=true|false (BETA - default=true)
    SuspendJob=true|false (BETA - default=true)
    TTLAfterFinished=true|false (BETA - default=true)
    TopologyAwareHints=true|false (ALPHA - default=false)
    TopologyManager=true|false (BETA - default=true)
    VolumeCapacityPriority=true|false (ALPHA - default=false)
    WinDSR=true|false (ALPHA - default=false)
    WinOverlay=true|false (BETA - default=true)
    WindowsHostProcessContainers=true|false (ALPHA - default=false)

    diff --git a/content/en/docs/reference/command-line-tools-reference/kube-scheduler.md b/content/en/docs/reference/command-line-tools-reference/kube-scheduler.md index 45d8cae73a..621bac8aa2 100644 --- a/content/en/docs/reference/command-line-tools-reference/kube-scheduler.md +++ b/content/en/docs/reference/command-line-tools-reference/kube-scheduler.md @@ -27,7 +27,7 @@ each Pod in the scheduling queue according to constraints and available resources. The scheduler then ranks each valid Node and binds the Pod to a suitable Node. Multiple different schedulers may be used within a cluster; kube-scheduler is the reference implementation. -See [scheduling](/docs/concepts/scheduling-eviction/) +See [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/) for more information about scheduling and the kube-scheduler component. ``` @@ -51,19 +51,12 @@ kube-scheduler [flags] ---address string     Default: "0.0.0.0" +--address string

    DEPRECATED: the IP address on which to listen for the --port port (set to 0.0.0.0 or :: for listening in all interfaces and IP families). See --bind-address instead. This parameter is ignored if a config file is specified in --config.

    - ---algorithm-provider string - - -

    DEPRECATED: the scheduling algorithm provider to use, this sets the default plugins for component config profiles. Choose one of: ClusterAutoscalerProvider | DefaultProvider

    - - --allow-metric-labels stringToString     Default: [] @@ -166,11 +159,11 @@ kube-scheduler [flags] --config string -

    The path to the configuration file. The following flags can overwrite fields in this file:
    --algorithm-provider
    --policy-config-file
    --policy-configmap
    --policy-configmap-namespace

    +

    The path to the configuration file. The following flags can overwrite fields in this file:
    --policy-config-file
    --policy-configmap
    --policy-configmap-namespace

    ---contention-profiling     Default: true +--contention-profiling

    DEPRECATED: enable lock contention profiling, if profiling is enabled. This parameter is ignored if a config file is specified in --config.

    @@ -194,14 +187,7 @@ kube-scheduler [flags] --feature-gates <comma-separated 'key=True|False' pairs> -

    A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
    APIListChunking=true|false (BETA - default=true)
    APIPriorityAndFairness=true|false (BETA - default=true)
    APIResponseCompression=true|false (BETA - default=true)
    APIServerIdentity=true|false (ALPHA - default=false)
    AllAlpha=true|false (ALPHA - default=false)
    AllBeta=true|false (BETA - default=false)
    AnyVolumeDataSource=true|false (ALPHA - default=false)
    AppArmor=true|false (BETA - default=true)
    BalanceAttachedNodeVolumes=true|false (ALPHA - default=false)
    BoundServiceAccountTokenVolume=true|false (BETA - default=true)
    CPUManager=true|false (BETA - default=true)
    CSIInlineVolume=true|false (BETA - default=true)
    CSIMigration=true|false (BETA - default=true)
    CSIMigrationAWS=true|false (BETA - default=false)
    CSIMigrationAzureDisk=true|false (BETA - default=false)
    CSIMigrationAzureFile=true|false (BETA - default=false)
    CSIMigrationGCE=true|false (BETA - default=false)
    CSIMigrationOpenStack=true|false (BETA - default=true)
    CSIMigrationvSphere=true|false (BETA - default=false)
    CSIMigrationvSphereComplete=true|false (BETA - default=false)
    CSIServiceAccountToken=true|false (BETA - default=true)
    CSIStorageCapacity=true|false (BETA - default=true)
    CSIVolumeFSGroupPolicy=true|false (BETA - default=true)
    CSIVolumeHealth=true|false (ALPHA - default=false)
    ConfigurableFSGroupPolicy=true|false (BETA - default=true)
    ControllerManagerLeaderMigration=true|false (ALPHA - default=false)
    CronJobControllerV2=true|false (BETA - default=true)
    CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
    DaemonSetUpdateSurge=true|false (ALPHA - default=false)
    DefaultPodTopologySpread=true|false (BETA - default=true)
    DevicePlugins=true|false (BETA - default=true)
    DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
    DownwardAPIHugePages=true|false (BETA - default=false)
    DynamicKubeletConfig=true|false (BETA - default=true)
    EfficientWatchResumption=true|false (BETA - default=true)
    EndpointSliceProxying=true|false (BETA - default=true)
    EndpointSliceTerminatingCondition=true|false (ALPHA - default=false)
    EphemeralContainers=true|false (ALPHA - default=false)
    ExpandCSIVolumes=true|false (BETA - default=true)
    ExpandInUsePersistentVolumes=true|false (BETA - default=true)
    ExpandPersistentVolumes=true|false (BETA - default=true)
    ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
    GenericEphemeralVolume=true|false (BETA - default=true)
    GracefulNodeShutdown=true|false (BETA - default=true)
    HPAContainerMetrics=true|false (ALPHA - default=false)
    HPAScaleToZero=true|false (ALPHA - default=false)
    HugePageStorageMediumSize=true|false (BETA - default=true)
    IPv6DualStack=true|false (BETA - default=true)
    InTreePluginAWSUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
    InTreePluginGCEUnregister=true|false (ALPHA - default=false)
    InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
    InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
    IndexedJob=true|false (ALPHA - default=false)
    IngressClassNamespacedParams=true|false (ALPHA - default=false)
    KubeletCredentialProviders=true|false (ALPHA - default=false)
    KubeletPodResources=true|false (BETA - default=true)
    KubeletPodResourcesGetAllocatable=true|false (ALPHA - default=false)
    LocalStorageCapacityIsolation=true|false (BETA - default=true)
    LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
    LogarithmicScaleDown=true|false (ALPHA - default=false)
    MemoryManager=true|false (ALPHA - default=false)
    MixedProtocolLBService=true|false (ALPHA - default=false)
    NamespaceDefaultLabelName=true|false (BETA - default=true)
    NetworkPolicyEndPort=true|false (ALPHA - default=false)
    NonPreemptingPriority=true|false (BETA - default=true)
    PodAffinityNamespaceSelector=true|false (ALPHA - default=false)
    PodDeletionCost=true|false (ALPHA - default=false)
    PodOverhead=true|false (BETA - default=true)
    PreferNominatedNode=true|false (ALPHA - default=false)
    ProbeTerminationGracePeriod=true|false (ALPHA - default=false)
    ProcMountType=true|false (ALPHA - default=false)
    QOSReserved=true|false (ALPHA - default=false)
    RemainingItemCount=true|false (BETA - default=true)
    RemoveSelfLink=true|false (BETA - default=true)
    RotateKubeletServerCertificate=true|false (BETA - default=true)
    ServerSideApply=true|false (BETA - default=true)
    ServiceInternalTrafficPolicy=true|false (ALPHA - default=false)
    ServiceLBNodePortControl=true|false (ALPHA - default=false)
    ServiceLoadBalancerClass=true|false (ALPHA - default=false)
    ServiceTopology=true|false (ALPHA - default=false)
    SetHostnameAsFQDN=true|false (BETA - default=true)
    SizeMemoryBackedVolumes=true|false (ALPHA - default=false)
    StorageVersionAPI=true|false (ALPHA - default=false)
    StorageVersionHash=true|false (BETA - default=true)
    SuspendJob=true|false (ALPHA - default=false)
    TTLAfterFinished=true|false (BETA - default=true)
    TopologyAwareHints=true|false (ALPHA - default=false)
    TopologyManager=true|false (BETA - default=true)
    ValidateProxyRedirects=true|false (BETA - default=true)
    VolumeCapacityPriority=true|false (ALPHA - default=false)
    WarningHeaders=true|false (BETA - default=true)
    WinDSR=true|false (ALPHA - default=false)
    WinOverlay=true|false (BETA - default=true)
    WindowsEndpointSliceProxying=true|false (BETA - default=true)

    - - - ---hard-pod-affinity-symmetric-weight int32     Default: 1 - - -

    DEPRECATED: RequiredDuringScheduling affinity is not symmetric, but there is an implicit PreferredDuringScheduling affinity rule corresponding to every RequiredDuringScheduling affinity rule. --hard-pod-affinity-symmetric-weight represents the weight of implicit PreferredDuringScheduling affinity rule. Must be in the range 0-100.This parameter is ignored if a config file is specified in --config.

    +

    A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
    APIListChunking=true|false (BETA - default=true)
    APIPriorityAndFairness=true|false (BETA - default=true)
    APIResponseCompression=true|false (BETA - default=true)
    APIServerIdentity=true|false (ALPHA - default=false)
    APIServerTracing=true|false (ALPHA - default=false)
    AllAlpha=true|false (ALPHA - default=false)
    AllBeta=true|false (BETA - default=false)
    AnyVolumeDataSource=true|false (ALPHA - default=false)
    AppArmor=true|false (BETA - default=true)
    CPUManager=true|false (BETA - default=true)
    CPUManagerPolicyOptions=true|false (ALPHA - default=false)
    CSIInlineVolume=true|false (BETA - default=true)
    CSIMigration=true|false (BETA - default=true)
    CSIMigrationAWS=true|false (BETA - default=false)
    CSIMigrationAzureDisk=true|false (BETA - default=false)
    CSIMigrationAzureFile=true|false (BETA - default=false)
    CSIMigrationGCE=true|false (BETA - default=false)
    CSIMigrationOpenStack=true|false (BETA - default=true)
    CSIMigrationvSphere=true|false (BETA - default=false)
    CSIStorageCapacity=true|false (BETA - default=true)
    CSIVolumeFSGroupPolicy=true|false (BETA - default=true)
    CSIVolumeHealth=true|false (ALPHA - default=false)
    CSRDuration=true|false (BETA - default=true)
    ConfigurableFSGroupPolicy=true|false (BETA - default=true)
    ControllerManagerLeaderMigration=true|false (BETA - default=true)
    CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
    DaemonSetUpdateSurge=true|false (BETA - default=true)
    DefaultPodTopologySpread=true|false (BETA - default=true)
    DelegateFSGroupToCSIDriver=true|false (ALPHA - default=false)
    DevicePlugins=true|false (BETA - default=true)
    DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
    DisableCloudProviders=true|false (ALPHA - default=false)
    DownwardAPIHugePages=true|false (BETA - default=false)
    EfficientWatchResumption=true|false (BETA - default=true)
    EndpointSliceTerminatingCondition=true|false (BETA - default=true)
    EphemeralContainers=true|false (ALPHA - default=false)
    ExpandCSIVolumes=true|false (BETA - default=true)
    ExpandInUsePersistentVolumes=true|false (BETA - default=true)
    ExpandPersistentVolumes=true|false (BETA - default=true)
    ExpandedDNSConfig=true|false (ALPHA - default=false)
    ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
    GenericEphemeralVolume=true|false (BETA - default=true)
    GracefulNodeShutdown=true|false (BETA - default=true)
    HPAContainerMetrics=true|false (ALPHA - default=false)
    HPAScaleToZero=true|false (ALPHA - default=false)
    IPv6DualStack=true|false (BETA - default=true)
    InTreePluginAWSUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
    InTreePluginGCEUnregister=true|false (ALPHA - default=false)
    InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
    InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
    IndexedJob=true|false (BETA - default=true)
    IngressClassNamespacedParams=true|false (BETA - default=true)
    JobTrackingWithFinalizers=true|false (ALPHA - default=false)
    KubeletCredentialProviders=true|false (ALPHA - default=false)
    KubeletInUserNamespace=true|false (ALPHA - default=false)
    KubeletPodResources=true|false (BETA - default=true)
    KubeletPodResourcesGetAllocatable=true|false (ALPHA - default=false)
    LocalStorageCapacityIsolation=true|false (BETA - default=true)
    LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
    LogarithmicScaleDown=true|false (BETA - default=true)
    MemoryManager=true|false (BETA - default=true)
    MemoryQoS=true|false (ALPHA - default=false)
    MixedProtocolLBService=true|false (ALPHA - default=false)
    NetworkPolicyEndPort=true|false (BETA - default=true)
    NodeSwap=true|false (ALPHA - default=false)
    NonPreemptingPriority=true|false (BETA - default=true)
    PodAffinityNamespaceSelector=true|false (BETA - default=true)
    PodDeletionCost=true|false (BETA - default=true)
    PodOverhead=true|false (BETA - default=true)
    PodSecurity=true|false (ALPHA - default=false)
    PreferNominatedNode=true|false (BETA - default=true)
    ProbeTerminationGracePeriod=true|false (BETA - default=false)
    ProcMountType=true|false (ALPHA - default=false)
    ProxyTerminatingEndpoints=true|false (ALPHA - default=false)
    QOSReserved=true|false (ALPHA - default=false)
    ReadWriteOncePod=true|false (ALPHA - default=false)
    RemainingItemCount=true|false (BETA - default=true)
    RemoveSelfLink=true|false (BETA - default=true)
    RotateKubeletServerCertificate=true|false (BETA - default=true)
    SeccompDefault=true|false (ALPHA - default=false)
    ServiceInternalTrafficPolicy=true|false (BETA - default=true)
    ServiceLBNodePortControl=true|false (BETA - default=true)
    ServiceLoadBalancerClass=true|false (BETA - default=true)
    SizeMemoryBackedVolumes=true|false (BETA - default=true)
    StatefulSetMinReadySeconds=true|false (ALPHA - default=false)
    StorageVersionAPI=true|false (ALPHA - default=false)
    StorageVersionHash=true|false (BETA - default=true)
    SuspendJob=true|false (BETA - default=true)
    TTLAfterFinished=true|false (BETA - default=true)
    TopologyAwareHints=true|false (ALPHA - default=false)
    TopologyManager=true|false (BETA - default=true)
    VolumeCapacityPriority=true|false (ALPHA - default=false)
    WinDSR=true|false (ALPHA - default=false)
    WinOverlay=true|false (BETA - default=true)
    WindowsHostProcessContainers=true|false (ALPHA - default=false)

    @@ -219,21 +205,21 @@ kube-scheduler [flags] ---kube-api-burst int32     Default: 100 +--kube-api-burst int32

    DEPRECATED: burst to use while talking with kubernetes apiserver. This parameter is ignored if a config file is specified in --config.

    ---kube-api-content-type string     Default: "application/vnd.kubernetes.protobuf" +--kube-api-content-type string

    DEPRECATED: content type of requests sent to apiserver. This parameter is ignored if a config file is specified in --config.

    ---kube-api-qps float     Default: 50 +--kube-api-qps float

    DEPRECATED: QPS to use while talking with kubernetes apiserver. This parameter is ignored if a config file is specified in --config.

    @@ -247,63 +233,63 @@ kube-scheduler [flags] ---leader-elect     Default: true +--leader-elect

    Start a leader election client and gain leadership before executing the main loop. Enable this when running replicated components for high availability.

    ---leader-elect-lease-duration duration     Default: 15s +--leader-elect-lease-duration duration

    The duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate. This is only applicable if leader election is enabled.

    ---leader-elect-renew-deadline duration     Default: 10s +--leader-elect-renew-deadline duration

    The interval between attempts by the acting master to renew a leadership slot before it stops leading. This must be less than or equal to the lease duration. This is only applicable if leader election is enabled.

    ---leader-elect-resource-lock string     Default: "leases" +--leader-elect-resource-lock string

    The type of resource object that is used for locking during leader election. Supported options are 'endpoints', 'configmaps', 'leases', 'endpointsleases' and 'configmapsleases'.

    ---leader-elect-resource-name string     Default: "kube-scheduler" +--leader-elect-resource-name string

    The name of resource object that is used for locking during leader election.

    ---leader-elect-resource-namespace string     Default: "kube-system" +--leader-elect-resource-namespace string

    The namespace of resource object that is used for locking during leader election.

    ---leader-elect-retry-period duration     Default: 2s +--leader-elect-retry-period duration

    The duration the clients should wait between attempting acquisition and renewal of a leadership. This is only applicable if leader election is enabled.

    ---lock-object-name string     Default: "kube-scheduler" +--lock-object-name string

    DEPRECATED: define the name of the lock object. Will be removed in favor of leader-elect-resource-name. This parameter is ignored if a config file is specified in --config.

    ---lock-object-namespace string     Default: "kube-system" +--lock-object-namespace string

    DEPRECATED: define the namespace of the lock object. Will be removed in favor of leader-elect-resource-namespace. This parameter is ignored if a config file is specified in --config.

    @@ -348,7 +334,7 @@ kube-scheduler [flags] --logging-format string     Default: "text" -

    Sets the log format. Permitted formats: "json", "text".
    Non-default formats don't honor these flags: --add-dir-header, --alsologtostderr, --log-backtrace-at, --log-dir, --log-file, --log-file-max-size, --logtostderr, --one-output, --skip-headers, --skip-log-headers, --stderrthreshold, --vmodule, --log-flush-frequency.
    Non-default choices are currently alpha and subject to change without warning.

    +

    Sets the log format. Permitted formats: "text".
    Non-default formats don't honor these flags: --add-dir-header, --alsologtostderr, --log-backtrace-at, --log-dir, --log-file, --log-file-max-size, --logtostderr, --one-output, --skip-headers, --skip-log-headers, --stderrthreshold, --vmodule, --log-flush-frequency.
    Non-default choices are currently alpha and subject to change without warning.

    @@ -390,32 +376,32 @@ kube-scheduler [flags] --policy-config-file string -

    DEPRECATED: file with scheduler policy configuration. This file is used if policy ConfigMap is not provided or --use-legacy-policy-config=true. Note: The scheduler will fail if this is combined with Plugin configs

    +

    DEPRECATED: file with scheduler policy configuration. This file is used if policy ConfigMap is not provided or --use-legacy-policy-config=true. Note: The predicates/priorities defined in this file will take precedence over any profiles define in ComponentConfig.

    --policy-configmap string -

    DEPRECATED: name of the ConfigMap object that contains scheduler's policy configuration. It must exist in the system namespace before scheduler initialization if --use-legacy-policy-config=false. The config must be provided as the value of an element in 'Data' map with the key='policy.cfg'. Note: The scheduler will fail if this is combined with Plugin configs

    +

    DEPRECATED: name of the ConfigMap object that contains scheduler's policy configuration. It must exist in the system namespace before scheduler initialization if --use-legacy-policy-config=false. The config must be provided as the value of an element in 'Data' map with the key='policy.cfg'. Note: The predicates/priorities defined in this file will take precedence over any profiles define in ComponentConfig.

    --policy-configmap-namespace string     Default: "kube-system" -

    DEPRECATED: the namespace where policy ConfigMap is located. The kube-system namespace will be used if this is not provided or is empty. Note: The scheduler will fail if this is combined with Plugin configs

    +

    DEPRECATED: the namespace where policy ConfigMap is located. The kube-system namespace will be used if this is not provided or is empty. Note: The predicates/priorities defined in this file will take precedence over any profiles define in ComponentConfig.

    ---port int     Default: 10251 +--port int

    DEPRECATED: the port on which to serve HTTP insecurely without authentication and authorization. If 0, don't serve plain HTTP at all. See --secure-port instead. This parameter is ignored if a config file is specified in --config.

    ---profiling     Default: true +--profiling

    DEPRECATED: enable profiling via web interface host:port/debug/pprof/. This parameter is ignored if a config file is specified in --config.

    @@ -456,13 +442,6 @@ kube-scheduler [flags]

    List of request headers to inspect for usernames. X-Remote-User is common.

    - ---scheduler-name string     Default: "default-scheduler" - - -

    DEPRECATED: name of the scheduler, used to select which pods will be processed by this scheduler, based on pod's "spec.schedulerName". This parameter is ignored if a config file is specified in --config.

    - - --secure-port int     Default: 10259 diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha.md deleted file mode 100644 index af458320a5..0000000000 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha.md +++ /dev/null @@ -1,61 +0,0 @@ - - - -Kubeadm experimental sub-commands - -### Synopsis - - -Kubeadm experimental sub-commands - -### Options - - ---- - - - - - - - - - - -
    -h, --help

    help for alpha

    - - - -### Options inherited from parent commands - - ---- - - - - - - - - - - -
    --rootfs string

    [EXPERIMENTAL] The path to the 'real' host root filesystem.

    - - - diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig.md deleted file mode 100644 index b678061bb0..0000000000 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig.md +++ /dev/null @@ -1,63 +0,0 @@ - - - -Kubeconfig file utilities - -### Synopsis - - -Kubeconfig file utilities. - -Alpha Disclaimer: this command is currently alpha. - -### Options - - ---- - - - - - - - - - - -
    -h, --help

    help for kubeconfig

    - - - -### Options inherited from parent commands - - ---- - - - - - - - - - - -
    --rootfs string

    [EXPERIMENTAL] The path to the 'real' host root filesystem.

    - - - diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig_user.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig_user.md deleted file mode 100644 index de07cd0f7d..0000000000 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig_user.md +++ /dev/null @@ -1,102 +0,0 @@ - - - -Output a kubeconfig file for an additional user - -### Synopsis - - -Output a kubeconfig file for an additional user. - -Alpha Disclaimer: this command is currently alpha. - -``` -kubeadm alpha kubeconfig user [flags] -``` - -### Examples - -``` - # Output a kubeconfig file for an additional user named foo using a kubeadm config file bar - kubeadm alpha kubeconfig user --client-name=foo --config=bar -``` - -### Options - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    --client-name string

    The name of user. It will be used as the CN if client certificates are created

    --config string

    Path to a kubeadm configuration file.

    -h, --help

    help for user

    --org strings

    The orgnizations of the client certificate. It will be used as the O if client certificates are created

    --token string

    The token that should be used as the authentication mechanism for this kubeconfig, instead of client certificates

    - - - -### Options inherited from parent commands - - ---- - - - - - - - - - - -
    --rootfs string

    [EXPERIMENTAL] The path to the 'real' host root filesystem.

    - - - diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_generate-csr.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_generate-csr.md index 2a41f2e58f..1abc7d9bac 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_generate-csr.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_generate-csr.md @@ -17,7 +17,7 @@ Generate keys and certificate signing requests Generates keys and certificate signing requests (CSRs) for all the certificates required to run the control plane. This command also generates partial kubeconfig files with private key data in the "users > user > client-key-data" field, and for each kubeconfig file an accompanying ".csr" file is created. -This command is designed for use in [Kubeadm External CA Mode](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#external-ca-mode). It generates CSRs which you can then submit to your external certificate authority for signing. +This command is designed for use in [Kubeadm External CA Mode](https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#external-ca-mode). It generates CSRs which you can then submit to your external certificate authority for signing. The PEM encoded signed certificates should then be saved alongside the key files, using ".crt" as the file extension, or in the case of kubeconfig files, the PEM encoded signed certificate should be base64 encoded and added to the kubeconfig file in the "users > user > client-certificate-data" field. @@ -29,7 +29,7 @@ kubeadm certs generate-csr [flags] ``` # The following command will generate keys and CSRs for all control-plane certificates and kubeconfig files: - kubeadm alpha certs generate-csr --kubeconfig-dir /tmp/etc-k8s --cert-dir /tmp/etc-k8s/pki + kubeadm certs generate-csr --kubeconfig-dir /tmp/etc-k8s --cert-dir /tmp/etc-k8s/pki ``` ### Options diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_admin.conf.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_admin.conf.md index 2a81cee1d4..31192cf3f7 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_admin.conf.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_admin.conf.md @@ -50,20 +50,6 @@ kubeadm certs renew admin.conf [flags]

    Path to a kubeadm configuration file.

    - ---csr-dir string - - -

    The path to output the CSRs and private keys to

    - - - ---csr-only - - -

    Create CSRs instead of generating certificates

    - - -h, --help diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_all.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_all.md index b948adb65c..77ea6e45a1 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_all.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_all.md @@ -44,20 +44,6 @@ kubeadm certs renew all [flags]

    Path to a kubeadm configuration file.

    - ---csr-dir string - - -

    The path to output the CSRs and private keys to

    - - - ---csr-only - - -

    Create CSRs instead of generating certificates

    - - -h, --help diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-etcd-client.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-etcd-client.md index cb8fe0d5f7..f95a51e1a7 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-etcd-client.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-etcd-client.md @@ -50,20 +50,6 @@ kubeadm certs renew apiserver-etcd-client [flags]

    Path to a kubeadm configuration file.

    - ---csr-dir string - - -

    The path to output the CSRs and private keys to

    - - - ---csr-only - - -

    Create CSRs instead of generating certificates

    - - -h, --help diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-kubelet-client.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-kubelet-client.md index 475e8c9f22..27ba374b9f 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-kubelet-client.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-kubelet-client.md @@ -50,20 +50,6 @@ kubeadm certs renew apiserver-kubelet-client [flags]

    Path to a kubeadm configuration file.

    - ---csr-dir string - - -

    The path to output the CSRs and private keys to

    - - - ---csr-only - - -

    Create CSRs instead of generating certificates

    - - -h, --help diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver.md index 750df89d83..7dc59c45d4 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver.md @@ -50,20 +50,6 @@ kubeadm certs renew apiserver [flags]

    Path to a kubeadm configuration file.

    - ---csr-dir string - - -

    The path to output the CSRs and private keys to

    - - - ---csr-only - - -

    Create CSRs instead of generating certificates

    - - -h, --help diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_controller-manager.conf.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_controller-manager.conf.md index b052fb3e54..4df1d8221c 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_controller-manager.conf.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_controller-manager.conf.md @@ -50,20 +50,6 @@ kubeadm certs renew controller-manager.conf [flags]

    Path to a kubeadm configuration file.

    - ---csr-dir string - - -

    The path to output the CSRs and private keys to

    - - - ---csr-only - - -

    Create CSRs instead of generating certificates

    - - -h, --help diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-healthcheck-client.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-healthcheck-client.md index 252296e395..84d75bfd36 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-healthcheck-client.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-healthcheck-client.md @@ -50,20 +50,6 @@ kubeadm certs renew etcd-healthcheck-client [flags]

    Path to a kubeadm configuration file.

    - ---csr-dir string - - -

    The path to output the CSRs and private keys to

    - - - ---csr-only - - -

    Create CSRs instead of generating certificates

    - - -h, --help diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-peer.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-peer.md index f25b86fa15..60acaae1db 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-peer.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-peer.md @@ -50,20 +50,6 @@ kubeadm certs renew etcd-peer [flags]

    Path to a kubeadm configuration file.

    - ---csr-dir string - - -

    The path to output the CSRs and private keys to

    - - - ---csr-only - - -

    Create CSRs instead of generating certificates

    - - -h, --help diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-server.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-server.md index 059d0d9bbb..969157fe3e 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-server.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-server.md @@ -50,20 +50,6 @@ kubeadm certs renew etcd-server [flags]

    Path to a kubeadm configuration file.

    - ---csr-dir string - - -

    The path to output the CSRs and private keys to

    - - - ---csr-only - - -

    Create CSRs instead of generating certificates

    - - -h, --help diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_front-proxy-client.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_front-proxy-client.md index d93fca8d46..3d9564e485 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_front-proxy-client.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_front-proxy-client.md @@ -50,20 +50,6 @@ kubeadm certs renew front-proxy-client [flags]

    Path to a kubeadm configuration file.

    - ---csr-dir string - - -

    The path to output the CSRs and private keys to

    - - - ---csr-only - - -

    Create CSRs instead of generating certificates

    - - -h, --help diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_scheduler.conf.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_scheduler.conf.md index 5d7ade453b..6c8d40dae3 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_scheduler.conf.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_scheduler.conf.md @@ -50,20 +50,6 @@ kubeadm certs renew scheduler.conf [flags]

    Path to a kubeadm configuration file.

    - ---csr-dir string - - -

    The path to output the CSRs and private keys to

    - - - ---csr-only - - -

    Create CSRs instead of generating certificates

    - - -h, --help diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_list.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_list.md index 4634bd0a27..b7f3e05a8b 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_list.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_list.md @@ -55,7 +55,7 @@ kubeadm config images list [flags] --feature-gates string -

    A set of key=value pairs that describe feature gates for various features. Options are:
    IPv6DualStack=true|false (BETA - default=true)
    PublicKeysECDSA=true|false (ALPHA - default=false)

    +

    A set of key=value pairs that describe feature gates for various features. Options are:
    IPv6DualStack=true|false (BETA - default=true)
    PublicKeysECDSA=true|false (ALPHA - default=false)
    RootlessControlPlane=true|false (ALPHA - default=false)

    diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_pull.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_pull.md index 840072d167..a44970a68a 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_pull.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_pull.md @@ -48,7 +48,7 @@ kubeadm config images pull [flags] --feature-gates string -

    A set of key=value pairs that describe feature gates for various features. Options are:
    IPv6DualStack=true|false (BETA - default=true)
    PublicKeysECDSA=true|false (ALPHA - default=false)

    +

    A set of key=value pairs that describe feature gates for various features. Options are:
    IPv6DualStack=true|false (BETA - default=true)
    PublicKeysECDSA=true|false (ALPHA - default=false)
    RootlessControlPlane=true|false (ALPHA - default=false)

    diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_migrate.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_migrate.md index 5858bdb307..8aa2f6f1d2 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_migrate.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_migrate.md @@ -19,9 +19,9 @@ Read an older version of the kubeadm configuration API types from a file, and ou This command lets you convert configuration objects of older versions to the latest supported version, locally in the CLI tool without ever touching anything in the cluster. In this version of kubeadm, the following API versions are supported: -- kubeadm.k8s.io/v1beta2 +- kubeadm.k8s.io/v1beta3 -Further, kubeadm can only write out config of version "kubeadm.k8s.io/v1beta2", but read both types. +Further, kubeadm can only write out config of version "kubeadm.k8s.io/v1beta3", but read both types. So regardless of what version you pass to the --old-config parameter here, the API object will be read, deserialized, defaulted, converted, validated, and re-serialized when written to stdout or --new-config if specified. diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print.md index 2f20d9d1ce..e8aa81abf6 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print.md @@ -17,7 +17,7 @@ Print configuration This command prints configurations for subcommands provided. -For details, see: https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta2 +For details, see: https://pkg.go.dev/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm#section-directories ``` kubeadm config print [flags] diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init.md index 4294cffe8b..62f4ca7e5b 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init.md @@ -134,18 +134,11 @@ kubeadm init [flags]

    Don't apply any changes; just output what would be done.

    - ---experimental-patches string - - -

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    - - --feature-gates string -

    A set of key=value pairs that describe feature gates for various features. Options are:
    IPv6DualStack=true|false (BETA - default=true)
    PublicKeysECDSA=true|false (ALPHA - default=false)

    +

    A set of key=value pairs that describe feature gates for various features. Options are:
    IPv6DualStack=true|false (BETA - default=true)
    PublicKeysECDSA=true|false (ALPHA - default=false)
    RootlessControlPlane=true|false (ALPHA - default=false)

    @@ -183,6 +176,13 @@ kubeadm init [flags]

    Specify the node name.

    + +--patches string + + +

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    + + --pod-network-cidr string diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_all.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_all.md index 48ae42ca48..c30d45980c 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_all.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_all.md @@ -62,7 +62,7 @@ kubeadm init phase addon all [flags] --feature-gates string -

    A set of key=value pairs that describe feature gates for various features. Options are:
    IPv6DualStack=true|false (BETA - default=true)
    PublicKeysECDSA=true|false (ALPHA - default=false)

    +

    A set of key=value pairs that describe feature gates for various features. Options are:
    IPv6DualStack=true|false (BETA - default=true)
    PublicKeysECDSA=true|false (ALPHA - default=false)
    RootlessControlPlane=true|false (ALPHA - default=false)

    diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_coredns.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_coredns.md index 68f0d0d025..3e4076a862 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_coredns.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_coredns.md @@ -41,7 +41,7 @@ kubeadm init phase addon coredns [flags] --feature-gates string -

    A set of key=value pairs that describe feature gates for various features. Options are:
    IPv6DualStack=true|false (BETA - default=true)
    PublicKeysECDSA=true|false (ALPHA - default=false)

    +

    A set of key=value pairs that describe feature gates for various features. Options are:
    IPv6DualStack=true|false (BETA - default=true)
    PublicKeysECDSA=true|false (ALPHA - default=false)
    RootlessControlPlane=true|false (ALPHA - default=false)

    diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver-etcd-client.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver-etcd-client.md index 4c8bed971a..3280fdc0eb 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver-etcd-client.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver-etcd-client.md @@ -15,7 +15,7 @@ Generate the certificate the apiserver uses to access etcd ### Synopsis -Generate the certificate the apiserver uses to access etcd, and save them into apiserver-etcd-client.cert and apiserver-etcd-client.key files. +Generate the certificate the apiserver uses to access etcd, and save them into apiserver-etcd-client.crt and apiserver-etcd-client.key files. If both files already exist, kubeadm skips the generation step and existing files will be used. diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver-kubelet-client.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver-kubelet-client.md index 814a9c15ff..f98f75def0 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver-kubelet-client.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver-kubelet-client.md @@ -15,7 +15,7 @@ Generate the certificate for the API server to connect to kubelet ### Synopsis -Generate the certificate for the API server to connect to kubelet, and save them into apiserver-kubelet-client.cert and apiserver-kubelet-client.key files. +Generate the certificate for the API server to connect to kubelet, and save them into apiserver-kubelet-client.crt and apiserver-kubelet-client.key files. If both files already exist, kubeadm skips the generation step and existing files will be used. diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver.md index fa2d46ab8e..afa192d3de 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver.md @@ -15,9 +15,7 @@ Generate the certificate for serving the Kubernetes API ### Synopsis -Generate the certificate for serving the Kubernetes API, and save them into apiserver.cert and apiserver.key files. - -Default SANs are kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local, 10.96.0.1, 127.0.0.1 +Generate the certificate for serving the Kubernetes API, and save them into apiserver.crt and apiserver.key files. If both files already exist, kubeadm skips the generation step and existing files will be used. diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_ca.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_ca.md index d12b74f19f..b94061e8d4 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_ca.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_ca.md @@ -15,7 +15,7 @@ Generate the self-signed Kubernetes CA to provision identities for other Kuberne ### Synopsis -Generate the self-signed Kubernetes CA to provision identities for other Kubernetes components, and save them into ca.cert and ca.key files. +Generate the self-signed Kubernetes CA to provision identities for other Kubernetes components, and save them into ca.crt and ca.key files. If both files already exist, kubeadm skips the generation step and existing files will be used. diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-ca.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-ca.md index 2cddb77ade..547601e364 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-ca.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-ca.md @@ -15,7 +15,7 @@ Generate the self-signed CA to provision identities for etcd ### Synopsis -Generate the self-signed CA to provision identities for etcd, and save them into etcd/ca.cert and etcd/ca.key files. +Generate the self-signed CA to provision identities for etcd, and save them into etcd/ca.crt and etcd/ca.key files. If both files already exist, kubeadm skips the generation step and existing files will be used. diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-healthcheck-client.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-healthcheck-client.md index 9876d5bce7..ea3755c786 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-healthcheck-client.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-healthcheck-client.md @@ -15,7 +15,7 @@ Generate the certificate for liveness probes to healthcheck etcd ### Synopsis -Generate the certificate for liveness probes to healthcheck etcd, and save them into etcd/healthcheck-client.cert and etcd/healthcheck-client.key files. +Generate the certificate for liveness probes to healthcheck etcd, and save them into etcd/healthcheck-client.crt and etcd/healthcheck-client.key files. If both files already exist, kubeadm skips the generation step and existing files will be used. diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-peer.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-peer.md index d86991f8f8..904b00a68f 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-peer.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-peer.md @@ -15,7 +15,7 @@ Generate the certificate for etcd nodes to communicate with each other ### Synopsis -Generate the certificate for etcd nodes to communicate with each other, and save them into etcd/peer.cert and etcd/peer.key files. +Generate the certificate for etcd nodes to communicate with each other, and save them into etcd/peer.crt and etcd/peer.key files. Default SANs are localhost, 127.0.0.1, 127.0.0.1, ::1 diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-server.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-server.md index 213cf22d2f..4b8894075c 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-server.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-server.md @@ -15,7 +15,7 @@ Generate the certificate for serving etcd ### Synopsis -Generate the certificate for serving etcd, and save them into etcd/server.cert and etcd/server.key files. +Generate the certificate for serving etcd, and save them into etcd/server.crt and etcd/server.key files. Default SANs are localhost, 127.0.0.1, 127.0.0.1, ::1 diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_front-proxy-ca.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_front-proxy-ca.md index c2d37be74f..8193d38fce 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_front-proxy-ca.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_front-proxy-ca.md @@ -15,7 +15,7 @@ Generate the self-signed CA to provision identities for front proxy ### Synopsis -Generate the self-signed CA to provision identities for front proxy, and save them into front-proxy-ca.cert and front-proxy-ca.key files. +Generate the self-signed CA to provision identities for front proxy, and save them into front-proxy-ca.crt and front-proxy-ca.key files. If both files already exist, kubeadm skips the generation step and existing files will be used. diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_front-proxy-client.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_front-proxy-client.md index 58a81fa7a2..d5cff5b662 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_front-proxy-client.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_front-proxy-client.md @@ -15,7 +15,7 @@ Generate the certificate for the front proxy client ### Synopsis -Generate the certificate for the front proxy client, and save them into front-proxy-client.cert and front-proxy-client.key files. +Generate the certificate for the front proxy client, and save them into front-proxy-client.crt and front-proxy-client.key files. If both files already exist, kubeadm skips the generation step and existing files will be used. diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_all.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_all.md index 45fa4a29c4..6a53512cc4 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_all.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_all.md @@ -91,17 +91,17 @@ kubeadm init phase control-plane all [flags] ---experimental-patches string +--dry-run -

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    +

    Don't apply any changes; just output what would be done.

    --feature-gates string -

    A set of key=value pairs that describe feature gates for various features. Options are:
    IPv6DualStack=true|false (BETA - default=true)
    PublicKeysECDSA=true|false (ALPHA - default=false)

    +

    A set of key=value pairs that describe feature gates for various features. Options are:
    IPv6DualStack=true|false (BETA - default=true)
    PublicKeysECDSA=true|false (ALPHA - default=false)
    RootlessControlPlane=true|false (ALPHA - default=false)

    @@ -125,6 +125,13 @@ kubeadm init phase control-plane all [flags]

    Choose a specific Kubernetes version for the control plane.

    + +--patches string + + +

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    + + --pod-network-cidr string diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_apiserver.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_apiserver.md index d073ed89f0..b46d5ea7c8 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_apiserver.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_apiserver.md @@ -73,17 +73,17 @@ kubeadm init phase control-plane apiserver [flags] ---experimental-patches string +--dry-run -

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    +

    Don't apply any changes; just output what would be done.

    --feature-gates string -

    A set of key=value pairs that describe feature gates for various features. Options are:
    IPv6DualStack=true|false (BETA - default=true)
    PublicKeysECDSA=true|false (ALPHA - default=false)

    +

    A set of key=value pairs that describe feature gates for various features. Options are:
    IPv6DualStack=true|false (BETA - default=true)
    PublicKeysECDSA=true|false (ALPHA - default=false)
    RootlessControlPlane=true|false (ALPHA - default=false)

    @@ -107,6 +107,13 @@ kubeadm init phase control-plane apiserver [flags]

    Choose a specific Kubernetes version for the control plane.

    + +--patches string + + +

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    + + --service-cidr string     Default: "10.96.0.0/12" diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_controller-manager.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_controller-manager.md index 4a7f1e0fe0..48d36cb899 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_controller-manager.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_controller-manager.md @@ -52,10 +52,10 @@ kubeadm init phase control-plane controller-manager [flags] ---experimental-patches string +--dry-run -

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    +

    Don't apply any changes; just output what would be done.

    @@ -79,6 +79,13 @@ kubeadm init phase control-plane controller-manager [flags]

    Choose a specific Kubernetes version for the control plane.

    + +--patches string + + +

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    + + --pod-network-cidr string diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_scheduler.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_scheduler.md index c8ccb8c37a..f726834229 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_scheduler.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_scheduler.md @@ -45,10 +45,10 @@ kubeadm init phase control-plane scheduler [flags] ---experimental-patches string +--dry-run -

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    +

    Don't apply any changes; just output what would be done.

    @@ -72,6 +72,13 @@ kubeadm init phase control-plane scheduler [flags]

    Choose a specific Kubernetes version for the control plane.

    + +--patches string + + +

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    + + --scheduler-extra-args <comma-separated 'key=value' pairs> diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_etcd_local.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_etcd_local.md index 1e4e8fa22f..f5bc0a529b 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_etcd_local.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_etcd_local.md @@ -56,13 +56,6 @@ kubeadm init phase etcd local [flags]

    Path to a kubeadm configuration file.

    - ---experimental-patches string - - -

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    - - -h, --help @@ -77,6 +70,13 @@ kubeadm init phase etcd local [flags]

    Choose a container registry to pull control plane images from

    + +--patches string + + +

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    + + diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join.md index 3f39346c96..145f0bc340 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join.md @@ -69,7 +69,7 @@ control-plane-prepare Prepare the machine for serving a control plane kubelet-start Write kubelet settings, certificates and (re)start the kubelet control-plane-join Join a machine as a control plane instance /etcd Add a new local etcd member - /update-status Register the new control-plane node into the ClusterStatus maintained in the kubeadm-config ConfigMap + /update-status Register the new control-plane node into the ClusterStatus maintained in the kubeadm-config ConfigMap (DEPRECATED) /mark-control-plane Mark a node as a control-plane ``` @@ -157,13 +157,6 @@ kubeadm join [api-server-endpoint] [flags]

    For token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.

    - ---experimental-patches string - - -

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    - - -h, --help @@ -185,6 +178,13 @@ kubeadm join [api-server-endpoint] [flags]

    Specify the node name.

    + +--patches string + + +

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    + + --skip-phases strings diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_all.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_all.md index ed1753457a..7a3517652d 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_all.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_all.md @@ -65,6 +65,13 @@ kubeadm join phase control-plane-join all [flags]

    Specify the node name.

    + +--patches string + + +

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    + + diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_etcd.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_etcd.md index 9990ce3dc1..c06ddaae40 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_etcd.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_etcd.md @@ -51,13 +51,6 @@ kubeadm join phase control-plane-join etcd [flags]

    Create a new control plane instance on this node

    - ---experimental-patches string - - -

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    - - -h, --help @@ -72,6 +65,13 @@ kubeadm join phase control-plane-join etcd [flags]

    Specify the node name.

    + +--patches string + + +

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    + + diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_update-status.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_update-status.md index 10127f967f..af1aac985c 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_update-status.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_update-status.md @@ -10,12 +10,12 @@ guide. You can file document formatting bugs against the --> -Register the new control-plane node into the ClusterStatus maintained in the kubeadm-config ConfigMap +Register the new control-plane node into the ClusterStatus maintained in the kubeadm-config ConfigMap (DEPRECATED) ### Synopsis -Register the new control-plane node into the ClusterStatus maintained in the kubeadm-config ConfigMap +Register the new control-plane node into the ClusterStatus maintained in the kubeadm-config ConfigMap (DEPRECATED) ``` kubeadm join phase control-plane-join update-status [flags] diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_all.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_all.md index 02864ace82..661edf597d 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_all.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_all.md @@ -93,13 +93,6 @@ kubeadm join phase control-plane-prepare all [api-server-endpoint] [flags]

    For token-based discovery, allow joining without --discovery-token-ca-cert-hash pinning.

    - ---experimental-patches string - - -

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    - - -h, --help @@ -114,6 +107,13 @@ kubeadm join phase control-plane-prepare all [api-server-endpoint] [flags]

    Specify the node name.

    + +--patches string + + +

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    + + --tls-bootstrap-token string diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_control-plane.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_control-plane.md index 820f499c41..c9084c6e55 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_control-plane.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_control-plane.md @@ -58,13 +58,6 @@ kubeadm join phase control-plane-prepare control-plane [flags]

    Create a new control plane instance on this node

    - ---experimental-patches string - - -

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    - - -h, --help @@ -72,6 +65,13 @@ kubeadm join phase control-plane-prepare control-plane [flags]

    help for control-plane

    + +--patches string + + +

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    + + diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig.md index b678061bb0..55177462d6 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig.md @@ -17,8 +17,6 @@ Kubeconfig file utilities Kubeconfig file utilities. -Alpha Disclaimer: this command is currently alpha. - ### Options diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig_user.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig_user.md index 8293ee2f27..89315e27b8 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig_user.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig_user.md @@ -17,8 +17,6 @@ Output a kubeconfig file for an additional user Output a kubeconfig file for an additional user. -Alpha Disclaimer: this command is currently alpha. - ``` kubeadm kubeconfig user [flags] ``` @@ -27,7 +25,7 @@ kubeadm kubeconfig user [flags] ``` # Output a kubeconfig file for an additional user named foo using a kubeadm config file bar - kubeadm alpha kubeconfig user --client-name=foo --config=bar + kubeadm kubeconfig user --client-name=foo --config=bar ``` ### Options @@ -74,6 +72,13 @@ kubeadm kubeconfig user [flags] + + + + + + +

    The token that should be used as the authentication mechanism for this kubeconfig, instead of client certificates
    --validity-period duration     Default: 8760h0m0s

    The validity period of the client certificate. It is an offset from the current time.
    diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset.md index a745cb8c9e..19bdbb417a 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset.md @@ -20,7 +20,7 @@ Performs a best effort revert of changes made to this host by 'kubeadm init' or The "reset" command executes the following phases: ``` preflight Run reset pre-flight checks -update-cluster-status Remove this node from the ClusterStatus object. +update-cluster-status Remove this node from the ClusterStatus object (DEPRECATED). remove-etcd-member Remove a local etcd member. cleanup-node Run cleanup node. ``` diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset_phase_update-cluster-status.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset_phase_update-cluster-status.md index b73f736958..9d4b7af77f 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset_phase_update-cluster-status.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset_phase_update-cluster-status.md @@ -10,12 +10,12 @@ guide. You can file document formatting bugs against the --> -Remove this node from the ClusterStatus object. +Remove this node from the ClusterStatus object (DEPRECATED). ### Synopsis -Remove this node from the ClusterStatus object if the node is a control plane node. +Remove this node from the ClusterStatus object (DEPRECATED). ``` kubeadm reset phase update-cluster-status [flags] diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_apply.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_apply.md index d34e01da47..3add5a98c2 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_apply.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_apply.md @@ -72,18 +72,11 @@ kubeadm upgrade apply [version]

    Perform the upgrade of etcd.

    - ---experimental-patches string - - -

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    - - --feature-gates string -

    A set of key=value pairs that describe feature gates for various features. Options are:
    IPv6DualStack=true|false (BETA - default=true)
    PublicKeysECDSA=true|false (ALPHA - default=false)

    +

    A set of key=value pairs that describe feature gates for various features. Options are:
    IPv6DualStack=true|false (BETA - default=true)
    PublicKeysECDSA=true|false (ALPHA - default=false)
    RootlessControlPlane=true|false (ALPHA - default=false)

    @@ -114,6 +107,13 @@ kubeadm upgrade apply [version]

    The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

    + +--patches string + + +

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    + + --print-config diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node.md index 5bd05a9822..a8a3138c88 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node.md @@ -59,13 +59,6 @@ kubeadm upgrade node [flags]

    Perform the upgrade of etcd.

    - ---experimental-patches string - - -

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    - - -h, --help @@ -87,6 +80,13 @@ kubeadm upgrade node [flags]

    The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

    + +--patches string + + +

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    + + --skip-phases strings diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node_phase_control-plane.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node_phase_control-plane.md index 835eba6842..58a6a672e3 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node_phase_control-plane.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node_phase_control-plane.md @@ -51,13 +51,6 @@ kubeadm upgrade node phase control-plane [flags]

    Perform the upgrade of etcd.

    - ---experimental-patches string - - -

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    - - -h, --help @@ -72,6 +65,13 @@ kubeadm upgrade node phase control-plane [flags]

    The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

    + +--patches string + + +

    Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

    + + diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_plan.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_plan.md index 7d16866b9a..c3cc133169 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_plan.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_plan.md @@ -55,7 +55,7 @@ kubeadm upgrade plan [version] [flags] --feature-gates string -

    A set of key=value pairs that describe feature gates for various features. Options are:
    IPv6DualStack=true|false (BETA - default=true)
    PublicKeysECDSA=true|false (ALPHA - default=false)

    +

    A set of key=value pairs that describe feature gates for various features. Options are:
    IPv6DualStack=true|false (BETA - default=true)
    PublicKeysECDSA=true|false (ALPHA - default=false)
    RootlessControlPlane=true|false (ALPHA - default=false)

    From 8f301ea379f7a13e5cbb58a9f16353474f7ecaf4 Mon Sep 17 00:00:00 2001 From: Yuiko Mouri Date: Thu, 5 Aug 2021 11:54:46 +0900 Subject: [PATCH 074/279] Replace with relative path --- content/en/docs/concepts/security/pod-security-admission.md | 2 +- content/en/docs/reference/using-api/api-concepts.md | 2 +- .../tasks/configure-pod-container/create-hostprocess-pod.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/content/en/docs/concepts/security/pod-security-admission.md b/content/en/docs/concepts/security/pod-security-admission.md index 95cce7862e..0a640918e1 100644 --- a/content/en/docs/concepts/security/pod-security-admission.md +++ b/content/en/docs/concepts/security/pod-security-admission.md @@ -91,7 +91,7 @@ Check out [Enforce Pod Security Standards with Namespace Labels](/docs/tasks/con ## Workload resources and Pod templates Pods are often created indirectly, by creating a [workload -object](https://kubernetes.io/docs/concepts/workloads/controllers/) such as a {{< glossary_tooltip +object](/docs/concepts/workloads/controllers/) such as a {{< glossary_tooltip term_id="deployment" >}} or {{< glossary_tooltip term_id="job">}}. The workload object defines a _Pod template_ and a {{< glossary_tooltip term_id="controller" text="controller" >}} for the workload resource creates Pods based on that template. To help catch violations early, both the diff --git a/content/en/docs/reference/using-api/api-concepts.md b/content/en/docs/reference/using-api/api-concepts.md index 7ff6028eb3..913d3db42e 100644 --- a/content/en/docs/reference/using-api/api-concepts.md +++ b/content/en/docs/reference/using-api/api-concepts.md @@ -211,7 +211,7 @@ the size of a collection. ## Lists There are dozens of list types (such as `PodList`, `ServiceList`, and `NodeList`) defined in the Kubernetes API. -You can get more information about each list type from the [Kubernetes API](https://kubernetes.io/docs/reference/kubernetes-api/) documentation. +You can get more information about each list type from the [Kubernetes API](/docs/reference/kubernetes-api/) documentation. When you query the API for a particular type, all items returned by that query are of that type. For example, when you ask for a list of services, the list type is shown as `kind: ServiceList` and each item in that list represents a single Service. For example: diff --git a/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md b/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md index 5b9ab97a2c..2ab2bd3661 100644 --- a/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md +++ b/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md @@ -47,7 +47,7 @@ privileges needed by Windows nodes. To enable HostProcess containers while in Alpha you need to pass the following feature gate flag to **kubelet** and **kube-apiserver**. -See [Features Gates](https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/#overview) +See [Features Gates](/docs/reference/command-line-tools-reference/feature-gates/#overview) documentation for more details. ``` From f51ed0569dd6b9d971088b819edd3eaf179500b2 Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Thu, 5 Aug 2021 12:50:28 +0800 Subject: [PATCH 075/279] Config API for 1.22 --- .../config-api/apiserver-audit.v1.md | 16 +- .../client-authentication.v1beta1.md | 10 +- .../config-api/kube-proxy-config.v1alpha1.md | 179 +++++ .../kube-scheduler-config.v1beta2.md | 710 +++++++++-------- .../kube-scheduler-policy-config.v1.md | 4 +- .../config-api/kubeadm-config.v1beta3.md | 6 + .../config-api/kubelet-config.v1beta1.md | 724 ++++++++++++------ 7 files changed, 1080 insertions(+), 569 deletions(-) diff --git a/content/en/docs/reference/config-api/apiserver-audit.v1.md b/content/en/docs/reference/config-api/apiserver-audit.v1.md index f0f36c2344..11df06bd8c 100644 --- a/content/en/docs/reference/config-api/apiserver-audit.v1.md +++ b/content/en/docs/reference/config-api/apiserver-audit.v1.md @@ -81,7 +81,7 @@ For non-resource requests, this is the lower-cased HTTP method. user [Required]
    -authentication/v1.UserInfo +authentication/v1.UserInfo Authenticated user information. @@ -89,7 +89,7 @@ For non-resource requests, this is the lower-cased HTTP method. impersonatedUser
    -authentication/v1.UserInfo +authentication/v1.UserInfo Impersonated user information. @@ -123,7 +123,7 @@ Does not apply for List-type requests, or non-resource requests. responseStatus
    -meta/v1.Status +meta/v1.Status The response status, populated even when the ResponseObject is not a Status type. @@ -154,7 +154,7 @@ at Response Level. requestReceivedTimestamp
    -meta/v1.MicroTime +meta/v1.MicroTime Time the request reached the apiserver. @@ -162,7 +162,7 @@ at Response Level. stageTimestamp
    -meta/v1.MicroTime +meta/v1.MicroTime Time the request reached current audit stage. @@ -206,7 +206,7 @@ EventList is a list of audit Events. metadata
    -meta/v1.ListMeta +meta/v1.ListMeta No description provided. @@ -252,7 +252,7 @@ categories are logged. metadata
    -meta/v1.ObjectMeta +meta/v1.ObjectMeta ObjectMeta is included for interoperability with API infrastructure.Refer to the Kubernetes API documentation for the fields of the metadata field. @@ -303,7 +303,7 @@ PolicyList is a list of audit Policies. metadata
    -meta/v1.ListMeta +meta/v1.ListMeta No description provided. diff --git a/content/en/docs/reference/config-api/client-authentication.v1beta1.md b/content/en/docs/reference/config-api/client-authentication.v1beta1.md index e78edd23f6..d018fb208f 100644 --- a/content/en/docs/reference/config-api/client-authentication.v1beta1.md +++ b/content/en/docs/reference/config-api/client-authentication.v1beta1.md @@ -187,6 +187,14 @@ ExecConfig.ProvideClusterInfo). +interactive [Required]
    +bool + + + Interactive declares whether stdin has been passed to this exec plugin. + + + @@ -215,7 +223,7 @@ itself should at least be protected via file permissions. expirationTimestamp
    -meta/v1.Time +meta/v1.Time ExpirationTimestamp indicates a time when the provided credentials expire. diff --git a/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md b/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md index 86315856b2..94209488fe 100644 --- a/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md +++ b/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md @@ -546,6 +546,10 @@ this always falls back to the userspace proxy. - [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration) +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + +- [GenericControllerManagerConfiguration](#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration) + ClientConnectionConfiguration contains details for constructing a client. @@ -597,5 +601,180 @@ client. + + + +## `DebuggingConfiguration` {#DebuggingConfiguration} + + + + +**Appears in:** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + +- [GenericControllerManagerConfiguration](#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration) + + +DebuggingConfiguration holds configuration for Debugging related features. + + + + + + + + + + + + + + + + + + +
    FieldDescription
    enableProfiling [Required]
    +bool +    		 + enableProfiling enables profiling via web interface host:port/debug/pprof/
    enableContentionProfiling [Required]
    +bool +    		 + enableContentionProfiling enables lock contention profiling, if +enableProfiling is true.
    + +## `LeaderElectionConfiguration` {#LeaderElectionConfiguration} + + + + +**Appears in:** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + +- [GenericControllerManagerConfiguration](#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration) + + +LeaderElectionConfiguration defines the configuration of leader election +clients for components that can run with leader election enabled. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    leaderElect [Required]
    +bool +    		 + leaderElect enables a leader election client to gain leadership +before executing the main loop. Enable this when running replicated +components for high availability.
    leaseDuration [Required]
    +meta/v1.Duration +    		 + leaseDuration is the duration that non-leader candidates will wait +after observing a leadership renewal until attempting to acquire +leadership of a led but unrenewed leader slot. This is effectively the +maximum duration that a leader can be stopped before it is replaced +by another candidate. This is only applicable if leader election is +enabled.
    renewDeadline [Required]
    +meta/v1.Duration +    		 + renewDeadline is the interval between attempts by the acting master to +renew a leadership slot before it stops leading. This must be less +than or equal to the lease duration. This is only applicable if leader +election is enabled.
    retryPeriod [Required]
    +meta/v1.Duration +    		 + retryPeriod is the duration the clients should wait between attempting +acquisition and renewal of a leadership. This is only applicable if +leader election is enabled.
    resourceLock [Required]
    +string +    		 + resourceLock indicates the resource object type that will be used to lock +during leader election cycles.
    resourceName [Required]
    +string +    		 + resourceName indicates the name of resource object that will be used to lock +during leader election cycles.
    resourceNamespace [Required]
    +string +    		 + resourceName indicates the namespace of resource object that will be used to lock +during leader election cycles.
    + +## `LoggingConfiguration` {#LoggingConfiguration} + + + + +**Appears in:** + +- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) + + +LoggingConfiguration contains logging options +Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. + + + + + + + + + + + + + + + + +
    FieldDescription
    format [Required]
    +string +    		 + Format Flag specifies the structure of log messages. +default value of format is `text`
    sanitization [Required]
    +bool +    		 + [Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). +Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)
    diff --git a/content/en/docs/reference/config-api/kube-scheduler-config.v1beta2.md b/content/en/docs/reference/config-api/kube-scheduler-config.v1beta2.md index 8121773162..1a28c03c88 100644 --- a/content/en/docs/reference/config-api/kube-scheduler-config.v1beta2.md +++ b/content/en/docs/reference/config-api/kube-scheduler-config.v1beta2.md @@ -13,16 +13,250 @@ auto_generated: true - [InterPodAffinityArgs](#kubescheduler-config-k8s-io-v1beta2-InterPodAffinityArgs) - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - [NodeAffinityArgs](#kubescheduler-config-k8s-io-v1beta2-NodeAffinityArgs) +- [NodeResourcesBalancedAllocationArgs](#kubescheduler-config-k8s-io-v1beta2-NodeResourcesBalancedAllocationArgs) - [NodeResourcesFitArgs](#kubescheduler-config-k8s-io-v1beta2-NodeResourcesFitArgs) -- [NodeResourcesLeastAllocatedArgs](#kubescheduler-config-k8s-io-v1beta2-NodeResourcesLeastAllocatedArgs) -- [NodeResourcesMostAllocatedArgs](#kubescheduler-config-k8s-io-v1beta2-NodeResourcesMostAllocatedArgs) - [PodTopologySpreadArgs](#kubescheduler-config-k8s-io-v1beta2-PodTopologySpreadArgs) -- [RequestedToCapacityRatioArgs](#kubescheduler-config-k8s-io-v1beta2-RequestedToCapacityRatioArgs) - [VolumeBindingArgs](#kubescheduler-config-k8s-io-v1beta2-VolumeBindingArgs) - [Policy](#kubescheduler-config-k8s-io-v1-Policy) +## `ClientConnectionConfiguration` {#ClientConnectionConfiguration} + + + + +**Appears in:** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + + +ClientConnectionConfiguration contains details for constructing a client. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    kubeconfig [Required]
    +string +    		 + kubeconfig is the path to a KubeConfig file.
    acceptContentTypes [Required]
    +string +    		 + acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the +default value of 'application/json'. This field will control all connections to the server used by a particular +client.
    contentType [Required]
    +string +    		 + contentType is the content type used when sending data to the server from this client.
    qps [Required]
    +float32 +    		 + qps controls the number of queries per second allowed for this connection.
    burst [Required]
    +int32 +    		 + burst allows extra queries to accumulate when a client is exceeding its rate.
    + +## `DebuggingConfiguration` {#DebuggingConfiguration} + + + + +**Appears in:** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + + +DebuggingConfiguration holds configuration for Debugging related features. + + + + + + + + + + + + + + + + + + +
    FieldDescription
    enableProfiling [Required]
    +bool +    		 + enableProfiling enables profiling via web interface host:port/debug/pprof/
    enableContentionProfiling [Required]
    +bool +    		 + enableContentionProfiling enables lock contention profiling, if +enableProfiling is true.
    + +## `LeaderElectionConfiguration` {#LeaderElectionConfiguration} + + + + +**Appears in:** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + + +LeaderElectionConfiguration defines the configuration of leader election +clients for components that can run with leader election enabled. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    leaderElect [Required]
    +bool +    		 + leaderElect enables a leader election client to gain leadership +before executing the main loop. Enable this when running replicated +components for high availability.
    leaseDuration [Required]
    +meta/v1.Duration +    		 + leaseDuration is the duration that non-leader candidates will wait +after observing a leadership renewal until attempting to acquire +leadership of a led but unrenewed leader slot. This is effectively the +maximum duration that a leader can be stopped before it is replaced +by another candidate. This is only applicable if leader election is +enabled.
    renewDeadline [Required]
    +meta/v1.Duration +    		 + renewDeadline is the interval between attempts by the acting master to +renew a leadership slot before it stops leading. This must be less +than or equal to the lease duration. This is only applicable if leader +election is enabled.
    retryPeriod [Required]
    +meta/v1.Duration +    		 + retryPeriod is the duration the clients should wait between attempting +acquisition and renewal of a leadership. This is only applicable if +leader election is enabled.
    resourceLock [Required]
    +string +    		 + resourceLock indicates the resource object type that will be used to lock +during leader election cycles.
    resourceName [Required]
    +string +    		 + resourceName indicates the name of resource object that will be used to lock +during leader election cycles.
    resourceNamespace [Required]
    +string +    		 + resourceName indicates the namespace of resource object that will be used to lock +during leader election cycles.
    + +## `LoggingConfiguration` {#LoggingConfiguration} + + + + +**Appears in:** + +- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) + + +LoggingConfiguration contains logging options +Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. + + + + + + + + + + + + + + + + + + +
    FieldDescription
    format [Required]
    +string +    		 + Format Flag specifies the structure of log messages. +default value of format is `text`
    sanitization [Required]
    +bool +    		 + [Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). +Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)
    + + + ## `DefaultPreemptionArgs` {#kubescheduler-config-k8s-io-v1beta2-DefaultPreemptionArgs} @@ -254,7 +488,7 @@ NodeAffinityArgs holds arguments to configure the NodeAffinity plugin. addedAffinity
    -core/v1.NodeAffinity +core/v1.NodeAffinity AddedAffinity is applied to all Pods additionally to the NodeAffinity @@ -271,6 +505,37 @@ a specific Node (such as Daemonset Pods) might remain unschedulable. +## `NodeResourcesBalancedAllocationArgs` {#kubescheduler-config-k8s-io-v1beta2-NodeResourcesBalancedAllocationArgs} + + + + + +NodeResourcesBalancedAllocationArgs holds arguments used to configure NodeResourcesBalancedAllocation plugin. + + + + + + + + + + + + + + + + + +
    FieldDescription
    apiVersion
    string    		kubescheduler.config.k8s.io/v1beta2
    kind
    string    		NodeResourcesBalancedAllocationArgs
    resources [Required]
    +[]ResourceSpec +    		 + Resources to be managed, the default is "cpu" and "memory" if not specified.
    + + + ## `NodeResourcesFitArgs` {#kubescheduler-config-k8s-io-v1beta2-NodeResourcesFitArgs} @@ -294,7 +559,7 @@ NodeResourcesFitArgs holds arguments used to configure the NodeResourcesFit plug IgnoredResources is the list of resources that NodeResources fit filter -should ignore. +should ignore. This doesn't apply to scoring. @@ -305,73 +570,16 @@ should ignore. IgnoredResourceGroups defines the list of resource groups that NodeResources fit filter should ignore. e.g. if group is ["example.com"], it will ignore all resource names that begin with "example.com", such as "example.com/aaa" and "example.com/bbb". -A resource group name can't contain '/'. +A resource group name can't contain '/'. This doesn't apply to scoring. - - - - - -## `NodeResourcesLeastAllocatedArgs` {#kubescheduler-config-k8s-io-v1beta2-NodeResourcesLeastAllocatedArgs} - - - - - -NodeResourcesLeastAllocatedArgs holds arguments used to configure NodeResourcesLeastAllocated plugin. - - - - - - - - - - - - - - - - -
    FieldDescription
    apiVersion
    string    		kubescheduler.config.k8s.io/v1beta2
    kind
    string    		NodeResourcesLeastAllocatedArgs
    resources [Required]
    -[]ResourceSpec +
    scoringStrategy [Required]
    +ScoringStrategy     		- Resources to be managed, if no resource is provided, default resource set with both -the weight of "cpu" and "memory" set to "1" will be applied. -Resource with "0" weight will not accountable for the final score.
    - - - -## `NodeResourcesMostAllocatedArgs` {#kubescheduler-config-k8s-io-v1beta2-NodeResourcesMostAllocatedArgs} - - - - - -NodeResourcesMostAllocatedArgs holds arguments used to configure NodeResourcesMostAllocated plugin. - - - - - - - - - - - - - + ScoringStrategy selects the node resource scoring strategy. +The default strategy is LeastAllocated with an equal "cpu" and "memory" weight. @@ -399,7 +607,7 @@ PodTopologySpreadArgs holds arguments used to configure the PodTopologySpread pl -## `RequestedToCapacityRatioArgs` {#kubescheduler-config-k8s-io-v1beta2-RequestedToCapacityRatioArgs} - - - - - -RequestedToCapacityRatioArgs holds arguments used to configure RequestedToCapacityRatio plugin. - -
    FieldDescription
    apiVersion
    string    		kubescheduler.config.k8s.io/v1beta2
    kind
    string    		NodeResourcesMostAllocatedArgs
    resources [Required]
    -[]ResourceSpec -    		 - Resources to be managed, if no resource is provided, default resource set with both -the weight of "cpu" and "memory" set to "1" will be applied. -Resource with "0" weight will not accountable for the final score.
    defaultConstraints
    -[]core/v1.TopologySpreadConstraint +[]core/v1.TopologySpreadConstraint     		DefaultConstraints defines topology spread constraints to be applied to @@ -432,45 +640,6 @@ and to "System" if enabled.
    - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    apiVersion
    string    		kubescheduler.config.k8s.io/v1beta2
    kind
    string    		RequestedToCapacityRatioArgs
    shape [Required]
    -[]UtilizationShapePoint -    		 - Points defining priority function shape
    resources [Required]
    -[]ResourceSpec -    		 - Resources to be managed
    - - - ## `VolumeBindingArgs` {#kubescheduler-config-k8s-io-v1beta2-VolumeBindingArgs} @@ -499,6 +668,24 @@ If this value is nil, the default value (600) will be used. +shape
    +[]UtilizationShapePoint + + + Shape specifies the points defining the score function shape, which is +used to score nodes based on the utilization of statically provisioned +PVs. The utilization is calculated by dividing the total requested +storage of the pod by the total capacity of feasible PVs on each node. +Each point contains utilization (ranges from 0 to 100) and its +associated score (ranges from 0 to 10). You can turn the priority by +specifying different scores for different utilization numbers. +The default shape points are: +1) 0 for 0 utilization +2) 10 for 100 utilization +All points must be sorted in increasing order by utilization. + + + @@ -800,6 +987,8 @@ If an array is empty, missing, or nil, default plugins at that extension point w Enabled specifies plugins that should be enabled in addition to default plugins. +If the default plugin is also configured in the scheduler config file, the weight of plugin will +be overridden accordingly. These are called after default plugins and in the same order specified here. @@ -952,6 +1141,37 @@ for the PodTopologySpread plugin. +## `RequestedToCapacityRatioParam` {#kubescheduler-config-k8s-io-v1beta2-RequestedToCapacityRatioParam} + + + + +**Appears in:** + +- [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta2-ScoringStrategy) + + +RequestedToCapacityRatioParam define RequestedToCapacityRatio parameters + + + + + + + + + + + + + +
    FieldDescription
    shape [Required]
    +[]UtilizationShapePoint +    		 + Shape is a list of points defining the scoring function shape.
    + + + ## `ResourceSpec` {#kubescheduler-config-k8s-io-v1beta2-ResourceSpec} @@ -959,14 +1179,12 @@ for the PodTopologySpread plugin. **Appears in:** -- [NodeResourcesLeastAllocatedArgs](#kubescheduler-config-k8s-io-v1beta2-NodeResourcesLeastAllocatedArgs) +- [NodeResourcesBalancedAllocationArgs](#kubescheduler-config-k8s-io-v1beta2-NodeResourcesBalancedAllocationArgs) -- [NodeResourcesMostAllocatedArgs](#kubescheduler-config-k8s-io-v1beta2-NodeResourcesMostAllocatedArgs) - -- [RequestedToCapacityRatioArgs](#kubescheduler-config-k8s-io-v1beta2-RequestedToCapacityRatioArgs) +- [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta2-ScoringStrategy) -ResourceSpec represents single resource and weight for bin packing of priority RequestedToCapacityRatioArguments. +ResourceSpec represents a single resource. @@ -978,7 +1196,7 @@ ResourceSpec represents single resource and weight for bin packing of priority R string + Name of the resource. @@ -995,6 +1213,72 @@ ResourceSpec represents single resource and weight for bin packing of priority R +## `ScoringStrategy` {#kubescheduler-config-k8s-io-v1beta2-ScoringStrategy} + + + + +**Appears in:** + +- [NodeResourcesFitArgs](#kubescheduler-config-k8s-io-v1beta2-NodeResourcesFitArgs) + + +ScoringStrategy define ScoringStrategyType for node resource plugin + +
    FieldDescription
    - Name of the resource to be managed by RequestedToCapacityRatio function.
    + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    type [Required]
    +ScoringStrategyType +    		 + Type selects which strategy to run.
    resources [Required]
    +[]ResourceSpec +    		 + Resources to consider when scoring. +The default resource set includes "cpu" and "memory" with an equal weight. +Allowed weights go from 1 to 100. +Weight defaults to 1 if not specified or explicitly set to 0.
    requestedToCapacityRatio [Required]
    +RequestedToCapacityRatioParam +    		 + Arguments specific to RequestedToCapacityRatio strategy.
    + + + +## `ScoringStrategyType` {#kubescheduler-config-k8s-io-v1beta2-ScoringStrategyType} + +(Alias of `string`) + + +**Appears in:** + +- [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta2-ScoringStrategy) + + +ScoringStrategyType the type of scoring strategy used in NodeResourcesFit plugin. + + + + + ## `UtilizationShapePoint` {#kubescheduler-config-k8s-io-v1beta2-UtilizationShapePoint} @@ -1002,7 +1286,9 @@ ResourceSpec represents single resource and weight for bin packing of priority R **Appears in:** -- [RequestedToCapacityRatioArgs](#kubescheduler-config-k8s-io-v1beta2-RequestedToCapacityRatioArgs) +- [VolumeBindingArgs](#kubescheduler-config-k8s-io-v1beta2-VolumeBindingArgs) + +- [RequestedToCapacityRatioParam](#kubescheduler-config-k8s-io-v1beta2-RequestedToCapacityRatioParam) UtilizationShapePoint represents single point of priority function shape. @@ -1820,199 +2106,3 @@ UtilizationShapePoint represents single point of priority function shape. - - - -## `ClientConnectionConfiguration` {#ClientConnectionConfiguration} - - - - -**Appears in:** - -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - - -ClientConnectionConfiguration contains details for constructing a client. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    kubeconfig [Required]
    -string -    		 - kubeconfig is the path to a KubeConfig file.
    acceptContentTypes [Required]
    -string -    		 - acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the -default value of 'application/json'. This field will control all connections to the server used by a particular -client.
    contentType [Required]
    -string -    		 - contentType is the content type used when sending data to the server from this client.
    qps [Required]
    -float32 -    		 - qps controls the number of queries per second allowed for this connection.
    burst [Required]
    -int32 -    		 - burst allows extra queries to accumulate when a client is exceeding its rate.
    - -## `DebuggingConfiguration` {#DebuggingConfiguration} - - - - -**Appears in:** - -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - - -DebuggingConfiguration holds configuration for Debugging related features. - - - - - - - - - - - - - - - - - - -
    FieldDescription
    enableProfiling [Required]
    -bool -    		 - enableProfiling enables profiling via web interface host:port/debug/pprof/
    enableContentionProfiling [Required]
    -bool -    		 - enableContentionProfiling enables lock contention profiling, if -enableProfiling is true.
    - -## `LeaderElectionConfiguration` {#LeaderElectionConfiguration} - - - - -**Appears in:** - -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - - -LeaderElectionConfiguration defines the configuration of leader election -clients for components that can run with leader election enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    leaderElect [Required]
    -bool -    		 - leaderElect enables a leader election client to gain leadership -before executing the main loop. Enable this when running replicated -components for high availability.
    leaseDuration [Required]
    -meta/v1.Duration -    		 - leaseDuration is the duration that non-leader candidates will wait -after observing a leadership renewal until attempting to acquire -leadership of a led but unrenewed leader slot. This is effectively the -maximum duration that a leader can be stopped before it is replaced -by another candidate. This is only applicable if leader election is -enabled.
    renewDeadline [Required]
    -meta/v1.Duration -    		 - renewDeadline is the interval between attempts by the acting master to -renew a leadership slot before it stops leading. This must be less -than or equal to the lease duration. This is only applicable if leader -election is enabled.
    retryPeriod [Required]
    -meta/v1.Duration -    		 - retryPeriod is the duration the clients should wait between attempting -acquisition and renewal of a leadership. This is only applicable if -leader election is enabled.
    resourceLock [Required]
    -string -    		 - resourceLock indicates the resource object type that will be used to lock -during leader election cycles.
    resourceName [Required]
    -string -    		 - resourceName indicates the name of resource object that will be used to lock -during leader election cycles.
    resourceNamespace [Required]
    -string -    		 - resourceName indicates the namespace of resource object that will be used to lock -during leader election cycles.
    diff --git a/content/en/docs/reference/config-api/kube-scheduler-policy-config.v1.md b/content/en/docs/reference/config-api/kube-scheduler-policy-config.v1.md index e694f7ecbc..8b6c0a9a24 100644 --- a/content/en/docs/reference/config-api/kube-scheduler-policy-config.v1.md +++ b/content/en/docs/reference/config-api/kube-scheduler-policy-config.v1.md @@ -89,7 +89,7 @@ of the predicates after it finds one predicate that failed. **Appears in:** -- [Extender](#kubescheduler-config-k8s-io-v1beta1-Extender) +- [Extender](#kubescheduler-config-k8s-io-v1beta2-Extender) - [LegacyExtender](#kubescheduler-config-k8s-io-v1-LegacyExtender) @@ -132,7 +132,7 @@ resource when applying predicates. **Appears in:** -- [Extender](#kubescheduler-config-k8s-io-v1beta1-Extender) +- [Extender](#kubescheduler-config-k8s-io-v1beta2-Extender) - [LegacyExtender](#kubescheduler-config-k8s-io-v1-LegacyExtender) diff --git a/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md b/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md index 0b64912a99..5f73e8b3a8 100644 --- a/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md +++ b/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md @@ -1413,9 +1413,15 @@ first alpha-numerically. + + + ## `BootstrapToken` {#BootstrapToken} + + + **Appears in:** - [InitConfiguration](#kubeadm-k8s-io-v1beta3-InitConfiguration) diff --git a/content/en/docs/reference/config-api/kubelet-config.v1beta1.md b/content/en/docs/reference/config-api/kubelet-config.v1beta1.md index 0df26b64df..261a6dd5f8 100644 --- a/content/en/docs/reference/config-api/kubelet-config.v1beta1.md +++ b/content/en/docs/reference/config-api/kubelet-config.v1beta1.md @@ -14,48 +14,6 @@ auto_generated: true -## `LoggingConfiguration` {#LoggingConfiguration} - - - - -**Appears in:** - -- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) - - -LoggingConfiguration contains logging options -Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. - - - - - - - - - - - - - - - - - - -
    FieldDescription
    format [Required]
    -string -    		 - Format Flag specifies the structure of log messages. -default value of format is `text`
    sanitization [Required]
    -bool -    		 - [Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). -Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)
    - - - ## `KubeletConfiguration` {#kubelet-config-k8s-io-v1beta1-KubeletConfiguration} @@ -81,7 +39,8 @@ KubeletConfiguration contains the configuration for the Kubelet enableServer enables Kubelet's secured server. Note: Kubelet's insecure port is controlled by the readOnlyPort option. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Default: true @@ -93,7 +52,8 @@ Default: true staticPodPath is the path to the directory containing local (static) pods to run, or the path to a single static pod file. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that the set of static pods specified at the new path may be different than the ones the Kubelet initially started with, and this may disrupt your node. Default: "" @@ -106,7 +66,8 @@ Default: "" syncFrequency is the max period between synchronizing running containers and config. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that shortening this duration may have a negative performance impact, especially as the number of Pods on the node increases. Alternatively, increasing this duration will result in longer refresh times for ConfigMaps and Secrets. @@ -119,8 +80,9 @@ Default: "1m" fileCheckFrequency is the duration between checking config files for -new data -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +new data. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that shortening the duration will cause the Kubelet to reload local Static Pod configurations more frequently, which may have a negative performance impact. Default: "20s" @@ -131,8 +93,9 @@ Default: "20s" meta/v1.Duration - httpCheckFrequency is the duration between checking http for new data -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + httpCheckFrequency is the duration between checking http for new data. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that shortening the duration will cause the Kubelet to poll staticPodURL more frequently, which may have a negative performance impact. Default: "20s" @@ -143,8 +106,9 @@ Default: "20s" string - staticPodURL is the URL for accessing static pods to run -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + staticPodURL is the URL for accessing static pods to run. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that the set of static pods specified at the new URL may be different than the ones the Kubelet initially started with, and this may disrupt your node. Default: "" @@ -155,8 +119,9 @@ Default: "" map[string][]string - staticPodURLHeader is a map of slices with HTTP headers to use when accessing the podURL -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + staticPodURLHeader is a map of slices with HTTP headers to use when accessing the podURL. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may disrupt the ability to read the latest set of static pods from StaticPodURL. Default: nil @@ -168,7 +133,8 @@ Default: nil address is the IP address for the Kubelet to serve on (set to 0.0.0.0 for all interfaces). -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Default: "0.0.0.0" @@ -179,7 +145,9 @@ Default: "0.0.0.0" port is the port for the Kubelet to serve on. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +The port number must be between 1 and 65535, inclusive. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Default: 10250 @@ -191,7 +159,10 @@ Default: 10250 readOnlyPort is the read-only port for the Kubelet to serve on with no authentication/authorization. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +The port number must be between 1 and 65535, inclusive. +Setting this field to 0 disables the read-only service. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Default: 0 (disabled) @@ -206,7 +177,8 @@ if any, concatenated after server cert). If tlsCertFile and tlsPrivateKeyFile are not provided, a self-signed certificate and key are generated for the public address and saved to the directory passed to the Kubelet's --cert-dir flag. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Default: "" @@ -216,8 +188,9 @@ Default: "" string - tlsPrivateKeyFile is the file containing x509 private key matching tlsCertFile -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + tlsPrivateKeyFile is the file containing x509 private key matching tlsCertFile. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Default: "" @@ -227,9 +200,10 @@ Default: "" []string - TLSCipherSuites is the list of allowed cipher suites for the server. + tlsCipherSuites is the list of allowed cipher suites for the server. Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Default: nil @@ -239,9 +213,10 @@ Default: nil string - TLSMinVersion is the minimum TLS version supported. + tlsMinVersion is the minimum TLS version supported. Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Default: "" @@ -254,7 +229,8 @@ Default: "" rotateCertificates enables client certificate rotation. The Kubelet will request a new certificate from the certificates.k8s.io API. This requires an approver to approve the certificate signing requests. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that disabling it may disrupt the Kubelet's ability to authenticate with the API server after the current certificate expires. Default: false @@ -267,10 +243,11 @@ Default: false serverTLSBootstrap enables server certificate bootstrap. Instead of self signing a serving certificate, the Kubelet will request a certificate from -the certificates.k8s.io API. This requires an approver to approve the -certificate signing requests. The RotateKubeletServerCertificate feature -must be enabled. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +the 'certificates.k8s.io' API. This requires an approver to approve the +certificate signing requests (CSR). The RotateKubeletServerCertificate feature +must be enabled when setting this field. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that disabling it will stop the renewal of Kubelet server certificates, which can disrupt components that interact with the Kubelet server in the long term, due to certificate expiration. @@ -282,8 +259,9 @@ Default: false KubeletAuthentication - authentication specifies how requests to the Kubelet's server are authenticated -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + authentication specifies how requests to the Kubelet's server are authenticated. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Defaults: anonymous: @@ -298,8 +276,9 @@ Defaults: KubeletAuthorization - authorization specifies how requests to the Kubelet's server are authorized -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + authorization specifies how requests to the Kubelet's server are authorized. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Defaults: mode: Webhook @@ -314,8 +293,10 @@ Defaults: registryPullQPS is the limit of registry pulls per second. -Set to 0 for no limit. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +The value must not be a negative number. +Setting it to 0 means no limit. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may impact scalability by changing the amount of traffic produced by image pulls. Default: 5 @@ -328,8 +309,10 @@ Default: 5 registryBurst is the maximum size of bursty pulls, temporarily allows pulls to burst to this number, while still not exceeding registryPullQPS. -Only used if registryPullQPS > 0. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +The value must not be a negative number. +Only used if registryPullQPS is greater than 0. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may impact scalability by changing the amount of traffic produced by image pulls. Default: 10 @@ -341,8 +324,9 @@ Default: 10 eventRecordQPS is the maximum event creations per second. If 0, there -is no limit enforced. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +is no limit enforced. The value cannot be a negative number. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may impact scalability by changing the amount of traffic produced by event creations. Default: 5 @@ -355,8 +339,10 @@ Default: 5 eventBurst is the maximum size of a burst of event creations, temporarily allows event creations to burst to this number, while still not exceeding -eventRecordQPS. Only used if eventRecordQPS > 0. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +eventRecordQPS. This field canot be a negative number and it is only used +when eventRecordQPS > 0. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may impact scalability by changing the amount of traffic produced by event creations. Default: 10 @@ -370,7 +356,8 @@ Default: 10 enableDebuggingHandlers enables server endpoints for log access and local running of containers and commands, including the exec, attach, logs, and portforward features. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that disabling it may disrupt components that interact with the Kubelet server. Default: true @@ -381,7 +368,8 @@ Default: true enableContentionProfiling enables lock contention profiling, if enableDebuggingHandlers is true. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that enabling it may carry a performance impact. Default: false @@ -391,8 +379,10 @@ Default: false int32 - healthzPort is the port of the localhost healthz endpoint (set to 0 to disable) -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + healthzPort is the port of the localhost healthz endpoint (set to 0 to disable). +A valid number is between 1 and 65535. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may disrupt components that monitor Kubelet health. Default: 10248 @@ -402,8 +392,9 @@ Default: 10248 string - healthzBindAddress is the IP address for the healthz server to serve on -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + healthzBindAddress is the IP address for the healthz server to serve on. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may disrupt components that monitor Kubelet health. Default: "127.0.0.1" @@ -415,7 +406,8 @@ Default: "127.0.0.1" oomScoreAdj is The oom-score-adj value for kubelet process. Values must be within the range [-1000, 1000]. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may impact the stability of nodes under memory pressure. Default: -999 @@ -428,7 +420,7 @@ Default: -999 clusterDomain is the DNS domain for this cluster. If set, kubelet will configure all containers to search this domain in addition to the host's search domains. -Dynamic Kubelet Config (beta): Dynamically updating this field is not recommended, +Dynamic Kubelet Config (deprecated): Dynamically updating this field is not recommended, as it should be kept in sync with the rest of the cluster. Default: "" @@ -441,7 +433,8 @@ Default: "" clusterDNS is a list of IP addresses for the cluster DNS server. If set, kubelet will configure all containers to use this for DNS resolution instead of the host's DNS servers. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that changes will only take effect on Pods created after the update. Draining the node is recommended before changing this field. Default: nil @@ -454,7 +447,8 @@ Default: nil streamingConnectionIdleTimeout is the maximum time a streaming connection can be idle before the connection is automatically closed. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may impact components that rely on infrequent updates over streaming connections to the Kubelet server. Default: "4h" @@ -470,7 +464,8 @@ status. If node lease feature is not enabled, it is also the frequency that kubelet posts node status to master. Note: When node lease feature is not enabled, be cautious when changing the constant, it must work with nodeMonitorGracePeriod in nodecontroller. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may impact node scalability, and also that the node controller's nodeMonitorGracePeriod must be set to N∗NodeStatusUpdateFrequency, where N is the number of retries before the node controller marks @@ -504,8 +499,10 @@ health by having the Kubelet create and periodically renew a lease, named after in the kube-node-lease namespace. If the lease expires, the node can be considered unhealthy. The lease is currently renewed every 10s, per KEP-0009. In the future, the lease renewal interval may be set based on the lease duration. +The field value must be greater than 0. Requires the NodeLease feature gate to be enabled. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that decreasing the duration may reduce tolerance for issues that temporarily prevent the Kubelet from renewing the lease (e.g. a short-lived network issue). Default: 40 @@ -518,7 +515,8 @@ Default: 40 imageMinimumGCAge is the minimum age for an unused image before it is garbage collected. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may trigger or delay garbage collection, and may change the image overhead on the node. Default: "2m" @@ -530,9 +528,12 @@ Default: "2m" imageGCHighThresholdPercent is the percent of disk usage after which -image garbage collection is always run. The percent is calculated as -this field value out of 100. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +image garbage collection is always run. The percent is calculated by +dividing this field value by 100, so this field must be between 0 and +100, inclusive. When specified, the value must be greater than +imageGCLowThresholdPercent. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may trigger or delay garbage collection, and may change the image overhead on the node. Default: 85 @@ -545,8 +546,11 @@ Default: 85 imageGCLowThresholdPercent is the percent of disk usage before which image garbage collection is never run. Lowest disk usage to garbage -collect to. The percent is calculated as this field value out of 100. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +collect to. The percent is calculated by dividing this field value by 100, +so the field value must be between 0 and 100, inclusive. When specified, the +value must be less than imageGCHighThresholdPercent. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may trigger or delay garbage collection, and may change the image overhead on the node. Default: 80 @@ -557,8 +561,10 @@ Default: 80 meta/v1.Duration - How frequently to calculate and cache volume disk usage for all pods -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + volumeStatsAggPeriod is the frequency for calculating and caching volume +disk usage for all pods. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that shortening the period may carry a performance impact. Default: "1m" @@ -569,7 +575,7 @@ Default: "1m" kubeletCgroups is the absolute name of cgroups to isolate the kubelet in -Dynamic Kubelet Config (beta): This field should not be updated without a full node +Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: "" @@ -582,7 +588,8 @@ Default: "" systemCgroups is absolute name of cgroups in which to place all non-kernel processes that are not already in a container. Empty for no container. Rolling back the flag requires a reboot. -Dynamic Kubelet Config (beta): This field should not be updated without a full node +The cgroupRoot must be specified if this field is not empty. +Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: "" @@ -594,7 +601,7 @@ Default: "" cgroupRoot is the root cgroup to use for pods. This is handled by the container runtime on a best effort basis. -Dynamic Kubelet Config (beta): This field should not be updated without a full node +Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: "" @@ -604,10 +611,10 @@ Default: "" bool - Enable QoS based Cgroup hierarchy: top level cgroups for QoS Classes -And all Burstable and BestEffort pods are brought up under their -specific top level QoS cgroup. -Dynamic Kubelet Config (beta): This field should not be updated without a full node + cgroupsPerQOS enable QoS based CGroup hierarchy: top level CGroups for QoS classes +and all Burstable and BestEffort Pods are brought up under their specific top level +QoS CGroup. +Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: true @@ -617,8 +624,9 @@ Default: true string - driver that the kubelet uses to manipulate cgroups on the host (cgroupfs or systemd) -Dynamic Kubelet Config (beta): This field should not be updated without a full node + cgroupDriver is the driver kubelet uses to manipulate CGroups on the host (cgroupfs +or systemd). +Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: "cgroupfs" @@ -628,21 +636,35 @@ Default: "cgroupfs" string - CPUManagerPolicy is the name of the policy to use. + cpuManagerPolicy is the name of the policy to use. Requires the CPUManager feature gate to be enabled. -Dynamic Kubelet Config (beta): This field should not be updated without a full node +Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: "None" +cpuManagerPolicyOptions
    +map[string]string + + + cpuManagerPolicyOptions is a set of key=value which allows to set extra options +to fine tune the behaviour of the cpu manager policies. +Requires both the "CPUManager" and "CPUManagerPolicyOptions" feature gates to be enabled. +Dynamic Kubelet Config (beta): This field should not be updated without a full node +reboot. It is safest to keep this value the same as the local config. +Default: nil + + + cpuManagerReconcilePeriod
    meta/v1.Duration - CPU Manager reconciliation period. + cpuManagerReconcilePeriod is the reconciliation period for the CPU Manager. Requires the CPUManager feature gate to be enabled. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that shortening the period may carry a performance impact. Default: "10s" @@ -652,9 +674,9 @@ Default: "10s" string - MemoryManagerPolicy is the name of the policy to use by memory manager. + memoryManagerPolicy is the name of the policy to use by memory manager. Requires the MemoryManager feature gate to be enabled. -Dynamic Kubelet Config (beta): This field should not be updated without a full node +Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: "none" @@ -664,9 +686,19 @@ Default: "none" string - TopologyManagerPolicy is the name of the policy to use. + topologyManagerPolicy is the name of the topology manager policy to use. +Valid values include: + +- `restricted`: kubelet only allows pods with optimal NUMA node alignment for + requested resources; +- `best-effort`: kubelet will favor pods with NUMA alignment of CPU and device + resources; +- `none`: kublet has no knowledge of NUMA alignment of a pod's CPU and device resources. +- `single-numa-node`: kubelet only allows pods with a single NUMA alignment + of CPU and device resources. + Policies other than "none" require the TopologyManager feature gate to be enabled. -Dynamic Kubelet Config (beta): This field should not be updated without a full node +Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: "none" @@ -676,8 +708,12 @@ Default: "none" string - TopologyManagerScope represents the scope of topology hint generation -that topology manager requests and hint providers generate. + topologyManagerScope represents the scope of topology hint generation +that topology manager requests and hint providers generate. Valid values include: + +- `container`: topology policy is applied on a per-container basis. +- `pod`: topology policy is applied on a per-pod basis. + "pod" scope requires the TopologyManager feature gate to be enabled. Default: "container" @@ -692,7 +728,7 @@ the minimum percentage of a resource reserved for exclusive use by the guaranteed QoS tier. Currently supported resources: "memory" Requires the QOSReserved feature gate to be enabled. -Dynamic Kubelet Config (beta): This field should not be updated without a full node +Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: nil @@ -704,7 +740,8 @@ Default: nil runtimeRequestTimeout is the timeout for all runtime requests except long running requests - pull, logs, exec and attach. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Default: "2m" @@ -718,12 +755,15 @@ Default: "2m" bridge for hairpin packets. Setting this flag allows endpoints in a Service to loadbalance back to themselves if they should try to access their own Service. Values: - "promiscuous-bridge": make the container bridge promiscuous. - "hairpin-veth": set the hairpin flag on container veth interfaces. - "none": do nothing. -Generally, one must set --hairpin-mode=hairpin-veth to achieve hairpin NAT, + +- "promiscuous-bridge": make the container bridge promiscuous. +- "hairpin-veth": set the hairpin flag on container veth interfaces. +- "none": do nothing. + +Generally, one must set `--hairpin-mode=hairpin-veth to` achieve hairpin NAT, because promiscuous-bridge assumes the existence of a container bridge named cbr0. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may require a node reboot, depending on the network plugin. Default: "promiscuous-bridge" @@ -733,8 +773,10 @@ Default: "promiscuous-bridge" int32 - maxPods is the number of pods that can run on this Kubelet. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + maxPods is the maximum number of Pods that can run on this Kubelet. +The value must be a non-negative integer. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that changes may cause Pods to fail admission on Kubelet restart, and may change the value reported in Node.Status.Capacity[v1.ResourcePods], thus affecting future scheduling decisions. Increasing this value may also decrease performance, @@ -747,9 +789,9 @@ Default: 110 string - The CIDR to use for pod IP addresses, only used in standalone mode. -In cluster mode, this is obtained from the master. -Dynamic Kubelet Config (beta): This field should always be set to the empty default. + podCIDR is the CIDR to use for pod IP addresses, only used in standalone mode. +In cluster mode, this is obtained from the control plane. +Dynamic Kubelet Config (deprecated): This field should always be set to the empty default. It should only set for standalone Kubelets, which cannot use Dynamic Kubelet Config. Default: "" @@ -759,8 +801,9 @@ Default: "" int64 - PodPidsLimit is the maximum number of pids in any pod. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + podPidsLimit is the maximum number of PIDs in any pod. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that lowering it may prevent container processes from forking after the change. Default: -1 @@ -770,9 +813,10 @@ Default: -1 string - ResolverConfig is the resolver configuration file used as the basis + resolvConf is the resolver configuration file used as the basis for the container DNS resolution configuration. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that changes will only take effect on Pods created after the update. Draining the node is recommended before changing this field. Default: "/etc/resolv.conf" @@ -783,7 +827,7 @@ Default: "/etc/resolv.conf" bool - RunOnce causes the Kubelet to check the API server once for pods, + runOnce causes the Kubelet to check the API server once for pods, run those in addition to the pods specified by static pod files, and exit. Default: false @@ -795,7 +839,8 @@ Default: false cpuCFSQuota enables CPU CFS quota enforcement for containers that specify CPU limits. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that disabling it may reduce node stability. Default: true @@ -805,8 +850,11 @@ Default: true meta/v1.Duration - CPUCFSQuotaPeriod is the CPU CFS quota period value, cpu.cfs_period_us. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + cpuCFSQuotaPeriod is the CPU CFS quota period value, `cpu.cfs_period_us`. +The value must be between 1 us and 1 second, inclusive. +Requires the CustomCPUCFSQuotaPeriod feature gate to be enabled. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that limits set for containers will result in different cpu.cfs_quota settings. This will trigger container restarts on the node being reconfigured. Default: "100ms" @@ -817,9 +865,11 @@ Default: "100ms" int32 - nodeStatusMaxImages caps the number of images reported in Node.Status.Images. + nodeStatusMaxImages caps the number of images reported in Node.status.images. +The value must be greater than -2. Note: If -1 is specified, no cap will be applied. If 0 is specified, no image is returned. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that different values can be reported on node status. Default: 50 @@ -830,7 +880,9 @@ Default: 50 maxOpenFiles is Number of files that can be opened by Kubelet process. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +The value must be a non-negative number. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may impact the ability of the Kubelet to interact with the node's filesystem. Default: 1000000 @@ -841,7 +893,8 @@ Default: 1000000 contentType is contentType of requests sent to apiserver. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may impact the ability for the Kubelet to communicate with the API server. If the Kubelet loses contact with the API server due to a change to this field, the change cannot be reverted via dynamic Kubelet config. @@ -853,8 +906,9 @@ Default: "application/vnd.kubernetes.protobuf" int32 - kubeAPIQPS is the QPS to use while talking with kubernetes apiserver -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + kubeAPIQPS is the QPS to use while talking with kubernetes apiserver. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may impact scalability by changing the amount of traffic the Kubelet sends to the API server. Default: 5 @@ -865,8 +919,10 @@ Default: 5 int32 - kubeAPIBurst is the burst to allow while talking with kubernetes apiserver -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + kubeAPIBurst is the burst to allow while talking with kubernetes API server. +This field cannot be a negative number. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may impact scalability by changing the amount of traffic the Kubelet sends to the API server. Default: 10 @@ -881,7 +937,8 @@ Default: 10 at a time. We recommend ∗not∗ changing the default value on nodes that run docker daemon with version < 1.9 or an Aufs storage backend. Issue #10959 has more details. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may impact the performance of image pulls. Default: true @@ -891,9 +948,11 @@ Default: true map[string]string - Map of signal names to quantities that defines hard eviction thresholds. For example: {"memory.available": "300Mi"}. + evictionHard is a map of signal names to quantities that defines hard eviction +thresholds. For example: `{"memory.available": "300Mi"}`. To explicitly disable, pass a 0% or 100% threshold on an arbitrary resource. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may trigger or delay Pod evictions. Default: memory.available: "100Mi" @@ -907,9 +966,10 @@ Default: map[string]string - Map of signal names to quantities that defines soft eviction thresholds. -For example: {"memory.available": "300Mi"}. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + evictionSoft is a map of signal names to quantities that defines soft eviction thresholds. +For example: `{"memory.available": "300Mi"}`. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may trigger or delay Pod evictions, and may change the allocatable reported by the node. Default: nil @@ -920,9 +980,10 @@ Default: nil map[string]string - Map of signal names to quantities that defines grace periods for each soft eviction signal. -For example: {"memory.available": "30s"}. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + evictionSoftGracePeriod is a map of signal names to quantities that defines grace +periods for each soft eviction signal. For example: `{"memory.available": "30s"}`. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may trigger or delay Pod evictions. Default: nil @@ -932,8 +993,10 @@ Default: nil meta/v1.Duration - Duration for which the kubelet has to wait before transitioning out of an eviction pressure condition. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + evictionPressureTransitionPeriod is the duration for which the kubelet has to wait +before transitioning out of an eviction pressure condition. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that lowering it may decrease the stability of the node when the node is overcommitted. Default: "5m" @@ -943,13 +1006,14 @@ Default: "5m" int32 - Maximum allowed grace period (in seconds) to use when terminating pods in -response to a soft eviction threshold being met. This value effectively caps -the Pod's TerminationGracePeriodSeconds value during soft evictions. + evictionMaxPodGracePeriod is the maximum allowed grace period (in seconds) to use +when terminating pods in response to a soft eviction threshold being met. This value +effectively caps the Pod's terminationGracePeriodSeconds value during soft evictions. Note: Due to issue #64530, the behavior has a bug where this value currently just overrides the grace period during soft eviction, which can increase the grace period from what is set on the Pod. This bug will be fixed in a future release. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that lowering it decreases the amount of time Pods will have to gracefully clean up before being killed during a soft eviction. Default: 0 @@ -960,10 +1024,12 @@ Default: 0 map[string]string - Map of signal names to quantities that defines minimum reclaims, which describe the minimum -amount of a given resource the kubelet will reclaim when performing a pod eviction while -that resource is under pressure. For example: {"imagefs.available": "2Gi"} -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + evictionMinimumReclaim is a map of signal names to quantities that defines minimum reclaims, +which describe the minimum amount of a given resource the kubelet will reclaim when +performing a pod eviction while that resource is under pressure. +For example: `{"imagefs.available": "2Gi"}`. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may change how well eviction can manage resource pressure. Default: nil @@ -973,11 +1039,13 @@ Default: nil int32 - podsPerCore is the maximum number of pods per core. Cannot exceed MaxPods. -If 0, this field is ignored. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + podsPerCore is the maximum number of pods per core. Cannot exceed maxPods. +The value must be a non-negative integer. +If 0, there is no limit on the number of Pods. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that changes may cause Pods to fail admission on Kubelet restart, and may change -the value reported in Node.Status.Capacity[v1.ResourcePods], thus affecting +the value reported in `Node.status.capacity.pods`, thus affecting future scheduling decisions. Increasing this value may also decrease performance, as more Pods can be packed into a single node. Default: 0 @@ -990,8 +1058,9 @@ Default: 0 enableControllerAttachDetach enables the Attach/Detach controller to manage attachment/detachment of volumes scheduled to this node, and -disables kubelet from executing any attach/detach operations -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +disables kubelet from executing any attach/detach operations. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that changing which component is responsible for volume management on a live node may result in volumes refusing to detach if the node is not drained prior to the update, and if Pods are scheduled to the node before the @@ -1008,7 +1077,8 @@ Default: true protectKernelDefaults, if true, causes the Kubelet to error if kernel flags are not as it expects. Otherwise the Kubelet will attempt to modify kernel flags to match its expectation. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that enabling it may cause the Kubelet to crash-loop if the Kernel is not configured as Kubelet expects. Default: false @@ -1019,10 +1089,12 @@ Default: false bool - If true, Kubelet ensures a set of iptables rules are present on host. -These rules will serve as utility rules for various components, e.g. KubeProxy. -The rules will be created based on IPTablesMasqueradeBit and IPTablesDropBit. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + makeIPTablesUtilChains, if true, causes the Kubelet ensures a set of iptables rules +are present on host. +These rules will serve as utility rules for various components, e.g. kube-proxy. +The rules will be created based on iptablesMasqueradeBit and iptablesDropBit. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that disabling it will prevent the Kubelet from healing locally misconfigured iptables rules. Default: true @@ -1032,11 +1104,12 @@ Default: true int32 - iptablesMasqueradeBit is the bit of the iptables fwmark space to mark for SNAT + iptablesMasqueradeBit is the bit of the iptables fwmark space to mark for SNAT. Values must be within the range [0, 31]. Must be different from other mark bits. Warning: Please match the value of the corresponding parameter in kube-proxy. -TODO: clean up IPTablesMasqueradeBit in kube-proxy -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +TODO: clean up IPTablesMasqueradeBit in kube-proxy. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it needs to be coordinated with other components, like kube-proxy, and the update will only be effective if MakeIPTablesUtilChains is enabled. Default: 14 @@ -1049,7 +1122,8 @@ Default: 14 iptablesDropBit is the bit of the iptables fwmark space to mark for dropping packets. Values must be within the range [0, 31]. Must be different from other mark bits. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it needs to be coordinated with other components, like kube-proxy, and the update will only be effective if MakeIPTablesUtilChains is enabled. Default: 15 @@ -1060,10 +1134,11 @@ Default: 15 map[string]bool - featureGates is a map of feature names to bools that enable or disable alpha/experimental + featureGates is a map of feature names to bools that enable or disable experimental features. This field modifies piecemeal the built-in default values from "k8s.io/kubernetes/pkg/features/kube_features.go". -Dynamic Kubelet Config (beta): If dynamically updating this field, consider the +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider the documentation for the features you are enabling or disabling. While we encourage feature developers to make it possible to dynamically enable and disable features, some changes may require node reboots, and some @@ -1077,19 +1152,29 @@ Default: nil failSwapOn tells the Kubelet to fail to start if swap is enabled on the node. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that setting it to true will cause the Kubelet to crash-loop if swap is enabled. Default: true +memorySwap
    +MemorySwapConfiguration + + + memorySwap configures swap memory available to container workloads. + + + containerLogMaxSize
    string - A quantity defines the maximum size of the container log file before it is rotated. -For example: "5Mi" or "256Ki". -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + containerLogMaxSize is a quantity defining the maximum size of the container log +file before it is rotated. For example: "5Mi" or "256Ki". +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may trigger log rotation. Default: "10Mi" @@ -1099,8 +1184,10 @@ Default: "10Mi" int32 - Maximum number of container log files that can be present for a container. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + containerLogMaxFiles specifies the maximum number of container log files that can +be present for a container. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that lowering it may cause log files to be deleted. Default: 5 @@ -1110,8 +1197,13 @@ Default: 5 ResourceChangeDetectionStrategy - ConfigMapAndSecretChangeDetectionStrategy is a mode in which -config map and secret managers are running. + configMapAndSecretChangeDetectionStrategy is a mode in which ConfigMap and Secret +managers are running. Valid values include: + +- `Get`: kubelet fetches necessary objects directly from the API server; +- `Cache`: kubelet uses TTL cache for object fetched from the API server; +- `Watch`: kubelet uses watches to observe changes to objects that are in its interest. + Default: "Watch" @@ -1124,7 +1216,8 @@ Default: "Watch" pairs that describe resources reserved for non-kubernetes components. Currently only cpu and memory are supported. See http://kubernetes.io/docs/user-guide/compute-resources for more detail. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may not be possible to increase the reserved resources, because this requires resizing cgroups. Always look for a NodeAllocatableEnforced event after updating this field to ensure that the update was successful. @@ -1136,11 +1229,13 @@ Default: nil map[string]string - A set of ResourceName=ResourceQuantity (e.g. cpu=200m,memory=150G) pairs + kubeReserved is a set of ResourceName=ResourceQuantity (e.g. cpu=200m,memory=150G) pairs that describe resources reserved for kubernetes system components. Currently cpu, memory and local storage for root file system are supported. -See http://kubernetes.io/docs/user-guide/compute-resources for more detail. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ +for more details. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may not be possible to increase the reserved resources, because this requires resizing cgroups. Always look for a NodeAllocatableEnforced event after updating this field to ensure that the update was successful. @@ -1152,9 +1247,10 @@ Default: nil string - This ReservedSystemCPUs option specifies the cpu list reserved for the host level system threads and kubernetes related threads. -This provide a "static" CPU list rather than the "dynamic" list by system-reserved and kube-reserved. -This option overwrites CPUs provided by system-reserved and kube-reserved. + The reservedSystemCPUs option specifies the CPU list reserved for the host +level system threads and kubernetes related threads. This provide a "static" +CPU list rather than the "dynamic" list by systemReserved and kubeReserved. +This option does not support systemReservedCgroup or kubeReservedCgroup. @@ -1162,11 +1258,13 @@ This option overwrites CPUs provided by system-reserved and kube-reserved. string - The previous version for which you want to show hidden metrics. + showHiddenMetricsForVersion is the previous version for which you want to show +hidden metrics. Only the previous minor version is meaningful, other values will not be allowed. -The format is ., e.g.: '1.16'. -The purpose of this format is make sure you have the opportunity to notice if the next release hides additional metrics, -rather than being surprised when they are permanently removed in the release after that. +The format is `.`, e.g.: `1.16`. +The purpose of this format is make sure you have the opportunity to notice +if the next release hides additional metrics, rather than being surprised +when they are permanently removed in the release after that. Default: "" @@ -1175,9 +1273,11 @@ Default: "" string - This flag helps kubelet identify absolute name of top level cgroup used to enforce `SystemReserved` compute resource reservation for OS system daemons. -Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) doc for more information. -Dynamic Kubelet Config (beta): This field should not be updated without a full node + systemReservedCgroup helps the kubelet identify absolute name of top level CGroup used +to enforce `systemReserved` compute resource reservation for OS system daemons. +Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) +doc for more information. +Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: "" @@ -1187,9 +1287,11 @@ Default: "" string - This flag helps kubelet identify absolute name of top level cgroup used to enforce `KubeReserved` compute resource reservation for Kubernetes node system daemons. -Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) doc for more information. -Dynamic Kubelet Config (beta): This field should not be updated without a full node + kubeReservedCgroup helps the kubelet identify absolute name of top level CGroup used +to enforce `KubeReserved` compute resource reservation for Kubernetes node system daemons. +Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) +doc for more information. +Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. Default: "" @@ -1200,10 +1302,16 @@ Default: "" This flag specifies the various Node Allocatable enforcements that Kubelet needs to perform. -This flag accepts a list of options. Acceptable options are `none`, `pods`, `system-reserved` & `kube-reserved`. +This flag accepts a list of options. Acceptable options are `none`, `pods`, +`system-reserved` and `kube-reserved`. If `none` is specified, no other options may be specified. -Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) doc for more information. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that +When `system-reserved` is in the list, systemReservedCgroup must be specified. +When `kube-reserved` is in the list, kubeReservedCgroup must be specified. +This field is supported only when `cgroupsPerQOS` is set to true. +Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) +for more information. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that removing enforcements may reduce the stability of the node. Alternatively, adding enforcements may reduce the stability of components which were using more than the reserved amount of resources; for example, enforcing kube-reserved may cause @@ -1217,9 +1325,9 @@ Default: ["pods"] []string - A comma separated whitelist of unsafe sysctls or sysctl patterns (ending in ∗). -Unsafe sysctl groups are kernel.shm∗, kernel.msg∗, kernel.sem, fs.mqueue.∗, and net.∗. -These sysctls are namespaced but not allowed by default. For example: "kernel.msg∗,net.ipv4.route.min_pmtu" + A comma separated whitelist of unsafe sysctls or sysctl patterns (ending in `∗`). +Unsafe sysctl groups are `kernel.shm∗`, `kernel.msg∗`, `kernel.sem`, `fs.mqueue.∗`, +and `net.∗`. For example: "`kernel.msg∗,net.ipv4.route.min_pmtu`" Default: [] @@ -1230,7 +1338,8 @@ Default: [] volumePluginDir is the full path of the directory in which to search for additional third party volume plugins. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that changing +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that changing the volumePluginDir may disrupt workloads relying on third party volume plugins. Default: "/usr/libexec/kubernetes/kubelet-plugins/volume/exec/" @@ -1240,9 +1349,10 @@ Default: "/usr/libexec/kubernetes/kubelet-plugins/volume/exec/" string - providerID, if set, sets the unique id of the instance that an external provider (i.e. cloudprovider) -can use to identify a specific node. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + providerID, if set, sets the unique ID of the instance that an external +provider (i.e. cloudprovider) can use to identify a specific node. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may impact the ability of the Kubelet to interact with cloud providers. Default: "" @@ -1252,9 +1362,11 @@ Default: "" bool - kernelMemcgNotification, if set, the kubelet will integrate with the kernel memcg notification -to determine if memory eviction thresholds are crossed rather than polling. -Dynamic Kubelet Config (beta): If dynamically updating this field, consider that + kernelMemcgNotification, if set, instructs the the kubelet to integrate with the +kernel memcg notification for determining if memory eviction thresholds are +exceeded rather than polling. +If DynamicKubeletConfig (deprecated; default off) is on, when +dynamically updating this field, consider that it may impact the way Kubelet interacts with the kernel. Default: false @@ -1264,9 +1376,10 @@ Default: false LoggingConfiguration - Logging specifies the options of logging. -Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. -Defaults: + logging specifies the options of logging. +Refer to [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) +for more information. +Default: Format: text @@ -1284,7 +1397,8 @@ Default: true meta/v1.Duration - ShutdownGracePeriod specifies the total duration that the node should delay the shutdown and total grace period for pod termination during a node shutdown. + shutdownGracePeriod specifies the total duration that the node should delay the +shutdown and total grace period for pod termination during a node shutdown. Default: "0s" @@ -1293,8 +1407,12 @@ Default: "0s" meta/v1.Duration - ShutdownGracePeriodCriticalPods specifies the duration used to terminate critical pods during a node shutdown. This should be less than ShutdownGracePeriod. -For example, if ShutdownGracePeriod=30s, and ShutdownGracePeriodCriticalPods=10s, during a node shutdown the first 20 seconds would be reserved for gracefully terminating normal pods, and the last 10 seconds would be reserved for terminating critical pods. + shutdownGracePeriodCriticalPods specifies the duration used to terminate critical +pods during a node shutdown. This should be less than shutdownGracePeriod. +For example, if shutdownGracePeriod=30s, and shutdownGracePeriodCriticalPods=10s, +during a node shutdown the first 20 seconds would be reserved for gracefully +terminating normal pods, and the last 10 seconds would be reserved for terminating +critical pods. Default: "0s" @@ -1303,19 +1421,25 @@ Default: "0s" []MemoryReservation - ReservedMemory specifies a comma-separated list of memory reservations for NUMA nodes. -The parameter makes sense only in the context of the memory manager feature. The memory manager will not allocate reserved memory for container workloads. -For example, if you have a NUMA0 with 10Gi of memory and the ReservedMemory was specified to reserve 1Gi of memory at NUMA0, -the memory manager will assume that only 9Gi is available for allocation. + reservedMemory specifies a comma-separated list of memory reservations for NUMA nodes. +The parameter makes sense only in the context of the memory manager feature. +The memory manager will not allocate reserved memory for container workloads. +For example, if you have a NUMA0 with 10Gi of memory and the reservedMemory was +specified to reserve 1Gi of memory at NUMA0, the memory manager will assume that +only 9Gi is available for allocation. You can specify a different amount of NUMA node and memory types. -You can omit this parameter at all, but you should be aware that the amount of reserved memory from all NUMA nodes -should be equal to the amount of memory specified by the node allocatable features(https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable). -If at least one node allocatable parameter has a non-zero value, you will need to specify at least one NUMA node. +You can omit this parameter at all, but you should be aware that the amount of +reserved memory from all NUMA nodes should be equal to the amount of memory specified +by the [node allocatable](https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable). +If at least one node allocatable parameter has a non-zero value, you will need +to specify at least one NUMA node. Also, avoid specifying: + 1. Duplicates, the same NUMA node, and memory type, but with a different value. 2. zero limits for any memory type. 3. NUMAs nodes IDs that do not exist under the machine. 4. memory types except for memory and hugepages- + Default: nil @@ -1338,6 +1462,29 @@ Default: true +seccompDefault
    +bool + + + SeccompDefault enables the use of `RuntimeDefault` as the default seccomp profile for all workloads. +This requires the corresponding SeccompDefault feature gate to be enabled as well. +Default: false + + + +memoryThrottlingFactor
    +float64 + + + MemoryThrottlingFactor specifies the factor multiplied by the memory limit or node allocatable memory +when setting the cgroupv2 memory.high value to enforce MemoryQoS. +Decreasing this factor will set lower high limit for container cgroups and put heavier reclaim pressure +while increasing will put less reclaim pressure. +See http://kep.k8s.io/2570 for more details. +Default: 0.8 + + + @@ -1364,10 +1511,10 @@ It exists in the kubeletconfig API group because it is classified as a versioned source
    -core/v1.NodeConfigSource +core/v1.NodeConfigSource - Source is the source that we are serializing + source is the source that we are serializing. @@ -1412,8 +1559,10 @@ hairpin packets. enabled allows anonymous requests to the kubelet server. -Requests that are not rejected by another authentication method are treated as anonymous requests. -Anonymous requests have a username of system:anonymous, and a group name of system:unauthenticated. +Requests that are not rejected by another authentication method are treated as +anonymous requests. +Anonymous requests have a username of `system:anonymous`, and a group name of +`system:unauthenticated`. @@ -1444,7 +1593,7 @@ Anonymous requests have a username of system:anonymous, and a group name of syst KubeletX509Authentication - x509 contains settings related to x509 client certificate authentication + x509 contains settings related to x509 client certificate authentication. @@ -1452,7 +1601,7 @@ Anonymous requests have a username of system:anonymous, and a group name of syst KubeletWebhookAuthentication - webhook contains settings related to webhook bearer token authentication + webhook contains settings related to webhook bearer token authentication. @@ -1460,7 +1609,7 @@ Anonymous requests have a username of system:anonymous, and a group name of syst KubeletAnonymousAuthentication - anonymous contains settings related to anonymous authentication + anonymous contains settings related to anonymous authentication. @@ -1492,7 +1641,7 @@ Anonymous requests have a username of system:anonymous, and a group name of syst mode is the authorization mode to apply to requests to the kubelet server. -Valid values are AlwaysAllow and Webhook. +Valid values are `AlwaysAllow` and `Webhook`. Webhook mode uses the SubjectAccessReview API to determine authorization. @@ -1548,7 +1697,8 @@ Webhook mode uses the SubjectAccessReview API to determine authorization. bool - enabled allows bearer token authentication backed by the tokenreviews.authentication.k8s.io API + enabled allows bearer token authentication backed by the +tokenreviews.authentication.k8s.io API. @@ -1587,7 +1737,8 @@ Webhook mode uses the SubjectAccessReview API to determine authorization. meta/v1.Duration - cacheAuthorizedTTL is the duration to cache 'authorized' responses from the webhook authorizer. + cacheAuthorizedTTL is the duration to cache 'authorized' responses from the +webhook authorizer. @@ -1595,7 +1746,8 @@ Webhook mode uses the SubjectAccessReview API to determine authorization. meta/v1.Duration - cacheUnauthorizedTTL is the duration to cache 'unauthorized' responses from the webhook authorizer. + cacheUnauthorizedTTL is the duration to cache 'unauthorized' responses from +the webhook authorizer. @@ -1626,8 +1778,9 @@ Webhook mode uses the SubjectAccessReview API to determine authorization. string - clientCAFile is the path to a PEM-encoded certificate bundle. If set, any request presenting a client certificate -signed by one of the authorities in the bundle is authenticated with a username corresponding to the CommonName, + clientCAFile is the path to a PEM-encoded certificate bundle. If set, any request +presenting a client certificate signed by one of the authorities in the bundle +is authenticated with a username corresponding to the CommonName, and groups corresponding to the Organization in the client certificate. @@ -1665,7 +1818,7 @@ MemoryReservation specifies the memory reservation of different types for each N limits [Required]
    -core/v1.ResourceList +core/v1.ResourceList No description provided. @@ -1678,6 +1831,39 @@ MemoryReservation specifies the memory reservation of different types for each N +## `MemorySwapConfiguration` {#kubelet-config-k8s-io-v1beta1-MemorySwapConfiguration} + + + + +**Appears in:** + +- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) + + + + + + + + + + + + + + + + +
    FieldDescription
    swapBehavior
    +string +    		 + swapBehavior configures swap memory available to container workloads. May be one of +"", "LimitedSwap": workload combined memory and swap usage cannot exceed pod memory limit +"UnlimitedSwap": workloads can use unlimited swap, up to the allocatable limit.
    + + + ## `ResourceChangeDetectionStrategy` {#kubelet-config-k8s-io-v1beta1-ResourceChangeDetectionStrategy} (Alias of `string`) @@ -1694,3 +1880,45 @@ managers (secret, configmap) are discovering object changes. + + + +## `LoggingConfiguration` {#LoggingConfiguration} + + + + +**Appears in:** + +- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) + + +LoggingConfiguration contains logging options +Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. + + + + + + + + + + + + + + + + + + +
    FieldDescription
    format [Required]
    +string +    		 + Format Flag specifies the structure of log messages. +default value of format is `text`
    sanitization [Required]
    +bool +    		 + [Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). +Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)
    From 1230f21648f44872cd5efaa6dda36a320bdd89bb Mon Sep 17 00:00:00 2001 From: S Nitesh Singh Date: Thu, 5 Aug 2021 10:30:26 +0530 Subject: [PATCH 076/279] add eviction to glossary --- content/en/docs/reference/glossary/eviction.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 content/en/docs/reference/glossary/eviction.md diff --git a/content/en/docs/reference/glossary/eviction.md b/content/en/docs/reference/glossary/eviction.md new file mode 100644 index 0000000000..4437e43354 --- /dev/null +++ b/content/en/docs/reference/glossary/eviction.md @@ -0,0 +1,18 @@ +--- +title: Eviction +id: eviction +date: 2021-05-08 +full_link: /docs/concepts/scheduling-eviction/ +short_description: > + Process of terminating one or more Pods on Nodes +aka: +tags: +- operation +--- + +Eviction is the process of terminating one or more Pods on Nodes. + + +There are two kinds of eviction: +* [Node-pressure eviction](/docs/concepts/scheduling-eviction/node-pressure-eviction/) +* [API-initiated eviction](/docs/concepts/scheduling-eviction/api-eviction/) From 1ad2bce47543b96e33ffe21f447694d672cf84ac Mon Sep 17 00:00:00 2001 From: Yuiko Mouri Date: Thu, 5 Aug 2021 14:55:29 +0900 Subject: [PATCH 077/279] Fix missing link --- .../en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md index b51f786f04..3d4959b536 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md @@ -133,8 +133,7 @@ dynamic certificate reload is currently not supported for all components and cer [Static Pods](/docs/tasks/configure-pod-container/static-pod/) are managed by the local kubelet and not by the API Server, thus kubectl cannot be used to delete and restart them. To restart a static Pod you can temporarily remove its manifest file from `/etc/kubernetes/manifests/` -and wait for 20 seconds (see the `fileCheckFrequency` value in [KubeletConfiguration struct](/docs/ -reference/config-api/kubelet-config.v1beta1/). +and wait for 20 seconds (see the `fileCheckFrequency` value in [KubeletConfiguration struct](/docs/reference/config-api/kubelet-config.v1beta1/). The kubelet will terminate the Pod if it's no longer in the manifest directory. You can then move the file back and after another `fileCheckFrequency` period, the kubelet will recreate the Pod and the certificate renewal for the component can complete. From f21e99e8e7efa249a305d06a26677ec783568324 Mon Sep 17 00:00:00 2001 From: sdghchj Date: Thu, 5 Aug 2021 15:29:34 +0800 Subject: [PATCH 078/279] Update service-accounts-admin.md --- .../docs/reference/access-authn-authz/service-accounts-admin.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/reference/access-authn-authz/service-accounts-admin.md b/content/zh/docs/reference/access-authn-authz/service-accounts-admin.md index 071329096c..0309bd7aa0 100644 --- a/content/zh/docs/reference/access-authn-authz/service-accounts-admin.md +++ b/content/zh/docs/reference/access-authn-authz/service-accounts-admin.md @@ -115,7 +115,7 @@ It acts synchronously to modify pods as they are created or updated. When this p 1. 如果该 Pod 没有设置 `ServiceAccount`，将其 `ServiceAccount` 设为 `default`。 1. 保证 Pod 所引用的 `ServiceAccount` 确实存在，否则拒绝该 Pod。 1. 如果服务账号的 `automountServiceAccountToken` 或 Pod 的 - `automountServiceAccountToken` 都为设置为 `false`，则为 Pod 创建一个 + `automountServiceAccountToken` 都未显示设置为 `false`，则为 Pod 创建一个 `volume`，在其中包含用来访问 API 的令牌。 1. 如果前一步中为服务账号令牌创建了卷，则为 Pod 中的每个容器添加一个 `volumeSource`，挂载在其 `/var/run/secrets/kubernetes.io/serviceaccount` From b2f7ce183e958d30f9fc0ea8e514f84e7eeac4fa Mon Sep 17 00:00:00 2001 From: seokho-son Date: Thu, 5 Aug 2021 11:23:19 +0900 Subject: [PATCH 079/279] Translate kubernetes-release-1.22 blog into Korean --- .../2021-08-04-kubernetes-release-1.22.md | 157 ++++++++++++++++++ 1 file changed, 157 insertions(+) create mode 100644 content/ko/blog/_posts/2021-08-04-kubernetes-release-1.22.md diff --git a/content/ko/blog/_posts/2021-08-04-kubernetes-release-1.22.md b/content/ko/blog/_posts/2021-08-04-kubernetes-release-1.22.md new file mode 100644 index 0000000000..d936d7c767 --- /dev/null +++ b/content/ko/blog/_posts/2021-08-04-kubernetes-release-1.22.md @@ -0,0 +1,157 @@ +--- +layout: blog +title: '쿠버네티스 1.22: 새로운 정점에 도달(Reaching New Peaks)' +date: 2021-08-04 +slug: kubernetes-1-22-release-announcement +--- + +**저자:** [쿠버네티스 1.22 릴리스 팀](https://github.com/kubernetes/sig-release/blob/master/releases/release-1.22/release-team.md) + +**번역:** [손석호(ETRI)](https://github.com/seokho-son), [서지훈(ETRI)](https://github.com/jihoon-seo), [쿠버네티스 문서 한글화 팀](https://kubernetes.slack.com/archives/CA1MMR86S) + +2021년의 두 번째 릴리스인 쿠버네티스 1.22 릴리스를 발표하게 되어 기쁘게 생각합니다! + +이번 릴리스는 53개의 개선 사항(enhancement)으로 구성되어 있습니다. 13개의 개선 사항은 스테이블(stable)로 졸업하였으며(graduated), 24개의 개선 사항은 베타(beta)로 이동하였고, 16개는 알파(alpha)에 진입하였습니다. 또한, 3개의 기능(feature)을 더 이상 사용하지 않게 되었습니다(deprecated). + +이번 해 4월에는 쿠버네티스 릴리스 케이던스(cadence)가 1년에 4회에서 3회로 공식적으로 변경되었습니다. 이번 릴리스가 해당 방식에 따라 긴 주기를 가진 첫 번째 릴리스입니다. 쿠버네티스 프로젝트가 성숙해짐에 따라, 사이클(cycle) 당 개선 사항도 늘어나고 있습니다. 이것은 기여자 커뮤니티 및 릴리스 엔지니어링 팀에게, 버전과 버전 사이에 더 많은 작업이 필요하다는 것을 의미합니다. 또한 점점 더 많은 기능을 포함하는 릴리스로 최신 상태를 유지하려는 최종-사용자 커뮤니티에도 부담을 줄 수 있습니다. + +연간 4회에서 3회로의 릴리스 케이던스 변경을 통해 프로젝트의 다양한 측면(기여와 릴리스가 관리되는 방법, 업그레이드 및 최신 릴리스 유지에 대한 커뮤니티의 역량 등)에 대한 균형을 이루고자 하였습니다. + +더 자세한 사항은 공식 블로그 포스트 [쿠버네티스 릴리스 케이던스 변경: 알아두어야 할 사항](https://kubernetes.io/blog/2021/07/20/new-kubernetes-release-cadence/)에서 확인할 수 있습니다. + + +## 주요 주제 + +### 서버-사이드 어플라이(Server-side Apply)가 GA로 졸업 + +[서버-사이드 어플라이](https://kubernetes.io/docs/reference/using-api/server-side-apply/)는 쿠버네티스 API 서버에서 동작하는 신규 필드 오너십이며 오브젝트 병합 알고리즘입니다. 서버-사이드 어플라이는 사용자와 컨트롤러가 선언적인 구성을 통해서 자신의 리소스를 관리할 수 있도록 돕습니다. 이 기능은 단순히 fully specified intent를 전송하는 것만으로 자신의 오브젝트를 선언적으로 생성 또는 수정할 수 있도록 허용합니다. 몇 릴리스에 걸친 베타 과정 이후, 서버-사이드 어플라이는 이제 GA(generally available)가 되었습니다. + +### 외부 크리덴셜 제공자가 이제 스테이블이 됨 + +쿠버네티스 클라이언트 [크리덴셜 플러그인](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins)에 대한 지원은 1.11부터 베타였으나, 쿠버네티스 1.22 릴리스에서 스테이블로 졸업하였습니다. 해당 GA 기능 집합은 인터랙티브 로그인 플로우(interactive login flow)를 제공하는 플러그인에 대한 향상된 지원을 포함합니다. 또한, 많은 버그가 수정되었습니다. 플러그인 개발은 [sample-exec-plugin](https://github.com/ankeesler/sample-exec-plugin)을 통해 시작할 수 있습니다. + +### etcd 3.5.0으로 변경 + +쿠버네티스의 기본 백엔드 저장소인 etcd 3.5.0이 신규로 릴리스되었습니다. 신규 릴리스에는 보안, 성능, 모니터링, 개발자 경험 측면의 개선 사항이 포함되어 있습니다. 많은 버그가 수정되었으며 구조화된 로깅으로 마이그레이션(migration to structured logging) 및 빌트-인 로그 순환(built-in log rotation)과 같은 신규 중요 기능들도 일부 포함되었습니다. 해당 릴리스는 트래픽 부하에 대한 솔루션 구현을 위한 자세한 차기 로드맵도 제시하고 있습니다. [3.5.0 릴리스 발표](https://etcd.io/blog/2021/announcing-etcd-3.5/)에서 변경에 대한 자세한 항목을 확인할 수 있습니다. + +### 메모리 리소스에 대한 서비스 품질(Quality of Service) + +쿠버네티스는 원래 v1 cgroups API를 사용했습니다. 해당 디자인에 의해서, `Pod`에 대한 QoS 클래스는 CPU 리소스(예를 들면, `cpu_shares`)에만 적용되었습니다. 알파 기능으로, 쿠버네티스 v1.22에서는 메모리 할당(allocation)과 격리(isolation)를 제어하기 위한 cgroups v2 API를 사용할 수 있습니다. 이 기능은 메모리 리소스에 대한 컨텐션(contention)이 있을 때 워크로드와 노드의 가용성을 향상시키고, 컨테이너 라이프사이클에 대한 예측 가능성을 향상시킬 수 있도록 디자인되었습니다. + +### 노드 시스템 스왑(swap) 지원 + +모든 시스템 관리자나 쿠버네티스 사용자는 쿠버네티스를 설정하거나 사용할 때 스왑 공간(space)을 비활성화해야 한다는 동일한 상황에 놓여 있었습니다. 쿠버네티스 1.22 릴리스에서는 노드의 스왑 메모리를 지원합니다(알파). 이 변경은 블록 스토리지의 일부를 추가적인 가상 메모리로 취급하도록, 관리자의 옵트인(opt in)을 받아서 리눅스 노드에 스왑을 구성합니다. + +### 윈도우(Windows) 개선 사항 및 기능 + +SIG Windows는 계속해서 성장하는 개발자 커뮤니티를 지원하기 위해서 [개발 환경](https://github.com/kubernetes-sigs/sig-windows-dev-tools/)을 릴리스하였습니다. 이 새로운 도구는 여러 CNI 제공자를 지원하며, 여러 플랫폼에서 구동할 수 있습니다. 윈도우 kubelet과 kube-proxy를 컴파일하고, 다른 쿠버네티스 컴포넌트와 함께 빌드될 수 있도록 하는 새로운 방법을 제공하여, 최신(bleeding-edge) 윈도우 기능을 스크래치(scratch)부터 실행할 수 있도록 지원합니다. + +1.22 릴리스에서 윈도우 노드의 CSI 지원이 GA 상태가 되었습니다. 쿠버네티스 v1.22에서는 특권을 가진(privileged) 윈도우 컨테이너가 알파가 되었습니다. 윈도우 노드에서 CSI 스토리지를 사용하도록, 노드에서의 스토리지 작업에 대한 특권을 가진(privileged) [CSIProxy](https://github.com/kubernetes-csi/csi-proxy)가 CSI 노드 플러그인을 특권을 가지지 않은(unprivileged) 파드로 배치되도록 합니다. + +### 기본(default) seccomp 프로파일 + +알파 기능인 기본 seccomp 프로파일이 신규 커맨드라인 플래그 및 설정과 함께 kubelet에 추가되었습니다. 이 신규 기능을 사용하면, `Unconfined`대신 `RuntimeDefault` seccomp 프로파일을 기본으로 사용하는 seccomp이 클러스터 전반에서 기본이 됩니다. 이는 쿠버네티스 디플로이먼트(Deployment)의 기본 보안을 강화합니다. 워크로드에 대한 보안이 기본으로 더 강화되었으므로, 이제 보안 관리자도 조금 더 안심하고 쉴 수 있습니다. 이 기능에 대한 자세한 사항은 공식적인 [seccomp 튜토리얼](https://kubernetes.io/docs/tutorials/clusters/seccomp/#enable-the-use-of-runtimedefault-as-the-default-seccomp-profile-for-all-workloads)을 참고하시기 바랍니다. + +### kubeadm을 통한 보안성이 더 높은 컨트롤 플레인 + +이 신규 알파 기능을 사용하면 `kubeadm` 컨트롤 플레인 컴포넌트들을 루트가 아닌(non-root) 사용자로 동작시킬 수 있습니다. 이것은 `kubeadm`에 오랫동안 요청되어 온 보안 조치 사항입니다. 이 기능을 사용하려면 `kubeadm`에 한정된 RootlessControlPlane 기능 게이트를 활성화해야 합니다. 이 알파 기능을 사용하여 클러스터를 배치하는 경우, 사용자의 컨트롤 플레인은 더 낮은 특권(privileges)을 가지고 동작하게 됩니다. + +또한 쿠버네티스 1.22는 `kubeadm`의 신규 [v1beta3 구성 API](/docs/reference/config-api/kubeadm-config.v1beta3/)를 제공합니다. 이 버전에는 오랫동안 요청되어 온 몇 가지 기능들이 추가되었고, 기존의 일부 기능들은 사용 중단(deprecated)되었습니다. 이제 v1beta3 버전이 선호되는(preferred) API 버전입니다. 그러나, v1beta2 API도 여전히 사용 가능하며 아직 사용 중단(deprecated)되지 않았습니다. + +## 주요 변경 사항 + +### 사용 중단된(deprecated) 일부 베타 APIs의 제거 + +GA 버전과 중복된 사용 중단(deprecated)된 여러 베타 API가 1.22에서 제거되었습니다. 기존의 모든 오브젝트는 스테이블 APIs를 통해 상호 작용할 수 있습니다. 이 제거에는 `Ingress`, `IngressClass`, `Lease`, `APIService`, `ValidatingWebhookConfiguration`, `MutatingWebhookConfiguration`, `CustomResourceDefinition`, `TokenReview`, `SubjectAccessReview`, `CertificateSigningRequest` API의 베타 버전이 포함되었습니다. + +전체 항목은 [사용 중단된 API에 대한 마이그레이션 지침](https://kubernetes.io/docs/reference/using-api/deprecation-guide/#v1-22)과 블로그 포스트 [1.22에서 쿠버네티스 API와 제거된 기능: 알아두어야 할 사항](https://blog.k8s.io/2021/07/14/upcoming-changes-in-kubernetes-1-22/)에서 확인 가능합니다. + +### 임시(ephemeral) 컨테이너에 대한 API 변경 및 개선 + +1.22에서 [임시 컨테이너](https://kubernetes.io/ko/docs/concepts/workloads/pods/ephemeral-containers/)를 생성하기 위한 API가 변경되었습니다. 임시 컨테이너 기능은 알파이며 기본적으로 비활성화되었습니다. 신규 API는 예전 API를 사용하려는 클라이언트에 대해 동작하지 않습니다. + +스테이블 기능에 대해서, kubectl 도구는 쿠버네티스의 [버전 차이(skew) 정책](https://kubernetes.io/ko/releases/version-skew-policy/)을 따릅니다. 그러나, kubectl v1.21 이하의 버전은 임시 컨테이너에 대한 신규 API를 지원하지 않습니다. 만약 `kubectl debug`를 사용하여 임시 컨테이너를 생성할 계획이 있고 클러스터에서 쿠버네티스 v1.22로 구동하고 있는 경우, kubectl v1.21 이하의 버전에서는 그렇게 할 수 없다는 것을 알아두어야 합니다. 따라서 만약 클러스터 버전을 혼합하여 `kubectl debug`를 사용하려면 kubectl를 1.22로 업데이트하길 바랍니다. + +## 기타 업데이트 + +### 스테이블로 졸업 + +* [바운드 서비스 어카운트 토큰 볼륨(Bound Service Account Token Volumes)](https://github.com/kubernetes/enhancements/issues/542) +* [CSI 서비스 어카운트 토큰(CSI Service Account Token)](https://github.com/kubernetes/enhancements/issues/2047) +* [윈도우의 CSI 플러그인 지원](https://github.com/kubernetes/enhancements/issues/1122) +* [사용 중단된 API 사용에 대한 경고(warning) 메커니즘](https://github.com/kubernetes/enhancements/issues/1693) +* [PodDisruptionBudget 축출(eviction)](https://github.com/kubernetes/enhancements/issues/85) + +### 주목할만한 기능 업데이트 + +* 파드시큐리티폴리시(PodSecurityPolicy)를 대체하기 위한 새로운 [파드시큐리티(PodSecurity) 어드미션(admission)](https://github.com/kubernetes/enhancements/issues/2579) 알파 기능이 소개됨. +* [메모리 관리자(manager)](https://github.com/kubernetes/enhancements/issues/1769)가 베타가 됨. +* [API 서버 트레이싱(tracing)](https://github.com/kubernetes/enhancements/issues/647)을 활성화하는 새로운 알파 기능. +* [kubeadm 설정(configuration)](https://github.com/kubernetes/enhancements/issues/970) 포맷의 신규 v1beta3 버전. +* 퍼시스턴트볼륨(PersistentVolume)을 위한 [Generic data populators](https://github.com/kubernetes/enhancements/issues/1495)를 알파로 활용 가능. +* 쿠버네티스 컨트롤 플레인이 이제 [크론잡 v2 컨트롤러(CronJobs v2 controller)](https://github.com/kubernetes/enhancements/issues/19)를 사용하게 됨. +* 알파 기능으로, 모든 쿠버네티스 노드 컴포넌트(kubelet, kube-proxy, 컨테이너 런타임을 포함)는 [루트가 아닌 사용자로](https://github.com/kubernetes/enhancements/issues/2033) 동작시킬 수 있음. + +# 릴리스 노트 + +1.22 릴리스의 자세한 전체 사항은 [릴리스 노트](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.22.md)에서 확인할 수 있습니다. + +# 릴리스 위치 + +쿠버네티스 1.22는 [여기](https://kubernetes.io/releases/download/)에서 다운로드할 수 있고, [GitHub 프로젝트](https://github.com/kubernetes/kubernetes/releases/tag/v1.22.0)에서도 찾을 수 있습니다. + +쿠버네티스를 시작하는 데 도움이 되는 좋은 자료가 많이 있습니다. 쿠버네티스 사이트에서 [상호 작용형 튜토리얼](https://kubernetes.io/ko/docs/tutorials/)을 수행할 수도 있고, [kind](https://kind.sigs.k8s.io)와 도커 컨테이너를 사용하여 로컬 클러스터를 사용자의 머신에서 구동해볼 수도 있습니다. 클러스터를 스크래치(scratch)부터 구축해보고 싶다면, Kelsey Hightower의 [쿠버네티스 어렵게 익히기(the Hard Way)](https://github.com/kelseyhightower/kubernetes-the-hard-way) 튜토리얼을 확인해보시기 바랍니다. + +# 릴리스 팀 + +이 릴리스는 쿠버네티스 릴리스에 포함되는 모든 기술 콘텐츠, 문서, 코드, 기타 구성 요소 등을 제공하기 위해 팀들로 모인 매우 헌신적인 개인 그룹에 의해 가능했습니다. + +팀을 성공적인 릴리스로 이끈 릴리스 리드 Savitha Raghunathan에게 감사드리며, 릴리스 팀 이외에도 커뮤니티에 1.22 릴리스를 제공하기 위해 열심히 작업하고 지원한 모든 사람들에게 감사드립니다. + +우리는 또한 이 자리를 빌려 올해 초에 생을 마감한 팀 멤버 Peeyush Gupta를 추모하고 싶습니다. Peeyush Gupta는 SIG ContribEx 및 쿠버네티스 릴리스 팀에 활발히 참여했으며, 최근에는 1.22 커뮤니케이션 리드를 역임하였습니다. 그의 기여와 노력은 앞으로도 커뮤니티에 지속적으로 영향을 줄 것입니다. 그에 대한 추억과 추모를 공유하기 위한 [CNCF 추모](https://github.com/cncf/memorials/blob/main/peeyush-gupta.md) 페이지가 생성되어 있습니다. + +# 릴리스 로고 + +![쿠버네티스 1.22 릴리스 로고](/images/blog/2021-08-04-kubernetes-release-1.22/kubernetes-1.22.png) + +진행 중인 팬데믹, 자연재해 및 항상 존재하는 번아웃의 그림자 속에서도, 쿠버네티스 1.22 릴리스는 53개의 개선 사항을 제공하였습니다. 이것은 현재까지 가장 큰 릴리스입니다. 이 성과는 열심히 일하고 열정적인 릴리스 팀 구성원과 쿠버네티스 생태계의 대단한 기여자들 덕분에 달성할 수 있었습니다. 이 릴리스 로고는 새로운 마일스톤과 새로운 기록을 세우기 위한 리마인더입니다. 이 로고를 모든 릴리스 팀 구성원, 등산객, 별을 보는 사람들에게 바칩니다! + +이 로고는 [Boris Zotkin](https://www.instagram.com/boris.z.man/)가 디자인하였습니다. Boris는 MathWorks에서 Mac/Linux 관리자 역할을 맡고 있습니다. 그는 인생에서의 소소한 재미를 즐기고 가족과 함께 시간을 보내는 것을 사랑합니다. 이 기술에 정통(tech-savvy)한 개인은 항상 도전을 준비하며 친구를 돕는 것에 행복을 느낍니다! + +# 사용자 하이라이트 + +- 5월에 CNCF가 전 세계에 걸친 27 기관을 다양한 클라우드 네이티브 생태계의 신규 멤버로 받았습니다. 이 신규 [멤버](https://www.cncf.io/announcements/2021/05/05/27-new-members-join-the-cloud-native-computing-foundation/)는 다가오는 [KubeCon + CloudNativeCon NA in Los Angeles (October 12 – 15, 2021)](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/)를 포함한 CNCF 이벤트들에 참여할 것입니다. +- CNCF는 [KubeCon + CloudNativeCon EU – Virtual 2021](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/)에서 Spotify에 [최고 엔드 유저 상(Top End User Award)](https://www.cncf.io/announcements/2021/05/05/cloud-native-computing-foundation-grants-spotify-the-top-end-user-award/)을 수여했습니다. + +# 프로젝트 속도(Velocity) + +[CNCF K8s DevStats 프로젝트](https://k8s.devstats.cncf.io/)는 쿠버네티스와 다양한 서브-프로젝트에 대한 흥미로운 데이터를 수집하고 있습니다. 여기에는 개인 기여부터 기여하는 회사 수에 이르기까지 모든 것이 포함되며, 이 생태계를 발전시키는 데 필요한 노력의 깊이와 넓이를 보여줍니다. + +우리는 15주(4월 26일에서 8월 4일) 간 진행된 v1.22 릴리스 주기에서, [1063개의 기업](https://k8s.devstats.cncf.io/d/9/companies-table?orgId=1&var-period_name=v1.21.0%20-%20now&var-metric=contributions)과 [2054명의 개인](https://k8s.devstats.cncf.io/d/66/developer-activity-counts-by-companies?orgId=1&var-period_name=v1.21.0%20-%20now&var-metric=contributions&var-repogroup_name=Kubernetes&var-country_name=All&var-companies=All)의 기여를 보았습니다. + +# 생태계 업데이트 + +- 세 번째 가상 이벤트인 [KubeCon + CloudNativeCon Europe 2021](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/)이 5월에 열렸습니다. 모든 발표가 [온디맨드로 확인 가능](https://www.youtube.com/playlist?list=PLj6h78yzYM2MqBm19mRz9SYLsw4kfQBrC)합니다. +- [Spring Term LFX 프로그램](https://www.cncf.io/blog/2021/07/13/spring-term-lfx-program-largest-graduating-class-with-28-successful-cncf-interns)이 28명의 성공적인 인턴을 배출한 최대 규모의 졸업반을 가졌습니다! +- CNCF가 연초에 클라우드 네이티브 커뮤니티와 함께 배우고, 성장하고, 협업하기를 원하는 전 세계 누구에게나 상호 작용형 미디어 경험을 제공하고자, [Twitch에서 라이브스트리밍](https://www.cncf.io/blog/2021/06/03/cloud-native-community-goes-live-with-10-shows-on-twitch/)을 시작하였습니다. + +# 이벤트 업데이트 + +- [KubeCon + CloudNativeCon North America 2021](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/)가 October 12 – 15, 2021에 Los Angeles에서 열립니다! 컨퍼런스와 등록에 대한 더 자세한 정보는 이벤트 사이트에서 찾을 수 있습니다. +- [쿠버네티스 커뮤니티 Days](https://community.cncf.io/kubernetes-community-days/about-kcd/)가 Italy, UK, Washington DC에서 이벤트를 앞두고 있습니다. + +# 다가오는 릴리스 웨비나 + +이번 릴리스에 대한 중요 기능뿐만 아니라 업그레이드 계획을 위해 필요한 사용 중지된 사항이나 제거에 대한 사항을 학습하고 싶다면, 2021년 9월 7일에 쿠버네티스 1.22 릴리스 팀 웨비나에 참여하세요. 더 자세한 정보와 등록에 대해서는 CNCF 온라인 프로그램 사이트의 [이벤트 페이지](https://community.cncf.io/events/details/cncf-cncf-online-programs-presents-cncf-live-webinar-kubernetes-122-release/)를 확인하세요. + +# 참여하기 + +만약 쿠버네티스 커뮤니티 기여에 관심이 있다면, 특별 관심 그룹(Special Interest Groups, SIGs)이 좋은 시작 지점이 될 수 있습니다. 그중 많은 SIG가 당신의 관심사와 일치될 수 있습니다! 만약 커뮤니티와 공유하고 싶은 것이 있다면, 주간 커뮤니티 미팅에 참석할 수 있습니다. 또한 다음 중 어떠한 채널이라도 활용할 수 있습니다. + +* [쿠버네티스 기여자](https://www.kubernetes.dev/) 웹사이트에서 기여에 대한 더 자세한 사항을 확인 +* 최신 정보 업데이트를 위해 [@Kubernetesio](https://twitter.com/kubernetesio) 트위터 팔로우 +* [논의(discuss)](https://discuss.kubernetes.io/)에서 커뮤니티 논의에 참여 +* [슬랙](http://slack.k8s.io/)에서 커뮤니티에 참여 +* 쿠버네티스 [사용기](https://docs.google.com/a/linuxfoundation.org/forms/d/e/1FAIpQLScuI7Ye3VQHQTwBASrgkjQDSS5TP0g3AXfFhwSM9YpHgxRKFA/viewform) 공유 +* 쿠버네티스에서 일어나는 일에 대한 자세한 사항을 [블로그](https://kubernetes.io/blog/)를 통해 읽기 +* [쿠버네티스 릴리스 팀](https://github.com/kubernetes/sig-release/tree/master/release-team)에 대해 더 알아보기 From 7a746df1a5203268619f6ce40642d8b929b709bf Mon Sep 17 00:00:00 2001 From: jmyung Date: Thu, 5 Aug 2021 18:59:08 +0900 Subject: [PATCH 080/279] Add jmyung to sig-docs-ko-reviews --- OWNERS_ALIASES | 1 + 1 file changed, 1 insertion(+) diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES index ea9761f277..58002ea61a 100644 --- a/OWNERS_ALIASES +++ b/OWNERS_ALIASES @@ -133,6 +133,7 @@ aliases: - gochist - ianychoi - jihoon-seo + - jmyung - pjhwa - seokho-son - yoonian From 2eda36ea27cc822adf2be9178c7fb7fc9069b25a Mon Sep 17 00:00:00 2001 From: Vijay Kumar Jalagari Date: Thu, 5 Aug 2021 16:10:36 +0530 Subject: [PATCH 081/279] Selector expect map not string If we using string then k8s api is throwing validation error ``` (HorizontalPodAutoscaler.spec.metrics[0].object.metric.selector): invalid type for io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector: got "string", expected "map"; if you choose to ignore these errors, turn validation off with --validate=false ``` --- .../run-application/horizontal-pod-autoscale-walkthrough.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md b/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md index 0e6ebd97d0..6328d458fb 100644 --- a/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md +++ b/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md @@ -397,7 +397,9 @@ section to your HorizontalPodAutoscaler manifest to specify that you need one wo external: metric: name: queue_messages_ready - selector: "queue=worker_tasks" + selector: + matchLabels: + queue: "worker_tasks" target: type: AverageValue averageValue: 30 From cd44e2757fdfe5ab23185d86493822573253df0a Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Thu, 5 Aug 2021 11:53:21 +0100 Subject: [PATCH 082/279] Link to v1.22 release announcement from removals article --- .../2021-07-14-upcoming-changes-in-kubernetes-1-22/index.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/content/en/blog/_posts/2021-07-14-upcoming-changes-in-kubernetes-1-22/index.md b/content/en/blog/_posts/2021-07-14-upcoming-changes-in-kubernetes-1-22/index.md index 4c3fbdefee..6759bf4975 100644 --- a/content/en/blog/_posts/2021-07-14-upcoming-changes-in-kubernetes-1-22/index.md +++ b/content/en/blog/_posts/2021-07-14-upcoming-changes-in-kubernetes-1-22/index.md @@ -19,8 +19,9 @@ is that they have been superseded by a newer, stable (“GA”) API. Kubernetes 1.22, due for release in August 2021, will remove a number of deprecated APIs. -[Kubernetes 1.22 Release Information](https://www.kubernetes.dev/resources/release/) -has details on the schedule for the v1.22 release. +_Update_: +[Kubernetes 1.22: Reaching New Peaks](/blog/2021/08/04/kubernetes-1-22-release-announcement/) +has details on the v1.22 release. ## API removals for Kubernetes v1.22 {#api-changes} From 1b8686e66a2a0166e9955d0354ffb6f23e876376 Mon Sep 17 00:00:00 2001 From: Jason Haugen <56001173+haugenj@users.noreply.github.com> Date: Thu, 5 Aug 2021 09:18:38 -0500 Subject: [PATCH 083/279] Update kube-scheduler.md fix a small grammatical error --- content/en/docs/concepts/scheduling-eviction/kube-scheduler.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/scheduling-eviction/kube-scheduler.md b/content/en/docs/concepts/scheduling-eviction/kube-scheduler.md index bfbd65d0ca..916f050513 100644 --- a/content/en/docs/concepts/scheduling-eviction/kube-scheduler.md +++ b/content/en/docs/concepts/scheduling-eviction/kube-scheduler.md @@ -47,7 +47,7 @@ functions to score the feasible Nodes and picks a Node with the highest score among the feasible ones to run the Pod. The scheduler then notifies the API server about this decision in a process called _binding_. -Factors that need taken into account for scheduling decisions include +Factors that need to be taken into account for scheduling decisions include individual and collective resource requirements, hardware / software / policy constraints, affinity and anti-affinity specifications, data locality, inter-workload interference, and so on. From 111b8032e0b071523eacd686e812277305a41a6b Mon Sep 17 00:00:00 2001 From: Mauricio Poppe Date: Thu, 22 Jul 2021 06:55:35 +0000 Subject: [PATCH 084/279] Feature blogpost: CSI Windows support with CSI Proxy reaches GA --- ...ndows-support-with-csi-proxy-reaches-ga.md | 76 ++++++++++++++++++ .../csi-proxy.png | Bin 0 -> 257248 bytes 2 files changed, 76 insertions(+) create mode 100644 content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md create mode 100644 static/images/blog/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga/csi-proxy.png diff --git a/content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md b/content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md new file mode 100644 index 0000000000..0dd00f223e --- /dev/null +++ b/content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md @@ -0,0 +1,76 @@ +--- +layout: blog +title: 'Kubernetes 1.22: CSI Windows Support (with CSI Proxy) reaches GA' +date: 2021-07-27 +slug: csi-windows-support-with-csi-proxy-reaches-ga +--- + +**Authors:** Mauricio Poppe (Google), Jing Xu (Google), and Deep Debroy (Apple) + +*The stable version of CSI Proxy for Windows has been released alongside Kubernetes 1.22. CSI Proxy enables CSI Drivers running on Windows nodes to perform privileged storage operations.* + +## Background + +Container Storage Interface (CSI) for Kubernetes went GA in the Kubernetes 1.13 release. CSI has become the standard for exposing block and file storage to containerized workloads on Container Orchestration systems (COs) like Kubernetes. It enables third-party storage providers to write and deploy plugins without the need to alter the core Kubernetes codebase. Legacy in-tree drivers are deprecated and new storage features are introduced in CSI, therefore it is important to get CSI Drivers to work on Windows. + +A CSI Driver in Kubernetes has two main components: a controller plugin which runs in the control plane and a node plugin which runs on every node. + +- The controller plugin generally does not need direct access to the host and can perform all its operations through the Kubernetes API and external control plane services. + +- The node plugin, however, requires direct access to the host for making block devices and/or file systems available to the Kubernetes kubelet. Due to the missing capability of running privileged operations from containers on Windows nodes [CSI Proxy was introduced as alpha in Kubernetes 1.18](https://kubernetes.io/blog/2020/04/03/kubernetes-1-18-feature-windows-csi-support-alpha/) as a way to enable containers to perform privileged storage operations. This enables containerized CSI Drivers to run on Windows nodes. + +## What's CSI Proxy and how do CSI drivers interact with it? + +When a workload that uses persistent volumes is scheduled, it'll go through a sequence of steps defined in the [CSI Spec](https://github.com/container-storage-interface/spec/blob/master/spec.md). First, the workload will be scheduled to run on a node. Then the controller component of a CSI Driver will attach the persistent volume to the node. Finally the node component of a CSI Driver will mount the persistent volume on the node. + +The node component of a CSI Driver needs to run on Windows nodes to support Windows workloads. Various privileged operations like scanning of disk devices, mounting of file systems, etc. cannot be done from a containerized application running on Windows nodes yet (Windows Host Process is available in kubernetes 1.22 as alpha). However, we can perform these operations through a binary (CSI Proxy) that's pre-installed on the Window nodes. CSI Proxy has a client-server architecture and allows CSI drivers to issue privileged storage operations through a gRPC interface exposed over named pipes created during the startup of CSI Proxy. + +![CSI Proxy Architecture](/images/blog/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga/csi-proxy.png) + +## CSI Proxy reaches GA + +Since the introduction of the [CSI Proxy KEP](https://github.com/kubernetes/enhancements/tree/master/keps/sig-windows/1122-windows-csi-support), storage vendors integrated CSI Proxy into their CSI Drivers and provided feedback. We learned about use cases where we needed new APIs, as well as getting bug reports, bug fixes and documentation updates. + +We've updated the [KEP](https://github.com/kubernetes/enhancements/pull/2737) which now reflects the current CSI Proxy architecture and added additional [development documentation](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/DEVELOPMENT.md) for people that want to contribute with new features or bug fixes. + +Before we reached GA we wanted to make sure that our API is simple and consistent. We went through an extensive [API review](https://docs.google.com/document/d/1sBP8f_mwV0N_xRRQQGDwHZpU_nTHtpFxdi7LKSUtgX0/edit#heading=h.inwrahdkakje) of the v1beta API groups where we made sure that the CSI Proxy API methods and messages are consistent with the naming conventions defined in the [CSI Spec](https://github.com/container-storage-interface/spec/blob/master/spec.md). As part of this effort we're graduating the [Disk](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/disk_v1.md), [Filesystem](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/filesystem_v1.md), [SMB](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/smb_v1.md) and [Volume](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/volume_v1.md) API groups to v1. + +CSI Proxy is compatible with all the previous v1betaX releases. The `csi-proxy.exe` binary deployed on Windows nodes still serves requests from v1betaX clients thanks to the autogenerated conversion layer that transforms any versioned client request to a version-agnostic request that the server can process. We added several [integration tests](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/integrationtests) for all the API versions of the API groups that are graduating to v1 to ensure that CSI Proxy is backwards compatible. + +We've also considered the scenario of a version drift between CSI Proxy and the CSI Drivers that interact with it and provided a way for CSI Drivers to perform a smooth upgrade to v1, GCE PD CSI Driver can recognize which version of the CSI Proxy binary is running and is able to handle multiple versions of the CSI Proxy binary deployed on the node. + +CSI Proxy v1 is already being used by many CSI Drivers, such as the [AWS EBS CSI Driver](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/pull/966), [Azure Disk CSI Driver](https://github.com/kubernetes-sigs/azuredisk-csi-driver/pull/919), [GCE PD CSI Driver](https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver/pull/738) and [SMB CSI Driver](https://github.com/kubernetes-csi/csi-driver-smb/pull/319). + +## Future plans + +We're very excited for the future of CSI Proxy. With the upcoming [support for privileged Windows containers](https://github.com/kubernetes/enhancements/issues/1981), we plan to use CSI Proxy as a library in CSI Drivers in addition to the current client/server design. This will allow us to iterate faster on new features because the `csi-proxy.exe` binary will no longer be needed. + +API support for the iSCSI protocol is in the alpha stage, we plan to make additional enhancements before graduating it to v1. + +## How to get involved? + +This project, like all of Kubernetes, is the result of hard work by many contributors from diverse backgrounds working together. Those interested in getting involved with the design and development of CSI Proxy, or any part of the Kubernetes Storage system, may join the Kubernetes Storage Special Interest Group (SIG). We’re rapidly growing and always welcome new contributors. + +For those interested in more details about CSI support in Windows please reach out in the [#csi-windows](https://app.slack.com/client/T09NY5SBT/CN5JCCW31) Kubernetes slack channel. + +## Acknowledgments + +CSI-Proxy received many contributions from members of the Kubernetes community. We thank all of the people that contributed to CSI Proxy with design reviews, bug reports, bug fixes, and for their continuous support in reaching this milestone: + +- [Andy Zhang](https://github.com/andyzhangx) +- [Dan Ilan](https://github.com/jmpfar) +- [Deep Debroy](https://github.com/ddebroy) +- [Humble Devassy Chirammal](https://github.com/humblec) +- [Jing Xu](https://github.com/jingxu97) +- [Jean Rougé](https://github.com/wk8) +- [Jordan Liggitt](https://github.com/liggitt) +- [Kalya Subramanian](https://github.com/ksubrmnn) +- [Krishnakumar R](https://github.com/kkmsft) +- [Manuel Tellez](https://github.com/manueltellez) +- [Mark Rossetti](https://github.com/marosset) +- [Mauricio Poppe](https://github.com/mauriciopoppe) +- [Matthew Wong](https://github.com/wongma7) +- [Michelle Au](https://github.com/msau42) +- [Patrick Lang](https://github.com/PatrickLang) +- [Saad Ali](https://github.com/saad-ali) +- [Yuju Hong](https://github.com/yujuhong) \ No newline at end of file diff --git a/static/images/blog/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga/csi-proxy.png b/static/images/blog/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga/csi-proxy.png new file mode 100644 index 0000000000000000000000000000000000000000..7d1f42af944fd599cfcc78726bc7416fa1266f23 GIT binary patch literal 257248 zcmeFZby!qe7cdS828e)^fP|=oQj!uwOGr1;-3;B0f+D4Yba!_T14uWLLyvR}4MWH8 zp!dG-^?vvJp8Nmro#&Z3XZG2#_F8MNy=tEzd0BC6Oj1k~6clVp2~kB9l-s>1DCh*Y zZvrLZEyT+xD0dCaMMUH!MMS9N?QKlVt&CAnB!a%G-BMTTB1+O!lr;0ZEpZ1LG<1jR z={q7J!91#GkM2B)e1Px&kz8B#TV*hvs-ueNU?qxyNb6SG_?dx_v9Y#RTVQwmC*Pv8 z?xX&rzC;1j{_||3)J`Y_4{k8(-8?u!3kbm{ zCdN*=d*BmY&4rS-UR;+`bIE?1PTE8~7zn6AMPUsch&H{EGJ}RJ5EkNG9P~yj%~z)T zjFw`EVwWP=ODvpld$;8LT=E&;ErVNT%x_(9wQlsGd$5VvA*A($tr3b^sY51IOcgT_|b%Ad^feVDTl%6^UM8WdNHCHk=h9eai6 zB;$A-HR0)sJ-dVD$)0!Pvoj)N@O|+XA1Q`;?43sX`?Oht(ikY|M6bUXQjGOqRfn(Q zvZ##$-j6>ZL=|O+P{Ji%aJo|wr_!-YC-ROx`$A*B*GAEaDLl{N05Nv6BlSpN=nj@& zE2QF7AfPc@o_~z>V_tcGVX(}kF`cg=qH?W#h0TZpe?9+Wu|`> zqP0UX?}>}C_ru2cieW9K+Gq#e;>pzxlW*zrw=B}L?64aggQTJMzR{U%dXje^2i|`i zG$$%PjgHfLv1@jGH?WV~bfMwKpm!xL-_r^_3cMox$vf4wuRkuq+gM2}L@sS*+GF7+ zAyY!K%zWrLz8jxNOy_BuFpl1NzjVbt*ubdNl9|q%ese`L@a=9xZf$$m{A(e45xQ># z@3&1Yc+EYq%W|HbT6>L@n%qa)e=MAXc`?jdD`T1CnGHnFK+U%bS~L{I#c zSy0E`+=Z1tltyK1(vnB(Zc;44EWjZ9MpSZR66b0@bJ*G&OEXsTeLF$t>GvkD1rGcZ>tqUkWv&s67D4Hz{D-AQivSZSy|ek>uEDs`{t*gQU|ygSWQYl@0FM@z~+nf$VTfgT}=?r8gdZmS}%ss)#}#)k;hF z>9vHV1Vo}kQcZ$9wfzBR%UdbcxCoYdHh`Nk=hYV3q~XXk^)&76&3Y0s(9=HW6;>cLd-&_hG`{* zg;&bjaDthZ29J!Sru3AoW!g*@G;4Ux`9RN|6zba$qa!0A=_BY<-1nWLsBf6aVqmOj zq-eMy?LzT=nqhv+U~Gy~hEh?v?#dV0Xr@;%+35TpSYoDTu7|`?7C4+jWI%>lm08#3 z^QQJdFp(se=2-&a;kYCw=Q6!ch~Y}^dr4qLo4G11IGur*c;fcH@R;b--KXm zVAo+Iu|e1o*x972q!b)hrUufyG~uxwTFuiP_2154wp!gb{b1JF{HRi-=&qY7`v~2* zgpsmEMaOF0ptxa_U5s7PF6)B(!Wm6XP(;^*2znYaY1vpuY>o%(0?I5Ej;jr+F4780 zw8O5$YgwAo%yEY?vGK2Bx_ZZA64?=~rg698S7M6U1x#kmzm?ps_@rJ?@e;ht+w-YS zf2s7DI%5G?N~uReDs#!CN3}=ixkvt!e1m+D>QQ0tm=%Hn@pY_kY=)DFGu_%`d}MsO zG;_Snx~(eTdSJYvyu4bf^lY$bcB>Zp88pz)+0cHObYtdGr+%5p*A@=(w8v8~V0O?2 zW7?6f9?1>mHODRzr$gtcm&Gn%GO-8CywW@c7UMF+aabLh-!t2n=4_XDR_EGU5bqlw z>a$T>x0d0Vih0^0?fV>N*4<$;aO+6TQqA-!-7VQIw4>KYmK2WRw&4>L*c8QliJ(_W zWPCPmFY3iSE>=f3kP}lKnp@h4nKi?Oh`I9q6`Cnu@(!I=euUHx_HN>)N9)nsK<{#GI z2403GJnU!c@4r`CG# zAxlEoNO`fWGoFtv$ycopL9xVUv78e{r=cu7GMOVjC_A{f+CI3ts*tW0(m-rT_Bb>* z9HX>;oUrt0VPk=&gPcO-AwE}@eebYq^)bn=>HPSgXqYJG9#>Uty@JCaZk zk&vX7c+T{c-PrB***Kn|X&CgA#g}K2))J31pJrQ2AxMZh!J{={j>QLG4#*ZZJLJfH z!2VtD>hFltu1hb0@U^}>sCOb}pNWgp#RIIX^LjSP)81R`@=!kq&2JQo1g-(GWeoO1Y}8J&l*$oh0dV79tzGj@z;CZl#w`CH?W>#!Q~{A%6#%> zmDfgshZC|G6AlaL>Q`6Rjvc=pER#gBE%&>=j9_!vXE0J-E?AxzD_-f@KXF(VxO_DKKJNbJeYdVY$_tF(iYywAXM6)`18D1c<_*O;zr_2>%BY|R|XGFQZnP#W$F)Wzw1a5t* zbNWPkStuo!BZFs{3kM`;gthS$zfCmQ29DR5o;jIa z=bpXR|CGZlv@FX(?X;)|BI3d|Qa1vgZJAc8BHmEhy10lA(FJb=Pr~Yxp^b;Wn|@BW zNN!0XKGm5!%^>Gb4+BR6t3=Z8ad4e-QSkAd?;Jjk5`Pv>N}+8Z;%;?W+OY7d!z0c} zMw_-wjt`tP?s>F09s$#6uc%1+$m4YAc)S*2`qDHk8T+NjVgkHYWMyIn!R)G=16g(2 z{ZXvbNMVHp7eW>ta_7pnm)fg7TXz(pYjfLi9IUTd)>{%6b!gc@K07Xq^&P}-R==xG zg7-r%)@A1sXCV$-cw1j*VNl)6rURi-o3O@B^CPgpDa*lJoA{mZEq)?C?_JT|MWv4O z?1Sv30frZP!O0gHtMd?`J6yIz07!JEl9y#E=eWm-;V_>t~jO zmJ6^cxNC#?RuIB%hx5vM8!~j%zU|_v=ks#^#nM9gEPb*>@-u#3Z}9nj z^U4t=2Fv*O0tS@J$$KauLX>u6SMLYe4f{x}w1(`%$2-X-r#j=zvnV6YvQAnnoTw$l zoDjWEY>!a|(2EBt6cle|9)D!Oap54wo^`#weRir7k1FWD5<9Th&@hYi@=Bf~Cxl=N z4jUo0m7a>aa*b!yA^fMFw-2DggH9<A+er+H9D>Ag00i)xivAU#* zj10;%;QlrWIw~m&25^T8eECty{&O#eN{4deXE_=Q%6oGZ^grsz0@v%$C*XVC=GXPc zmq3(Tz`y&z*EI$0&)TC)=_Qq5kOzcc7)clxKR8)NSMkYLpqGEqE z2mXPm%^V$Vd6=19TwIu3*qChWO_^VCb8|DZurjlg$32^Z5m*v8(xiM*=(iF)d(%%-2ttUof#S|EF)D zDc^M|kG#37v6Z^0xix?@U<`g%Rt{FapAG(xNBFGT+=1u)Hz$;bR3s_|on#=@xpLOwJX zl~V?;0GnNZ(5@|Ix?fk|9`&I1%}J&n3W^|#q^OXxE9%C~tpw%Knf6@)ECy&W)w7h_ zA9HdZNNqqnNb&Kd_RWi)gX;n8VjqJP=Ix9RT6zkvH^6~P?z+r97d zYI7O>Nc#UJ94LPBcL2nwI4HgO7dZJ@1&uA?#=pZl3R>!YDi-{_<*c%Q+W_6< z<*k27AavoUf_gN{eKN*)|Bj*n7H#kSD|P|U{_eGJlXOm8d^h#K;V+;8Zp_@ne+dWf z?XM_)vGN>TUtj$zRz%08Vrk+2mvB(wK0`%gOSJ$$3;vf31~9tAzl7s|jQ)S2!v7fk zA6M=F82uml<$n_WpSP#~N%Vi*p8hA%|8aZzpX&0@`r!Xmmw(j5{->k=vp)FGs*B(y zI{)eFW6g4t(9NnT@CmO3{!zVt%T14iLGjHIB{}Q)q&>)q?&Tga??MRMp2sKL4XE-Y zgdlD{)-%4%wwGBPrb zs_*ZS7nGH;o;Jkjo}a=Rt59#;9LMoFZZTjok?kQ061AGCa~dnsh9qo7CqBY;_M4p4 zupG@(iFnX(d1`s~4aZv#pH|jt$a@dE`&pdA9Ebln#R)OSxS5(In`nWt%vj~!M-eeLOb{-*DZdnF?G zxSwoFIz%24&>-R0HjNim zxG4qHmik`8XFuMDmZrf&w(CUvgp@6~N<>3HmG z$UBGqPU26hfDxlXLG*_W)8vnVwec2*pC#aR)r1Kd*-P6LoM&_u-_u?NC)_YD*PY=D z!mdXTu$ZZ4m3;i>T()>Bn7wS2@_{3na}ki{=j=b`#vU!`X0K;2Iq6uGn}t8J2lTS{;M z<1J-Y&vE}Cn7N^3G+#|qMdhou=Wg5KglY1G6HGh$Yk;?$9N(_!l*cx-e6oR?b11am z=jsgZJgTCW2}1EnPaxY3 zmW>yiHu3cy$jH=v>2HIMN?DtUV9L^-1MOFHX?1lxkkz!{bGOv(hke{@9&*Y2URJyF zZGEI;+y~!9ygE}2JHq?^lZs*}y*f$0+U4>C)*E^)+tn3O|VkB2Vu*sim7hTLNA6->Rwc@WyNPr$~ZQx z7sT73o1{ItZ2O)na)EuIR|KYh9zwu3S_I<}Ao$VMk)b!-&%3=bAc>t`wh+b}2j)kJ z&3z<%ZWRtX?Cj8=phYugOrc6Ba$4swKALekavH5vh8j-;g!4Abv_c`MQ2y|vw1c9@ zWZz^$jH_w1CnzwctD-v3FpN8^i_3+OKmmm&qA7%mspbco&kPx-mAXcBR|M_ZtYsW& z%$<8*g6nRcy*}r*o@Dnpo_p_bKjw3~d-$Dxc&j1CcDebs-c+D>l5O*y2L3+s81o#h z6OGHx$Km7CwGLjs9J(EJ%NJ2n9;WWr^vhLrfn`gllbUy(((eA|gAg3QcB&M%=oT5`8XD#?r;ZS5@6vwX}CFKYTpfZiLJ7ZdR<8Y1O}6&q?2yb{MGK z_FUl&olH#HQ??a*^igjJn{{TSb|uMUW5DOKd@X#Ew1H|y*}{(mc{AnvYX^AFuq`=r z!?D3zIb?P@xVMaVtEMH%eVyLpWGR}goCHDbD@f`Gzq&l~mPlh8;9~ndVdGQZbT_`Oe%qhNo&=^WzZ8z;Pk`q)~O2r`HqM{eaLLi z5naHdzof|HHTd3Ak4!Q?rag`9>BAUS|wsOfk02i7k65PVxH54 z9wQ4n(X@e>ug}#^wdsG9bgo7no#3XHUpc)|E1q6_UdvO-Uk?Z+6pQM@Vy^%GW9O?y<4Us6tPinL ziYk1QpmPgWtZSuk;ZhwKmS_%La88();h)rW8r=?dzfj0gi*Q#_jJJ3_CR=M^lZX{D zjVoRU23L-%9xg`6#rX%rFAu8`*w`yr3zrdVm9G$%@VcsJ4+{rwdPR?I8*Xq&!BCNt znU){BQxO3P_){92#fY*jChfZMB#*5%U9Kg8SPIRK?KlkgoJkZDRA}hX0N!c}0oNniGyAz|&~ZCMn{d2$ZcutlbJiz; zn*jM!HtPqjT_S?ae|+xQB+Rv_Btz+QUb>x2Ghu5-`bA<60|T|;>SFs$r_GT8+a<$i zQuPrL1|EAT8CO4!Pde3GaO*Sql$78iL}>&V#d0;V@e*0w;1aKUK2OYVmLeD?9I?Jj z!%3IY^nri-p!QQiQR&$jf=cwuO99tn!_}Lm!uK)n=B`AvN^*4)zD(q@NxI&%F9Qqx zbN1wG*xocrd>gSWhH_ft=#+9<3tXK$z?I_oI|!p*o-9Uq)e_i$?Yp{wU!53q?KGTi z?Q_-O_vFtmI8PW8Zx`$oG!u{(?QE0}RBd}7K?W`8ac$d4Opg)efpdyve3!=y&gZ)w zQv=?I<*V+c%%qsT=eyxP2b-A-&wixFUy;(hUKt|Nw3>6tT;MTE?xi zT9_?JsqRpCh3rv>K-e0A1%Wx0~zAlpr4lh+i|AJ86iwXW7!#@u*5 zbR|oNn^85$T};)rmYobf^%~8<4Q3$F8sxD!GlD+3xY+iozScT!g)OFft!X8{Fbv$r zqa9oMs;2XTT(>ct=ay4gr&`D8j#f~FH!Tu!ut0hB(oW$3>TdHT(fyvXt&|Yv#n#x^ z*d&=vJ)So6u%W5O_G;L0eW$ob{>m#155n)m+p#on5OGljiS`q-n5OjV1qfYOk@m%Q zeFNKCU7E8T5;Fe1^3~bJV7T|<4Z(FUyUX*F27XNDyp{GJq=j|sXAo~JGD> zvF-oO4g67}2^940KOq89jOo764<6JU^Wav|m8Twam$($MY^JhhukeWLf@S7%ti@-#?pb;_X(aE=?zBwF2eR2` z^I+-Ii^!8Ytqwc6IhZD`T_A*euG&tn=k!&POUwr> z(O1*hKRQR%bjj_witxE4&t^g29@@#RWodWJJlTzUmJS&tw1WzWf}zNiU*-T>(NT{f& z0BB?!UWq9x#g<`m#JBtA8>qV9<5bvhRCl%odAucNH>BbuV-IB))v~1l*YfjfeSbXP zjBdA&Y@bO8t4YN~^o1wRxr+wX%)+UeGVtv5zkVR&q;vR%(J1GD0K=U}^!Nk{s4S#vvT014s?H_TepBHiCFu8_Lt? z<6KPjk%u0k2=1KOl?*INQ7wt*&Rmxsaag6TeGWo_AF$3_`>0xW);&z;1umG{WNX1T#0>jz4ukMiSRGNj zH)XH52g0KS(f5@4Oz%r0)-r|-;=*cma=!U99!x|Yx_RK$jj@on?_@>HAJTxMv&!pK zM?bMGR)>sW>^T@e<$H-JC|}<+XnuF+^2~O_Um8(p%?dqi-%5u4rt_enwLKNYVS7cO zlScRJ0l{0}q`RXLanV}#lB#WkxOd#=)#YOIc%4DmTmBrEUEUzOyzD|`tLw%h*nN`O z=R|6FN0@Y3yanaSy|a|Lo7eiAK!xZ=)i;EZ2rEXBu;KhsvwW!DlUX>%ZUcm zyL!hFM3}FGUR1Z9S3_Gc+E)*Gvz~lDhD+-H(QR0UE0j0T9sH@-o!6F2=wcYYZrwDK zu`jolZ;An0+5|s2p1lR=qV+YK9Fgyn_C}v*B5P8tfo9XTZ`aIiur)JNDGo%7v5Jl< zu%`Ra;Adg(T;J{3Vp-SpO->KivL5LkL_(6PREr5nF-1WXIphZib%7_}Bih}Exa=^i zU`hw1&qU;|Zniu`N91Lv8_CJ$)1q>(tyv_7lTN-`NluDW+rE`97P=?*;MUn3Et)>T z_evcQ%A%zr4(sU!%!z7ZQP}3vy?}y_-TcE{&`B}Eay|o5Sae529LA?TFw!DamKr;< z5QO!345IU7OKBT9k)m(Fy0(;(N@3!E5l+I^juZSP?>)&^O;~EHBuwJX69oAyP*u)* zVkGHjD@Ep8OdD(O-zjWULN=>3%SOK(en}r-&>lAI$$zAFaPnpR?2~(_eE40a#UGm^ zhwa`^rm_+GVoecdg+nlwG{ykzXkYIijS zoJTB(j}!J9Ckp?JQHbgwN@or#Smc#DG9k) z=4zDWsgEo2s;k0K%Cmo(?~(`7PAv>b1vv)y$h-LnWT zdZqQ?@jTdwW=0fLToZ5GQ2jaMc}?v4XED$Nc4v#6_avacLW*0YaR8UmjCTMo50aDN zJ@O<)(4*rcLm^4uLtC((htw# zlCJC1l+u3wQ4<6WL*GX#!Q_Z(f)WXjG@uV_^z;_n$!tPu1Wl&P#<{xIKW)@pdr&q^ z24U-uL}6+&>xDfSG@iA}RjocuRJb!thp*}=Oh#_JyL`I!+?8_5Bk*uyoWi6+rtVM{ zIgy{_H$tXaMo$dLi!;%(f#=9&SR{qXm&$6aNYRlVt@#YNIFd7aABMfMS;V|+z{Y;nu$xLz8)tJ)5#X;U;N~uJD;)7rh*f$!8Ka> z3QCh}n%OQ5e)-Y|TWvdt>40dE12hx4aV}l$U1y9@;3%5@FhIlc}V_8DC46{6X=2z$ci;mVVHSY3s}uV;CwQ-HSqEh4@>%7s5dfS z_vDc%d!(X>Qo{|lx`}KmnLPd11aX5hfy!KV_j};uO(B88-?3MXA`mCE_wP7uOXy-)Zqyf4>?+z)XrC6U%D+Is8#wN7C_v*)50)`VtDh# zu_n3I(8S%LI<+YTEut%HuI0VB<1p7~#v?f`99~J{TP^-(sr>IbG9=3A-;jU7Fwxqk zl58m?O%rdKMvp+?JvC=xS5Mk7t!oMqR*2SdH!th^(%(bF5>W)@s7OcXXU&$fzf&$t zHLoyWLSrK}*a`PJH-s)&eCS@j-AjiX`LdQ`pBnRiMm#}?#358@MIx_BdH%AD+qnph z4cIR+OxPDy<|AJ|0R#l^R8vTI-1=nN2{!g%-X=$@TG^G0{Lbq~fX!2eP$+Z47a%r( zbsdajKC7E8G~hxOS8l(($3qA9&O(lf#p-x0+-oBHJ=?)A4M9VQxJ|khEhzC9rFmd^Nq} zL{d)f`oj;8i$Hb=Nl1M@d(^Pv@l<|*I4FV)%*5(_eq1xL?$mP+qKxBM;_$c{0q^01M$3ENE}Vc7!*tt?T^*?F3Ek}INR zP6yiZAa(kRhrGELBUm4+h9fsi9SCE(oIDT-b}jsEs@(H|rXOokgXX<$_6BDGVrA4- zU2BneTnDOJUI$|OrWj0byRiLY*;$GK*%D4zpt@~J0~-nCcVGooHN0Qnmjyj;lbzH7 zv9!y^j%iLAxo?Kf2o(R_){sgG_^9;m@hgQVf9@xre6eC<$l{t0*qrS}Fk-QYMNMnL zr-kC-6wBbK2_273<1I-a2T-IsVyrM7k>Ng=_6o~^ORi8QUlpm!{fCo@<4F9_y=SP; zw#6of%%o#FbY#^ck=KRO1;3NWX`LVu_8rRwe|$RBz(MYmt0J$K%xpOj;{~y>WL*)2 z-eODA$w6*iJUX0|qg(5^Q!JcuhQr15O@$a_cU(jr| z7u8Z_o9n*4g%jpYv8M6;JI4%i!=Okls>U)GQfhH3{pmdoF%=6;D%xiT>fz!5GCPKy z4gkBYDbvOexTWsaO}B$dpINt+SjY>j>qx?k!vJX6osGroUiTz+x)D>#A{>&WGvuvP z8^7zV2^$W&cAdLheQiOu8lIjzJ|Yp&-PfXP)uL*;as+7|pVW=zT^w+8d7U~s%+X$P z=X$M|3w3;7fnt4(!Fm>lC~Vh488u4X%L{pX6Z<2DCiB6>ygP3>=y1Hnkz(!4mwy3p ztGPS)Ni-Jq6S};eX>5<)q5x(itc$QeJ|5>{6)+t5CfQA>X z!z1~|u*>v;0unZp<0Gb>#ZV_La^20$0S+$o@Qa=I0_?E(xZ1hOa~F<_d(eX+sjM=~ zD;`rMBtziNn&+o#{$b>s{KKK`7_9u0i&r>Fivd`wC-BWg=Sg~SZo^d$`Dj15M$RV* z(iBpwbF&ZmV-9BBTgsN}qJ_%p8WDatw*9stxLXzWnAn#SRvvWKpAW~s2s7(8_CUDE zjWsMi>$MZ6ZGO34jqTHSr30VmCfoHYdC;p zT4oeMPRVWciG8#`Yi~rFL&+TeS#AIU8oSC{nL1HCsCoo16=7C--`5XczmO+HAlvUm}g|LA}TE zH_=TlrAA@^FA>~PC`+%n?oKgTo`nMqdNWgsU{7|k_j(I1rbt#i0gAjC^{5k{ohB^a zzjiL_yzf++pYnb+%wxuPbS1bMqlmV`D4*Respt-{Q8+;bB_doB3~pg&t}d7RQ()2? zvDPNxo?DnEI;qm+(`t)vrk14nmjb~#sXAE}C9WYAu>i&cl6Y4(UUfNC>_h=fRJwx5 zwOTx@J558I?V{X$uBqXE48dKR3Y^=rvt?|i?hD}iLzLc#J z*dLw64D2+1Pwre&Wj$r0RljVt-71_3siLDxZ%XiY$1Ke}y-+QYg`oyiJ6_Vg`x;Ci zF_0h~Ug#hL!-S=Ou}OAJri~rrC3Z5R{F@aW0EB3iUV4Ou{EW57kG|6 zCuTKPkpC*Pd$i51PR9h$@J2j7*6FCJT?VySv{IaeFZ%+zt8$Dff(f%a!yE}g;1{3xet!z!rBm8S(h27=uXvZ(Ce1Lz-<&J>OEFWd0LNVLqwWl_g zl_gzIhJ{{hzZGBZ*b8Hy07deyUryLM_^J@tgh9nmG`*+oI!@+lWchYm_0;SH48!wN z`3N`_BqWu}3@sX}25m|AR^g3}CT%i6T&bv$K6g&&eoqGBTSFcDuBWrRWj##6;NwUMlX-=kO_XI)vgWH5>-1^AlYba~c<&XPlH~6iH!3qtgAad(flCD_|M%o@k9$xQCSMLs; zr>s}r*Bl=&gj)mFk2An+Qz~lOOCkhFPDeI^Px2oYFVD6C+jpuDa0MA+POc`;K4-C8 z{46fUr9!-?39ij#)Tw{T!|a;M(n_rBsh^9+?6BOsEAlRfe~l(Um>*DgGxF*5_M2|t zjHkY*u)ypvgJLn&Gyy?*cY(z(55+@Cms(y0@yfd{0iJix8LBBDN^%jgm>2IJr6Bm^ z4GvqKU-n$!kjy$#OvD**THf>Kn8>+UESBV&PjXu(;RS5E3lF4!y7LhB6B&!g*eV3P z<~598*+xeiygYQ7FwFfW<=Wt$`+eUu;Zr?`;zkOuV!h8+?DTw@*=vR(sxTdoLO_Rh z8bn4wA8>&a5*_-vyNFKWlTDM{vWlapNBV)Jgd~7py*ZsX#@#_zPiF40{Y`oOYvyJO z1CW*xX(Xax#9z*y$NMS_B^@2!-#273e4vP{i_k)xl-wLfa3P zQ(1Z%uP$sThk!^%367_-s_IP$b6)cL(^q1cV|U4UMsS8lBGD{zQh?<$dDJ}=c~Me$ zGW*t%2@1pm8?v8Zn7SGyv)%aH3jXWg-?Fz~(XhB5n8gE;j2S>zd!@?y@$K)z?f1OP z$oD|P^`4oyh2I~wjHy$SEP!MKN{^jyw=P)Zj1?L4{(SZ~Y5#|(^g3lb&Eg*BuWc%2{NTIzNfOua1Vk7+$>2;}}!9KAS#U z^&IX!%vq!bp1H@%Q@4SH=~e@w4vT53{L6#KXST+bpo@dy!(iR>W~Ta`=2iDS8v)l3 zl~X2DtMxzHCS#Lh)~6PDX)(&@y_u2^zBo;6Q&}n~-~mDC26u1&%B{&6p3U7&_a06L zO^eat+47=WMF^*RZt@}4Cgn+V{ps-IW0JJa^OqO|T3IXcsO*G)hcr{HQd*7kV%l(FFGD!~%e zc-B&5-B<(8D0CM3MPCNP!Ocsck?qpAY6Iy@AskB)&2F~84HW|xlSxnP(&7-37B zT5BVQ>00M!%kJ{$Sq6WM8eGEc>2{bL$?d;xL@Pnv#%7rvIm*=+xLED(xBeHVA)V7(>N2;jY8 z`295johAat0B$RQAa+HBKFGE>hX(@1Z@65-;Lf|p0^_fVP2|l)K-WN;E)JZZeXQC% zuflB0$&RIB820{AHMT+82!1*Hza_*f+@o@Vn{TDH>f{@(X zrepdYi5K2n+`Arw*Tr~hYnP36gUjJ{-z^kbPjX69z$bIZ)Eh537V*(8)v zwdd3b_fEV980o0W8O}9!3ldLqbsN`h7Oa=Zicetc<|a#1Hpli>UJGWFEQ3{==Np)m zaX~e>UuLT}tG`-b4)<*CTQZe@blxo3{@Qpb1Ms^Ve)8U#BChdg2j!EI;oeD-;$Y*%o|?|il9C+Tv-I`h zD_FI9J_Tq7kvzW4WVPTCcOs{rWnbQB9ULq^xdOXv)~Lai$Gu*1Yf9nAUb&`Za3Ut7 z%xkPUOnY;IylR|gEh&9M!0#!np|U@rlAc*t8M``FsQS^bd2xD!0M|a1B*1w2VvCEj zY11+t>uI0!W(~40{Z8L8TgcVlvaJ5{7gy(64Yu~M_?0{-sOU$Hm<^<@P3<%_%CWvrTb(Ax|GTttGGm&4>{$HaUT`%3Zix!WH5sRv z?m=3K^ig`)e$R+VDB45JzJin08?ZHLELeOW_BU{PDhc)g!8>F2-iWNFV(5klo0qtb zsS3{YN((E15X#1l_#bUt00wmYOQc`Lb9$eo?JjtlWvv{^?t|j#7}8Vy*;Ra4`l8ME zv6w51brT+7_Z$ao2?&{GSzn`O2vjp~KQxBEPc{XGfd-lLPZUwJ zY=qeWN&O+v_+0oX8Ng3pfH%R8f_fH^qI1&5-?S*qc2U$Yn|JBmh|_bxv;VMB8uT4K zmBgWi2SYy=V8jc1j2K59tJAlX6VqhgYb~tWhoJAw`OeFG@aeB=2y}gt#_t!jxBDt6 z*~bHnDV$QHcnj_K887CGliY@?gZxFYI?iX`8*_4BLcC-BWicBZc@HEsxBaz*)M>_T zaO2kOT3>K(AI5vCi?xWGYpeyHP_yGp?Bf4bf%vPQgW|V?3G5j*Q%Vkh?iqBQC6n0r z8FOI(0!zyLaj>>(XWWyHFU-_w)T``9U!NT$3>O%`592hO*44tHhQBlRU&7jkPBkPQ zS6JIkj1mC_#+ZFMYSBe!lveQ&3ibQh157+U$S!@OLKdn%k7&03xsJ z_P#v2OMH)HU6|Shy*yoDlVvTh+~me3W7u`K0%s?+Rs8`v z%CKL(nv{~INs6!lgwcx?X4|uA+;j%7rh52K3?^fW6x#dYAzSYQa|yugW3Zk3LeY_= z2O#<9*bcH>`T6BSKDJI5azIhh_g+?FSB09Vw|mfgJc|V$`>eYcPfTHpJ884Y4& zJ)%bo!o=&jPbMntWGXAI;EyJ#1#Cn{=iT*z?4}L|dFCh9RjXudw3o)4YCX~|v>eWP z4oe)wn6K~l7?mY!tc>I-twiQqbmq5~NOylVB%)(inplaaFgGv}*Uh7)!nPY7mrNzW zFuC8t8oQD0d;%NGv#gHHFVbZx)={Tf>VAPm5N8fG-;UwlWhS&xbbY?I82CXkTtxaG z^~_)M!j-+2Nmecvq5m(f_P;{x-F2d`S$xvR$Nz|>|D%&R0^nR`zjOB3{{x1<^dx9@ zovdB8mizLLWbOZs{Ev74zXpF%k?MZXqP@!o*6+e61vrCTVW#lpY3hT&VZ9chMue2i z;ZOezu7)3wR6PZxYKQ!gHj_hr_FGQ3FyE3{ z$3HRkbL9}k0{u~2;{MHiT@(VEQpis{y`IG1W!$gnMiv7t_pCK70)Oie9hg4a9q(Tm z|KHI8e91H!D*XcC59m@lf$0;xc`N_$w_++Bpy{4(H`7n7G}8iyt39n{L-FWn{3MkLo-4`LJUT%TmQ*| z?G{P_vXmN*=dmo|MTs*`M>AttGV%5~L{5J-DuDq$05Idf{U-GbO=SR)BMKi*J@OS~ zLica#9TX=wrcLxLtF#z>Mhr3jkCPY>mO8F;7-v96v4yqP04wlf01r}myT9U^&H+^*R%oK0K^1@Kr3=`F{khgadt@dPzV+tV!n=lnSd7Qlxw9|?bF+Ar6v zS0*F=?Pu{vNdT`eDsLJKQF#JA1yYza!wyFt{DHQ;#{h-|iZ%%U`2P#hbTj}kZ6lmO(V=mCr+8Y-mlCxw3Yj_5AJ{D!RDX*Z)Dx^%Cj4-k{FWQ%-*_j#_|l5oF?r{wQb@*TD6M z7XAsc-}Rds6uVd`e*=Jy5*Tu6IBMi)N_2`ZS{rW6M2(%HhF=t;=9nf$kZ3_sQPJ$V zo>-Z6MMISo2ZwV!5u=9st5>g}Gnu@ydDcTDkyD(kN{I&9fs^I6RpuMqDLm}X@yeSd zWBW9mEDp_gXw`dE3k~E#R}srRx5~I>4F~+J`s1ytB%O)^F5DmYINqE{xG`bX;udkv z#;!d@u+N>?$Ni~~v#UQokY6OiI%12BHX0W1*g?O1XjN2Z>~N1A#+ks?<`LSx_|SE? zjd=6hEy{}SvBJ$T-t7wK%}I`)qwVFFHui3z&qfCltcn!6`pFvbW3S?c^BVDt7PLa9 zGM+_DCjWN>NvXJ|z4MuZ`!%`zsPX6=^-Nj#A7f)(kJ$2S_O3w4SV}ar+j(JSpZQ8vUjtjQp+087`0sZB=AV>Txdz zEp&!P+arrdVAy*2;Yw)#nsP^1n;Sm5Nf^(b#I+bwd2*+d0|wv=cn{+}BZpa|a+%s> zF4n=wt-7cJQ29hw>Og`~hq+mNNix?&LUL`*>~Tbv-#$(Jf|0{LpmN!M)`R{^$IUkd z$<}K{-a9lCoE#h+z!@WSkIR#lx1;lb-Axo@QmX^iJ9wYoNTeca*JV}C=gk)*y# z8N&h8uZ^Ws85RQu{5C_0$+a(SX!tHFKqn(g&O1W4CNf|;ShB%2$$d@$6%yK$ZcHR_ zO;|;&Ye~V9uCEUzToRP07EejP7J!Unw_bKtb#-t&+gOod8o0)Or$b>a!0%xIku~xT z8I}jCSQ5D=v|ul7zW78ljSW;8!BG2#1(0jwT>k@k-zR0LXNJ@2r5_@rU17k=I#9OTsUXj$5c7WR@}vkLas>9B-|d zc;kfM#ve}fd*}s41%HCT-5m`x!%*ZOrUfHtu9*Jy1 znH6P^va|OlLULJ=nMATFWEanIO85Q!{hr_Ryq?$d*L` zmeGF=_=%L5es1y==@p!Pa9A(&vDwMM1AT~osp_Sq|)J`T3v8Zz0_jEcV3eHYWM zwAF4fcpz6I7V~e)FRc+A&mJrKIFsIwdPs=Ie5j%M?&HUgZ*&0=iHCw(1?80Favram zFAT0QH=1R{rECxnqrRA5M)zDnbd=}ca5Dx$d+Ro8)<@V!`2;u#Eb+N$Tt-sxx)hmT zj*?&q{EDW4uY`Gd(;gY8glAQm9PZ0pF zj>N2tbAMLMsLTR4eVoC>j*Y^i?wizw$|F-~^StPIOYqvi0w4yvJ0lhAedLyd6w{*p z)fICc5u6simx zg&TupY)Y*aIsaycZXgI8_q6{xMrA{PXlNaayKG|H`Sd(A<5r_y1h@VhJI_b~#t>77 zHb?j+@p(jU3OjRoP&Z)WP*zStV9RmTD^81SRp8AGd|W;ixP$^@l>VPH!$1z8PnMGG z=*)It>6E^7Dw3G*5$r2e#qD-nPwFp;+$2c2LprS*eu+}^!9PXG;*4iu>(|rYiya-B zB!bCZ6%;|ckQqNWKGIYEjpyDYu?8*QISui&M{r33?z`FJ)AJL@L+y0AHf1>oE}1NEW_YkUI9(0%PjvKGpXfMI1<*ilFKMF zCinrageSNE`2j1~pp0)uOn=rAk2pOwO--m1(b$6Wf33NmWV`vk^mwX-3eW&s1b{Q) zoVArX>p}>pY^BW!Snufh9wH!>-6Jwgd<{2Wx2k9LkHLtKIDIwmKK{*Hf4u+(rZb|7 z7BS05O2vpiG8n7iJ@4r2Gt_^Bvk#Jm{Rlmsn0E{{#mitPt*Fh31H}6Y$}Rg_t|zIh zsHprj%k=xZ*(XpDP)#;)pSSXlvq?*VC-!7P1DrCa#6|HEb`FNm)8iit$$K660d0Xx zu~LjCaGHS?9M0|1QTC($c<~a%yjD`DU&9TOW5h-Cu&7m!C6E1G*8!q? zz0XCNm2V?gc<}mI;T9}EN^F5P+-t7HdJ)i0RTi>i=+^oOFS%ukAg4cINji)m7BSLqA__m-X~Xa+awqf zK0|Woi~65Z6b#IDZjin2Z|P6?zXW+v`>7y}@y9NMps>OtT3ulh`6EFvkCxB^1BFYe ziYVu%(BC-!59Nh zFhK)WQ|9c#b9`F3$i<|5S2U#4F#Hn|PA3XFy)4i!YwrP^jXh+3%qPQRigQ4wfTQis zEA-Jb-(Ul;Bkz}feFo-L;5h7pL1Y4xL-DdbEAMzyqSgGNiCPDO7-X7*eG}AMBeOKd z?dw(+?P#hfKEq8rj}1u7{RsBm$0~ol2AuhS3?B5S2mR^9I9CT!kq`FKRG}mI_&5Cg zBAi;sQ{1*j?`Uh&ew3w&gRWI2+s(y~l}m+n7X+ddus5K1~6X!dbpIrJY_JO zM7PE{^W)&4)_A3zi^};esOLD(0%{+0I_%|NO9{1lo=XK=yK|}I_r~pQ=E6@IJ!4a< z>^STDiBq3_wo2fWAps3{dEIJl*HFH;36wTI2N8;yihEpoo`VuqLlG){E~}}^6)KLQ z!!5dwp^WWc?f>r_7hoV-Q6eF?MRht+&vGK#D{pUBUthff5DRhiL9ZKfFCK5(jDg{Y zj9Xh!*`)<`)voFHR%HP}&o!vhXrzhX&@1AFkrJCm@mninyC)RP%*<8^-kc#5Ps_ms z^ZUJs0I1;7u1ihzIqz>8{fB=;=pKQ{GK~(LTaA;hE z#t~x(1mqgd$^HAYw~<^#CqDz$k%|77UGo2dnCiQUY9_}!_O78h+5NK>uQ|F{m?j!8 z3ka3CU^6_{ht_-B-yITq0d#)@V3<`u{$lJOOb)8n>hVWP#ff1TXHGoP2Xz{Prz_1e zk@|ZWjGR0$JYpYuvSvce9`}TM^k>S^)NPH~L`=mQE8l-4j<9JE#AI6k)u(1(xSJ#A zA3PF$5(HOB+>{0cw*rJOe_@35uZo6JR6Ebe>Xta0eX9S`4fSOXY$^B8wO+$i)_YHB7hyQloB z&Cm$w=-tn;nfLx4khm=DZBY4C?vV!+x5vV#jl;8k`G2#+?*52kvnnK*g0KJCp;~mM z>XUPr#+^H}zeni7Cp?xDZ!KAv%6Rt8XkZ5gjwPGRU&%9KBOTw*o3plJc}RK6pRlmGwU76zaiNF zyJi$MD+o-OZp`%x5Oujinc6r^ACV@Z*gbFY9hWi_*6`An8vmbi-WddE^stYTA=U&M z0AZVIHgiQ#4-sgw!=HwEyoJgJsG`QbJW=ozz|kJ?fm1);#@;xojJLTFZ?SMveNLGvL1Y-^YD07>ozkys~0uO3?y#uyZ| zf90+~t>e8ht88tsO_EmPnPj+Sex7k3AbPyFY{?+(ipz`T_Aeukn2b^Wi&RJ8!%`7( zlGSc1yXLkFlhXT8gc`B>jD zSH%4Vm%g>A=g;C4(FX}B0j82^aaf$3oLIpd#AC!T2h>!`jBC!0h$&p-O$aZ5FF8?CmyuTuPnh$>?w|wa4%IV;^!8 zcgUnk_}A8k7Tm4-tnV_hS!pJBIN0bZJMKE5UX0e0TD4wH+orT`LT{`6~)1>h^}=P>P3E zZ`$3!5_OBYv!tp6GKhuYUNm8?uVucOXRUj%>8yM35ns33u*AD!=7KwO_J>-xrP)B< z2g@ZP3)sX!Mo~ujd45fVqEw`)RLrZs9m`Dko~4QI_9WVKYu;G2*1d9dLb#?`UN@kl zZNL^8fFjA27Hy)SP*C7HS@)b<*Gi-7`S>p^xs|RPceO8UH^?<~+rpHVN-%D^hX=o< zxHOs;G0hhfd2s&PVRiw;G7r5RJo+S!5wronCFP?8Lf7ukT|cx!hMo|-Eidif-z+&e zxu@em^L$}m@=9#s>qY*;kVq(?j(-x{`93ZJF*Wj7{6qHTn@cwN?Z096T7kEadwO?@ zP)B1NZ!f=n&W4icS!ny?H*7u;e7cJ=c9Znot7c>_)A~&3!DOwQjcu1$;>f*|Rpk=n zw)TnD#qxEPu?G*-6WGre{}!l9uUj!};3o*U68kCKu5##$IAWrl!DkC((F(0c*zs8BL z#uIszQth+!w=CjaeJ~twqieaqU92?sFvV=5cDvZYdr7wv3f^m{-i=-LZ2DG-Jd2IW z;$K<_cMvg?lR?MPBA-s0-bvm)W*sTDFzU8RqAn1!qY7GqNv{D2{!FCq(b~3djf{G3 zjlFe~Sn+&nbY$RxlGzkgtFV03urd2!YaxX9Qy(|ON+@$=G4vADFeU2HXlQc~qKrtD zNxWf-R-A^$#YzKFk@3qRD@Nl)i(r(Td9M<#C@}!8tH-hyur0qtbE#~Y&DXG~L1=jQp)E}$ zQh<^{kppEv-|iL^TOIB-XDP;;uZ)#fA@i>qv*TUIO8}ENUnq8*l6-&+#sjNXnJ!gX zX+k{N%0FpK@!C~N7cei}CniLE;^uaP&5a5L58q(XjbDe_cKQV4Fd@p@u;!X|oc_h1 z0#8azI>ulWn;kmt^5{y?KamSKYlJLO5g>W^r#l2*h=pxFNFeX#R?(d-GEBlTSm*wo zwG0`VhfEzxgjrXUFYI-!9}~sRSMRxZo_{d{T@(v1XukTI_as>%WB$661%|gqECj|~ zCMWVu<|5m))ZZU5z0uN!o9{nv6;)-AJ#bJe!_ajw2|4Riy}2;J)|r3?>Q;}y>-Xkx z*7t{tnGWKI2KQ#SNh-QM-Fr8UM$R5N;U~E2nnh)uYGS2qsoq_}ZmX-U@5ddQyr0Ar z?uM!SK{aLKa5%9$j{D=1O6aNgRb0#_N zFMAz~0ETXf@x$*8=18Z6$Hwd^nAL^UQeg-gkXeQA+KgNpNkp--Qp~ax9!yqFT8WJB zr->HGDA}*i&?hh;@sJ0#R)ukF!`l0C`}mRUZ(_oynBv98qy zr?0{^wofOevABps{$T`2-ytxAKCo2e2v<4c$LJceR#K%xC&U9JfjJL}Zz&Q{zFJwM z7!clW2(b(`^_(77SZjDqtV2{ZzSTl-No)8_vR#wZcICyr&8aB8e(D*7hga4?5zP8n z6HJ`;jbm#lM#&ZkM}&IP%~nh<9o6r2kope}2|1tt&RNE|7|z1P z$;((uibCHg$4#O{UotK_&2Ei5Y=5VUvx2mbtM=u3txDT?j^&MSFL$?APHq+3g%Fkx z#TJC6TgDu{Zh(=%e~hStf93ALN`&SlJfy9a%o&diyOK6)?d3-bfUB7>Hu-me6dfVx zRVvrNH#XL|pX@y`u*qdbdkU0H}U9r?dH6Wt62tO8;Uh^2lR8N|x+rsQ%UQOkE*QI4sn&+e5BbBsv9k-7z{Kj1D)n@(RAl7{) zb2w`^<+q~nLdJTo9<#NiVHTNI{y!x&F=-%9*`y^tUXAp!3c>RADiD|9yH zWo6}1itm93-Bs(DZkYD?{jL&&4SN=J$#ei^z1p$CopncLmsK&z^1D)^^*()h_Dbo# zvdw6o*=4FHrAInw%A~AY*Pm6tS=jJj@^lyZd27nYv1oOUuZ(k*o>@gNsB;nSU6C zLn4-49rVBN1YkD<)1LXsGv+ATO0&d-h^Jp6;=gg0_0?S3rEe#%#lwU%x0SJvQ6`1y zJUW$Jjg0S?N6UVz^;g_6!C@$A+MIaIB(mmJQvRIJMO8AY=w%hq>@PE{({l|MRgh<)9o5NG`K6F2WR^hnX`R|Z< zB|6Rb4hF~CL(Ps5DSCzbv-h_CgVmb3gVcty6J>dxbvvr!wRLrwb+p#=_AD8684|Tv z3&abntEOm=io0pp*lrs%K2bJgd=ReK9`0P9zsnoTZe?P?3!O+Au$L)d{izGnyw2hWoyxEzM zhqqP(hK#CJ(PX}z3j$dO5W-7;5@FTYStuc!hd95t_Y8!3{ND&;pn)n zk|gYm9m{z~5~d2Q3=-Jgp>kBfIwR&43eyFcZofTDm+ImSO`nR>b9w2eezd5Ov}Qo8 zVFPpa##=2b?@~lXc9xmB&SROke6U^8(m*x}xw{5qK4)69yjHRYL)D*05ijQa^1d0J zDffcMXYvLT<*`;j`v%{*u=S-2x4$n>T=h@j9Jw_=H*3seerguWnb?5sw!71bB-Z%^9@RPwYG2Mbg_f$e6{JU+5B zSSg~ufo{5y)4Q*)W5zuK+UbY-GG;~Jn|oW!qxUx#sh}=#8dG$LJMSO0MYI=F9Ucmm z7dLx+BV{Zv<>r)TG)!*2?zQs+gXF9j(n{(NN4eYA+I)8UaUQ@kBM8t!DLKdi+2Yhz ze`@rmgE|qJ-W1U%Oj5zk0;K5kRB?Fb5*5Nn&qS{bzd`S)S}w=^$`8fM%^NFBdh|uW z4gX?7wAaBe+PU7;7dNE9?!9@Ledp!BdkzQmMGK6}SFMfo29;wuQ^i`wL&rS@$a)vm z6Sx0ncXxZz_bU`-j5KK0@ zr4>#xa-vE1*UOiVz6kO|8PUe2C+WpeGT$Whf=RYaX@z%k|I2C&9YAbLwh1lwk7b8D z-S0IdLK~!U=vc*AoP%+s@zK?9i(-f+kF@eSC~3Qr$IlE-QWm%p@2QuL*3lO))WrRv z%wBKxpeX`~d8sbkc?$ttAOxp4 zce0c@vf<@E@A4y#G|5mCS>fwnW7T07(wf7=l!}R!kYDsa0j4e-#fwpI%2x+B7kq*$ zy4&>pGm`7RY|{R-Vopze7g}=P?^^c1WPR5GrSeN* z%rK9yreH{do*Znro{g9r-|_CopLY++#0{PNcYjQs1pE>TgT$F+BI(JC z_QC5zWf(SMy#$@6M{ZdiCTbYA`$q7E9PLm~A?#O=Sm2ni%pKTKnG}YV#G^0Li{J}< zbkKoD_Ql}ms49oab`a9F-Ho|EYt`{J8Gn{rPZ@zDOGm~25ORi5)|oP(`R!pem%Olq zfUXM#W=`(2kjrcutmPp5?Y?<($l^BS-W+3jAYh4$Vtv?<@pe7Vp@3HX`#5N%4P+@m6Zmyf4po-x8^SG}kke(h=t&av+9_ssmDwi^2bG`* zH@4O|-bN!$j0Y&*AhXX64?=(&{sLXel6mU60oTZWkza<{EMT3;!1z4BB=>2K=9yx$ zaJp&dQwe+K3{G$%88II{k1U!aJz|oRYWh;DQ$R(kKPN4Q9svW~$B1G~Z9E5`s%F5x zWWAoIcSC20j4G|HHIhMOMmv=@a)NB1c4#k#NeWv%R}~9lc9OMp-IKhwwlENAnrBt5 z6`17?c*1Y$hW_!c3m^QyLMW4{q_E==PCO4%O)cQ+gUz=lq6nkFW@`A~kUn6+GOvIA zx!g)^*LNP~clkSCTsJUzcSgmK)pWDMVg(;PqULR<`^Wb+n^6|C@kotJqqv{3Dm-J|WpOofNVOnt8NjPr{I z$Y(w0%RkB;WQWyqg{PJ3yWX|8bA)B)-T31)0g<1-Q6lD)-*&{0f=!9hCQ@GZ#pQ^u zi2iu&pHrejiQQ;KH9n3vp` z>7>ARO@iLc)nlQ?z~ z7Rt>Z{o;S`ZwJnZC7a4yA3_~ zW|-bJ^zlo}Ljv-9A%4UZU0!=XZ&CX-dTd~KM4iP+jyiQF)Sk~AP|F!$t^L4VP6InZ znjJ?kGi0Bj zw!crlP*wqyC;vx>_%bX8;+G*Vc>Tn z;7+f`84F<34S-7LlQiIS(W@q}gNGjG2&Mj36X1TH*@%JH>ALsRO0U6FQPOgU9Ea6zXY!sE!%f%pcv8EmEY?AADcd-^q~S}@AB&!U>Aa&x|)Ifhf? zHeWHHu`MP`k#?lX?6!XJOJ>aH0CXINbK}8_9k%seKja#=N|$_?p@ff)Tde+^jp8j7 z$QFiLs3TDqVF!FlsCku#ERLy7$uJ9gTvF648~Zn1TZlzKCnQ|$RFBNPG8}EZGPPbJ zff`~hva)n>ULU!#Civ&8=I|z(N9K;V5slBcDih!t$WdYLtMG#CRgQY@Q#PkO%_8Dp z^wcio>^xECV8w!m3UuX!mLy^NBQ}G^ScQ#+5IvMI_+L;=5@hP&)GQ1KUttWDCx(`1 zS_sV-KV%YsA!n}(a>HHGVngw})-x%;DGf5pSA*Rv_S$vEki4I?x(sQFn~;{c3n{Il#IFAj+ZP$tN#AwdHyfiu3`w~9 zJY>^MKP9S4MIUUXfn71D`Yc9^@7R|n!Fa!=HlJcr0-Y>EbJu4#lfF_zs*E@?`3u>b zbF9{VuVhFF&s;l2sBzVHgopQal~TY(Do%CM;?6x5DSefbEwb{gkekhn3^GHjLxra8 zSoy7Hjx(>qM7Kv%WuKhGOM80hu2{b(RNSF@r9(+2_$)+*%<#%a5?V{K@k!tS zC+aNv!?Vn%>5b6zuMN?__?-Tc5)-V|bde_3VO3DQ;RGdyh+|KmOzC*T&>VzU7Dk!L z2Jk+q7jvEoRXz+dN5??YPx;Yno65OK5QhVfjJZDs+Xp$m1EE1O!9oPntbVfW{SyR+ zz(3h}Orn+)#|b^)kMKMqPJRez@TV1yU{g%e@9 z$Vq+DM7rUm`-|>gcZy=Nlwu=cP4%MohCI%4 zG8B&c^W)}_axtBf$_ZjhoPWOlb3x5XmhIG27)p&{Hd5)(OxU%)>kdDX`5E3ufPd<( z6VETo4z%=6U~^Diod}fIhl7pis>Z_vE2ETTC~uJhvi*pHrJGt`s; zMPpjh!Ye}jL5mU;_V*nV0J|u6#{4x7M zCRMahifY0z|(cd7}2F_Q-uzk<7&u&-+WU3=U4#E-~k~7k~ z>))K#XKpDO#pCvpvfTgi1p~Bs7B7w|NPL(i0QZ7s;ZGL!)YvjEslym9ZPlJ#Of+d> zypT(lIHx&Qkh}G8VFbLaCX^08iXzksrr?OPUF&#Tift+?Gm5|Uu!Czpch{2!)TYsyaB;0>nd-MdmJu$B#)_;o{XF++?1g(??xCk zk3UP3A8l~n^bSCKBd6;0Kw=5%MJd71PE7N8ohI|{(?acM2|I6uK8hwxKZ~4Ni!R}? z^!8caHDQ)!N#)@57ueDmQou2!oYGU2JeU4DWjJ0;2 z)L7N9UHxr^7*(88!R}!Hag;i83q$jyx$Hcz`SM-g-`|Q}hEH_*Mm_~KjEV2_`4jy+ zBlgyL%(^=d5U3~7@s(N#8b|RC4F}rSMIzcdq$iBxkviqC9N?zKD#>?N%}cz;&{CmMQD z{0Oe?HU#%p;U({2qj~ZNK*g?oG?wIXJ(JE%Fh%ThZ@y1L&pe-Zpq~|BHEPGPerdQ! z1~|kwj*_lYC5nU(-zv);2%)uJOz|7hS(ifsxG(u(GtL_lR*JYaC8-t#r?2f)^P%<^ zhZX>9u&cZb65QFrLdP+Z`I8y2)$>1Pxn-;$Yn#}NF1H$ZYt$}$aw2#qY8dyKLv#4% zsqXcOZKs@ah*8}L_uMC8vaBhuH9g>!%*61h$?QuNgNkq!E)&KG zqqQ!4Jv|OMwEfy5`!PYaobLxl%m*V43kmJpRQr0IM=Ct9%$GTv_zMy5CY}RtP&f*P zf>aQ@_llyZ^@!GJra{2m2IM^Oa3qQife&tE&j``Lm{UJe83CCS=D3M0w_|Vtr_zKF z88Ev}GK#nK35#LyVw&QPk(SnYZgQRqSb+JGXU|E8`ZXOM&_THCK)}BKw2LyL3zm|hfjop2d>zuK zEI(B{saD~kce0r#W@tY@_GWf9Nfxx=P|NyB6K7sdPy1PVBREQ+>aN$?L$4C26StO!u;4&g z8~F4890&(;Ah!yL9!ekw68Nl8>d%3Y9HHxvGhP_)qbVTt_sPk~R>zn_;^K}3UO0~& z+$ri7wo7*#V|YYesnWx4|Jqq=z~BwSr+vBr5z#bSC130EOi!|I%Say)GCi0dgV$A9 zz=&Y$%^kyFrU&>m+~M#VlP(KDQ!Fzi*YS32CmR_KFnEED?0{HrB>y~!j{J$BRblh{ z9CEXVlZ??4BLO|aK{kR1rDk28?{CsPgR;JT0yOm8Nco)#ptX%M@^}9B{=88j?$iz@ zviq$BmorqGe17v7zr|JhZ5)?7)Ap>5IVeJ zo!JG=giIeHa`NPSfI#WC!6si{LOOml3O(}l#p=$Jb2rHQ+SM}eh+q*=Q!?P*TdV!z zwsI9nNyX0%0N*ue=O#4`+jr-bWsYgsFDLLvDB>=M^!~VY@Z^KJf#!j_VSB8FW=GZ$ zHso%0|xW?X4N7CQM_I$oKs8EA=CkEt}8hP4Yf(@-A3)#M*<&uJI66m zN_A{LB%rySS}>k1Mf8TQcJ}RKsxGi@l_z*zJJTufTd!P}f97_MOEQ~6IEqC+j&y(f zyG*WXCcJs#cbTHAJ2HDKwHXZ&Ip(`}&o9zNp1sa(&t}d581)&Cl76l0o41cBz7;R< zd`%6$reqo9^2P%$Yh{YtfJUd*s%Uw=V!3QON!8`V_*09I%yt=`rkCefIG*6uue*l~ zWkj3LxWIu-`S`B1TIfhN;A}mH)+~%ZD&($~V zM4hGuDND8&c)kj|db3*mmS*fc_Bc)%k-IG4_F z^!Lq75RTpSrwyqlt)O^=@E32mt)e+yVXq^(@W@$6-6@63N!5)`F|igk6DHrD-;%f= zNE#A9FRPX&j?q_R3T3f5`gN5_`1m{~0oR5c2^sW&2#@I@YbSCUvq|` zRM)FUf{XzdF{RMbT7j$AUF|MQk*_6z&~ALd3RdJLw3BWI_nm^<4-PHBBKR_>mp^0NI z`()#+L!?LG8DOYtrsi&6IB?0xXbxxY4&J(P6az&A9*U3d*RavR%0YZF!~ew>@r5#YnhE!fvNEB`+hP@0Ii`0MVqW*HQWcpnHRib`Up#@x(*#V(hqJX0 zN2YmN(ZKUOBb9)Vkz6*^{>t(I*p5sk0O-+k-_Uh{Wd;j$HTRHrQ2C3FuwtC9ZQaL0 zlWN_L<&5*=)*9BK-Z8C0w^gMuqzHr@;kwsA7T{pQu@(3aolu@;78{M-}>xg zp^GmLScSNJhA0mLWl6uxThCY@VPk5=1)PjC5_Js#Xv~PPdg(Do5YhOuKdtUM`Mvi~ z&l4bwsv}LS1=%kc>{ux-4FnTr(S@w*2RkQS2rhotWJq^Y^pEdT)fxYzH9nw3Cf8Rg%!W0Q$SKu?A^pgTVIZIvNNnc@OM|&T z0QiCo%KT2g7L#)DFsU@0BB!iY05>nV>^j`{#n*$R=Y=I-#OhR7cW#)b5aRP}4Bz!l zhX|gW^Kowm34<^T<4Gg>+MXYyf)wNQBKPveIRO;lq{~V8z5Y83AOWm5Hf@~I1g0D$ zXjprMK3N#=oEMHFeP5!8d3nCx1sayMZ5L-}S*KnDoxmK8mzur*941V&85N$ncArrj zFa+a?9%#8>`9;<$-@gz{pmP$1F1`|Q77275m1fJlgL}@!wR+G4Q|K`9^edFMk}2#G z2XLrn$f6R8i7E2&i4C)$a1m8S`gH1(IXX^d_KAxXz%_8=T|bgBx&~@O2m<0Eu8V*| z20X{}I0uI~lO({LD1KpWk*+WF_^ozUc#M>KU`7YAPdXd9um0LI35=&B4}D&wc}W(U+981RR2H0m%o|=K*)+Rr^w+45?`nB)Q%0Kvn4`ew>pZn8_IT)Ra0G?OJ05dpa zNT-UEGy&E`kzl<)`CQbG_V9t3E;09Xy~|vr;ENxlPO`O6C#tM)ZvxxIJ%q)S$Qdg~e}- zf)~Ctv^tOb@b+&Cq<*>0iYb*7LM-C&x&F!a8NKqQt5_^WZrWS>v)zf)Y0}N_FWGt6 z4Lk~NR+QyZtz3O!KduP@+4AeA$|LCM$7zUzWrjaV%a^B!|U;T7q z6P?mb=#XZ0;nvI4%L2FZa4g13%?K>zWQ~(E1o3=S*TQvgi`*U)ymDY6>qCqG?mj@J zP@M$LBhKdtqs}D>tW>xlyXb;`w)KbO=~HFoI?3y$A_N?-c5F}Vw*++zO@vqINKmlA zHm8@nwGzR5;R{v3nhh65=aQzVry^Avf(6`;aRccrWm@K$uRg%<+~LAqxFYpHT9V1t z(&$h;#iM$&4r|;yBcEqP65cOk}}0RN}I++y3z<^lKCTWFWH< zD4m_ezf%4TS>`kOn0sn}s3>Gf5V|g?4wy@7BSEaTqi=$mVf$JCpRRGrjEto6;_Jb9 zYp&4}@R#w7o!JkMQ*22p7-QJv2}bB1D2F-+2P5cvP+wif3Ktc@=Ydyn*S`J0#TQWSv8qgM{rshiT(ZK(+s3^K3_%v zM#=0AEq`4&|fjBp9yLlD&EK_~ewILkrpY#Dx-$zp*%qNq_$5Eh! zwZGLMvVGZo&+Ba{t<)a%GLe>spwUmt`n_+lAIYM+9j98Dj59(*=`L|Qf9v)~J>2l< zGFkH9u;4b_EOnE8evV_z&C1T^a>%C z4%er<8Be^A5Oi7OdR#+wWB0vT;3uwDOl&?v!)Q7;e|&Jb{~B5&U)iL@%y{PI#IOZJVP<%ic?K97xYR%#}4o9GF|9JAtboI#n%Gqp5uG{g!m7>O>gR?q$kV0Uj`}rVRtWI8?5>-k6Rr}_UNIF1NaoFuTELbf=KUBt z76N}fipSN{3cNh)0}%Vk1x;?=#EI+rWO4BVE==taNtlgV+Z;{?oSH>`{m+8;ccy>; zcKF_3;O($H>D`w-?aXD7LLVpQOHR%b{{5oTYlktpQJu}#Uqfy&*C%f;h!^$z7BBY8 zb?GIZ|MaRsX_Twu3QG@bGkQHD3^Tkq3D-a3S%=~)l?d}ILnbsNLE;358roUPH$FA( ze`z||X#4G5G6O?h#Y5du^2V7TzkdXOOzeAQa@Vvgo@&Xxa9#A($rRclUrOp8ZDW^S zT=mVUl+;_S0@`Pp9*MFbKMohwo*O6;dy(tH8?!s5t+&C zJ7bgsZTQI`vpbh)Lt3z$?~CYXDze#*dz@0B(`c)wJ(KpRO5T8&ORpBMdz>id)%mcw z)|BqD-@oYYX5F^&_XzfyJoEcO$Tb#v?wg7W;}vCePnh)IVNAq3YqS-JkTm3c^%gLG zThy0ha2}n+cVeo=+p1G}KXFy7$?6jB*3YHU56;*41U^_4h1YGLHQ89?NQWNJ*^%;# zh_8gV8@B+1D^cv1o_94DRhR)`LFCm$gpTvFbb#oB(H7w=MiLwt3XagF(H(zyfiBK3 znm3LYii5@K@msFBCgIIn`vMZ0Jq0}{m!M4I%_pJ{Y^|CKsbczRv;mj%w;`}W(X~CM zB0y*#!8M3eaUdBizBI&i*gQ6bQA5rnwbEoWPN2(g`)q1XKu`Ac)z=|>3m+JD%5&Po zwq&%LtSR`5#yN)tjKXL)*d92$Ou4C)NV@^a-pXh9QLFiJ_1g58iW2;vrBi}shFiw< zUTa||STOI*Uo%M#z(@D#oBxiCefP_ab;(-Pu1=Uot=!azk}GNQ%4~1@;Z;{WPsi^} zkqlz~laq(sb6IHGD142Hi@Ua?BQ!d84^SN`;-5lwBA>XoCuy`#_V=S2GUT4o>x=N+EKG`z7F6-N=CMaEvQ6JM zvmm!NzE2{Xe1(H}H7P3N7Ww@}uQL9V#rJp3nSWYKms_e*eCwiqvVKN!8}{t@2<`Qm`01u4^+Qtpjfn@$ z8#m|D=&Dw`YPeVEjDF3hJokz`fsS!Jq$W8d+Uj-kx$}j!NztOrXSGv<_(4!!)f-YB z7iyogx{9%%GCTOJFqwn`0nb_k`G5TNP4H?h&%q1_73>c69~avMMWYI_(OO;7!^u!W zaN6%CpDXaOk~-j(iAC-$H$yGKOu7oNu?1lxZsW0jw89Rg?2I#4XF@P6M+WC;aOs9^ zsYA$6{N6a*(qZ?yxm+AAC&~C6`moogJKEYOUO(Y+lI#+4`P#iCkfW2upK{%siJMLT zf%_GuP77s!+B+?MO0L(}F7iEleUevn&+W!Icfqv<>(yWD>s0gaT<#yL05wA~PHgwH zf1v~Y{dOuGd6l?*{z&;qZ+ZkhAGWJ5zC{qLpv&)5FKQ+dp1h zF$N~!Q7VSzqLA0uh7+9=Qhv@mSM*YLfz?nj%VANI+MUK`o2=}$X5j=zdhp%J1J?9- z{(=PC6mmvpi9B-Ej>3pC<*@?4Z%H+8UbMy9xRdW>X-$0+EH+8;xGffVGVamo^H+LO zwN_r8B&Kt6GcDcmGkx6ziBE=bE81poo5NkDeXH}2 z>J~EA_wR?Fy8PqYi$fuinq||a=9U=5PY$_`p9Grfokcz5G@nN=MrO*6taJkj^#&^% z*lwb_bMx;s{Qt?L{w=UwZ{f4LKIEKRiBNXff7Qf z6qM+QhafXu-2d=Q%7BwOB$wL*H=FwF+#PnEsYtseIg4JO;C1lz4m&4w`_?Je;PeI2 z;=0tQo6Cc}j)|k8(znQ`n{)N4dCZhkr?iB9g%d|$%`n#hkItfFU zB!4^R5__|Jq~56GxAm)D{07smi=T=0J>7n)SJhCE8nzSSm_M)h_Uw`e8Ycinkzlv%83u8f7+%G=r ztk^k=T2yJR%WMk=yINyR>MLB?>*&Y84436^W?$UI#EdI3X!KkEM8r~s~z|x*fg5`(mA|OVGC7}5s_WBea@$ToPOGABNWEYZy(1L{|jZV^|1j*DVkgNe6Cx65*c~QBM~Md zG^U%^2cy?#d%O;fu7>ke(BlrvZsfq95=Zhp+uP|1>~4dYfyxrXqY5)Dw# zaek_hi*2QPinAI00qX)!&Nk1kvFl8WnA4dxxgok?d*hz+-FKQiBzc25q3kNJWbaYP z%BEgssHE#T-*~>Z%T}uauVnhIWO8tYVZ#+6_GUtfWa&o~hU-xSZL~q@@ujBFV?^hJ z!TT#YS-^$tp2K+Hc-88AxdX!Z53d|c0xS>pZJ@rdC^kjNjW~!LfU&~~5npD2HaWx9 z{L^fqQ8%w9JPPY73B#$Ue#Uca`Fm`brqlOTZx+QQ*}YF$Y6LUyk|%V1nutg6(Z!Jp zH!Tb7S3GaIb#O1s1W2DrC*N8T_N(EgPIKPG|57bOt9ZfPep2dk)j7+760FY$d&C25 z-8aWvb1&O2Gx|H|2(0?~63SY>n?LySX+NgceV%zLa?IU|C^-BIMXNNH=`V%^_qHPJ zFIR_gaoR|w5{GQb*j}w`yvJiP8(JF3_V6A9?rn)tvo-+r#QS==K%?EjTeVoP-O`KBUl> zZ*ajxqjyrP+`14;GEsDsjeg{T)@UhSf8urP+4(mk9L#2lf&xjsJ)$CC_U%tP{hH?>6*GB2 z^*Z)NA%)~uH>c_OTb~--NP1Hn#OpEFqB#|AS8H+wwqHE$>1nk%>GsntGCzw&aSfzd zP5#-v54RA_^I%;ai+Hdje3xk9$54e@1kddozn8BaW?gjV0U#YNmSj7s=yOr4pu*_Q%PGLJzg7R#$JTb!4<3GJmQcY)#0V61L7F%UV2bf12s_Q`$by9{Tvc zr8);JgY}rvR0dseXwQV@Jg#~D(i@|_nh`d*Ou^%_ePB|~_a*02>q7)hdM``lK0ag5 zPhcJ;j(=&7UexK#E1#q=ifr!buV+)E$4}`dC#)I@=B$4l@64M^4yGe3qRqP5y+1v= z@#2)#&s;;XsC~0w)V|TLYlC?P)ZKK$&3*m6PG9=0lA2sk-ir8+v%6t-vLpJ6hw<6{ zY#as|AQT`7OM0#HfIJC-J4x2q4cu7f0fp(W2ayz>hs+yyDl+DqF-B&+Df-mW`i)+r z8o{|=m9gk=!?pC*!sWcjX|?q9=J6_rivr2;J~|q$VCuTVUmGOE^n!lCuDyh~rLj?O zGdF4r+q`-)D)JIbZ)?c*eai*4>nB~p6|Z5MSi;!4TNEq`36z8bw(9Y`@E{i^r3% zUUny<#IVQLDE4*?cW~-% z+JIKrZ7i?ZvmW7>pr^cv3Hqm8DPNPZpF zqkX{o^SAwpJC}4V>Vx*Ey|Fi=7w;zz<&B)UL}+>5JpUAS`BVH$DNWHl7U*bx@6%k` z0+W6f(^FOM-&Hu9M8v%J26nb@`Ov&PZI^vz%%IGUcJ=gzcA=~pso|qjYZpl8FRK+{ zO!STUWt{o!8${e)_wGAoZ(9Tn&aJ2C+nK+98yT>s)-v6O%dP=HlGx_Vuj=73qCnL*X>$ot57>;4wLCX<9Q%8oY_ZW^^Yc zu*~Oe2TJy3(Q#$?gx#*IJDhUwn939;{o)}oqWQS!*1n}L!(tP#(>{6Qe+B%g9aa)Pual~;@J*S&sB$>pRGjkrd~e`JoSixcDu~iXfNn{f7Zi} zb0n#L@p78>Ocv?FAE34}X|04VE3oI=z|uu~DfIp6pEs&CESbjE63%hC{+<=Zuvq-a zO@g|!+}d$hv9kfcE2Gyyn{TAv6F-OH*@ER@h7r}LxMB-{NmQz-{%n@&`PJ}_7S~`@;rX+|$-7qx51f0HV&8S`azvz0)s4BN` zZCDT_B}AkJB$beE0YQ{T1qErOrMpX!2BjM$mF|>IfkjIwNOy-y!+S6G-simIi$9Fv z8p3+!d}iEng+WT+QH8#eu3s?%2pTp!GY^r8BlLiO=jHhbIW2Y*1Em8UaI6^C1x*fgFX^PUBkAJUlWfgH4r3j-qVnJ{| zyu=qO zXupB>y>ABJmbQL8#c1!YGDhvHe4OAY>Qh4dwV&Can~c#z1U23ulH;`-4$((?M%v}{ zdCN7KroEUPxDb<&=)Rs!VlaB?n3J;{M>%~B;#~* z_VwFIL9PtV_!efZJ7U;N{d&GSf7E`hX`D5qAWr*sg3;HdSJLLB_H?H!Yf>b*0ZSA& z^E7FkvqX24L*<^1X042IRNsTg!H+k@TAyYq#;f%03ahjyP!+pP+eA6CcoXAvcrPAR zIsM!qPDe)}W;E0Fo56e-)fnn#E;L3ELQCIT?*7N|syWpi-L3`;v9w2nBDRx_$X#o1 zw#x5Zs&cSDOZ?5Sx`6|oiDQ4`h-Kma;1#9Rv$tExiLV!C`nW{jKB+%eYKn^Q$y7Km zhJ`uR7C1Nic~x>oJ3GL{eeO4dO3p7r-x$pAh*ZIlA3TD<#{o$C1=i_p8Pz#b&esAf zxTaMqK26B#&5S)x&U3gQNn=)F1I;z1K-tcqH(|t<`tR`{GZE(<@mtRTtvry3=5C3& zxZikwY-Y7wcUxD>-LJP@28l@Z!%ZP+ia!DnGyW(Apzs$E@k9Uz;8p5kA_=n%HwNq* zI(?1x?As=K0NF`q%ilhb-XLn6NP6IQ3otm3x*{0Z^j|ZW(?Lo|6JonP^#J;a@;|#0 z`HO5Wh_rvE_4ELwo$!IHy~_uJUTY%0VW>4O#=8TkX>r@vB`Gyu*mmLDj38sfhne)d zYsX8y6qI6~nzufevNdEBD)?zm;Tsf?Rx&=R=_igqQGT= z6gXeHzM>W_JLtgiQ-=hfIVt@9kGB`h(v)Z_!HFhUH}!4*8nmP{n6+xlt0-(54N3q< zZ%p}C6p5ox+yW)z!;um3)cIK4seB^o+1Pi7yYo2Atr%-zQJUy+T?u!pMB?Z+nn{)( z$|QZY$zasm`hA4@PHjxeIDF2s9rqyO-d^eSaZ(KxCG7Cmanudpn0!keCv1Cy-Bb3l zK$hAOr?zUFjh*>K(URowolEbd&v;d*i)}XT4ZJ>@T0RE4H>VqO0L=$rNU(982;p{oFsbAy~bboZdMF0 z=AOcUkFYYX$rp(iPJ))_JAi@w{ft>dhE8)>gH>BtX@;3wOoxEDU-|K*Qhu^Js<0zTjeL;D~-lY88R3AtJ&X_`zL ze~ThNK3Wp=+(Y4Cp8XNIj9M1O-9pUyXPc9hZE=e+Hk z?>$&F(s+W^Zu~N-w47w8ZCk<9XT0zxTQd7?aTP1iFlLsC$}eb*@8`yHv@%A0}A!kY)%LZz0iWR(C^^m{cVDwKz;ZS*4u4|T^WBrqpNU78{uu0D_? zuUHk4r@6N7y5jsY^C|oHqQx*M%~VzgsV!sS>H7WQG{A2rox+f(9L7oh$yd%Z4>9$2 zGm$}`mco@7Ub&96$1nQ5{9jeuXT=Cu9~!IVZTLC#FiLx@^KCs$?s(9)yKr8SJa<#y z^xOE#q#aLouR5)NzE8Yth0yEHEjp8_%xg>XR0dj)Dpx;BeomtN!8Nln_+qN>#J&m5 zNZmsNCzL{EH);_Sif48sNz|%LQ_FiIudlyso2#K?J9x`faPw#~xPKRLcg zT0?Y9=2f((oG}^j(=;J|X3aB%#J<88``o7<#{R%dyaml>_xE4zb>-Sk-OI`ydjnjm zvCA|-kQ2jLL?1Z@;R)?e}fAx9@)mQ<3{Z_#Z6)qH-eG!sk+uaR7*&0k$ ze;EM*-0w2>H8%5pMdA?-p1+Xjy!i{dc`?Qh7x60B|E*%Ypb23XKThPY%B;&%**z7H zpt;_^`#72h_{im()mhs! zDJFx3@ddHzsYlw4uJ5Q4o#qD4GXz{Vcs#u>zJ5M^A57eq`9tiEBjtztsY_im0AF&H zj3uk>C2$_EHm+dciBxLBZ6(-cXyg@n{kQ9sQtS;E=500qiyYNO3M~D3BFz?CG*Z%+ zo#b(}D!UHdB73%e0~nHeE(+gSRFB_AERVlGlm5u;GsZgg_bM(z#q8}cQ{SgIy|ScY z`XS$q-{RR*)|}3SwAZ(pBbapkmgTL#IKCq%ePB}^Pt}Q+DjxZh?IW{{1f|gYtSC{` zZeo-CNuk9+ft9hGaHTmI6zjOG21N<$D57YPSD6@`PE&O$|D}GS*oKg?n=$gGNzf;L z`%P&0+e3X0t0jr=C)s?DLn!Wi&W*_l&5JGcDVB$d$LJ5k#J9r3yEYn@0ln*l00<%4EFm zgRfMrtI@lK{o{A!&sateCidrH*31s)XtZoK4s;E^1fYUxy&Xo26ITFR0cwjro)#v** z;Z7_Z0S8hp9>|!wKS~WtsTgE$-d$c=@`J!bMhtTwcr2>N1Rx*^JX_sl0RBh;h~!@jo}L7X-|5MY~a-Z)p6Qtd!v<@9+IM& zZ$251nG<`fp=O|xOsC41|7*4+Vbq+Z+M8_DX|wzKck3b+j;F$O3(pQbwKB<4y~&0x z3}*s7O@>Ote^4o@QF25)87Ivj60cm9DE=MBHDm^fQE|pe*2@=!;p3r(yUO4_Rz$=Kfmm*wy(_9`T4H zM|M>`;MN0jMQuTPJXVpZJUg*`jT*vHZ@H%(R;b)!^5j0yw=Kg;jKl)Mb_|(5qg#H| z`IvPt@KX8BUo~FOiz$pgKR9e)fll7Gem(Akb^;aLktpsD{TC!Q?#7DA@5o{T@d-*l z_c5`!;+@vvbk$W)6sM8&Yk!jNdp?xy1>uq9)TdBQCsy&5e3L+lxu1{XSYB?ZJ^%0r zHa*$&vC(KN#uF#YDfCXKgTEe=H6A3!N~y7C0WQbaSKlvLB+5Eo6w;L`8Xp1l_mz?C z$tsd1IxkW-nmKZyR%@H*OIGXAHNW`K`rv$N6Jy+IhW=&2MBuw8A}_Z(!icYuDCR#L zqQ7WvZHBv$V{(WzVRh@QllhIn#K!b_r1uv9!oPdc*Hk=M*7nK|k6Scr`Mx%-sVly} zpkJYEI4fc9=w?WPFrHou{)54qXo=ay-$Zyew7~p!o-6=aW?z{b|CGYCtDk8 zUp;CRYPlW}O0uH!aNcH@Wav%WD3N%5k`@YGhUBb-88joc)hHWo4pW2*R&Tk{x~+}f zE`-?m;wE}O>tw8p7Iq_AhjK2aKT*hCZH<1fmtrYWvw~$SU~@z;*ZyI>B7oro6bh!2 zPX@CCH^)i}tfj@h$<7<2*j{M+ctW7>Cv@FRc3NS8*2-s6t;DpXYWHx7qcsH02(vHF zQrPQs7Yn`gR%<6db+ff7u1(ubF%V?zdr#qna;PkZjRl* zuXBWnILxkapz13IR2erS;_o1mzt!Pl)Mqb~HbIxHyz*&I$Ms-hd#VNhNVP+x5i;p= zUJ1T4%gHD5M5M57-K@t5~+gX*Ws+s~2r@AK|!h1zic zjuHg^IAPPM4B!?{R$b|nI6$Hzo`4p&Ho z!=1y2B*cuOIy%L=D6o4Bd|o2zfZKMHBmq#LIA2~vxX}6t0R7jYd=}nb%<}TIiss`} z835nWPe!g1v^t@ny#bb@J|A5w77=6A`*QnNRf-UZ$28nve~pdH(TarmSE%$nRRgL& zS}W_|tbf-nUB9E1?EO}JFHz8q?-W^6?AiC33bALNb}!y{3Oa9@oEZx^ZMiS6QY?iGaa8vfIQI9u%D(7SlvEcF z=yf`8FBr>42@t*}&&xZLLqRb@h!*!nC&o&vQClW9;X0&=YDen8Hmi|i;88Yp;zy|S z5GRgWNL4x3&k!eYOk_t}h89de}nU;=T=h)xx0eS5$Mo@C`%QHgO(!<(?IO}e< z%6m*?W3AvVsA5x#q7G#%T}Ned;d1pA`sp;JW}4DX_x+v24{rhBrnw!RX8Ar4Hm~NV zdSH!k{_Bw%ZzUdS>LDEAg1QV)DqAHg9$)vddZ} zD3vCKfj&|RkGlaXY+-``uL@ghXJ5L((bCYYvVRP%lHxY)+q$r9>zoefot5}2%=HZ? zx6n+;JtsQV$WE`}7~wyOkvFZowOc-&en!KpR{CsGv9d7vjUdTn6E4fvKPj-@X?<{j zUFXXTt+Cm0ubrF!V4K|X&9|lwp2#OvqFrB8X^KdF{OVZ0es^iiDIm4fmolBZZ|v1j zn)wLdTvDsGJZ{f|vTRHmE(p9B+QbRko>IzId$G{^hEZGz@X|AlWKh7Y-93zzxDhvd zHaus$DXSF0YRobuR4FutQ|CGyRr1XS32?M$=NeqO6XM)$|N8ABNZ|P z{-Eb4A0U+v+@m|#nLt|w2x!0b^NCvT?+S8!*cTyc#T;~40`9`xj0C11M@R)+dQ?k} zAkjmQAf&}>VQygX)1O0CU}xTUO_d7p3%h6ko(WSQt}qwOKXHM0d${cezpPT+K*D4t zQ=jU2AP`CRYN{Mwi~2pNwOtJQqu14A91FcgQO{H6ZE8f2$68SV9IF)kAMYwNqJ#qc z8bjzWlA8yj3ODL|`FvG@M{ zt}>ZejE;SEL{k+3-+2%Tf(+_bH8z`!_o9D0ABj0^p+yzV>3M7=YBH)czaYc#nhHe% zFQAY0<;4_T$aUa=WbCrU&piAWD;JaBd>v6d2Y}IZ*BYT434w*QWuH$MuE(uT)(Tfz zO#1L8tA8@Su#7oZvqHr4;fvu?`9mLFf1>%iZP08CsiSFM#HuyR`mSwTErRgsYm=8n z(Ga)($>X1^YjJNtxhe9*I0l;d*2CF133UCM@S2Gw9#IA#SvMtVOp9YQ0yrr2X7|hI zYeF8In6;IgfoD*I{@Ltz6|4JD5~BZivQSpCfzmh1w-xUwdehgz=ZsI4d#!EA_$|s8 ztN&c1u6z`*6U|f=Qx_i;K-4pt#Z7MydA}vKnC*>FGnYEw@^(Exf-u#9petkLfn{i# z`pG9sn~(OQx~c=4Kb^`_9rIir=@#sS1RgLz)}cznM{mH6URh z{U87K$NzKBeF(cNGaTD-zsQrgilnyTFuHKM&OhJf!PfoQUW!oHik{$ia)`F~%^cEK zPb%AK=2LY{+u{UC1>DK^mb%|YV#K~G^+V&(r%K3?Zcdte)KdI(vFl zi5eR@Gx$BZ<6Z``&^R3Wzr;otiM(6p899bQIt{56B0_JuZ?9;aINEg|SYrY}F$mwt zZpEc?0tFDGoVPA3+Nu0j+H$|#vlW*~*xz!sJ}U86I;()f`Vp|~amM%O+Hq_GtR^Z8 z7|ew^UYcW8V_z{1wB;LO?Gc)Ia^!nyk1&!6d z+!YxQPvGq;OK=d%(n_}`+C&_U=y_a?b49-Iv2|w|Q~$GKX;1l7u^(d}75Y;f!~@+8+tUn( zHmINFsH4ki(4ruUZHJ}&KjJsabG;HqAd*F?GyG4Pb$hg1(S0q+M*}(Dx|Q5ReXb@c z`tAe|36gqXs;5<`y6mY|Wt)Ml=mambzx%9|A~R0ycd?s*D3rf5T@!P@hR2@aA*Fe}gP#rtXJ zrj#?CX<0QNjOF+3nQ9-1%#d*Guf>ir>*VJ)@tak$N%n~dvN~A5!*{j)eBZ#vm8+T8 zPyEED4K1qRsd|zfLc+;vTC(O&wBZ<&fBds|opYbbaAq{BD9N1h*6+OGV#VnTkHRy2n_5AD~ zt&Y}X%!n#LgQ(RQVMH*>cvDdr9j|dAc~TkPC@GqdYgwp&Z~l!nt??5Z3+9OE<6W(s zEN_>FH z*i&(0EhY9HuNqDuH`%|a4hbes--s~-Ka2D-+>=Pg7hFZJ>Nfr147h%vDOQEGI_&B@ z%R|BckZubkhU|CaA6Q+N{Yu;fFhayejFMf73tSDstn7`1z$}{T;kL(+bWutY7+hRd z#~?-W4}df=k&()h{9BW0@kVtQ?2ko}i)BY|q#4Rhuz6rMR>)@HD9!+)NBV!G^_)mw-=n`# z@tSf3k~d7Oe!j!@ED*)mGi2b<%a=$`%^!~Tj%WIi8q|Z>-u42_6&8oC8g*2j+O^q` zSahSG4W>+w@ov*S#g#0{|Iwg%g<@Ysa_9HTz>|jWLqA?O1$cgoW)gng8OZkPoZ}@C z^-r&xSKY1?#)g-#4(m?%Tu=GQ(TpsQAYtu@+_O`jw5Zz9H~I^Qw4zH4JI~7`JTz;Z zM{K8H!?emAfRYUr=11HMn~&9RIJkSlNPk}?wGGgx{qm8kqBGcAgWod4vEA=*=L91p zMPO1n?zY7J&Bo0;-imL1cWpN2P~;}yzdVT@eSpTCmWMw}$35tiRjP3viDlg*?han0 zxRvnv^pwXZ{;$@=CzlDvn7Y*SL*-4Ac2moDO)mL7jUIgLi*ZV z??0HXr(q+Oh9leSI>KSJCoQLg2yF@z zh|W{E)EysH>|%S1H9w0O_v!p59ke-KBdlp~c89*QuJk=2Y>OX_Q>A+o0INFBmjdW2 zMqpz7!Ga^bTuRi4jO*Xuf@`X#tc~0v10@<7_M4l#T>TsVRx{C0uJ`RLBhei!n>qVP z29aGaS@VE|<#d2PCQ4k|neZov{htA3bP0wu_C!a8W2AtK(mtOu*A)B_>Go}8-3dKg zZzcW9vpf150hZSHHPCXN(}xS4^U-YV$69{!h@BO1n@w0aI{JofARRk2StjIXQg11kVV_FU_y;PAY>oV!gI-Xn)pbO^`d6as z4VxAMWAFLbP6%JHL`R97K9puqovn2~pCb+;>3VlI@c;lfT!*EEH=1yDOtQFUZu>pW z)l5URlVJTyFt`p8DYXq6?OU{PFsq0Tc$A8z0;xQZ}X=#ekniI~xz4HXoq;Dsy!i9hrzNlc_zS!k(U$$jl-Q2MzQH~Ecvr8$;_80e+) zeGPt=@i-0KIGeE%nF@(7uj~PIRQ=~{hgIVlqh8#-7rFGo8t@VOrdxNWF!D$#f~Mdh zOSsX$Qkm9L=+4RtT*<$k!1Tr-pxjXeq~*pLV($H!4z|_k*j{VG<(-Ko>X2A$y;Hjj zFwSvj=d~ZZt+xs!gg&sKaDQL>xwviu?PV-(64CaZ$VC^FD8B zZk_U#;q)7;$g zHVp%<^N>K~eF^sI;5#PN!JBq0Z(Fa)ci7K&N#V48KlqBGR&P#~uN6uv8$6rnOf`&^ z^U)@mk+0=3m6$s!nl7f{Uw-c@Mz#kn4~zTgFhU1(9W-o|J-vt+6nzUYM&&?1)<|2# zjh5yYpuQHIqQituhq7*5S4m(JXC^4&1kiBbsoV!;%1VA~udy)P$gG z-Ochnse&w;Y_2UV5E{62GINIlc3VLL-*>iml!pC3$+X^!DY1E{$ca1hdv4Lppf~AO zmfS6#7LEGmm`#6ziGi)wPNf?u-^k8djImL>hu} zB9ny|w5Vsq{5TT$EXYamg4lUM7pq=n6SE07HJqE3c$+sztJ3^OvDLIF7MYX+R!!V& z%3Jb?z$-+p1`aE5G|9!>Bym>O7eW~%4CrEVy3L*Hi6p3OBl`qj`CO6I6=eNbiuhCX z7F5?lNp`$2fAqy>%DWGOV+u-=pxw31lHU2sZ!>S2aH+o#edK(I-N-W&i+XMswE!PE zWaVK=;ufgY$!hB6R~V@!Kki-2P*{$+<=k{!SEEpE(1NdQz5kOoXm#&V7GZK3Z_rS{Ua zmS3V)aHNivyPWZbknt&A!Aa3)zH=aJ*v!ET6|(yG23$QwS|up+Pn51TqjB$&f6l=A zCA9Kg-wc3ldZf9|*T%!YS>tto6ue5#SKx0hSl_B>-YGT!C}uwgj^Fr_S4y@|LUvv* zVe6;tC!h+Q4?qvJ-{UJDCT6>Z8L96{Qjw1v@4@_kS^)L_SO$iuY9fjlF?hdzeo~a& zzK`K@{xh0lj?r%Q)DWmyIHlwtRW`5jejJP=0lbuVjr~PqtN?UW@|W8NmHqmN7~F3j z#5@1WR7}J^^ZOk!&G{kY;>^IAp>O+%ezfp#KY!S4=x%x+b zH#uKFQu(rGSw2EERy6ep8q^CHzVos8-P7F2X3*{bM>8m-tb@SY>unet?x6kRPb#H% zpX_8uWGzWWi|M$sl@?c%{`6UGi(%^8to>%tthZ5JlaEXyYb>6)9KY6>k6006{CgEv4 znfV^y6Jv+FUhY^!$X8;^LO>6{$w60fo5MU;pgIoy$f?nDbB}bWv0fo94q;0Rw3PFl zvKak=omJFM>(m4!*hEknBSUj!6!n!0x>4MAOIG3>qvXoUYMIVQ7Gop#69r!PWQGTO zHw&2l)Op#weZ_E>L;v1vLMl=RZ$3e_GE5d&(zVxM8xnl{@zv=*Y?M3wZ$T!Dot?}6 z*1=uQ{2L_6mY@#=BC!W|gRAuI_p^v_s1Qf;DS^S9K%u_hzub#zpU9ZW4P<*cQFh0y z$R6;EH8!%t^e1!lBQLg6N_Ax&m5pQ!75KUT3pF(lgM>qJ%n9|8dr|ZIhNS!4ghO|= zYLTkyARK!BRgAlT{jvj#)Tuo;%M|>t11par)CJm?XfAsT4*?r05*l_N(`55o;u#>i zT!fa#!t#KqG1Pir&ez{vwr-YRF9EvMFp%4#hGjjRs%S>?v{;<=Tr*^TT50pxk^~I0 zNdroU&8%i;T_a@BKO~lBjhscakZksSJX}mTV_azE;PZS)z2r<+vC(sMk3KuuC2p(3QW}32YowN)?ebZ+&o&W{mU#-_ufD;sdqF zMcS?BPn@FAPexq=y~UC0P<7{D7#TCTJO1!XRief>4K6q-f)3r4&SHZ zH!eg8Z@K(EB`!5oVCrK-xocHaw{ei{_MzRuzwf@ibP2=Y!}ke>T~W7o=Q>KW0v6In z$8f8eYi&~F7#*G;mDgA^8!kM!y1bWcBbLOi@i>@8UN=F^*>~nS4!uIe75pN%>J7B) z+idfi@EFiTw9_j2sR3fMx*adGB$!e`lA?$%qwEk+d+in-Ma#@+d@BTY(1ph$*{rzT z_?K)ekeyfaOSkcMLq)4QRA(N76ht`3tk*2xS?)y2GGKj}^j|yYeU!Ja2&59OWO91r zmwWG7I+{^$!h4Wf@;BHA4UCymbOg$T=m{l#oz4X!s`ai8 zO1rNL_7BS~taSbG{luV%y5QkVNBQI_(R@Fs01^5s)iHYN3A+7db=;b~s}qFTV|^MH z0Zn|Ho1qodx!x?y14R=wlV9Darz9iEDTY3YwwBnR+j6Lk=1VEpCy!nIi-bO( zKwis=px!0{hfu1k2 zmNlh)it!KxLKzbh;+g?kCdUrU?D??h!+2|eYdM~d*~nthpF#!Nhiyn}w7cmp5^6pm zFxq2x%%qeeEnPrhshFpVuK6577EN1qho}Emd_C{(01Oh?ycqPQK$x)V>L$2d&S8N2 z9ZJ;{EZgQ7O0e4lgnjf*K>F|!N*!WKej^Y+(Bz~V^hZIASLY?l0CpLOG&B@m!wmF1 zRQ+FdO>b-tT+&t_2E_zSv#O$x1X?0}7s_PEIa+0XbD6w`ea=`8ZFUKiNZtpfF?%^v zArfKpk5FsVOLS7BHw$WXA;zVT1RAWcZZPd(HnyK+03ScisC9ec++?w(q`|MIw1Ta7 zS>zI&hT|uX@g7uY1^Y8im0qAwAd3{&!X-F+E=ruJcb>giz38OAfr?cxy?uw5Mi&L` zJ263K4Rd~XEwfkj>sMdXt83S5x0F=1?&1X0?rDsr28EWsmi%}-h(P=!V|~@rt1>k4 z7b3>>HaCnIx%Ik}Yf`@!Z6GFV7LyKY=;skmDf$OZ2#_W<-27R=1#iq+;Cas6$Fhbo^UH2H)EX~f)|Sb}ls4-|r9vZD`?%H9v-R2iVLN-2-m zt^~^!B-w(WPeP_U$FC40-N(~SGD=GPc1_vY+1+47@Xpj#d}2+IM>=yKQK(U+XxVt? z2n_rHwu{z)CV6qm?#Gw{+Tx#+)~4rQ{;0RBDlr*N&-w14G+X|9RaVe(qx#hW0*CGw zvB{QoT{IO6Xhqtnm?+nQJ6m9EcqTO_+Wk+;@($I1tJ0NKR)>Tt0(s1zKDm{Zm1tUM z|7%*uwMFIA;0bFVfwiqJ;PAM)^jgrAJybu}>OQ1N0jtMxGoH=caW3H5{78};^nYSO zo_E^aXGr^P-<#0$laZX<-#Cp`zZ?^fZ1aj%3z8Tltq7Ts{@8OhB_#jON|LaXqT}|I zMQ$mpPJ<>7!BC}z#wz%NtY~I5tHeGFa=wl*sb;35YgLJMSx$D!grZXV3qwc7^X`GSffgBbmR5EwY}ZZtbn3c${ta**yb) zTp}rVMXCcZz?t(5SfxSrM0ea4q`7}~mby2E!M(W9U-Y4TNWSy0#ljNB*Dfoo)lDa_ zln^m^m+%|gx!F(diR*S~kNNz%%00?!Hz;*cAZmR7fpO&$AeXZDbO4r=j3r(~h?xfC zBzSGhd}(|%eq*3?=+&!N5y{CG+M0lzRDb^bc@QyLU}sZ^UjXPZ>E(8>U@)n_czj}d zV4H|$^m=`owm_`Npzn`B^B63al!upHGRDy^0T2DU9O)j9iF73#cx6j}X=#ap z)25-j1jV@QT!e;Iz2UvB!@PSLi?=sb_QIP&-d)fRIiL|(hg^Zs0GF34^ey}@GlWF& zyGGT=I} zkLt!c<3Md%SXJBe$nXf%aeIN(mi@(brx{~0kSPT-hShw6C=QE)4Fl;UWe&Es9ek1x zCFfww@|1Y@w2=O5?BHw+PVhL@?&BlKC)wZ?K>oOm9Agp#{Kl(!1*=Po%1KlZh7X4x zb{FVx8Scz94}ohbD2fG{PgXxe76O1j8UgY?*9?iReBwdXr3X&dUiS{Ehnd;gvVa{6 z{>l2fpC~Snl$Qzl&FM%R`8U6l#!=vFDLKB`BRw=RB`zO_hMj~jlom$*mz)*(1796n z=la0Ic0PYMyXw+P$I>S$i83A>S@YGwW8*pnqg)JYIH&-2Lo?mnGL}t)v0r3ABr`J; zZG(6dmWKw23(_kj@aQcQW_{I|T3~K6>xIg1{&TCJ)$8QGye9M~S3TCvvKm zvEizCGBh-l35?oou5Jk4n1mQ2uPNALr$g`m8(Y=n9WdpVRz z?&W!;ZjtSFuw@HQZ)lTVu-KH}dq@I7nP~~>e=7bR`2-%ACgPOf<{CKPoMndmloKt9 zGVWR74F*~1_t?brw6tlYt{ZQ?J>Wl&o0%hjh?rbQ#T1b9Zh}-Gaq7}Xx*DB}i^~8o z63G24!HIK=^&_&l4ac~`BH48WFy|$@WA9TJlla7Y=d?7?`otF#*`Xo_um(#cT@;On zCJeryZFgpf7e4(&dbx9M&X?-NlENF&FM4 zK+j?X=xcU^;A$p_N!dcCjbV7XLcJAJMcI&hEP_Gq+K8hS#rkev$^)|&si~9$&Ckoj zM|GQ}a0>NE58xr^1WGnWEyg|Jgy8JV3(EtBd3WY_Q%HkOCUL;#?*{+nLu+cEIc(=^ zM$adBVqLGV-8^`@L4u0nLG5^!5E>Cn#|3tnrX#fum|@+tm)>-!@VAHpZcJSIceQ1C zH>{=w_dO{%u(P#Ad}zRmfE}ljngM27);$pU^ztZ^pRdAQ{?y{2au;mt78hf6Vj!z= zbE|EteM0S_0&DDrt`-k9%wM+XGV&0*gY?$s>Pu>mho?^x-1?0)*4$y3S!j~Cv@8VG zRIM9CL|K5cX$VmJATE!s=0ld8+hAV96`|5Cs^b?dGeE#|Y`;X7qwy6FE(SGQOypFM zBGfaJ9XK&Rg&YPa#xb$kt1C`eWl=7R8tdV zMtuyYG6^dDHE-|FFd9_ul(DM^{~8xx@o^@CS+k;(^}1X{>30Y|_>h?;FkMH8obI&R zu4ct{Q&`pMbrWce7+N+Q8M*u(e6pAx%pMfo)0`{7ZMTYvSis0RPfcoCOU zd*DWFHJn&>_4Gu-F_kb7@-pff-Sv@E@JZuW=6dkwyRy+wMxD;!1y@w=@b62S$eFN* zIeXNZTqYz5=PY+eyf*Tj^}$9yAkj)i%l~?Sv%+VA?awlLFDFrta2!rPM3SH~m@lwH zIuzB`*5=($)C>3IE0E=6MDkbQ_Lc(x_*KiQqU(RuK!d#E_cjExzgP5HIE(7`f`Ebc zGR5=Q6d-P4u$UyYJ^sAt>g(fMheK{*-I`EKNtZEwG6`wC4ge3I_%FqF&;4QUY`%#P zDyTG5sUf67u^$3hGGm&>$4_lSAx_Uy$?FZ`MD<}ad8o>?31wTY{4FIoRo<9{l46BOX zx!1mIJE(kl+FXZ!Lsm8Hf82a&bn)T8{w2jw2N!nmqMt{Fh4-q;GC72d`!QT)R@nwa z-NIm05)FKO>FEZK-kS>KUtG5959B{Bfe~eSFXoN7lHR8S1jzX?M;_>pdwd89P`Ne# z@g7gPT>Z}4_>=$R`8}rqo3bvH`RpO`@dAR7$H`3_Q2yN8>$wkt#TtmJ9B^7ZO{#jfOYbvY1zEN+#e5rO5Hhuiq&vc@aN+at@W8qM)g`8Dl$v=^TA39&* z1naa%y?6qjB_nj<>s9jAIQ`rthY5>gn_x*SUQD^E7S`lOPx8&E{(VDP@XupZH%)mw zS(sl1{f*r++c7OC8K^GPP5GIme8lD+{JuPS`AU&X_7J&wr{lOUH?x2^&F!n)?6Gpd zRb~OaM+B@LX&^r!R9+lAgACeIYgeJxS6PSp-WY^T~4RYXe8bz(C+axwRZixk-26R+}# z&ZEn}3eWnZW!vz4qkZU)>aT^`^}?zXN}xq_d6q*(feHXULcIzJ7+U}9hpwAxwaL>`dHwK#JHRwf>)L2bb0 z%B=SG6#t}5@MnW;vdR>0a5!bSU+98U+Z|-W2_<-pDLpZbwL}T1?(x1bLWc7W>!Z9H zVBDpB>%KNC_)C6-;$JXTA=cd6?WC6bVGuj%br8CRkCiiHu)LdYfm{><=zYmO z(Tl5z3!6@j5ibig67R;hxQKqG66WVut+bl9l#qaWL7B$B3I2Zr^cKg2!_W6hxa8%4 z+decwL_9-hCl|AVC9ZJ;!I6Zq*?PE0(mwlw8nz{ z&$#AhwITk7@wLQB`YQLhv zuI3w9C|k5h3Hcv+qg>rfEo)5%s!cag1=(E~`nnwWHR=A4kCsT5nOsHAE==s-t)KVH z8spZ_IWCfZZ%(MHmzxm2%|HfQ#c1%C8NqoloO(3>qs~FCY~iMR&YzqABxQI+<5gmk zqG$c6KdKkK?ZH*`R3H$prpU*M4gU_tTNw@j0f&WEe&j0UKuLbHnrPJ!4s@nOQ{RS* zbGN}aT<=NPDl`f;1zo^-4@YeAzy{7Zd!Y<)M3^3`cXO(l4->BY>jBX1>>+swU<|=i z4H?!HO-Sh*zI++u{^yTssqG?mO|2V~>Dc)Ys!ys(d7#}t_sHX!lXe!v^Qz#i7jMi~ z2Q&Pk*v-I$vBV6a5*jRVCP2JID~X;Vx8L+{*Oo^;+q+M02Lhkp^SoyGvvK5o>fjA1kPducP zFMm&zsXrgL8_WqU&+P^!gYBByZzphh404?w_s%6+*538Hm)(L1(H_?eli$}fKc{-C z!=_Ymj{G93s1wbOv?c#us3TdpH7axOMafwCvuEwI3&@ujf^9%4de5#QiOJ1zD|V{h zwTD<$lQu9gkn<-+LMUWtNNH%`pM0eA|J%)WRut1S!B=6WZ~9MxK@BY|^;?wHa&}LC zP2NHfOHmY@4RTOrQR_1tdk2@*`nLggI0%t@um(+Oje-;S`qDY2tYfXAlQ1=6p`MSKROg1BNLB8xCLWbU?lxJiTa&eoa@H#fDJu zD9&Rj>kGp>6ey(f?k163e)%I*vHa6#OTFqe zBlmOf0@ytUzz+T^-zcGSA%YIMltuQ`>2cou%(KPbg%};3`NEdCxf-m0!qz!W-Oj>y zd*@8kUE%t#hQNae?n8^DgTvD;!Z^WcUq~S@k5O;&I*3LCs|d5iEcDpb-Iz6WLu zogA}dt@HMseEL4@djg~Ijzr@MONn|lT@VGDD6)B@v9cgmnQ8uNS)u=lZikHO1CRf_ zls`k*XtVZh*b3fuQ!^_0;Xn{~?M-$jcPMiU+OK?sbM+d-O$Zx3Kb2Ta@Eu@~4`(@U z{u~05qXp{sV|5(g$Fo0eO=5+Z zOVnp$!~9j5QKP)JS1%{s2#tq1T};S9 znM01}D)&oaNQ&vXxrbeyo2$rKhl;zv3h^H38OQkgqS?t8Og@KW1zBVUw+;E+7iCUY zr1BOa8!E7GM*WsoLBFP)hF>qs35WI#7+{7Wa}B`@A@7e zoMmq-NEBoGvpk2Mkx^*$(dX2{r)j7~52)PG2W@{QhS}-9gD=OHMTjK;Tipwz}s&x474 z707SH%z>2Rqpd9m^4~sc!~;2Q$oluvLLq>a27U!BH^~o>@=ZQmrhxv<6XW0 z^N2MWj5Hxt{|0wsuZrY<<<${XRPKj1Qil4;ZknHsW#J^Xn5dFXzE+VbwZ8PcQI9Iy zB&a*U`Z;pxe{Jd_`fSh{lU(ZBuKuImB=?wojc)o%njI5itG7nt4{QUszm79{s*I#+GdW{$Bfji%g zSJl>O$ST2-BgEc&2=0DqSy|bp%^*kJ$DgS{FCfam*cfNJ?%;uWO-+sMZxcWFi!*E) zC7ruJjLWjrLxVF@gn5RmP3i0!4W7$PW6Y3UeorwLrKt0xO7ls^3D2MG7=NiE&<-v@ zPmxWCSR7IyN--+&@fkr5)Q6Z!q8{pCu&JvpM=e^e^hPC*m4rW^fh}<))<|JZMwW~C z)7u#Xr13k=J=B^S7hC#y-_vTF&*tNGa*i89G{*gbJZ4ivXYbP$pBJb*OsVdWl6f>{ zxgYJJRXvcezAQc>?~%4hSgp?F3de7e=NZ9Aq*<$cbU4!Z6$;~vU$+~Gk|S0jBeci3 z+YtMI*N9h~YoEb!a~wJi1%>!~f3 zkn_BzPK8xx^epXlP?TL`*gaJ~DcM-rQmqqH0%Uy0gW}OYBmXk&#N)%T?c8$e{MMLO z=dS}fdU~0&JlHi ze))Qv{{PF_$hP8A4FthGaQNKVd5A1l=H6XhUFCv%Xn%GNx`8lvk^J9fCCQ_N;081Q zRXc)af_GbJ<@^eNPn4#jt!jb{YdkZ<tc1f$Zo5M zdwH>Dk~%lm(JQeg;m9qYHXdZPq#};9Iis(R6R*_vOGb?+qWR?|WBr8O=A}TwwNA~@CA99}G z@9(~@>%Q(k&hrtD<1^mlHJ-2M>-iSAb*_GF$K*UGr$(6K^N7bX-i_z!q++!nOM17k z_6Vr?Zw6@=jm4z1h$I>`Z1)8ac%7uUYy4(nu)55C*-_~&bP4ADr(>z=+ z9x&)8bUp-`*KxN;aK4K3@RJg3c!K>OKR39oOuvu@EIvjdFFD)~EgFe2RSMGoiMf9g z_H%H_1YjaM?5!7lQjK!*)ztyjOYSSD=uMffsNZd^k(n|F6pW1 zX%5oQliQ$G9oMH(p~_IiNEU#bQPkG-scR@wW=-pC#qIKRpR+a|d84fA3ujL>c1_vz zzRWiNR!{;GDYtPy>Rgb^`7>qB$F;s*B?YCs(jVB3jur@`5n3B93Y|x>Yr~VEn05gU zH!}w{l<`j~Jcbo;P^dKQHML9I-L58UP0S(DT+Ckd5!m+~R>c$4ca!rdo_X!A6ia~f z_7El`U3l1~Ws4`rFh@tdx_V|v_$yTsF6$t}AWM05p7Bd9&ZQ3rg%(8GmYZX6H}tQ2 z2r8#tI!jcSUbA2pHor^wM090kczkV=*?H{})9fW9{x5ViL7u+9;GpmuwJR0a)rimdRKpt ziQ~bm2mqiffB*K9j60B!)$N|_l12lF!+_f>Y_u|*O7~d9XAKF1sZAY*7i@#4 zCpSSVUG%jQt4I|31Lv4i+V4n7#<3u&177n)=onOx&N9g)>k>efp{tsjD&;Hl@u6w| zWX1P*V4=4ijGkp8`~MhJJ=}|=;X0<^bRHQvbjVteu;p>2F&<_$}4$S*d8S&YE z*Y9f0NKbD{+TB9u@&)4IPo72tj2&`9SY0LXZ(fhd&uWITB*0KHS4#yDhB3AtSy5G5huJA|6L!|9AZmfe z)OdP!fdRc>Q#ZA@DPt;bqI?$6^zz@O1L<%Qs+{@K_$S2GK}i3g%XHplZSyC!$zEcMP0Y$I zqn_4YJbxch@(DtNPey!TB8$U?Ef-l_EZ8yNg?F&Qf*m8Yzj{19jbVwpJ3qiq9HS8d z6b(iJA&o+01W;607H$F3G8}urM@e10p^VMXV6TQHCi1{xyP*)yKmq6hpUSQ4u$?b^ zL3Qz?bwQ=Y(3_sZ)*fBsgi8s7z&KvaX~V!vMVaYmo}|4Qiz;boGCNRlOZ;J5pl1-i z!^Qx#_BVk*#!V=`pSPk``N!&!5kO^#6! z7u9QK2Fo>Pt9RW|Uf3EZtOkIT6|MlvF~Fone^w5n5gP4~XNZKnM>abnejmz$5re_! zzkm^>_WBG3G2%*2d2A&U*|Hhna5UUumU@VN2GgrhnovG+DoBozjR27pc&oQw4?6Z4 zcD^=Ox}u=)40MR{VN>w)Yal*Cv)@t3jX@mDqBP*+kuJ>s?qKYMeR`U^ZJn$z1K#2K zkwf4S{%%<*0M^*j<7rV<32F!U2!@ALDFXD!t^gj0_v<)t2cr8SO_XBfvmaN6Wp~+K zPwwaxH(wf@Lu+j74W!!T8~SVnH~yKrf2!VO|I(TMZVpCh6(rgl-#^#BL#g}R!`0hM zY1*dza2G#osfbL{SOPeO~K2P32+&=`|FG?hEl1kRzg4l2ajVnj>IJc>$oOEd}l?XEZg~SXsy39Zd`P<%*z^f#sn1)>h?d zCIE@QGkT>$VInm-XW#zR_`s?vzbhT=DH%_MfIn9eP9`QMRTmlI{gsUXJ)+hJR(G)} z0pl!zoxMHaYut-dSxL=s*Dt5xykIk!Jgt;uaKWX@yoVAMjEK`0l?l?m-yR zH;2h2zu$soZ9uaB6q2r}*gLn7aUc7eONUT-(|v0}etk4tZ4?AVI^i${Y?U0)yQ_#e zchLN-39i6%e0V7`Qn*%!`b7NStC5w#O@2CIrcUC%M|)By@b`X3?9~q}Ci3eeveww& z_%jvWYNubHDQa(}P)6tR0pfE7NL9+}nJ4|0Dh_#37o5$NIp9TvP)IVtto=oM3%SvT z3tdY1xIjK3KX5$mAIHNFUX9K7U`Qs`1>&zIzF!G;!=T1pb)c}|C#^MR+|Nb^dEZ(Y!w+A7bZ48DMlxP z<(4a!mX@hyP>2rv7W~<6fB7H4NrG{7?VQI)rr4950M^^2nv|53`Zsnyatf+b%%1-` zkUf9zSp*B^!o#g8aa@=}5qmiZAsIn3F$}V#AK2s@`#CZ{G(mUOr;ej5OMb_t3GN`_ z?uDX(A{>NWa+vO7w?5@(?tNSGUvG)x6olHujHnhIwf|j+TX1WJw!AF0jiRcMsRM3eRw&elWErrHOih_#6C#9w@4cPg- zuxO=R@-z606rgPOq4Bvw=Ov3Tl@H4fpX6io zFl4+BG{)4r^RQBRU`~I8jlKCh$KO%#7fkDPF-YJnanpdPjDodp3GSeZ?$ABfzki1d=nkjsE(UrE z!@q{K^!)biNnI4W1C5#sBAYOhdDcK_!u-8AL1*C&X#`T?^`}h&Su+|1GETT|XxO+IQNRBGG^3?=&g_AtSiAn;X{o7Zfcns5_c)Gr= zU*%ek2%U*;t6#Ppy#|3uf+d7WzCqPirRO7m@8`*kHkw`klpyX9{N;h>4Z8jNkX=HX z>(<#RV(jMf1mLVZGd>@9Z{VdV`_C{lO9#`7bHQ29oTwaxZ{dIZr!(vTU>3#P{bhH1 ze+R_F4rnA5p_8kDbwX`?F83d+^AqSU%C3RTm3zbK3m$Yi=xDoa-`LpL6;spHiC?GZ z-~`FAC!`Q01j5tQK50q$yG3i9;pcea@#T|{>VkEtDf~BuBZnEhckY?P9^fyCo28cY z9FDwK09^FZMH7g_QHTn&q@b!A%)-uou*d1V+<%b9_Pw?oT=%x%NkIayN#e<C6=4QNv6vB1B1$zw$1=*IvIiKgZ($yvh+EmZ$3-`&}KWaSQy^J2Z$e;d-vB?&>t zBpFv>=<9Y)cH;dVslregpHrlSDwi2u5PE0;o!I;@FqA>!TMvk}F?7#DWf znV_G&^eFTSO}x$;z0;EmrlrjB_S zc9Wl(VgxOZ^ZecAu(R$#Jj!oiCx-WiYM`=qobQ5@0qO=N1PLWWGq|!6)#)A}>ctH#}ZJIFZ7aT>-|6Q#Y zRAC>D_{JY${tojIC`{RleSG9i7l4GvR@D$bgmtZd$Sy!kL@VK{2TGe}TrG%q4P+!4 zJi$aIpc>^GRq6xXaSYXQVMVi;!sHO8!D#dSwA+tt?*eI`dLl?fT&@N|FuWYO|HQRF zmEp1CNjbh@9sE3ZvgWxd2jzoDXvq>>u6z&>9=t20-Vf}8cBD~{F?39$+&~@DdUbL{!(@D7B&0iofrQfe6 z(9zNEU$7mBTrq#>uDkdmxAI;3J5W>Yesyz_Q)GimsaKv(z5%CoZ*C})v@Zn=<0A-$ z5b*=i^aQPYm5aG6CQsdfexL|YZj5X6*;N}(hPrep@sVroKGsQ)O-@sc>kK>eeD8!r zkR-Q^9y3r|8B*n}Q|0Px*Vy9Fq!hQ3?ivek z%<1p`#Bn0qU)cOpLAbTevs|La;x13Q@-P`YX;16mEBTMa)$Zkc{hS$@rYW3uOnbhQzc)SX z{R?N?U>CT-jLKLs8280iFPwcB(n1&gv8p8M%^<_`>DRe-j_c{;^>%F|)eMzES$C%A z#D-RhvD-;yZ#z|seC^xcP83yy#U2&#G77)Rv!^pJOc1ZqsCSvHEeIv<^H3y93FQ zW%>Ge93ld&xBHnfxOL^tpHk8vW9Q~p0e<3hk2~$6Ff-MpFNPDRhpVe6vROq%uOku! zaCU9IRyJU$Fi!w%Qnjn6)TOwPSiSV;tNifb(n?+_jL>hI&vIbJ%G}=EVHxdHDeQ}N zFR}w-f!#O9z8Ege4U2-3Kd02#4TNP4lNOdY+4`sD3PNG6hkj+hT5aoZpNKIM-r4az zF#%=^3=+=U9h)=1)+DjRPYzaW*YM!O|K2ZqyNlRK3?>$~74}+Bg56y+&7nDA? zVKfb_Kn?mYoo~w14V{BVS+^ExS_U5cD&1)tu}Oj^$VI1b6ppZtV06>mNS%_f+eht( zwd7`2K=ndkw?t^g9e6a80vsVyCkEq@skx2il91{?uBz3J^F{yUc0_gm!?xADY)EC` z5Vq{BYt(t4S88U$_J+O?fU~;SHBrXyoD8n>UPwf`0ePyb>2Vq;99gtc?_}e)E>YAfr%K3 z9%KkFjBouFP>Ev<%3`v>beT6DdtO%+*nudrF9D$%DZ-PVVYDp5EFEp5|^})U@ z&a*(=0vA$teq-OVuLTh8B?93Lc9t$E!cEeAK}l9Kw;Hf zAaQ^E_z}?tdF40EDZOHh&%S}oG!%7!INP^jX|pH@ghmiH_r~Xm*syTx^nAl9+a_3{ z9@pMizBmMDD#{ZAQzOdA#j<-q3J*ouSqPeGR_Id0#@M*17WCS*o+L)Xtpb$O)u7i1 z_5GmUn{3^JL>3knivIso78DDSVph4qs8Ua3gOD-s<9oaSl; zV9yJE%Qq;0O?%;P&8=tB)ec{)Jv@qj1BaG%ZO~rrvjI($Wk;&d*=w&^CfywUfJ_m+ zHVbFpo?PC6T9Vxt^Qe!|05Aq^#w0Gg>NE3StqVSmgk0hQ$=p1L>0WLMzr!E-mzC;u z4et4D{W$9JjLPW25ATq5#I7Y*6Jx@5LQHmim|Jk)o;D6pCA|+tAkDGixrXx(z;rC4 z*4t~4SCQ&VlS=_m#1;`tdk7orj1vfQ7hIB6d9U>*4c~$!U>+>fY4nM(ukqMVz!d*9 zgnj-lgl`*bCDmbAR?Ck72BPs4l-v|SB)Bql&}qO1=80m-;2xepl!4t-L7T5yReydS zDwvorTZD>GBw$R(Nw*=J*UD~H*o%kk-W*c>knvz)I^fu zU!afk)yoqJ9(D8iknS4|W9SoVlm%Br5JT5fQVYSn*sqYTvkQAq#7-ak6n0!yh~ zx`X65m^`XHDWHDPbKWr-e}{MQ)lVp7W@TGx4%R4>WswYILUt&3>J=Vp9d)czllj-H z0Oo_he>I79nX2{iQ%k19Rw4O_ONucyY9S;n0*FyAzy>nrZg2%s+|3JnPbXRP5q^#r z+gL^z_}yT5*3CdiNVxk9?1QpP^Nm@0EMuU|seND^nn_W$_ak$N*y)1mor=DiRtRBk zBCQ-adId%M1};+>!2Kz~ZN$P^YYo-I)>a z!j@0-95=L+BN$vDK^Jm&mA8r!9HAa0?VK?e@6Vn^**uWt;_L-&hYZBZdR7_W=qP9s zxz#%@c;jNQ3+a@@4Hus6cbUMcZeZMHnH7D1+xmBwTQ9Ftf#KWUzy)X+bRTlGvdJkT z17g?O_{GX!FLRXRh+6e7F5Fi#VcThlpvM|s3Z`V<+rV)@1C`}*g3^-m=R0xGgV3FK zy>Cn2vqa+AbvPNC;}x`=K30Ma^ya1r&%TG!01rYgpCExeR2vlY%#!#+oJB@MGo{;k~}?BcP!7k1FKGhUDnr(hB5f^DhG zod(7(A}J(#>^OI1I}5g&a32+4eg-{9U&Xo$gMFREs7U)U^`}U+CaY+C7YvrSw~tEv zslk_Wa067w!0C%QkcJhUp*^lO6X0hv>+6j{r=qIg6515|x7m7Z4s1EIm{f_J91;?NA-WZa%`;n-a@rT2S4y=NN!;FMXEsL1cHAbsiO{?>S=V$h4a4{ocg z3#p#hgue?Pbn!-Q5|p+ieCDyzOhgEw6wmj>-7jN23Db7EZFW<0=T7`JN`QF%JTz)S zdyno{ceCUC>xS`((IsX>XOS=Umlz-JMZPA|UQfx{E9f7N;^?}3)zY1Ps=X!CVbYiR zC4YClg`>|bM10&%*Ys&q&(B1wk7GM82FCLFM(hsaLAw0hq5K0oL7N-6(kM}_?;8Wd zJL7f-b6Zzu$z*oU1BCPF+QgCLZw7x*MZLWm&|-L{e(XqN^!6a7^t&e-9eefGRK38tvk>r;_xY6q|0%6QX@+A*$6Z?g|!%xHjW)BAGMv%uQMy96S9i1 z41ZX0rq9-W=~R*GKyuQhKi3CSP89v7yFd8D?x1&T{~J7Mp8G7T4)?@AEZe z>=F)YdX+C<>?tkJ86UN6N%(Utxi)a~mjxEFfa2_C`vdoi0j_TtVvJ=I=nKR;IKgQ+ zxjnK&S8rr0oIVe$ijPG723z18+I=9ImR-_k54ncrNXrR7Y#x4Ce5Msu-C_12x3KiG zjB(&fe>+>DG-xbFxfWGIq7~i2#jC#}os$KOii`u9Rl50`zq&6~Z}b$j+7EHHzWKnO z+LxkJ@aj3N3@ySVv>eb2mz(XII{nRyup9=aj?RFued?lksZL=BLmt`BazU%^rs8Wk z?=g|i#*`Mtub=ABc4YhHj;&SiR&I?j?DBPST56xnOHHG^>EO?p_dHemN^U(}aVYAF z()!SGesWok%GmW)cIU`7NBJ}L#h4B$tc<{5PF%rQ?{!-tO@2#O`n&^X++YW)>$Wot zHQnUS)J~>STHp$GTLwGOFyDWXUE`n)b>y;lOKqY*kF-WN^NiOR?WkqF?A)0uHne&f zp!2ySyP|vI{Xqu7>0A;4Ji^0d_n&>t?b_{XHymVQ)6|yBnVbBXQ>zR>RPHVai$yUV5by$Q~v$tls{?aY3eE1NU< z22V7#OL=NS{_KCFx(3OfZILf|A1wQnP8{k?J)&fi$-x9>#Op4qPiFBn?qla!5a8bX z`lQPkj7be@UY`+|bs}oToV+YeoY-~F@=1f?Q#l6`ngrDs^AXBE1VWyu;@6RFEjYLc z;Y{P>iw>g3Uexyqp5toLTzgMKYJy>urLy&+UXn@KwbykIMJy`dgjjj=p=e=lVUwhF zvRHN2ikTqT)W-y&Bjr<>ajo5oE)T&|##uUx2|MXZA|gOES;*>rI4AOFzW(Wp3C~n_ zN6II)6fX9Jy{!!-rg4^-n5*)&>4w%=iR1SjPmurl{N0a72i{YfR9HJtzvpqVLo7?X zIUE;f_q(L;1a5(opaE~8+a%OC4!okV zB}OsJ>ong8Cpp6!P+}S{bRNPcON{uc@fVmjq~@m!s@sN@CSG(?iC>h@Zp-)rs$;lI zI^(vJBS*Zb8TfLc?D7PatBC~I_o2oA>@BYOfo8}ar=JNLuEQaCYPKo+X2EqE!S}@* zzJv;bf4&1F1c#dRE2e22LS>3IE%DTzZ{cBKC^@bd96}{)`9me)?=hx5M+19 zYf4j9{2^(@tWbTE!xN`@a#xMpytJ&XAPFym*Ldib4>hR*Mw_l(7LOHT2LT+)H7!N9 zt&v2RCj0QES!;|16q4A~m$sJL19WEYsX1z!yoJ4?JE&54(ccQsAoOZrt5RiM5hYlr#t3nMkZ^5rcPGI8piqD3IBmY42I{4&2m^Ccb%n8{}-N zx43DX?9}d=OYs|4I2>COygFf%-}6Y2MaE=YEH>KsvI*O`-?Jmw^c??8vN>MKO*7+QT~5jDUnG-;}dQ>vS=iHZ(9=E&_J z667lazTi}Mb~wnh)D0Rr_Gnu)GgS6?hE(b5Xqk)yQ#BG!J-eQDzRU-BC8rWs#|&um)ks?=aJ^ z(S7-mp^M?9qv3<{(J&?D7lAd(H)8rdfQG)>_>6vU5;&8eTDzqb*xURH5VY>#64=m; z_o-37*WC}D>{6(1^|z@Vn~jk%@qN%nXbt0ceC*(xgK$mp%a7o-nV`HWsQD8kL`Et% zdG$?gpz1LPq@*?FT#OqykxHpA_#jnVbYpGKHgQq=M&^q`zuB3*+CX1ZHr05{%O99H z7&-N{_own=fyB?61eTw;6%$FD_c*od+?1e7Vt}t~apzMV`fQCf-}SINeffqeJ#n>N z$1EMAE^SY#xkG1zta08V9Cm39;E;gvY)RW12pPp$Cepi1GNG=yYc|@^oXzSnyz%pt_R2xikOaXsV`V_AL%v0cb5Oe7CbP-D}zU z8#-^4SD2?`Uvr_cCM+z7+Uz%G#q+!l8mQK|(R>4T-EtChXtWj?+5X5Y37Nxj#?i(KnatvtFS) zgWNQVSGLA@J@_@{w?WjREcQRUAN z7fcDYArA{kzuZB_^yQ<$2O~jj@u`{%7&56W?@r4=hp!wEH(gEy&Q0u+bp{#fON`^O zymR}Bo$|wCeFa8J3x^RvvEw+sV})&@lU-j$Za~m!Mz1Rqa)xNmaEAc|VB9GmJJFR7 zwWnIwd%Eq}II+N(tM;NMJ!>iJTG{j2m(Zgaw;3=K+4g%|f9_EWVxFO=^CoVcyyx&W z1@NF~GwVs2tf!so;iWCcCUWiO+Fv{PtG8DNG5{-JD-?tV7_(%Y6NXa9qB}+~tkDoM zszPILtCpg%>w>HoSpX$+2c)7UP#uHPjd`u%MYrdK9z(86D&(hQ0ll1b%m{ElpRR4; z@NT(6M*y&EJmHGTVs+(@H#vU(+67KR&)v?w2CPGrdH|qbVYj|28Vz=dPyaSlXH$@h zij_t%psZNfPZfS18STiLgP%O@0rKs?mHV3_dL1^h3P;*Jg$&s2msvN6^Ufhp_b9t- z2csa96O4(BggSNffu|DApb!O;L_m*sH_P| z6AaiVUmwvNV%$z>&dXBlac!~jD6;>9)q`jIjSwv;rL z12P(Sq}YG~zBKr*W*a47mibOI{Wp3+Y$4`A8}iSYmpUyoi#vmK+K#gEr5)@_ZUp=d z^t7%v0vRACyGSrPZRAhwAzliM(vO2`;wusSJqP@G0C;A@q;}a}d;d}$-vZRzZ`5+r zgmt{K>CKIymZwv)eg$a8?VL^8iw;e+(r4B%_4J0Q695iEI_Gt!=;y@lK($Bp;KR8} zw!!oprz`VUHgp;CFljgVpZ`I$DC3bUwpgf(M_tl*1_}=S>7O2nPgGrKWeFW zdPZKlURhdlJc!T<*cM_(KWtw>gzQ^*iubW^`0fzq__c|O;?D7*vg6@LdbtE*pC7RR z7&Gw102DD^pdyBT#K>P#hi5p7M4XqWM3FP3#X7@jy(6vt@}bY`DkOi91y=9i7v)ut z%+ulm)7WM4wSV=kSzCDa+hU&{0UU>KVR#nL5|1hnjW+T9799T zgi*z^*^uG+4}zHI2;8`T0zP4u^eUOPgPe#BpS-oSWBS;wU`lw5SLd!4lcRfm_r?bb zC@T=sC=)`8U>{0^L;`{cjm78fbvFi^TF9XjC%F)Ky{D0Wo@sadeoHJZhzB;{JW{5@ z(r6yn1iJA+r|2s6A^qdxINJu9z+GB|u7ankEu*%?7S}x*p@%{Xbs}IJKRlW7mkA<# zZ@>;a++EO)gv*}$Utb%itOkJ0F;J9<0${eKq|fLKD7r*Op3zlA#Zypi zyxQHZ;&Y6+mEyz?@SHM;vd>Z?LiN{k*1ZKF{{h2|4Xlw)#%57;GR%B{{)>pXZ@mEm zu>!!-GmkDS-DX0>Q*dDsB$QnJsp5jT|D7}!W=Mh-2ck*A(M`;7s`0bY(VIx!3IOdE zq<#klP>_(ENd5|kE_3i8CLI~-FW~3!+piGI!_W7Y=evL%C|SdgO}e`~h+5BHFI9%# zO~(B&x{#m&K)X>S|U z)ktVDrXXq<9UVnlJ<4~-0fyKz_d5V05X1+bsz7z|A5kXk;7k6O9MIil>@;8WirEdW zhkBA#RX-}UZypYoz7A#L6ui05cgUmfP1bbTpcnXvixiF^A87%%#F?F)y-oqjN2sw3 zTZv74aN5J||G?ChfxV?l>$rgky4Zc?)(~IQ>d}}Ae7CEwOl865ZCi)eC@(j9o{#}n zoAPL`2oksS^i;t=LNA8l`UvEDDF`g1hq)4>G|#l6-e=UW1@)gS)b50i2?A=;r{T5% zx_zQU+#~PU-SPzbJY*HBzHG^P3N?~Pt9_&>NZ_KZU6BS4=6Zy)Q zC4Db6M#Kc&b`7eZdmRmQ-vBxC3gOp zVR?LOqbrrr>9cDD6hCh0fEN1QZ6h9qsJfG>0qI~!7FYU=mEZ*FF=&LO%Hc%>O;qVl zLbOdJVF2HO1_|o+57C=nvtS#QM2NK>h07n%di&J^hq+ei6*t-p`D9}q{u6**=sjtY>kNJgk zXFviDtcZsNZl6G0sq~_puAyV3AgI#05?B-~R;x~w04F=!@NKE(qt!3=ufFC}J}Tx$ zwH@fCR06duap4gO+)@;*#-$`PVaGT0_-885jnr8rkOMTOXsSX)OM|BAr&Zq}Hh7_x zr>}kf&LD=XV=|x)4lmraq5r2x4Fy{kCP(&r@Pc6?M_&BMEJ6#y3^}7)lh7Q!{%y{k z9XS`Tqe|&uDHc6;*F4xJVJKpAB;#gD%E=(JwD^N`h(n^3NNeSgk~oNUqcPK_td zIndJo0+qq;m)b4(Q4rbj01GvH!UAcPQD*@$Ic9~1tFw6ndX$B?JN-9$Q!hsY1xXQ- zf;?@McQr#v<~nGesP9yu%oU_53ZnU1fvd6D2jrvc#iYMXxDlOfBFSS&Yer33SukgJ z!ed7sRtGDTjuHp&HPTtc=7GV9uG0I#YVC37Sm7hEAEJS{Hdx#8aH0KA}WJ|)D>S=Z?Zq(g=KN~GyMw?7e~Jo+Mt#M z>CY|DOB4KYk~AALAlRRZb3Cs$HNf{q{+pj9OXW34zKZKJ=8v4TFimntGq;Y3T+R@N z!J(tdGO4(>1%=$TvMxNN#eeh#`OV(EcY zCK}SimU^-w3s7B%{SCD(ojH&(O+)c?YNXMS^8_8aw}#mn<#hM2x_M0kAP=KyY5YOT z#nna{N|5y=gP0Yjyt;y(2LOU_e5E&BgBn^KFWW9)aRMpSHje=`eAUet>6@}#Rq8{4 zBZ_8WY37Nb@#+mSYac4R}C|&~-4cbn%BDL#$s+yFgY+>=$j`#o-s)ouB(k_etshB@l!XDQGor z;AB?0gf`zT2wq;b|3RCNQp#b2t{p{X!kTml`w&hc%j?gdOS8Tpn-f2o`u-4<1B4>0 zcUB4#-%`CP&?K^)l*Xe49r)^Oi!@C!=j(t}2;NTJv~;A&TfO?AgSX;W#AW>+*)uJe z3#ciDAd`ygUC4^wnHQKQnKPr44vP9ujV|GRp7+<$Kn?aKmODUuhC()fq>V#{PG-mV zVEqTa&dVaCU6TF;X|#>3;JF<{J^HkR}C_8oVFbY?o5FMJ(>TEt1w?Vp7csa{FYEfc#?%GHV~RFFPT zlh5@I6L~73;Y!wh)Wz*?(qN_e;f}AE+kq30I_(H^Y)v_*h{#wz2!azSHJ}!6chPJ`0`0MyBlwi!M6Rs)- z2|j?KI)RYhQB;@CIAO5KxIMFq?GAi%;vhgUaviExgqRCR7O(SEPl3^dhKf zWXX{UJ^7hd%3h@3j`CFfF-5@zV&DCkEWIe(4XqKH4>ZYJky>7>mI}=QKtLzE_4OnD zkj@3H%}t^Xi9M4b`MX3|G0#vDuRYZ(;Q(%C3w4QBaQ%YpLjA6dE zOy7%RzxN02n50)hFye!6?kxhoLQ$g!Zal{SW06ZBA*;*kjOELZfwUr>kBy*3Jn0hM zRWG~;&dHa_NmE?G(_|ihS|wbdZ4GSq(=N1z2#wod$kSVFytLDy#mDKYmmo0(Q2<%q zvs5N>IKbeAIkcY+}rJIq(`Zj?HfU{to&v+2Mk;>0PSa`o&FOS$1{AOHzY%qB|_3x@A8IL7x6;xS?Wc zJkA!KG%=P}HWaqoKIH6qT_b*XSJr>|wCp2%^;n`4b-~Fd(y!zKSv&sdn$55^NCpa( zQalVy?Wj9(o#k|?Jc}abZAQiuk~jos{JlLH&3Bg)wpK^u?bRyRW;oZ}$DMg@-M4UR zzV-ZJd(~#bn)vo|mzj6W=)B4eHwh;7JNRU+5d;2w^hA;eaLG7mkYq(u`uy`#^#W}d z(&V;JM`s_C;PE|xZ>4bHy)r3|od`bT0UY#US=K@zX4>9X8|xGwkQ_Zy<*~cN#_XX* z{9ak>rX>|Fndbrg=BEd|V-~LkT_v%g2%7`~q_SsniuI5MO!?1xL0~J!i*HP( z{TO?t=Ee>kx22pnBi>b}lea2R2v~Jt>y1 z6FquG&fXS$gEAlU)=-+hq zSt*u-ePNHAQ>Z*-in0velVP6hy6*$WU%>-5NL{Lb_!9|+O>p92{F?Jgl( zH+DC+Rth|9NQPNAkwWLO*18Wr-kc_4jLv>yZu$(35+fOb7bJHBz$Kg|5ctTo;kqf! z7tYK7OZot=4~wTs<}*RdL)h_T1Zinv%)#G~y3Bp}{)<&M{|YbO@@u)bx5u0=y?kuK z#`U`R5O#LPWMI11bLBV*1OO#i{29ny+Fy$oT6oP!1BEHPEE;-=e1^b4%bZsrX-^M& zar}eA%`na@Cz+43ESetYjYS=el_%wguC<9w&<;PAp}tJk563cZmj`dIOiwhXE;LPF zi8ccKm*Mne@}nb*M%EEYs(kj}y$-q*oCmhvVoGN1`B84!8@__Kd@!JHZm2wS4+=#3 z9HScBcV{7m4WxUMz{kH|aytiwHqr#W1+wN1jb=6H;f{+Ot{o7k z{jTS)h8lpGt zG*m_-#YFDxXb{IWhhMOeoZiAzL4?B|m&l^o)$1fZc3sQJ!>~Er z22D#c4jvqQf%-8OTkI6Un(q!oGRBqns$l8tz|iMSvHCe3o38g9Y?O~AYn73G?!<() zMlv*WM{_3iaAcUsr8pt{A0UkR+F)4Y^+2Pug<@X`)zdo7u=_Ri;x2!3VcLiMr2To- z9M5V5J?0?+UaDo5vqmGx0$KrQ{_RKW78J$;O|_(2ON!3tQJAL%pz}ox+mrI=fz9cW zt1d&L%hIt7u=04w7^|%5G3QJTMfT{>7qUN}1EbSLjpv8s@!h6?K(TIMlC-mo_C~YJ zKyVvO_i*NwkqI-ue;vc|7YdT;WNL~~?s)}C%h1EL^6%b# z!tDC(_AagSXsE?|5FBG#Rh3Npsr9g(6TKoQVjH*cz?ljUrY^{!Xma}FMZlsEd%71*GZC<@Qxo4DeLos=D{;Y_%x5L^*(fkel!!5)^I%kW+;{lOHBQc@ zPq} z@q5?Bp{y0%No+x3s?gUW>Mz5qSfNUPbc|Z|Cxf#Zaph+vK>^_G@rH$dzXb_J38G!Pqnf@hoQJZr%1oA>C$O6*;tYIutms?@Su0Ds zQKB?U;xkY4qEF|Qc!Cp@nqHf{#|^hJtc@}V$3Kzey7=_UVP-X+lp5xq6_Ve~9Z#ib z>e-#WQTnkm`%Sc<>ce@5$_8#;{zbiTF5r?5t{Fnf{IRKwjmyLx;>mod4 zWR-Uy1JNRQ3T?soO=Ed<)v8%2gC;G_K<4L*`0{Jh&`@Q}z{ zs}B%^_5OXPbqnhXC6NnlcT+#&9b_S56*V=y~6B!O2eK@a4CCQD3kRR^x&Go+O$wNFd;`-eT-}AszAg{P?b7 z(jDmaoBga-RM7%${vRI%ZC=%%=&_E^fnD<&xt+67 zK9{kVmgFbmkjQ>l+f`&-B8$}1aUO5Sc%qSIQBI8kWrzWE<_<8onmocN9qRFpikToL z^-z@`lK6J z#n&e4P6Mu03Ynokzz;1G7B^Vn)!w7gy>ON0G1jUmvK3l!FW{4Y z<@(;r%EzvyW-V{9Ss4D~D9-v18wiV!E4~K#1>1KEz6thiBF>-i-zyuvd2twrhyuL_ zE?$NRHj;yno@QrcY6aS<1#l=!6P&(gD|&pb&z-w~TDyL~ZsBoi?{CZSURi^$ zi+IoQqNzX5D`~JsWbxDFE)g&M2jEM4yT2ed|iV`rx3i$;M`2vo% zpJMpo!M!djNixOUbl3)3n@UPlvGhG)0TPRWDv>F?Y!Ni8vyI*oz04OLL^cNR5CLx_ zb0w-2yFB2no_N=Qs;~{>h<=LZ{{VexKR@u=l=SHICSQKU^$m(TZcg1A@?QXzG|V{b ze;8jtLp?(UyE{09aZ^k(@3*)0zBDhgJ7tt`sy*=9lFfD|p%cJc1Hq!RdK2UAkI|hX z{9$abhGrS>eUTc+87n+U)n07X!*zoess+VR-|y$liVu61^c!~Ld8r7PN)0fLI|5fa1cPD#t4KZI@lJ*;C z7a)+nBE4sl8t_rVu=#y^?Ke7GVnm}iF9nWje!p>nY2n26+ZttTZMU%l^$ab-+AM4A zK)rxOzqLEDwPm^+0)QO|lCrX@M&w z+OXx-SuFor`MqQlrr#NPyP@e1li2r2mO>fSGau7vvKJZXR-HcP`ul4&;xRl*m`Ro< z_EC__-n)t{igPBLrXbFNUn;7Y07GLHpxm#pIc{(ME?b+e1`f3;NWZ;;(%AY1P$n<^ zWF1Xpu~;i>4tuHw?WvO-pRlt7S5?n~y_?i5I{n+3dr|BzD>_Hy z6dWHU4!Rmn5K0aJxcM7u5=Gl|5(oa;9|f>T=$~8>Fc>6;7ku}YN)LM>^b|rpF_x+U zsTIL0yb0`=vO_#?YLKuSZ{>0r^w2u@LX$;2+I#|BTv9+$0BcN+qZNxags|oq&*4G^ zs!X2Vxeiv1=m224_OrJ@f@c-%8`?k^SW7l-ePh>;y;rWPd$AuP{GE&Bb7S9>6Le@H}6u5!?{Qjzf z;R%P~X*Lj++Z!Gs#zKdwtGr>LQ&eeFxzcMSCIJ1G)o&L*2@fxuL-$%4Y{T)vL*6m* z8XCvI2zkQSiIO{6_SabGF?BswpZD7!{*?>OOCoDa&~gfTZog+h@l+OuQwR;`e?5dG zG}>BphBEC%q*mNG)VH9aXF~iV=&-_JsL68^~GO4#VpN`uoGq zz(Wz$Mf-od zLzt84f))kS+F>>7fn51*$S+F4zFI?^F!UDI^;QVCJiO@w3c@7pL0IaqDOp8k@L}Kc znEfsJcVeHwPG?IbY}^}XFDvvhmAeLn5GEnp;BAtA?4S4k4j26)_pg<}en%bpQKPd@ zO}C!Kjw+)ma)*S0A`@VNYLtM~B zO{iRGICUN*yrzdL-_n74NG~LP4}k%1v#~sN-u2JjX~2k#J~2msJVX@nj>oc(--qv{a#7);q#=7HMD`5H-cs2kW$zUd85w1-Y}v`m-Vq@yvLiEl@BMq9 z%KhB;{XF02_x$Pt)BW*>ZDd12cjPSbbd%vCL5P!s{Q(pPLThTLP@dg3SJ9yrHW|Nkl> zeI&HNL%0w+H>3~&c29bmbL!05Pg3;sGdh~4rJgPwgf=^H%ZP`Ru z2&N9ZHz<=Lxot8wS**bH^bsILdHHKqI+(17x}WeNlp@8mPg^v}@gb(Y>I&k+0i=E{ zo6GaP=Ct&w8`4${o5t%fyk@17m&5;gui=eK6NKMDZ~pBP%h4SGv8<+yb^^k&vQ2v4%!a5=Sk7P!~B+T7T)Bya4^zPo&3jdvOGG1%PIvi*(?NZ zhS5Obhj~B@*kSF65d;SipE5ONDHgugqNcjYa(vZ)PSJPdjW!$%Vj(*^WeuW`J%4V- z>e==i&@jFA&K7vmdX*`HnB6$S21Z|%v}3o9t4wluywp0?w~yl`DBQu;>oHU1R-(&k zcyp7TVNQ-zh67MD8-qi2H|z;8f_RXm`^xOEnLz6RH`BtzP&Jp$OJsE z8~oUJ!Bu`9^dfm+xfaRJODoa|h>8J_ApD-uRyt#{-u)y+^ZT9r`{YWZ z^Mn>s>=G+1ib8~400az-ON$!7xziA1g$eoBvQ8oILbag5`9Ja0 zHIbm*>TL~^2U&#m0X*k^WP9M@-lV|1JAq6Nw3_9#W6;(RHd{mO{?FqRKMsdC#0hoj zcU%c^tA=oE3~shV^P6C2B3<7L^+4ojmi~eWe>>vWP>kuaBgMFO@~N!uy>zqtyZYJi?iK)hRMI>;^H z4wv+7%ounOt0ZW*$nro7=riSzLywIWobso_!K3ANh20x{U|^UDP7nvg^N@Y=LHgUr zK47d14{1G4)ubTQ1VqnwiLbatCTgV+{OeBqg+YZBN#l~$fBg<(>_{7S<$fTSV7w&~ z&wdo>jvs&Bh{oATc(IPE7l1M!Y%UB|$cgGif`af7NZovVU=|>6(Mf##M*aRd*C2fO zl`L!4zuUxe_#lC@#1%wkKjZ$2TzK4FV~f05kzi zH&!E|MjnrgMkauPSHk8gK;N>nWoTc(8C)d%;3gTTkv`MP@Pv5 znEf0=N+*c(Z4SLy`j(=1??SPL0jGrgg+%b*pX)A&hgta(u<6hw7aJd~6ul{M96kQO zzrT+>l56QrxsTu`S4+|ygHGyQpmNN^g6JFs#(2Iv{{)OT^I05dJ%7HWoFno^ zRv3M4KDzkfLo6_0{5JkL1$g`2&~u0t!{Nrf0Vc>8T<|=CDQGi}-xaxTB;u{FFmwLr zloh;z+yAI2N$NK`CUFNonl7!A2BuW-D+q#y368(51QLCNRQz*~k&8dIR~op>=+m3E zTta$$XrPhT@o_QjSrmp1g6?zY_euenhh$1QU*!7he7}A_y8h!w_phHp{$V0j4n#ml zpp5{}{b3=XHLCD(nt+`iJ7^PTfhZE=w9?oOVW<4GE0`IpDM0|imVzsHb?vx%9DS&e z_lL4~n(#j-AO;ySv@-G$AQhFI9SU)Chrs&;v=vD)E(hC%&(;kcp=L1#^<)teT){VN z9=6an;ow0SHkU_cMa=LWPo0*qI(~&h+^d1OW(;%!csn?%auXhQqy1o}T)l0wo>cJ{RGi2CB)CL~3)kt@V z)W^`{fN+C*=SC@1`_<3X^|tN!W2BRAml&*j$K$s<5EU7|6>Gd{Gy4+96lo z31t88VH1FdH&G?(_q(FUmePWhi^TCoanaMgKvV7oV~6sAMPS$Uf}_wJJo-Fv@gD!d z`ad>-cd3@Z&!7)jj7A_n&dX9S>xV}t<$yE**DOBccbC~MCcZxNN$Q(iCltTO&m4KX zU4xLwsjz4L8_P~6#lv)U-dp~naeEa?hkn;HBvX7Xyvv^nY~gj-U45TbN)H~6|6{u# zkD4l(1As0U#2EcB8#PAK|Dt9a5recWkcC%hy5|Lu zIN+TTL}5KGO5|;s`Ur>bezpdmDxf&<^_t$Yo6MXm*ggw=1b==S%%2I7Qd)>08IHp5 zciKl>3%b#vlT)BZ)`bd2a_SL@pysn_sw*%~TVMPskid`uNmf2ES^fA&{@j!aq_=YT zaONF=hj4SSk#|*y=#92;d>B%gNL~yw`12Vvw64H{><1D}Ic*A9z@Z2cXO}Vv7A8Q} z$%g{`fBh+F0=Z)9ePbvy9A5v=__~jTAc-E3u%7~Q6lb$I#Fwy$kSCB;(gQGxH3sfx zAz(B8!1T-n#HMf}OqKfk&F?6MgtGsqV+a9CDCxH+QWREMFO-{~X081ZQD+fa&@B zU8$qW0k1VjfYPK#BjWbPX%Nh}_pkAON9b3P!N%tmOD@QGI8-xmJmewF{5=tdf+YSD z=8(&wb1>E~kU1bynLga-ODC_>tF-A$09zstI<9S9Z=(Kj*Hst~P|#uj=fMb)UV$gmhb8|zHWa+62AK_# z29YKZ>5cCE^3qBny<`9-Vj4C4(=N;}kB@I;$SGIo{2j7yA+Z%n6Jrrbse|q{2FRR0 z+O)o@i-D3-k?oVkf9rK@q|T|i=r?i{r3G71$QTEa@d6&1g3O+~ft~;09c(8ptN_-C zyPgmJ2)y@cV7{(TuN``c;yA)hAJr$0J4(erV7RW5p295EWCq6+*f!agch0dwk%UJY z{@-!})`98M>m^*GKKeC;Z>o{}3xvBo7~VXDX~+kaY>nJ{f&Deb-A}mBwZPs+l7T7w zByaP$kT*AkEhVUQ{w8O@bsevbP&QfKUYLTtr1AsEj!88r$qvehWb1(rlJ(O7Z$brLu@b-v; zfE+klOe9bMOQI0+$>;Khv@t|$z|PA6)G(0YlJmeOJ6{%(|6POJFt`cD1p^ia^q3Ap zn_t73iojv2e^En2n2$!1c(g1hQ2Gc#xBdMJveFb1?f+$_ zgE&ng$81~tC8mRP<41V!Wl@=&=~d)k-84g6-pmn_bIqWSUTpyh*OoUC~g z+%%Ag`B+3S_6cIU2yl#v#=HL?BmfOKVgYW&cUT|-l$M7=KM}YZ8NWE5P!>yp`i>^# zo(0@2?2P>1B#7hpL@<62iYB@$Hf@okzmgNe0J?hyg4@{w7iydh87= z$I$Cn7of}kQ(bw^6<)J$#FA#VGu0ms(OF#9#~)eF{%#77FXV;b1k%=Q8#SCg`YX~i zNZI#11RmKFm_y{l&ncCxAV^q`hGPpbKu75xN3!5G>m>@q%MTMs$i)OH&c`__krDyL z9e1Wv=OK+|cf1y2rqf#h(S#xNFY2Kyv@A=^1gDhyk73#4L-QOtG(X=mC$dn*+xP!; zIjrc)*8EAR7^P%))D6PXA&fGAfB%Cquta=gtmKF>!7=aDm0LRQ*UYO=99TiicZ8Kf z%U6SmIGN0XW5Xaco~Z3U8Ms^u5uhXDQ6ZPxk!$IH=n{jWuV_m>KKWlLfR+iAzvMlrpl|qMXgdT0DtW!`bvh;>A zEOcSWTe)FOkmtwqozA#=OxDsf;O31?uD-szkP&wB#J=e^D46yaFF1rDM%0IV6epye z5Y_dez(Lv1ea8Pw3Ub;S@j_-`kH81%1F(VvH^V=?Ov7ZwW(tkg+eCQ?mh{8K3X;D# zO^hA_jX*I=&G9g273OzefcvU@xyV=<3g#OR1|ly9y{74-$h<@~@G@wioo#s|A%}NJ zCd7Lg@`FySL9Nl4z~fZE{?o)ium3^jkI{iOBu2MIkgSj{K`816#mnR=H2MxLg9Ny? z>fUsM0=TeKhG*ML6ZK>*;MsWKz5XiTyg!Jc#fAL`+CX$M{B(--S$x%~&kbYn+2E(% z3{y2V0MGM{`d3F}tJ(m3O7$54-7COP=;66D(^*VCPN-Bcqce_kIVd5*YGmMG2tJzauq^c_=3mb#xX8BZ!%MjlJwv||1K z^&J(rH(Td)p2>9mV(?aEtXNYBrin35f8Z8reihrB&1|SV5lbH$3O=N+)QL*9HlsbF zhC#{aB`mQG`+v+kH+61>Ra38>XQ)TaSZxy_x3${Bi_ z%^$kRV37~foW;kiXKBx{%LtNRV1JTQUI>k#s13J$Gi~Q9WL%dDDQf4MHNZ6zPPW~; zn5+-+G+0K|(j;J9}WQSkHI16LqAA;9OTOtqZ~} zZHp#Z6XqZe4R0=mzGejtrI*b**!n?UCD0PUqa4&n*TPWY43|eda^5OlOGho#Q2N6f z<2P&$!4+`-$}4U%NUm?g$ZPAIBDVA0f1@vk2uf36XL942KBUnH@o_+yuEo&}qES-C zWQBR|ZErn;RvGKsln-G0aB5i>^i2P8YjkhGIfLL%MJ-|TAWhjh>Z0U{$-Phdm< z!^ZWEAfQmSdwnp4fxtIU1*uO`dr8m}aPdq=Ta^=OI}CV}d$iRU@@zYBs=Fkkn-Qy% zA!^#}rj>;}pi=h2NIJ?iB6m;8EiwmT?i5hG;j9^mU@_r+50}R6SG&CY?_^1c9GKCS zl%lIBF=hm|--S?Nir}pNx-olrQPRv5*$hav#gW$#>~0&H_F)T8Hr)&8SuQz9K)da^Dam6NvuOkHOh=3@c``3uXcIn1?!ui|W2U}yEo`wn$G!CYLxq@SZI=(me?Ay3!8LoHJ zCe$Vcg9}?f^grWY20?BK1#>(HXM^gOpN9u_OiKoXr3DBdR$S#RU4B@%s6|c{^pA*F z<2e%EUOi07@bQZ(j8<)c28JjT&h8Dr#4W62R8yR? z;|tGKHwgP~k4vkNJ%e$rz~Nc7Omk^?(obzD&wfiuK;Q!HTs_Hec9r(GJdGLiZjJ}( zxyWPbpn~*nY=LL(l*uhGl4of|{(5=gz_$PXrkhGCk4vmsVT#g13ZX9*RqcPkt#JN! zm&jp2t?)SuO5b`O9JQV7Go@_PoKCSmBI;wQvx7o;h#eV`nRRZ%NT}i*J%71kA(z}S zK@Vx>0VnW6PLFv?I4{Z_=((pUhXRU65S74Fs$ebA+~^Cx#Fk&LR}TR;&J+}2GysvM zFAI!kL&(u}oM8!qLsW0LeqAz)Z)d#7M>(rDFJ64habwOscSV`l02EPd8$Mss*>lC`WLfz$)3Ta1Y8*D;Li9$9L=FU`1y1d4x9|JLOMJlj=Y6c8o4xGEzHy@SS zuHZL6JsD%{nYY}~nj)=TYFDSSArxw46>9txh_`<#RHUhhZ^kP2I)}z=dh^0@>3lS2 zjsMrWOXs7#{HiN{$XrTwoW9OECMXmugX}emhXTo!z)Xowwb1zCFp1hpnvFCCn9h|B z2MC`>MZcmn*HA|{#f(s!3wczdBr!JIV}PPe!;FgVt=m*jZhy>qOROD;rPUr6C6upn zQV0*1$6yB2$excLp?Dl471{bx3fMV5Qpy=225+W!xEG4Y+%)$_iIlVC>%lSnC2&vf zKg12?V&ZgVH9XZ?D>>|UqDewbhIjlcRM-3NPBE{lShFw%cE0&%gm@6km=ki^m5&(A zb)t0KJ{0!Ti*;quzXq*db{WB&&siv3>$s`s7O_uiGX3IYGJ^`^#&No`RzC+v&x4;T zow?`-`o}WEgq$a}hy5Prve2AXn2WFWey!tBni_pCrnlsL^esB``r2ymml;25>4|s- zQ(JqJI=N$hEM!$X%%ap9imJU!Gxm_hpRTKJA*+vYegRDm&3RI<$+1eNR(}P`A$cs$ z&3#t_m(#6y*E!7`?oJ2)Kb^Q>0v6{TDRaaV6rGuFpn!fyK7U zr@V^Y)0%S~Er(9KyMdol7JItvOYWKy!=R+zhp#}@ zr>%G6Ye@9HQ9*V#s-nK;fd;h)bJY%iHCaD=-K4i_r4#MWuJ>`bEBkq9K=_QF*EL%) z10wiQ*B|wz`Rt`Rd_@l#%&*kdbo#~RT`z9Yjg_{%+ou)XV_+sL$vAfP547{Upn~2t zeN`NfmIq_mjrg1lQ(^G+Aw`rvrIJ}*#sxZy7pZu)2uFlGyL0_i2;;mTs7+rX0G%Lh7eVy=bH&@TTnCRy_%e)or;(phN#3 zArZYN<|8pDCr#KMy8xE0Ib4o9lg?g~R37gcnS8OC)1Qfs<7}Pm4VborPW~j(MV^C| z-dr4y3y9c1cU9>OD0|3bD>nMS;)n;$^QULM7muBL-uhKih@d|wMcSsHIfM=}UjrkR zw(qL-T-+wBdUl=@CgSmCF6!vFdNo@4uTT?Sgsu5^?+;sB@kl8ZBOUg%IS;Aut_O*8 zS#sPcDzgmFXcv=67h)+1|H0oJP}8O-0aWo4rZ@g)J}e1gr<1GXO$P}Lb5ckPJs>T4 zWiuo_hp-@k+Lv1P{UVcwF&v}_T*r{Ypd03=&p3izrjwL@iK%h~W!+L3&yck^*?Yns z)sfdL(uO~YuSzY4#4Od9mDtqaUoVtccs>^VqmetC?pJvqrTasl?01~K*nG(jpTFpL zzkTIcSRh|a)1tX4XlbcK^Ruw#f(?Vcfn3jiFDHP-^p7H%K>27uyY^0;?L<%`!+Ue~clK>W)_~nF>7_Z^z zEn3P>L`PT4$R+!MU(Z^G=>Er`fwl23#ZWC?*XOGw9;5)Hh04d+93KLt-bM-K-}sy2^kcN{I%Bj%m*|+~k5(!sCvPHBcZ)zC>nS`H z*5xInA>d-V1&yK{X(H!9p90X{_Jm8V>fU}Z%v8&bjOoFN;xLOXxyF~fxAk%cOaJpK zxE`$KW(>AoVG0S{x>rN&eT#BK>|!&RX4GD}r{5NP?Wc21F3tx%7&>H;N61H;c%Mfw z2qc0SoHPNU(6UhQI7^JA9{I?(w&xqHnhXhYFdmZ<4Y9|Uwl~SxrDX6u49UG~bum~f zJ^B=@X?Q3IZ+JgM&_##ibd79tXY*>`kJ$~WZgGgXMI_W5ePz0LZ{0)&0 zbA~%rp7e|wyuitDQb zC%cJAPz$|!ke2AgGtX}7Ym>LAboZ_2$KNiNb4IcAbD6O#Gg^!kOI!8)%Ci=CBPJ?s zj81*3dG|`G-fH8MF**3%HlyX#QL9Quj6X^z-#b2Xi`1_5?1Q<0k&f7Lb^WK(LG%YJ zssy6rSV`z+tY!d2#_cXQvP#jDxtE(aeDy02(UU;h&t{KnEPQ*O=^zLFRg?FbB&Bw5 zOP1*Jm+yAvS|Vj)&%wj<87@l+mUhtHYm67|MB8r9{PgI{MRb7A!Cv_bE{$z;ww7o; zKI*Rn_;qi~^C0+L^3qWHdfk}QZ;zq#4J=6?dRVC-L?V}k7G84#|*0?50r!r!I`|D zit#!lJ*VzclstDC6|A5?j>gec6MUXdQ27}sR?2u4znZnmym zO5RmU%wV3j^IM^!4HA^De}rmYbG%nmECmcKYVHsiNyq~rOu(kye@q(%Nz4lA`*S!e z&u%QntvpSfwBhrm`|;ZNFVHLbJiAo651MVg@St;3fRVOw_NehSi{+DrrGKWG5p1i& z{zkblT^>)Xc|{iZOOqV(2wcn08}^yqLk2sBp{)kA4pOsqqS^`1HW%hiUZ(Fb6>9wg z-`XXiL?vDMSYDm4o%7NhgCSYi+s8@ZD6k58BiK8>eQApnX^fVrO5^-{p%hwZL_;_b z`rqxRa{cyADr(d^ngmaA+flglz2E{qL?S*7J2&v?KI@BRT3}Cn#OUr2hNBvw(RMAamT{@tt2+( z;_HJhcsl@Pf%CG0x5N;sh5=<1)RE?9^iRw$1Btm9rav^e3BVrO{5rLD0CW0NF z41IbX9>~gp_gcSvZe%Tu6nFN;e9smlqBAa;1N+``2)}s+Pftda3%uVKqBgl0%tzO$ zPwMd?O#N=#db+}`Q>;6tG-hG|AFpg0W-K=hv>=M^3aVs!8r**tUwE`+CpP6o+ywjZ zi$U{*u{nIDIK0c%aY^b@+`wZ(&Ub>tBIK@)eb7|}LkD{r_RpUM-FHwmiU8dN+iFIt z=Q~hHqvpQ1G@ezqfUWi_tlC?*hT)LQV)S$Myc+69?X%&UqAd$5C370^gvzSw_Ld6r z#UNs#HDAzqiS$V3Ja*8+Rg(eu`_LRg#Z=xVY^TFxRfXnug*0 zwX1eNEGnhfr$3)ku1}l=+^4L%r0d-CmEbr`#`}eN=pcf9Ow(|M;ZYu%ahf>J?CY+q zVW*%EE54@ESf|_?g9Ytd{pC1omnr^l`+2Z?cPp_scR^s#YorZGo&?}kBw(AhXWi&< z8e8q^66Qr2(lO#!RSRR|y90Fv=bx`e{iM7-UGw0SshzUWAmFX1We9@#p`@$>M6#1?OI7OZPp5MhLfA4l-;5$KZ_pR zIft9knN{iH1PGvk%i1RCOwzgq##D918cy_ItWROSF>Gsj29f-~TX?(iX9ROWoYd(w zQ`ayD<01Wn!lI8+|LFY)Or*Mqqvn`lZkGU+a+%JDEYFlFcb64m*;5)c#y&3d34H@zV8%@ze_on+LDmjf+dm8VP?ke|s z@+(p~Z`!8pSDU=TiB^fGS6<_LXiGz5o~dCBA2$#c3swAWgVuslZn-KdQL9TzZXL zV~+)llFUTD`R?hFNn2iNHS%>~wo8a~gSz@Vj*K3s#gOS9&K{`fI7ZNX7##tvJTTD~tByvh@y4=96-`|S)`pa*P=_OZ=1}{_d5JnbABBbdQI+p|JgtrjI&NuymZQSHU1JZy*e=SudJGS9O0h- zH~MrSDd<8&Ro$Ze1COeR7L%2cL3S=uz-goB3D^(reJo}7r!q6fo}?{%v5Jmb+1V=0 z&!y!u=nPp+oY@VyCbB_oQrh8374vl=n86b@5HLt>EKu^MAM5KHorSn`5KeMTdu%_l zJcHov_tVtQF20LB9{T=Wfv;&Q8F;(xs;z~RmUQ~o^7>xr4M@tAYCe8h1|#kYX}PF( zdS2iB*|{6LQ(C0|zS^TXay%~zFQ}1^D-ebsPo6H384-@&BQqqFp;2v!3GgI{+%o5C z&tLP&IO?dN+VG0_o} z>g#UfWtz1^ce83Pc?bT=EFPAp_Rxp`{rt2>h@@7D6ytqb%E|dJKfNB|EZdZ2=XqZ6 z3A&q{Kkui`ujZ*nKN*bG7=n9qMkwAEqSl3EwJKE+u30db?1%=JN9#_zi<1*A(US$e z`O#^e3sr~Dtw_q8dYgd@N^}4ItCJqI=0XHzuv#NyFuI25Ja84GpOhFD1ul9lJod)T zrepm3-YF2sJ=LM1UutW?R#(rQ{Pq3aEnj*{#nJ}!Q0lP%o?nuIb^8x2w$xe~EVy2qs((vAq40NXi*J(Jw(g&;A$Igf4gJj;qs z1k2@%!mffCCn}agizVGs#wkZ4N9%Z)q#ExMw}G_xvoIMZeb|fVDh*3F<^4W~EsJ}a zPx7^b`x!b;J!nh^rLR_eCwREqVO#PBVJWEe%gwtTly1=aN?d40NG`u@??s99{^NU@ z$J(`coJSbBZ8&FxjJRaeHHJrcF=&YHT571CVhyZLlt1nb{%{j6Ahg_5OeDfyf+hF? zGz7#&YQ>agJ2UUUn%MiD!MKI7vNcxY--igP5#4k{c+UwU`errGzz5G6&j7(RLF5{i z63K~q+pr$+o^7La!h#h5vvbp_aqL8=+W_S5XD-u=tHWz<@EwE-zz~gHf+uV+nenW@ zVy;FiC36*od2cnIdB5kaXgnE(b6sn?eC9P+XE_=osIv*!Y5o$@zi*&22CcJZ=-#*= zQu%VGhubn&*kRWABu|OU76l}!}}#ka%7#p$Bw*(Y3Pdo3T%zkYjv(Vub6@u zF94%s)Q+x9?sYe88RVHx3NELq3Ly&kGe1ky!dSt4Klu@%!2zUk|1mXUv$%<#t-(^J z^CbtxG@+8gG1dAH>L9p{&}E++)x08=!^d1>kz%sQAJY)9oaO-*^dZYKa6?JgWbbC` z3|>q6AuAir`K@gG4M*|J-5JpLI!ELX$Z(P|3I5UQDV;sxLEQ0^!&|6L;Lynk)>Ml# zP?#wJO(z?dW-C=-KYe_a&QnXY#vh@G;CN)PYI|Vw&gXZ|Awz>2*n9lUo~#)tZ*z#k z1gKbjp!9i|JPqDwy&lVI<+G3(T&tg_9lh@KIP zcz10H7?WwpEE^d!C=+M1SXW>wOQ0*~fJmk+B5Jq@`D@u`^br5LM@7(!)#9-?tJ>^r zrWGPey|T`266@r*D*qNdg^CI$)SYu`5`#YcL%FoIc`$ z-)QA@i@YRyo>cBVmeck`_(n5pTQ4F%dUoesmCXu0#W#`Njrk)AfzB%h+0skUeToN$ z$G|yfUYyR-tQy+rH)7&hYZsmef6%omm$57On%?&)vBf9pQhLcE$Hh~@p*E!*7a5}y zDSGOLrAC2eSidjR#5R>;6AfkX!TEDnIonU4y`%*OGwPvL!pJ_77zkDx4et)be|K4~ z{UU;7v9Qh2#Zfzrw+oa9x7qnHS#J?u{Rgb|yAeA9^f5Y8skcWMh-(uAs95yvc|2^T!pYpbx~V%6xW*@7znsbPsI-S z6ny$F3NusWeuXAh@utPx^@F7|OxzukIo9Gel->rEvErf7c6{SDn!n&l$K~x&v!iZN zccJkvY7!itOiQP!6{pex;&8xyjykvh(_83;bR7R6PKiQj@E?IBh|O0p=tnYzCTGgJ z&-2U$3_li)6>Q^OmEwVm@MYoSZ6*Xutp9vnT11#brHOI+H_L27M39M$DuQb^^J6At zFD~43pQKvT(y&~8DC3z=Fjej45wWbz5A=+i+#QK*q6$@DrZBq!q`Gxl!W4P&xRqA4 zr{X1E`y7KO#r&*P4s)oAP0F4d9$LQ;^{i0(c<$65*uE745Zw;T8^V<8a?1giUeTib zCPyuUwkR;@tVg=C0jJd#-F@@l*Myg*hk;#@#_aj*bTBEha|HFX07`cJEBsEy*KEGa z-;JdH-^jUoG1n~ZKn-5#e^m6oSuS@36M<; z(r<4!hB0ZHp1XYem9!|vDTl~FEWId`!dwu-J&K`ZoG@qkb|(0KMCblH^#;XjDt_tO}_LVJyH z!4S0rI)FMAxa&KM`asN9w3Mfu1i98HiFf~kMnLj~NOSU3(Wiea(c}pNR9=Bdb)JZpFY(AM~B-Xc-5L5!t5F410OvvLwE( z_>x6L0&6M8xNHr9BVW!( zO347-&eO9WuK4QJ^wl& zRT={HBk=XuHkY~lBqe49eH-)|y*QVH2dV(qaZ1YsG7Ccq?WEOfga`z3*`UlGgzJ-n z=Zsw&N>gS*D8A6AQ1WK9D{`TvW5FQ3v3+q0mmv$rj<=@n8*Z#X&Ac07U zlZw6X!-dpb$h&?8!UZnz(FP@Qzj#CLmPkAu%*X~o8>85vpNI_~e1lSA$k7J@tOB;(Q&ZjHTHiw)cN9o_*U``(3 z%U%JE(f3%V6>&!}`9ljm@SX?Giva@g;tnXC7y4k%e|&okB?MjGO@gfj%rr7q_7hV~ zR3@JR8$F?(?LSAF9>LU`R9QuTYeDhR_MoAhM|fl&xQ#R*Yw@~hLngk*|}LlO8`i}XDn#48%CI-juyU~=vJ zfV@I23VfUpXBiDC%kGCysO6mNRMnHbKF8n7@@)lB6w>6;0dV^z)Wx1IB=XsBzc*@ z)}{WGR%z4>`$ywucik#=5vw{4PJ|))w(_J%s9}`W>0J>eJM8)6SNC^14MkMv$=O=& zV?V(f;{)sz-i%kzSuWELrR&*PF0)w=q6jCVWV^Nkp!Jmc-VMDb2%V;Y=UPigt@Ri& zCX_udY3#wtVQ$QcC*syd#v>*Z>HQIcGB8An z8>DOv6>~_9vCTtPAAN4#F$I~VD(F)pHaQ7S1!k5A${l+F2;u1KeQe+S!rb^gjNzh8 zq07^ky-=o*Xehjsog?U5rW!b~zMJRFtbU_$_DZ+pW7%_GYh=BXY&26PC-h%RamcLv zlPC>`6{7h}(*^AxmcEDZd!8k{vR&YX;t*AVZ0ssTqHfiT?w2t?MxaRWr6yXh6GMoD zcGH?zpPC`x7=pgJl<2RTL1M6bYi8<~rdVfozZ zF?N2cQfPaf21h(kU1ec{<-RqfU49TMRZ+8CMAq>UYLID=u64#8dYFS*`B2F_5Ap?vF4-$KY_J1x~k{jK`r#53)WEXe-sp&C?;^==LPc*XJ-?Bzn@yE zHa|e4?bM*qC$ET#2Ws$>>kDkg3Zu6Q5-LNjU$d`Ik&wfj=s0LVh3tVi0W3)wsr$|k z6m8;8BC}0nu;^0$l^TAx-{QlW2AvckZ2cOGucU}JF~#YHatxwNeH^a-%Pz#LC!{vD zJbjAF#pLWg(n>@a0idg-Mt+EQ(M$!<(>AhQ_HQT_1chh^(4#ioW!B3im?|DC%|kpF zdbo#}-|R1b{Esi05~V95Jx6@ru)RKhWh|p?zEh>L#xsV9?a8dr*uG9+o!3x3{kJ8A z8(NN*x{nPY4jr&RkbbHf^%U6d{6`8sr~@^W$jxp8^jicZPtF9>1Q~3)2-KIP7XHgF z#auU8OuKgHQng3}X zg4yQghdG}&TiU!~Pb?ad$$q z=G}Qa&qCbuvLdVRXC@Uty&o^ATyVmDIy z5b|7P1S~aI0D>^&0Lt+gY7D6h9$JB3+jZcnB z7gtM~C1_dgKl!n9!gTv7L3r#oLdv;LuSjwSo}KKX4Yg0nT^I?`sCkG66$Mxu)cIT( zI>?14&j?aOsUcg_7yiI&alB%NR`Hmt*!a|DpBfWpf>p(-U>Twn7_mJBD*wJ{`PSYz z@VXmC{#CIH<|6`tuSNIs89y~ce?1S^vR38*3(f+Wvw=m6*c?n#<=ZOnEqMv7;l2V3 zX$7~a4tLSRMd&v9mvhr6*hGdD^)7LZ2MCuxC6DqVE}07bbeH`4{7`$VIbSratJz2| zU2*7IW~Q)vk3F44WPoI2yM*`Gs6Z^bE_!wT#btgc`wK5+S4a`zXqy-b^N{nVdYd>; z@_D{BIVQqy!ZuDFwWXuBUn|~gd^afatr4%IDKX&#(((IO(KXyYrx@FAvUDSYio&{! zs#^s}|0t#XnuUtkY@FX7I)xNRk<;!7r5cg`yBzNRbhf7?wtE9^rt~ccNIcXs55^r* ztFSFB`{xB}qQYrdjuxYDsptqq{^U$@eWVt>X}jPfTvX6_;RzHMizpNgB}>rzC(Ghg zvF*<9a#STs7eQV^Y$UUpY+L1B5oGH^_0eDXpz5XCSp|gJUSfFP*tX;+vXa}bFVkH6 z^2=Y;@8V}@Wwkpys66C??_pZ>fd$w8ezpaDtE0NKrBONP-(BKpzWDe*N!%6LYydjY z<+zx2Af?|IQF2C6PRvMt;f>d#7jMDkoitPu15~)1I8c zw8(%xnAIYMz0MdFStE(4`G<^r>KRXj2$_BzkSUcDHk908D3#>w^H-tHzKxSHom_fU@RN5uXLpi zQHe+m%Kwui5_xTQ^U??tOu9SLHEMebi8{$uYL!Jrh*f)8-qO_)f0v zrM9JE{^?YT+>Pb>@EliQ3K711L{9FlGR~;Nl==OQJ0tpW1M?EF!FRbfr#orp=tmTL zrd%~K&R19mpAd^>UbB?JoqAU647D6VR$zoMyz5I8QLYV5Qj(4mAbA`tOIfaM3L2X84 zB&r?!S(7{waqPuOSnEJGr)-!Y5-z$g@0Z2$LmAhOmcn0`kckUV zEV+eGB7>=|DsP%DsU51MnSnrcDcg^l`!gy-vCF_3?eG$*f{J2qhuZN%$7xbNU2x_Z zz%g5^P%X?r;?7Vk1_3^uzbCn$P--DUJLviRk-~ zvTHY72kOw7Y9)CRk*tiEtucm6;Z=Ld5|J!FzGhdWtQ5lNI_JBwqG>`yCS-WgocJLfTn6aY=hQ{aoCQXavhW(`I zW;rbsmwYw%$R9_t-ajS7e1TKq;Pa>X=pC zdI`-b{LudLuJx#=*82~I*a`*jC0ZNCh`DQ}=iV+=dpo(o_9;wLyGIeBOVesgr%fjn zg*5iO4_u}yo5G^W=*&;Y8h2sPn6GRmus-`d!+k42tq)VinDA@o{wVLv=T@8e!zT-M zCh@z{vr*BXWyWmW;>O8aaRi4$6lGA+OEa1IS(wmaT`X=9aviWID1Lq8pl<{4IMk2RG1VT8 z%>|Ke-v^5K-fQ&@IlpAGo&M!gxxe3_)wwxq_@i*Oc-BNa-I!X2VSJt--I$FnHR zTV>Zh%ZmJh*%xtB3f@ED>R;w$sspn1&x_Mldbq~U>*1;Wkk_3iu|5UU>}sc4DXijmSrvm?zB&}jJiN>P z_Bs@wt^4IU#y-+bB34Z7S^2PyDAgKev|jZO1hUW3JVz1re}PvYtrXR^}ezq zo;`JaM@ok6LUXbCokr;$tMv)B-W2CR#%2Gr6zLt1i}5(a%hP>y9J*ks1EY)usdm6X zOK2h`R`kFy{g1I5+)Q-OO@dwvu;@)`boka=i!)Kge0eKa6Qv}+sYFlaKj3k(I7UC6 zaT((Z$_c!AzlKaSgkN5)HvqbtSPf4Z*$C!NX#qb@vl5 zcetP$mL_b!o`U!cohny&cbDi(t(5+$V#LKAcHXd_dLag9KgwF}j$U#dS5~ z3TJkXD^49@!$sve!cf4~%*pCcPJSqC3W@Fs9mXz_zp0EwpppuJrbPWoV%iIg^yoN!p~efA;i)pUL~|G&3(3!&~q}-_ZtY6 zntm)8zSpd(#H}3@Ii)N#(V(2AmJj;~IZeDQO9sF;QL%gwTseRAD5g=Ds4LS(TQ}|t ztoIB;HIE{Td=6pGv8Q~eIplk#5H%v~LUm;j1ko7_j+jLYHpl>ll=;TUN8pYPshfZa zEy0QnvgC9-M*y3Qs;Jhd_5+@HdX1=ZN$+D?Yd;-^BI7<5Ws7=V4{ggbyYeWt685kt z)y==mT3=~{8MkOn!6TZ<*LBexQSQu=%b|pMLZ%imTGWLp^eSScB@ z+-q!{|FvwwGbSTc9F5e1UiK1oL&Q-|tbGgKun2H_*9Mr!s6lRgcmKF7M{4DcL)?;! zj3Q#x1x%aG2x<&FXaE6%`ZVcbU#Qwjal_4dWv`x@9Taa27cpjc>#c_H*}`Y@T5J!+La zY}W(7%UYv+ZxLq`L+-)cH2j_RXw(p8fg3Gg;W)K zQ;b6{R~g@$4l?G*n*|}KZ7zMD1$}ww1KN;c&wV+r@V&R<0IjVe~!Pxd5d$Gzsq*`cJo zZdE3Z28u>Vfd7+d>8FWA>gbD<0)K@|FuyCIlPS_+u0pV_aEsO(uMv~T4a7b1hfK)$ zG)=S$Y-zA>XHgJi7%s23Pw+cS;KOwD`&#{(JvFhOjgnmCpk{}?v=w~EovqGvK59tIH ziA|MqgD_dq1za3m4?Rd)LqAU5c&Vx`jke~Jl{h#Y1h{s3@nJX2&; zOg@QQneP1f&6LB#$KC_r&J#bWOjOvgw%_FOiLQ?!k+Avcn|{A>A&sb2>e0!m^4y43 z#%R(+?>HwL6XRtQ_b(F+5hxCAF5LDJ^Umjn!M>kqJS~whnEcGZ;vw{T%)NVu zPUNcU89?iC7iirz%X|>^UQaW);#No+M~}?^5fzI=_KoQ*`AQLz6>9<} z_e+4l|NM{;bEPkcBrW**gLT0M%E_KKu`U2=BPvR4BP zjjXiaBM$T|^QGe9D;Ju@LdJyldLen;Tg0d7D;`$6?r0&I2Qwtue2qxn=HdW$jq0E| zZBeF`{FhB7Y0@08A5?0*m9P$`_pXR=CwX-MU{RFq+#W0llvL(>KTK6FHe_HeD~U%K zM=#F&5yl)5R-MKPTMW-h8o#W(Ajg%rVH4M41K(q_v%W<2Vz;T8#8^7SMM7mkh=WjF z5J$ze&Yx8KLp_VR%;F)5;aK1uQhFE_vd6)bNwl8o&a>l~R>i|;9KR0D7Y@O?^PT$t z!`54dMb+*9!y@4zAVZhL&^?qW4MTURv_py@iiE-dN)DaUAYB3?B_Ivbr8Fp=Qqm>; zthvwc{O|MPdFACL*SMLz_S)a|Njs`x_@}aa8-hh3!t;M~q7*b`U4t;88WkejCo_`p1vi@P;b6CtHEJVhFvWKObco6}e8kA5pnaXro2@Pcn7OF50745uug} zDMSR1Lz%dLT)&O_@y2aun{Nj|)&6cjRu5)pX1FBIr+xuNWwVRc?A{ty@(s`On4zCd z3pJd|7vQA0(?Ou|Ant@G%pS@91IeCKE&`iG?P-xp=>O0HRUD1H!A~h+vlTVZG&QL@ zl)i1oJE|fP>dWyI6+s*&jtQU-c_OT$MLSuDjVCNoM-8dMo4nqGvsbX7h!roHIz`3o z3*HXjUCxIh0Dtn6V@XGOTzVvLiCFf@PT-)9t!?bg9>C z%pjjB$il=hCOP*C_ICMO3$?stoO`*@5A{#uSe>#M@k#Z2Hw7qc7zL|71KOB#kO3Uj zc67``S&HngzXDL|@!JUvLM-_fr~uACe;7hZl0@uc=0GgUYX$~-&&TJ+zqLPXaD1H` z)Si4Hb@}05X6f~5kUNEaAc|7|3GtGs;M%Tb%gWHTwW{Wu7j{SSMH!jJD9=O72l4t5 z3}iV%-k=+0B`@sR^MSu2+-sxl-5ee&UBj42f(T2&Vtkc}M&k;*1eS>%K?5 z)bYjnxy#^;W5#nHOVrvB1!b(-8d+Fc+c44pTqw9+-%cMNdqOI^2}22-3WzYN^tZ52 zdT>~r9=Rz9`;jg;n2FVH?m5P!ARo4dqXYLB$5^X=I68ud=YW(<{Lk;pP%0*P`jh?0 zXY|q0N|=y;bxk}f%BwFB;pm4T>g0C^oh;J5JbTabXt_gPgWK*##d|~bm3VaqPNkyv zI>ty#8P7e*dEH#{7?3phT!vQxP5Ozh8Gx_t!6sQ+le`IL7Wa>NEZQ1Sc6I`2nmFY2 z2aIZT{KxX0lNu|0({qbNEV5D-7Vg4F*43q!#f-HOJ5W5NE|-7wd2#`^%^^$R+($P!n5K^5?$O&it6Vqj{`iNB| zX3kN*JdU*Qa{(q2;)>Y&um7y@u6F(Ea*)OiRb|9DD()B>0fct>Z=AJ4?xm?EeKY2s zSIJNdMYrxn=Yj5x7>&@aTb2;kyvlRxK3)l4W{i4Za@>|yU+z%%Oq~*jXmzyni2HjF za9G541k7ZiIUrVv+xVpe-9_shPI>QhfC)NeEcG<0%XLdc`)2zM2S_u1XO!$$h|>KH z-1WMa697G<`i%Ih>!?aC+~^kZ4n}YR^CkkqOZ5VZj$0knhQxOt2q+&ey=z6(qHTNI zgxy;p!m0`{=AfM6H|BU}GcdI|&D(XGhjgKi&!0BSJ&1g9DSSH>lHTu1717CmZ8@(< z%9KHLb>2;I)BkIw5fS+kY|q+bqv7^|~ITm!5*kn%Zs~S3XRMxS%mRLI^sRW7D z!2EG|i~e;q={?9b4hc@4LPF-x8G!VS^5By_DR~8O!chS+yDdd5ALV!-T_E#u4%y~aDT0(KK6X~!Jos)roAV1{@X<`Mi28+sWo z9VBEM!j_<;M-gTP?X5Xc{n`qxM`U!L#T))97eI10A&{+(xOouPJCSe@btmS0XQEAT zGM+V;q}6&v^ZsMWb>f;Y`7?*Nj?LUx;ww!i3nDGB1`v|(pfS{!zFrWm=sk$NGteCr zRuCwfaxtWa3yc)hML&6g3zaP&xbF-OpK5^}ITHd#*2Lb?k95R8y1N#(tgDy!;m!g8 z`ca64Zl7_n4vb^bBG5_oo%$0po89Wp2ma+S2AsB5w;G2A7dciK@f-&vFWiZn3k9`K z)uAio`sH)gYlwSSDe`WiW+t&fXAwDm74S!jh11ykJUxu+;O@jBG6I{cML*$!hur(K zKW$^3!L?Wf$v|tC{DaD{{pp|Y7rst!v)nx2O&h2T_cvpvfXpirTMabLYsR(0+v}q- zZn^B@)hTNn*{h1HK11Y4Gl1k3*Wp(0dC04Wt{GP2u?zmIhH_UZRZYukyuh>iIH=?W#HwqC=>`0F zq*7L2ZRsuO(o6;Ah)MQ8UJ5awS>xisTR-;AWYd4&2tIO$Kr)lNKyq4g@R^r=Z8G_T z{01MnWsC@6EWrwwYf0s6!m+~pr$G$x;_}@155U%eq}kx^a*VQf2PQ<3QAw+O%h`?L zNsF%k{H}&*_HOg(c4)yv9P8mtYq@Vd*l`|KZHWS@T7Pw+6s zW72{sX_3ol1q&y4D7;@}?Tebj2&fZb(Kf6QM zbn=$q^y>CE0k?)py0;STn-Q2;xKxd#G|qz~dRY4Kp%K-m@7X(GV?G5mspI0)e*A?2 z{5|*y^3!20F^Ey6XAJpxk3(T&bmQrQa`V^ts}eKUUr)uAVglkv4-%ZC1-W+4oaaU= zm=-W<%oCs&NN`RuULhI&N>=fStktcA0k$r#YbXXw5Zm@e>GkK`t0d|~g=2jZ{0(I; zBU`K{tMHWfhgC@({R(4`veDMxIiq}iOJ9{9Q9r~1n#rVEud+^Wl zGM3J+$UV+2>p!vN<5*|MTc0Ml+EY!1&e&m-;(IT4+HG0grbRK&fdz{>Iyvy2ck!FR zmYYF0!qP1%ima1xOZLX+mHcmD8(XAqX5SB+Givo~D(g)%>=VPA4FEG{z+kzEJP1$? zF1MsFBKU(5GygD*;^HL?UM0M&mP_$fz{Ubt>cpE$vFJY=D#0bQ%=JT<6(&KLaODPo%WG%jKWTjLKJ3Zb^4juQt@TkXB>-s(bZCY zqchIikM~$(-PFqGT^8>>nll3LLI18hn7NV398I%{_wW2@4tYd{)h$F?)gt%kX*xS{ zW^~>#o2Os_8Yl=Lt`9L*h`#obGTJk9UR*hxOX|Q)3@0ArAW)>_Rt_A|0nBgIl6
  • jYDi}~^gbC}t8AMx7^H}<8H@N_ugiR%6I$g{7uy0~GCwg2_jN=e`B>C~uHsuwMhd{Mjk z%vtIC8;dv6pD=}D1VkIj5QM6pVP=;fm*xYrQF|O~jyPBc+9i8!-U}0hQ^fjS0H@p% z8c2PvumWV01Ma&^=e{Ro!HIIaMeSAS9jF>b0}~#XLK18MoG43{(?IlT5OcX1`6Cov zYZ#NhmZARw7m=b4EK7>?x17|kd3>CK$T%=2y(PW*IBe+~B+65cDNC&z=cs}*a>1Re zNaJ?bh?lOpFUGc#*=%T@Whf4q#z$iD?FQ5Io0pk))4g?mzn9@|&}JHu?N_;tgzqtj zWVW;|;rrc;UWE)Kn0`U;j$Rdpy!Ymu+KonhfSs!vLfGJ{H3W}2l`4LVZhj&T!gG{a zC!1EDwLq!IMSo4skDvY&Mdf6+14N=p`y$I98M7oK zZzDC>?tWmnnZvn2*6@u-a;f1}MMLU-xS9&t*7c$0WY2-xHSUgxdZ(?#iz%ofHHnXa zek2Zcd)H;+Z=UFI z3$ukRz%W~gn|84x*g|}7+%}D?=T+Ga(xdGZSopLJ0Nm+JE8iMw`&?MGtPlPTf;_@X zb)qgCbTUqGwLN6?1{Ql7Z;FspK={q~cn0|a!7qD8=4m!SlIS4*3t;o0`+ia|iKgMT zV=6Fp?qRFjWoRS@bKy2ef@C-u>RH9^k8{dJtOV7XWuoN(+joYLtV46(lq;-c7#F9T zj$tl-Xv(~0;=bWuXi904V-w&))bNFQi@wayfbdO2!Qfk%yvsj7!PxkD0{^|=>xL19 z9u`yhZL*ErSMowY!rJKahMc8;zRKUl@>^US5DAT83PI$a`wjX8kn8JmJ_pg}bePR9 zFR%qCYI~-B^YTU)AP1jwKJKOWzSukCMdZujcP`50CNrTdH|Lt0NwppXu25J*AgmoY zF*k3EOsb}#pZbg3fCae9v(Kk12J9RF7y2h0dPE+H>%GE3Yy%b2aP`>zpH@+|fGN|N zQg1f5NbvmjM(%|lr++JPsUGKbc6$vbniHeSn6y!mi>5=(=@3t}R(%XOFD{ktuadv% zYh49QIL|YD`ftiD0|moGfbE%?&@$h^y$5pP#!urP$Dt9;tPLF2_pe%*X+?QMg$G0# zY+_hrZPS-sU+(bW2zEa_gq@MT%rkR&#U$r6pu5J7dw(IiYVFo^bLB2ll6d;0Kwt-U zNPYl|D`*(;lO0?#@_%tl7k^)O5*2eIIzYFhSIocOSLu62TpqbfSA_&| zXeDp9#$d(^@T9!JQ3%<7s>^f2q5lIJxB7I#3YX9~5bZ=N8u%xdjx9|RKdu`>=bt#?<}%$rXwzVarufAVd{m`!;T z&Ly^M+Q83*Jxi+C2)0SU&rb|+gcB5b{rOpb7Cxd6V@K^V&39>}`9Y^g2+Tz?Ft3F_Xlf8lyEV5cD^%h!yK*O0I?MCNhrP z$_=iHrRoSd9nEU#-8yEQ0Kba>pQCgqxV3|TrY9`B3rLca3!lc`0%yf_ zMf?QG)H-b>Y$G>+PZ~-LE3{k4j1Fu-y~3}5dKqfj9af=Qp05oV;?hTU6CxqR{1~k0CswBr*tG{oCttyl zHj>uq1%p8yWa_^UV6*Sy?&?wjl&YRopKCI8T6E6bk(2cvo4yXmoEHQJRYTnx(`Oo^ zcqpX*g?NM`<^HSf4t1^Hd2%TWwP@ZLa)_{{V4`v`!D+jF3@Lt_*FKd-2X+KEU&oYg zWP6e#Lr6mD_jeKFWYz2EmPe}{-0-`-=bwpN!ws!Gnl$a0DgDmq)z!aPVb%~m4%i9l zQ@42kXD9TAWD*Cl!We}69B}F+!c94wffMsD#z!LG(j#O&kFx@`X?OWN9)Y~EkKg%X zZBC34#M0Ufl7+6C^7$j#CYvnL$)K53w$DO^97mq*2OO5tmPLClWT5EAiZp9PyY8=< z6&N(MZ-}uf*p)con|$ty2@Ig_9ZU!Cw8lXwl{uUt>L}_s?8Fq#;2!r@p$WKc`3#;h z^#{8#+^fir)FaAtj{g}5D~ks6cyhq9(&W?sTQG6pXmPm6Y}RO0X5Pj00jm&wi!0NdD?Hxr3Mk>;&6u!u3Vj|g zmD{9Wf6Du1X*EQU8_TYwF8llVQ{a)k4(1|#uF#k}I1WJKfu(?)ro1MIaD#G3p1p=H zSU2yX;_1zn6#yhY<=xDE9zztfRg7X4-^{ud zinUveLL z2ft*x1gkOi3m62ckY4>%CiZ(z016Qo8z%SO`_vl~X2 zd>-orMxRedh)4-=sCh$j1gs4oS4$0Na>@LHL%3M)wpIs3D;WNeU9%9Z{%38N-p659 zVUPnSPmE%Hk$&I$G95VgLhXz_?)BjH9891Ev&rkt zFH*J-2(#MdoF1+bv#E7O(p$Zm*GhVp6>UEB7;GRv@SOsr71kKZ4M|H)p5V)8hZ%e2 zRh5di-~JI+QE=BCSenPe2$4n*E8sO%w&N6udr@P{PaYU{0M>>4{?a=Gja`9Ckf`(f z=_hgvb|XP#9b|@5nB$Q!S zXy?SMC=O1DAv@SSpvpe4=x5i8*p!kADTiGd{^j}#;5fVK{ia;sgR@6Pv$TWmw%ujW z<^|hH<#^9DURzZ`oLUmB0lw8*#?FPFX5&*$lA~%hjcx`S5q){;_ry_kYyHEmxVKsf zPlvB|Rs4PR9zl%I4s4&BY@76|{k!h|{-V0jP+91GeN~$a?0-cZzvd|zv77P|jC*q? z@DU#bslQ1Gdi1X`TBH{Uqw{W~lfkqmO8(VMK68i}>>o;=n_I2_kbbtNka^vk1kdo2 zd6~*}+I*ZqQ&tsoFAjNx09kYy_<2bjrn2%I`v50iC9z3zjHN7QRVz%!b){6?BWx2z zQz3+PiPK*gqS1F-a?4)LHMx(o^|(OQsr|5L9hgq$BW{=8gUmip`m;ol*_0=ZFKn2P zDI{N|VUG}S0Sa^;-9lMQ~G*O)5Ooh3QZTX;?t_#5fudsMHiXqHA*qcdrc4Dx#?lE-jUm z;)|kAKP*YbR|Dd7{fz8XJU~Jtpx|0N@S}y z5O`ec#@zi|!PH|7o%o{aR;+rF%(V0voGYVWGEqW_sfF&aG9rG(kqL1ddFLH(#tO9E zEAy%PhDXQwo+(10?Hw=qY=C$R`2d+68ahm+&`P+~nG#Ya0GSPmVL*z&_Tgay@|3OD z7kg3O{hsVh-sT;TgP~9{#TR6X_!b$%Dooa_G78{ z8*A61X~;+1S0{Hue34N6Ud`N6)$F{1&?)`_r$4r&nOg`VR z(L{uvw|m+{$S#%WUM}Avq|W@cn;RC%f#O!>3CqGk6CKLQsj>ARZcb?Tu{YN15Q~d% z@F^w1;B|_Vnpf7r%){6gcviJ~E8v-$IP*JMFLsXhVwy028_R}fF$Ol&-jeKm2Ac;Y%RV5lOs$jvPTfIH5&#h% z1+SBHu3uqW1%sWK;H)9}!YRAl6d=8qZ!Bet7kPW%4fGGs=^-W`O|}s}fcoV}L-&Kv z)7i{BJagFf_$~0Lx(r|C;j>D1Vs%LNKdL7t`yI5(t!RoP0^WiH>G!@))0j#< zh%k9znI9IeMe&e~QXV^+Msmo}i!cfpamYUNf7L8tZGBG0kH6HyYoVp`#ICM~H+)F5 zxMneQV=KkoL5N&jNw;F;d!+CE&I$U6^9S5AT`gohvlws=lC+(Jh0il)~ ztJy8Y3o;j2^M$gkX#F1f3t$TtfHH?71^m63oQcQ}Pr5ldnTN@5R+3QFqB}!xlN|wh zlnK?Rkwwv<254g0TQ!f&Z~k}+?3RLGekPDl(q7f7qXli&wA4 zf(v)ubqU`A;TzN0P_nMR`D=kl%xZI8fZJ`}yOrq|^L5 zzBBGZj*e;8Pd`G?zD@AhL9VWwx!=c(JQ3u-aQ3iy@cyDaRt~4mQoE}ns0!DNYXnle zccAH561iA`vtk5>xa;->XYlvl%^nLsYbqiP^ymg4x zp*FY2bho4lU7?n!CO-skWtw#70d)goz|w`YHYggiVZ+LkV!Yd?$G>qb7WXk@{$`3- z!dr&*9K$6!oF3;_no=vX2CYk3!5Z8+wO*68K*qr16!1zjVV41mm~u0ALgNxhctX2E zg}6`?YB7mavqO+Mt(KH%5-4RR_EE*Bbr6K zt43CWfhX4oiyiP&mlh`u^F?eOJpN&e4iCj)}66>~|fgsQClq%?c$l(q`WW8^;E z)yGZ6#6NOVYYKk%{t2S>I4e`Go23b6l2Epf&}> z0|KLNgL1dZ>B!0~q&3d)IZ~nO>f1Pay2C8O9s$5@iQH77B@GmUiI7{Z6$nf$PeTWD z{P_I^MyS68)RvRjWJ7+rT47-Oh{jt#kLdnG$v?sYQ|lufrBAseEI06RZ{A=~Ng_nt z=B(UJ#if|VN;3TDJ`|i_;n$B-E{gmZ6P7x3_Nnm+P(iSdqarPa>8}8xn(CGeO;?HH z7RgR#ss|McKY-kE(hH;u>qZGhQyv3Q@)4YHsN%&^Io3%9uMb%ljXGy<&Y}5xDH^Xp z#qGgaL^GzMZU4~*R*nwMu;DU~B7{f5i}!s6t2vbv2Wx@|{`iw2!|~-D8F`g?uzB3 z4%7&lmdUKiCc`X4suxw6G>xb_{Kd<=5$?)nOxtIGz+6l;aS)p;e8@r6Ncmk`CQtx( zFSNO`TJ+VdWGSQWt<{ZRUp|_F9HF>w*`G{j3=@Isw!CAAcRlB%FXiu@3#_iB?5Qc3 z?9I0~uADB3X|$bSiX{Nr_jcPDVECv8rsy9n_f2_N>k8)i{8n#%oic2cJ9_{!?~aiE zQmfiAjoB-|_)nVj@cf9k7H3+HoFh12t=Bi~z&;Mz#QFD};H&3n99zqEu0YyD z6o%tO;5G>r8bM2|TpFG&JPB$Fa3-yIs`Hzjj}vB&L2em#w5I9EOHjcGi$3Xhkj01) zSeXDz%So^zvC7kMYd~{;eddr4F>a z#jwwfC0~L2m~^XW0efIJU_*3RVo>}4L#1pF zA>DqVu>njR1Y9K`OXTSSOv6$66r?zd8HsRxDt-!H-@d)fOi0314Yf4hasBE=Jkt*- zL#IXQ2~|TEGiKy;j^kEpquP4+aJI{5d7v@ln-tHtR$( zxR%zUtpseK1{5WB;qPTGy9{Ntf3G0xcz=AWX#ru(S^HLuCg4xjYBu3JgE+Sp@`;9{ zp`d^VIRmMv11At6RZgZZ#SuDCF@@B^>Qr1bHojIUT%W9dxvAh};7kE_y|eecH4?jd z11{3A2k~#Eg@%K!cCN1mLfmLM(yb~P6ZX9p8y5N6LJVj++<+>E_q1U#L^1?<}H+bPc{f#EvK&K{X6vbXU>7OPs9#Wb(V1V468>;`>RS7Jn=EzcU@cjumj)V>9YOj72I+_j|ngkKjmE z$!+mH+Yb^9qJt6;uC|c-kGoRIEber^#gx@+g>xYEFDbA|Ih4e;2ydH$XhusrI|-m$ zAoZIF*^4J@!{e~1d-FqqzS1DPv@(f$|G`z#!>9OX)O#LFX!2YatKVS=eJ2E`Q~$w` zd>qSSmHv?=sdR710WG1_ferTDdZ7{-Y(D z-qGbm#TQPn{1<(<7*I@I%%4@C^au$&I2B-H+d7MN@15}m!*yDX(L)}kpV=U4(< z=qH?;X@D%`46S|%d4z}65G?DpAYoJ_po*z|Isz7C(BjsSv?~n!2F|vBtRK$`wra#< z!Ixf>2KHbKDO#;`@w!C|){WO!=V|CjT{w(%r*1){-xzZ~27C5k0o43X&<|D9YlD@# z%@hIuNUTzEUQ0(!Qf_U&k0bndX6}lM6GjbFMk106u5hr0S&OC!PFvvz3w0uR2xZ)4 zDeg5&bt46Nw>WlFZ$a#09|L3e$Z}h20wtrhpHBaox_$LX=1n5q8VV7qc6>-JBQwZ+@w=*RV4C7js z%AZbRfFFDc)BYyNsRam}OG7~c^PBxR*T0@+d`_tv0P@atR#9_sNaF2P?MJZT%e4dt zKJvYbRu`2lo3AL2!Db9GE5!*1RePPgpL-(PU%tjfy7{yAqc^iM1Twh-1mx$Q4`m0m zHPYWEA*UtH(49F_reK8{JHn~Xn6dLPl@D5H%-fsasNFW%3HWcKKDWdYs5vPM&KL zXyqI8cz1GsZ=#n+!uy!_{%Ve{LoHu*kNQ%}30bFF<7d5*Cc4weSYLmW{2BJb^|`3T zip~7Qw4?D&hjp13^OR41Co1OK;vO{po&HWQG5LAWX?1O3`uHTHyQ-uy{Txs|_pBeO zn1@f;j6I(IQNO+6Dp6*VUNtn}vRWf{O}COT^P*3O^;p8K-?oFxb$23dN2zh=g7{#% z;=}KHCH6kk+VMQ0k~hCMOKb9`9M&kw)UTMLhm0~)WLyG22wF6FUiOvFfWoZBZIF@= zbSYB-FZ{fZ-=&>ys5^w%*yqo>!C7s$H-+e4rhMY5lbalVc|Vw;_hqc;b^R}g+V3Nc zFiLx}BmU~)-rBR)&ZyX?A<=ukyt*7Yk4?&u-yHYi4V=`gjAir#>EQ?XjpIb3z3NLh zP9mGCRYE5a+o#$i`E@JR4jIPPIv;EnC7-Y{C@Ifm4%-aeS4yQUNw$CA9PR+Ka(;Sxar& z6-8|Y6jpcV8ZGQlp@+}BUAeYI^l5ban$DpT6B=7<7{r&B4MoH)7(9b2|BD0}M0TZqUg)HO!Dwh6>`^ z$DyCqfxfUlp%N1x{+X2L;A4&gd^9382z~t^-PYsx?Z^B35E{>=lSj`ZL?=1#edZ@t zn|=;=y3OMi>J5r4Fo%MWF&=&KEAW^dSr%@C^+nA{ZS=i|F+z>u%P6M-cV&2e2+gY0hWRK$(2$nN`ro|0bx`F=CqTD|LfW@u`y_T~%Dg)}Y^X%sihQsL+4`6r&J*{27`*6Yq0u@%NJ%mG zy=wj49bhur%jSg>2Md|8P0$oj09-cHeVZ!hPM!Gh=NozQPQA2y${cX!~Txb$Z(SbvxG8$6sG8 z*DLof8(j~tXKduPr(*X{=hY95W$G^w@LaM+s%he@JCiS|=AOp0dzJpyybL40WYK?p zmAZ4Gtn3 z9}MS9o@sZiwQZmOWqkJb)4HSta4Mwk%vODx`=Th^ytBb`h9wnwj4+Lizh2zvyHKeu z%|JRk{COZDjC3DrZhUMa<9xE!0423tml^o5s(kXGy?M$`U1t5N-qP;RTd51t>+MJr zRWk{3_*VUO#IVR&fB#oxpL&Ml51Ol)w6A+)uWH2MFE^H={<>99wR@um)33S;AA(QQ zIGck@2ZBcBU?`%!Z4$ugTCtQ6AFO-qqhFs4^ znw-7bJ~aV9{c5{OzT}zu_1>QH-;C9PsJwyGzbsuR26-46eCh!Dcw1f9|r1WD0@w3`Wt0$i$3DYenI;+w>HVTo4ZC)6k=wo$Td+%XYj?;fa zgd?ykP|IvD{HXlzUxWCg-z!FTdGQUX^$>ch#ZXKKZv)ivqQ&=gsmk!T@wPyx`CWb- z26*~g^`eN)#*Ly+mhS6R;cjf!pQz-U42>rvp^**H=;4@uJvAWT*pSC#;dHezT1@I} z0f0?wClvJLXYkk*7!wW+JkSvttRgN=y8kH=sv#a&WE7#_`;X!01x~R1GfN1$!i`o! zvQtnnjVj;n?wg{92oHrRowh6*=H+HVZMfe^b!-&kTi5_B&=k8Qccfm4X-6@DhUbaCvfnerX|F1x zBDVMXS!Pi*s9czF+;viI)_f7LfuQQlZZ-@*1L-j;eTa15!`?Z-L;VIZq!$Rl!2?5j zSA*flGk^*XhIPE^S=r#WdO~Vr>k=a(d@_RXHR}81BKOwzG4F=FLr9DbQ)Kw2X9X3U z&g;*5SC@(~REtTe|Lx`*ne|zT%OLMxCMv=iJR;FgrKOJ@uU9lD{?=N_95eo@w+|P= z9(sBxICB|Q5sYhLg}9!hRAcIE_&SwwarlhkWF*~7<7-ZC^4_zIlBb*!XKT&vD#FoE z4N(~^tLWEzdrm>Cn7>O)qTnw-p?>LP%g2de8`(_LRG`=hJfcz3^%vRGFRzaCR^!mZ z2N4FB%eSt!mEW9yp(>S3kv603>`X<)SxUII8nQVksA4|p%>Mp$+p_A_7xi0z_nxJt ze4?u8@0O}Qd6{Krck z8F3OE*2yO)f0jR9oWtM@igDdgw(qh`r^^?@M_zKW$*84QxirBrmipI+bMOB8UVHqE z@Hzz0(Ldjr_@eCfQQFtDUpvj8STi{7@DRO8u~C$ZZKmtbp8eGhXduCm1`K%gbDKjDkYaZ-()4HIEVPu zQha%_U7;Q9sS^{*_z3X(ifK~)`PeIk@*beK%1w4cAePdQtd;{&;!r&`dp-FZ`W;mL}^B$x_OHuh=>k<+W zWb=C)rYt#}<>ZUC(qT88Ri=NgB2Azqd#6vQ8Q6;=@Uc1_pgbVNcE=O+3&9(95paf^ zJkM($-A;d_nB=?c1n_nnQMm@GXQVbv{yB82!rKqP;UnI(0E*z%syP6=` zD3SJ&>gTpAmh#Ra)Pz z3gfiN>8G_XCgF>zeWInpZaOs!j7jCF;hGJ;Kr4W~a0Zyk$ z@~w`89FEH25=c{42GEP`o<-su4}u*?V?wS%r>xOuwZEAV{W@=dQU%13MLmG^NbPsC zMArPl;9=5qn5_Ij#Rq3=IrQ(s?CSy6e~-8e@*#n(hJzJ-v!)nW4j9i9_DKe^4OlIdo1rOmJzel8;z3Ou^_5++Yg{kaz6JKZ_yn zr4XEgcnkF=MbNgSXnV9iizzAp1n8nw<&*X}v<)(u0I5+mqZ>j83u@^H^ZHG|m?CJf zmmIJmkX0ftH1rzwy{0xtx%Qs6cpJWN%V!T+x3AA9{Ev!k8uvgBiNDF}BF{|!1kzPT zGx^VW?cs)5iJ|EN!FvUHIElClW#LR+B2oOHxQSg|w9WLW_vJ{Hq<8d(2dGRm)#UWO z&AmQw_noYAXUS$Zf*6;)Qp7v(Y2^F(s~6RbkH7e?)@H1}UDcP`g?|4!zJ56!TK^}@ z4w34VVdfrUva@fW#yhQ^l=sv$>1yDN6@$yvVY#op}?60hEDsx{?}pR=`p zOT3R<0tZsFiHpiF(;TZuZ$ABLY&NNy$})BZ2bu1p)HUODmyi#aKR#>+!8x9PfM5rN z?|4?2yd4{x*(cRnjdk(7cK&SQ@X78WL&KD&$1cOyAGnG2A@Zfs0{7_Z?nTNx9)YZj zG!67PRQca=Ie7N{^<2{fL@#oa((LJD&Fi;=xZ59TMrNMRM8&=3*m!4Hc#xjLPH?e( zAcuWu`jDY+j*mHu+W5FxWduz<&knijb11Juml(C-zn4AWoB2(g^5d%bzM0GSfwdj! z`m&6iA7fX}==|?qCojb&R7(`+4p`BHDnwD(T4B7^N%`6j>Jv>~oU)hnxTY=FX}|X< zb?SR{uD-?&L)7$~Txg!Po8R9%gN5?Fy9EoMK-HFh`r}=8?mm0sa3-wX{f>5n((H3# zzBlYd6T(-rZWc9W|0HL%$03jZ+;%dYD&q|z=KcA-QBBVal2xzck`;ICdt1-&?|*BA zEswo>672>i={y_%eU0b;S9lG2fGe zhv&~552KtKwHC`127!#s%C|*b4I18tHcUG;r z`JQW>DaGEAum$n6r@PpVf%ml6Rv@2_XU=z?|AK~UKvWz^@ZHOYw>{S{Z_QD-{#4z} zyEK~>d9-(ZR!uie`su#Q_mx_C^lt8{!E{yFd0K<_M-|3Q&3WI!)n-PS&d*NMb`FT< zkzDxo*yoBJ-xSee~@p zLs*%cmVc0;nawP47Yf8XvTX_}XdT^a9`uxK=|3`@f2bi=5-1`l(#p`xGL54cpF}Hq z*Kg6{M@Wze(JypK=&R8GyySpCNEYDWL`%{lYx+RKivFX!f`gOH>6-(!P%^Et=apms zpm7Yd5-xDP75q4oMYH&sWk)hEnYU5v zXHIv2xnMNy@XtV?9tzT`>@b#k*rOLNa4_vMAXff*IN*U6VL3b0FSxuv+a0>dg#?ZU z+K;CIOdPU*W=-Knwalv%`DA z42uEmrJP&-mAJpyG<7HiyUC+&y7v(34~VVa-Fh|67(~T-va&wq@^*`|wU2 zB8kMHQ>!8A0e(*=nmg{DT#c)WxjA~6nA8YLiFOwa=8DwQpzeSJ0oh4Ug9fSgz3g}s7=fNN7q}2MYX+Q!!$E=ht$xWLx*%XlF}^#($Yu_-Q5U+ zf{K)ifaK6ftArqppdj7lw>ang-gCa|d%wTt;$rrmwbx$jSx?;0eQzhe=BLa+cGu+d z+^zj~%r8iV?&6d$+vxMgqlr0(EsBx7M5ibq#Pdze{94X+HV>(ge8IWXjP|4TP=d7H zBWnl?qqg)&lVCsn4+?V^$LSw0mK8kDqj^Xt8F%F-Z5gG~92M?VQ13&Q3n20Kzpdl3 zZojWqNZ@tYQM_}1QCwOz2l|sIKsWSAetLVr-p3(7jjhCKzR9Y;1tcgr+*>|lHfX6a z_{Q#$ zEe;s))Q-+08xUf|pG*os65FYmH&1=^2E)30Qc?bW`*hK3i=dSY+}|b5slDar!w-`+ zPe#+Z6bb?gz9j8^(Dk>#ccX2t6c&-18xPinh85dBYYVgcmx*cPwwE=h zZ`eo(=UM_eLXT99{B|xMSlbt&#@v4MXZhmY%L?>{KLHQj6{X`ZSM2=l_^@v|WI9%32LBy@kBV-S{;MhV5`+x7YjVTW0D{A9`>* zZFRVF@k);ShnKD*M^m1rPZ&q^_#IwMO#^PqPY5j#47I;`+-Ys`xm*_#dz^bpaOxNT zwQ%S?PT-D7gVw;&pjl-Lwa3*{SI%jYzeYDqsj%icS!SP-M}9j8^NI_Miz8DvxBqMt z-PMeHNQB2o4!RkWF(U>u*|&eAu&yqlapi#7=+~gRemS zY`lSwnaC;c&|VHp!l~XGTD=n8AHi_J>I(#lV7exHaRTVev?PfE1^P0&X87EU@ZZ@2 zbFao=QWf+`hOi#83;_2%M|p@rLy@pPb-+pyA~mUu8-xk^E}t8Ks7Jo2-OS~O=VIMqbCBSZY|k2%t|ys z15(d*q0Rv-pKl2!E@@b6xDpgT;fkh8f&Ce9*)Sf>0IBf|7n^n`hv zEeQY`m_i7rL|cP#I87`dPJJpW5=)4bC0ls8WXUl$S_TWD-}Ma2&vBF}++~O3`kJ?K zhAC%QE=!)x)HXDW3}Tp;y92~vq+Pin;zVjNQQLZBEpRV{q)kG(X*`LO!kti5+~*v& zF~S3)0F+jeQFq(+KYPo4r1!!$9g`Z%w(ur0+L%ZnwiQ8=?kv(Ap18qqAzM-8AdBlK zoMSD`GLk2#D9H8B)S7@ESWIl*PjfTGOEgT&Cr8Cavr9u)KB*bhdb zF`eH;&kwF3Z^`HlUYpw-7$pjz!+0kDJQ{53Z$%-){T$G$MhYFPKu|+OT#%9CCHj*X zlfx_AwHd%L1U@;t&^#_7IVtbpSz5(p)`pD?Q+mKPZ+@AvsEa49Q@qoYv{*YUz1C=!U99RkQ1WY*Q|xDk z1$q?xLM}*&eLGU=PZjHfl2|TIFQ>LXE?(bIju{Syka+j=vXSaK zw9f5Wmcr#cp>~7sKaZ(fube|l95aq7zEu+bXq=#a1HRAO^=iI=oLnZ;5Y?Jey? zBE^~tY!PD~hKJ~~>Dl`IoS{uk>D0yRUGxvt0Yn<43xWZC>ZA+W9oFT6^k!^p*YZ1K zB-CR%WzH$WHSA!-#}q+RiEaFEYgoUycf@oeV^9`QRROO=5V>@f5+)sC%bnJzHa3R% zFS(I;6=Zn*8FCaD-ZPKclaNK69Q!C}>)NEhy5WWjZi8+(Z(? zn(TQ%$`KS<Z_&2Fo^Vb04Ci@s?Dx(3TP3A(t*MzFIK?lh||5N*aTQ>D}%ch>A z`S)?yV%0Kg5ivT+#mF~6;8ECwQ@tUrE~T_Oq^%B15(oha{fI0S&e+~R!Vx@j0HM#O zPYCBQt*ek9%wYM12-@R8T}C^QyH6Fz10cG0;&2h(j9;`HZoYw0p3B8WY^Jd-;oC;; z=|)%F2Vh=|fE{&aIzgfyAMKoI!Y28HaJ6i*o%6lrZhMxr2lN+Yr}8UdDuk~o>095l z0+#;z)ostG`d8!Z4ROS2b#;%CQaT6iY~0mYwlUEQpdR}}NBgM*30gW2WLZn^;ryDc{``Jr$fE{5coQi(>Z>`3S@~GXUt2xpn_kn@+(nmds+?) zfx?R}p{)85Bpc`j=W&~vJ^rU;bvvoo%;El)Nq6?_=2`=buAmZ;5`tw#jERPdzY+u# z=k~D_&zOJg1js0>M)#AetswAp3d>cX@Bjy=n^Xe4ZWz*XHJ%#0LDXqEV`oM}Z^@v$ zNW}>Xyw6;`CYFBLzZwL{aFGFYio(8hRF511PFzW5V*HV`o}Cs(;4cv5j&arW1Fk4J zr)R0l#8L>~WaE?tf?|D3#G8bY{>Hzc;HE@Gou1@E73z17?~-I_FaV`Aa&Ddi zjrfo8-i)6{_-k-LE$vL}v1F7s#2mq`@RAH;oq+K*fZx@5a-1f9pr|l?Dz_~EL|MW_ z?Uj6gNOML0xD1S*{T>0oF-g7G4 zBLpV5i5W<+d+U8@jp>YxLa`^Pjw0fDa_1FDw3RJTyXO86abk0;FTY0kqj{5RkB^4D z6+>vM%M*8(Cjc)L(Enwbc3(B}Rq%l`=p+p2QU&p*$?X9k64epv;Q50rf$lRhJA5qF zH1+X`+j{JMcSa=MT7gZo4jqs0vt1-E?*#=inO#O$W$u2ad+VG+fxIdedFw3E5c+B* z&+<1Ic68ldn&aM7VlLg07@!3Upw}5}8DbpPJ3)}@j9+>Ic*#dl^;COvlUedCbE7Ww zFVw^xX0*+FxPf{uNqL?lNoHpytGxLhyckqr#O+wTUX7nO&P90amDvHP^Wo}IhSS>ODFah5}gDB zriz4vZ_SSd3b)`h<_9VzsTnlDc;KN>QITDY8&Hz!4WQJy5V!U(<&bZcDcmX|;a`&; z3w(ZKF7`eF%J94TfG0$r2jYqj}gK_2ZbkP}n(MwDNxykum3-b%4Zhn$(U`dQ;7?*D?*~9D2aWc zn`q%YtI1Ne@p=`#k9n!HVQ>Jti0yaPLR6+nsJd|b~l|3br@=+nj2 zMg**Pi%SfgXRQpqo0<3Gr3SPltiEI;EaoJ-rFk)_Ua$(s%0uD)nX;~8v(0u)36x)g zDuev#!byu25QRCoX^gCIQTqnBuPb51fs9>%RdwsEQ~n*bdYR5!l__zUqu? zBwIFVchS|^&fTl|F$8JXQ~h#yx(4!&G1^}T^vIuuy&X*>>+?j2vfM{^6>^!5kG%%? zHABC{3Ca8K9+WxU?}OiVR{@|W=`9GD^f%^_g$qFTCYxRhKsuQ)6_B8*jPj$x0CtE{ zqFLo0afrOaPmI^F`Mm|esc|QR)7aJyyN}aYSf5F0u|4$bC2omL0%%qcZsZ0HZNBtD zn`L%JJ(I4AdA8|^9SV`;U-8A}OKXDO9vEc`WV)fF)5PgaTlgfm9QP{f-D!W%I!v^3 z+Y2}p2ty_dYEY25x)^M?BZLAf%XDwsGnVy!c>vCpCCM`&h&h}-W&l8TQAA1&YTD65 zygV)(7+!P%vkW( z*+ebn1Z5%Zd!^3bqmINomQ(6d6vEY!f2fdG#$yTyr45dKw%&ZOs;V*Wpt>hG-6zhf zy;q@FQf0+oK#0V1XG{vz25k%ZYt68ua%Rxm$H8-i_4hlxJr~JP+ZPdHw1E08!}09J zievIVo=Q!1W*t4buf{~fahoL#5)bQq_(H_%iFKCle^n2R4DysMT6iKG$ zc5Z-KXpB>^V3*f5^q<9nd%HMre`20VgT=uYtImsS0jm5KT(&V#{wEWJP9#_gTQ(A; z#|aV2__%*Kup4+(&hl1{G3~T{?XH2oC5LUfo_M7LO~xhY_iP5jPT9qU zSNzq&mQ7ha2VC{PRs&UzWKFU*4s&NG-Ijz!VEHyOAw~YG3!7nkA!v*DyDZRuu}l0N z?J7(N@7=2htdh8>Y`tk;JTVDpa|T7M9M9SnZD?eI-rXwl3iV?Q22tOWdt^H~8o;Cm z8}h0l)s+^^{z84A@?>K;f7L2vU)i!#elWs_b5TL9n?tJZAzK!WeI}?Yli?>)zWJCj z2O5D`3XK1AXc^L=;=LW;Cwc}6C8Wou?g%{`5&K0<_T5lm$TlQqvM$#uV{6_ENk8d)EB9r2i!+EWCh?CX&rf1-t*b9V9A!ol9DBa^nYdp29r}$pUN8dsPF6ifPutYBt23wbG0Z7 z3H>t_BhZ}}Ez({=q)-n8OCP$WnsipB3)$o2E!Q@!;3UI{c|VC0rAlue!L&d(h3~tt zIRKwVRfLhE=7$tepf_H%~b1l5RS;%Zy0zgZ7~@( zRw5(wn}-c~aQtkWBky-rdCI}9_U%J@>hM5D<>xQrol*JeF%3RH!*T?+_iU?Vap2^HrrZ8>`Xy0Ec z5a8FIhXs3?P)X@LCHvGoBd9+f;N?y$#TIpMvDysIuTcb^h#>T-bE#lrQ}xshs7TcY zo2{L!$RHCNbQsf7+bE}}tStC*F^NwNAz~$$uD1chb7q)>9)FMO^`kmo93OsLocCxY z`t6z0mCqBJ{Ei!DR-)xHOq8;ytXkg(dR>>~=J?4`IJ6S^w>Gt%DlAMmTktrxr9JS) zQ!3s*tZ~}TI8Ofbs>7h4;mMU3|5UG4oT^opaQ3UIUw=_~{KJ@A$_0tDP05WWnWE;pf1L0)x1QYCTD{RZ1rkd^X5xo-p(SR7 zL3GfkMY((k@6@pJJjl;^P4T!^H#>_}YFB6Is>P8=QYbg$yy`xVVI9}#`-36w%3rjc z92J55jGu9*^m&M7;t^h4IohA21=f0rc;U4Ov{QxoA*~M>e=pvMzSwXotBYGMsvFSc za#9^tMybMnZ%9&6QC>4n#tN?oN3;?+$1O3eC3D{ARG-z3;^xD=qgsJZ?Y^BH9Zk2u zsI5D{`SYJn1Jns@eGU^(STAop%h^DdOArlldqPrt_v)i29QK` zd!sp?*`16%iWr9|Yh6~#qwd2(*kSF07aS0pfrGosfl{KLll zR-&z@FI9D4Zz!C@w5*?iCh7jknKC{y+}r-_l3Z7vk2|fA-r*6%8_6UH1m+gwX&kN@ zC^26FJq2>^q4T^eO=+hNz!J%6wX)BY8+%d?BTDq+pHgmKok#|RgR%HDKYEc|QztBU z%Xs?B9fOZH%M!CE>=`|dOnAzC<A)M3@Y<1e zIIT7f!w#}m`tCB1=MxiCRJ&Xpj0%)Ny3Jp3iCkwC#IhZZTDa zLiJK>6ZH{EOLwAwQEL}`jc!0r-tp{B^Eu1d%@euwkjN#0~;?$uI6 z(U&}ByFoCI?ddGTai>trQc8YuM|lTCe#273aEu%QYStllDR2dG_ANN2&Hne!VnFs@BHPGTxQJuZsbz$w4*aIS;;vL>!G<{o++dqsX#%1KF%ET^^vxRR?l+GnR!#X{RJDSN2G6Q{eJ=i?U(v zAG#|!X4P;n$SUO&6;+`_sP!F5Er3f{ZZY$Tq&)-$=^r*}dWk`J<(rt~Z|8df{e%sK zM;LhZPG!y6*&Rd_R(lCZY~CyN)`gk)vr_d3C0a@rv9#Yn7-=?&@0es?utPsE>r z1LgU-kB3-cS_0B|&5oaPtQ45ni7Uj#=-rWRx3#oW2Bv;~RVYEIHw>+R)NEUabg`JCXsRoMP!SB63$l=lV^|5if;3NB>6=uGaFWlwPAA3liE!Pp(SMYiBg zR_$jCYhK{XEOS9XO8`P?XdoAJ*T*&l9M zTyA$)GA?R66c>HD9K_ZEUK{2~e0-3F?}Eq;@h$U!x!CFga$=^ew|@sIzepnfV56Y? z`E&nmlf(anM7J%WMcV5$VbR-{?YoRzCCEXsxsbdkdYFZLhtn;r^Rx(&M9{@pS!x{^T7QhY70fdxo{h|(wWuM$F zmhg#r1k_!)46F1^f8T33xVgS`0cwY2O)21RWt*E1ns>R4UMZPacqyB%>bR{JOZg97KiQrUe0BdlS2n+O z$z-MO)0rKIH@Y`{=SCEQ-axZbDZ%4&>gyftj-be#EHUG_uIbK*(zQDi1<&C;QIoGjM33? zvh!UNknd&e21+lUUH4wbXrJwj6o_yeRq4rxJ#`OLcq%9;C~V({cW&8tw(Wlg=;2ry zI@m!mIctAajJP8TOrU1foC8003}E&m_uHOH|219v6lOJe7v;Aeu^t8)sWigx|Ah-KHpHj9Td6;LEQPI{j6}!x0jsePf@e@>^DVU;&OgDwVN6pco_ZM3Kb~fbN@b<*-6qFOl%2xYRHSa>Y26TT`fU&7qq*netwo>phn2Z7$1XOyJY2;7I~(46?p^OY(tiWorK2_+k(KODKS{M`|jI^Pcoj8=y6= z0D_qb{z8W4_n0_s*;w_a?EiDcL*_KuCt>=Qv4{6d5d(yYl>9G1b9X%RonO(<1mK=a za$wyuBvT1SmVnS*?z`q)H}}skv`M4$IZ_@70Oj;s73s*v35CCwa|SLd>o5ytMy{#s zCHoWIz`}XWpF(GFasT8y3K9<&v?N@okEOQIJG9H}U5)kkOG2-Pbaqpp=Xtc3Uh&RN zW=G>(X7ApSDH6)%)ji*Nv|~ci5x_`iC6Jrox4UixWU>#$~tg6b#eUX3>DYGKxUXDyZ@ugYuP_?(UQ_yKYiAYxECc>@Q1A4 zw9LcXqhkZ4_cd=`tc^ZC?>--X{^=rn_j)Z}KvO^kGBsK5(609RApv@GRr zjP`{&7NoaAIBeMh_rEOg$zsUapwD71-^itPA?TJnOAn1Z=UtyMALJm<7+-fcb9f%@P@=l3Pk zXqssxSwrER5e@W;|Jq9f8dUK}MkNwjjn9?3yOOlx@8u_`{YsaT$Z%}2hQa}e&442H^O2giDRz+;67GfE7-_3{V7E+|9!biyYhUp@$N)n^ai|dPA`2$9JwsAG}?p);Ph^8 zKaa_ZR|O#b<&ApHw&iVVaM-7w5GnalMvqJgipU8i%g%nlf|BkYL zo@p-j8NhU^hD+0}DyY*OALG%enw_W6CuQ@otF+%M*l=Hr*)WcTDM=b0>>u8G5#d~=?(VZ|Y7 zNh2%=CDlKcy{D(fT(gxOlrC5f`Bf&t_i_%%*K2zY`GYSo z&73rMAGJPB(fK{cZ10@`o=8GG^i|qhoOi!BmBHw-?1wBGX-OY?>&o!+X2T!a9tI%9%34xFQb!M#{Em%7YsCLMvZr#fbJn!_K1O znvYz8{3hs+j6o&xDb*lPLDQ*Fd5OqZV|;!6*CPGfu4};d0BJ(pv^Q|VIQ@6#k4B|- z^+3Np1edEn;OEZwe6IS~>>4r9StNS}+G;>wmWmA1lUA^9H^CiTS$+>1o-a zWB814%^V)}=Nj20g~hzOaRO1EKlM^ns1AV#1DRms%udIz zf2_63G<3LbtG(SHj2+1@R~?>s|9a$A@UOz_du-~n%N>+?>mQ87yxuwwgc<(1%l7Ll zr31~MJRX}y!Y7s|r+*I0&1R28eU28tHZaKS`y6_F493sIJTna*Y0-HzvM_cxtzorL ztU%=SyQ5uL9>=AWD&dBptlemdIN#+QR-0Yp$#2fNSc*|V$k@Cq5mvptM%PfF`>qz9ot4iI+&xDju1D^ zA~JwK_j+@eEl=c4LEfsl7!4bHzF%>~X|O?`64Tok$KPY1BDWJ{?$k|MjN#$n#vnQF zw)5R`h=AXz)uZ+i!A-1KU&B>OK@7P`MbV&i47sMm!6YLq4(feN4yRW#-PoiNSuMo88hG{3&s4K=j5vu)b2BelkLqHsCO9xWc1? z-=h07_UandM_DRnKd(1lBd4L)`P=qxTOWOeoe3B+uIW75ZAE2ID+D)2^Ut0qjwE2c z*P2gStiany3dW~`xd%q<(|gnJzU@ybNY<5cdklZ9Hj(tam*%oFNM>=hX_|LoVo^sf zU7{fPJaUO%@!QDh{DmsLKqpQ7*YvaV(D@=MpKm?ryB{BkVu#75elQ$=f=Zkx=25at z^%C_HI=Sz!FN3!nEuIhZ<&6H?HE6KThT0fP^2zdB>hgLNryAxwwR#btAb6Mp+W1AKMOzRUuIhQ`Ktc+hKY0$gtAxT zduZ>L)AF!RB%C9Y@kKqdPJho$n>h$M4A|tUt!6v>+i-t8`R4lkySYcP^}Tw>TOR$j zTPftRu;^78K)Pr^AXUQlmv?7?gKCr)PeuN7a+3;&T#r5CVYGx#fyQY^X@K`;t;DribEbPDo-8lwa8OLSIogKWa`U*KG-qlZQNwdUC~O8?B?{ z?%13EK_-E{f9j2`NXkxDu91OV*ja(bF@r+$*4NW_-$ld8b;Re9v*oHB_GL_l$g%)$ zn_s%`62Cq?5PhH(OL@)81@Z!CgOuv$~-UH6@mNvviL`JNUwC!Y4RV-}y%f2=Zr}LY_mwVloGVWy;NC*0% zu2)k1qHknt1CU(IYI=SV2N0yXpjV8>F`ZhoM@Q*HRAmN4CRz!#sd9xh+__`a%AuQBe8ChAN;cVr+P z|7WB1nJy|pG5O)Dm|==hOi=A-oZ)@mAFV$mu~gjtjZ^82bltIGTf$R_~R`#G=SUV+hvjba`2- ziL+9P+Hs+)u|q^;aVb}C;|{#2sw3ScgTC!h{~?Gqy+1sYRR*v2MF=iasR1#FL;1p) z-Hx1KanQFl&;A-Vhv^ROvQS@M0Zk>^>yR_;x!!WUv= z@FO`(M0T%)S0je~q9{9EZm!OI_}(tEde25OKG=Nfq(2Q#99?z-5}DC1$kel(1EuE9}L zHF2r%%0LH*0y0|l5Q|U`j3M7*88pD1N6CzeYApG$cCdGOy`R4lAeC@?@BDXMe;eM% zNuveq0#D%1K2rk1G69tYasXjM#RYsVm!74N?MEx**;^`S(gSZis+- zG|(H-jK-yW5p?{EIMeb0sN{e)=_ixl-n%L<6PCe?xyJSK*p9QKRVxWB0ME?cGsb>*D;btzSX7o@Z?FR$iS-E%fbEAsPdWy=+`uIe4A%^{P+FKUW8`nCPUhbN== zP0x?(B7hK# zx#zm`Auov?XZMr8M^dA&$gwEH+cqH7NLv;^ETQO#Mex?FL^sXpME9m7;dJvik$W80;CY?5fh9^W*hb;SYtR<=8miZ^Xm#C?&k5y=bA4;-II|&DVz))i5JX% z53J$1Y}*I34UR{f<*AdAn79=kB{IP=^NS!G40Xu*J@-K~WF08jXquv=dCAp8A>4BL zEIG^@-MVyzk666pNa267|+D#BTfzveyla#0gH2(T9 znlSs;_|&r*L>VBpD$>4&{k2H{N}0jlFoutB0`RO*{lj|k+AeUOIBbG4A|=`gNMb5T zcn8$F0+jAtF}zFExY|_kmBI6bnIVv{Sz(-m&#HI{`eo!xSuuzQO>r9i8cQuqKQIwq9 zILjXiUMl;R7rNgIM84d>gZ6*lg~bp=&MfdcC?!j;#v(yHmQKPOVG|4zv1IFmK6meT zJx{7FDZEWC(`S+QLpcr;`c1r7nxMF(w zU6&NC`Tv&`*KJbnuZ5R(aU1U+*G8oLm3jpUOiZHi4@@(lQ`ICl`dluy2Ps4G1=PUl zsuEn=Nt`TfC$yAd@)&g}Xw9JrtB1f^6WxPhesugq5uc4Wsd-D`SXMytYY)&x9)XH7 z5sPIR4muJSA_iMqI==z78X}mbh+l??E&$G9kebjYI)XaQf#~8kJwC~>B3kJLR`|nb zwf)Bb%hQrYXyStun#DsC!?FK5bN^(EQT@S7SWQX%@lR-IVFxLa2{uMH*yu}HrtP@^ zU6pc>NN@R3;EGg`gTigQo@ev>V8|&%2z>%AsB3}q9ZzH#-R=XxWVFDo_zRJONN;bi zK3LLK;9z28#%dS=v%$LK4PsOlp3i{HU+Xp_2vjIF6xczjSW~_Oy9iq<^x|Ebn_L0s z{dZOG6yw5~loN>hEI&N51j=J6Z`EJ9aoe&P*-S_MCxFEu3ZH}-)CHPj5Nv$~^!2Sv z<8=R?cmF3J&S!SJ{|2q@%LxAc--sSqc<BdL{U6iDf%Y;goW#ih`&9Esm1-*eb5MwnR}B~~lHkuj)OblM z5wHjA^1-3s1GZTEi!JdG8g7)Rt-in)0n$eNzKL3E+1orb&(-YJ+Ldn#9EAEWosKky zCAw^|(W12>TM@k$Ak9n))`k6F1@Yn}_)r=)$K}B{i*I22-OrCUL10oM)c@y-(l>vPtc7*Yb5s{PK`cSq3$~I98 zno6c8NsVJX3F{_MW2cBR6n9sAgS#sbaLORzt&}9(MWI$4ipFp?i=jYtQv{7+2)LX> zTr$>Uu*}6?UjebUb;;Qc+%YC3B8%H()OcbnkqT8B{&>0FVK5_$-}-K31jQ>#2~aZI z8V08(g~k1IA=S>X533&~XFSA{F7*7nJPaSQUG*(pcfVS$_+g4hXAXr&q)mkUyS$t7 zh?>4Y;dSwdg2*=RCxGDW3kU?ifl635pQU6MU)hYf(=gRb>`N>)Q9TE(c*JTK{X5%k ztbAwYE3d9d%zG>2@scVAYA5lMHeA9;5iiL_TZktQq!*RYhk0f>gw#-s)Zo|g`}2#F zh!Yq2w$J_+Ew%qUZ2vNSo-WL#i2TH*3lKym3P1e9!I*ACOqr?0&ge8*p)RD}hakwL zLkLj`IY9ijrg)V{36`PsVQ0$@%)^~?v>S1UsDjV*$`szYd}cG#Gw%qK0mqvrgv_)F zh&y3Lf-P7%(5$io1G>G9L;@yhEA`pQcZwru- zLSFsHqfcc!sz}7i(IkC0&w&6 zr;AT?fiSO>rQcU0Ur;3(r}Lkef9pI(VMn?1+7nbmkn);aT%f3e0zK)BKqsT231&R( z;N?N->F>V>aNpNMB$@U8yH*J)DLHx?WsUv2IBH#{t$>Q=qoRAx$}u?KR?@am|Ko0; zK`e$4)Z!Y)JKxRS?$^197k7u0VQ||1oP2Kh=Dx@x(=1`G!0I-Jt?qJ2HVJ|nA@Y0j zd7`+E(MtnmH_=ZyyyYs%cjDU!6OwQF3<>zZejr931NpUMpDB&w2-a1UrKVF*8&yx8 z%E3~_8V>d>Mq}lm5qU5!R|J(Sh{!D0u3OFFyr=Tz_0!-T36m?}Pe|79e-mvQn~3#$ z)_DSM#cS*9PWN{`?w?cb_Jb)I7$K%)PoWdS^)yh8n*cCZCD1nU_&2rpD^m*%b;8Xx zfE(>u2w258gV6{-NZSfzIs{1mND*TK5b3`7!_sd-3X~Xo1oXcEZa=>@U1GXRCzgI_}dobP-9|x|IM5 zI1b#<2NTbfzq~f#Pn}@PA_hkUS=PH0rlnLl3k%wjVkwgnMWQHoG&65NeXo!e&GW>Y zh059%BMgAZ6?Yzi;76e%Di+{77Ph_;B;r9n1I}Tw!1c<$6ku)9{bXMJYl>OK&~k-r z`|OT~;bU=;cHmNwabs7*wGKOXltbdF5#&ur+AR5U9Bd7+GCzmFA#d&jV|)kj9dew0 z^NM7d_~2oEN5Y%s7$8R!5Fhd2UmNxo2%m*=q*%Qa9dM8qaC-n!p)afAx<%u*vh^;2 z`bUo$;i#)<*9){~6TlH=(!udm!BN3clzLxpc64;_KUo>zbchh^-JbdkKkDW4UYgX> z14OxN!$6{dTDv+F-X2$Ref>@$Po1-ZL@_U-1*O%H2#1r3x>~1L((XY-r9nl8&JX5j zx1p0n0WEO0WRF|wC81CgPtL%`ctBbG$JkTd+bZ<9R#}P`6kf*k{Fn^Y1H&c>D+1`b zN?W?45o3gwWGR_Vl9F8-(V5*Ivdmo@vATQbpL-RS0hg% z^??E+zhbGx06|@q6fQtKK)sV={-{i9xAh(ruHKwCI8Gr-Ebgq}M>&n5g9?o{_GTUy zkDY7{^l1T_R=pDw`MV$Ah>BV(`Ti$MeOpo%A-bKM(vkuDNCBTe*QbfO-N2}@CAPI& zvMS|ut&p;a)x(maIn`_zK--{D{QmDx&8ePHQ@K8`>1s3Pk}nWTG~ILrnbT5nxSo8P zMYKOO?rxs2%w8utD!Wa*QJxt9)bLs~>De(chjfEb+GV9Dp2elSH8v z=8yxIfWoU%F>AruK8U1cd;Q=ZD6KnZhR-b{92DZ9Hc`5Tb$Yh~Ds$gUpYAzC;$ZhB zjD?&Z#BY$co-j7!R)5c69bUSLLI_as5i39!&H)7CB*VwAQI)zP4n6u#_xpAbQgCo_ zaRG$lj**2)6>g{fZTyofzyPY{KJ;9hk2x{}tLB%iRFR=^K8?^Z)IE9RVZz3@7huJz zw|eebFgYDId9AKVL>uz$@D|O@)Z0HNIQTX7#~G3g3}HFoG_2_v6L!RxEjtCKMjz%!wASxC9FD7$h`d*89@m5R2@H>8M;L z2q)w-6-R_`)S`XJB4f`tpquvq=r@IZ-49_7SqBU$ptQ?@zAJb326>8>G?>k8a$*Sj zzWP6l=ZgU|JRJVe|6eaZjSKkgKcu(cyG~OS#=~iak>;z#W8d=hNJTMcD3I#$jKiHN zsKGc3&HD=kH0Wx?U2bZi&d121eDO;7TfM?pj7CC^Hc8TL>L$W8n~xFpiTJZo(g@5* zOHwG;AeAZ*Rd-yxkqX!=9X=G?jcuz^iYIwym@L>ujr&;L8BHBSRM+Mb;5!qB5^Apr z9^S3n$0*E2JWTYWCwx2r+TL}4+^s{u3mQzk7xbtiiy@=7uy+_fFrN}l@wq%zqc``B ze%Lor)X79_Vwii?Wr22xp*BFlNBq&SE=-}mUScjb*s|E&&;0*oCgg}A2w=m}7&EaB zd2N4y=FZIMur!Sjc7ZMk9L8=l`4w=@o3UW2qxM7q&1E$;CUk59-{K>AE^<+J^ufu|#-jtE5F0g_TRkLB0=9}X^gV&} z0yg0RLhl}ZFL-5A%U6+7+i`QhPYQ6k)Rrmmkzt{~Q$C9Y;yp=3iIg~`#OGaZ=-)Xgd>rTYYdI}>Th7pEbv0^FCj6n7{*&o_!F+TKnm2~(11WiTKXO9@tS3iXQj$7M95NUcC4jf=Op~ofmG%CuqZlwLZMax0DG$)07xqGqc{xEAD@Hd!WKF)m(JN)T*#Nrw3g0&FPj)l;ZD z5Yvz%Bk9Ao7h7O9kOH`l_qE~l|1qW+=nrU$i6Kw9PZ%F z-6`rTLhR_($cqF2rmGD!G1@JLN0DWD?1kYum+Iah^0pMINpuW0%k6p-B1yk3 zeWw#ex_o{Sn2af&!XRq}f!EPRRIDb-LRjm1n}|)u`DqJnoSO6{{{QifBAGf9$qM*LF!BU!1L`eRK9Lf3C(6aJ z*I1R0Wpn3BcrJyT&_6bn@7-hhTnF%5)HKX^nGATrL}%Ic{vTZCo9b^(I6kRb>rmjt zK%GX?a(uDv7)h0R85J9`z=b<^>--jU0_QiZ%v-G~IVhKQ>3 z@K%gs=t^epurZvk&*9m0v0#1NI;RC>6-)h@O5GSVy6xYWqC>jU*@r~Am)L_hs7ms% zc?gZi0SvYK7i-t6fFZryWWtir4Xn{v_PtS_TKA=~9;#{A&W8*!gIZR{#ZueN4l{B~ z!x`?PEcwW2TpEku4@Ur(^vTb@JK9>X1S(Cl&AD#!Bd5zDJG_7YO=_6gdZ(EANq(N= zOx3zcUt&{CvQP}=T^Yxw-Lu5`I>Fw|*o|0nKk3UEo39MrRt7PH@?m4#LlJa4iXSfV z)^qP6{n`0zXxJDB{mE$%c%(npq@wWCVv?1@7Ez(gpMm5+w~9!|?mFU|OEd88nwZ0P zg|9~6*3b9!_BNYb@aL+R9(-&7V7Tsw?lJ1GV&e0#&PQcMU(tk&#bl0`3<_a&u(};( z@7l33(p)WHQY`yKgD`)=eFmj+#GNV=B<=C~VcF1_uEgNjp5&!bu zSEWTgotu@*Q_&5bVyzrO!So&h{jS&iGlw=$aoGildjuGzi`Wcu>D2I~-bH^&feOaZ zErBv??DenizTO0m7`m>jp|mannHcrm7eFrSKxgMZryQHq74>5#9KDBlnbH*=^Zf15 zrcS4ooSC1x+lr4IMNVLkK>909 zp$0pcZ#zY_-Y4I-K_~K*Df2xZX}BA_RyQfPm{PHTJ=)%0^OxW8or;}*Qm+5!g8-wm zXxcX&w!|`QGmsZj$CWg_`5l}n6*f%6R`^za#Zq}$J~IrfnnP#68^C}4N&Iz?dz3J` zT>_15j1di*PJugn9?I&N7;CmbHy2w2WM_{5WL8QMBKODK9A20J;!{nsx+9oB&VyovNA4r@&=2UV;X=3ko_tCmYKP5tGZaJtkOmo9$mI=ZE%~ z5o58Y`Gt^D2zgn~lc+H@eXzH;|DM2_s`yZiP7FQGqui72Fdpb;Z4%dZBZ;~g$6F8N zf|kd%tpZIkoT8a(r5EXVKo+2UFi$4Ia)flC-b3K3$dOk*g%zVV-$Wq-1W+p6~4Z>^}S|ktQH#A&@=u z)!cLjxvxjcF^caBfSc5k6Je7Ys8UD9XUoRfNR?(E^4sXPV~{c)(|*0qxTbNyW+PpX z`ZY#8{Dp_ijH(ScGzX2?NzTE}$Ue#k@_2Eky}Q1i^|aoPdjPxeVl5BAEviX;U~IjPQZJRN${VjG6#;Oi5L$`=x0sTk;r4^wICUw+hWm z{AE4MWftU#A#>62d|e(}EH1233`LC5iTrs8T+b4DSfYoNXnOgZ<;#u%H+C~_4;8^n zriWwz2r0a0hwz#*vE|D0F+pl^aJbMZcQT+-b?wh3EQVEu&dTPfiwUg6*gfz&N$@8k zijW7@C0aiIuEoGb(K8)6DY0GwB4;@zt^eC=uZJuZ|37S<1yq!4+qQ`Ti2;TNC59SO zQo6ev5u{s@M!I3>RJub{5Tr#=q)S>1a zc^ns!P>IZGc=u`Ul=lFOaU4) zdBpj+wxm<+dF-I#z(%`x^D^lcVJ6MMtee$ z4*#k6{ij&>OCFSnDL=hlP|xZZt8H2_P;h4&N}v%Pmyr`JUTI{r03DP`Ub&Ih7utop z%2^#4BnJAh`-oy`4Z~Ix-pyUONLGEv6Wg27RUc`?IWrep2rA=8 zsS4f|G$XcB&v6A%kzY3>TuDzF(m5GB+0T9uOA+}j!7CP)1Yk8ePSS&rM5Fb;@pYYQ za<^F$!+AztaO6g5WhsN*K^W4CYn#&`Cu7i=u=n*-(ElpOg))tVqGK`}RGE|=q)BC} zklF{z^D{uS;qR4-Jd+zbp=qy+15;BH(XBqow&1Xa>4fQMcXZa8q*KrDuYp||1;0kk z@@u17Ik{2!9x8@0tNK@WD>9ImcoT$nizN0>t>aa1cS5&osDydLzE$nfZ!5W( zxL*(hOC^tyr-1dfJfCg$Bqf!KN!OF`$}*Lq$qCKUSp4WYW9dbrp`Mn{%-e;wx~O{YZE9F=B|Cs5F+BV0dGE__4NN6TFyo>1vEZ+KeC1QKfWHcAhdrJq9yd{|Q7qHEPnfTtbDM7FOfx8&!`zh78Q$yn5tg1VJhCAMS z=bNIa=h`vna*Aa)Lw$_o!>a)&?C3T4Daq4cPlO+D=m7N(se2jJq-RT@c*~ko8VnQa zHkUmH@X8D*SP3=Y^n%i{=WQSRI^|S}04Fpz`$3^yEQ!x8D%*F39*n`QyNGKWYFG<# zrID8|hbtcoB!o=+KQsnjcxcm+Hpe8obn|sf`h^JrutCA;9M2$ddZnH<(-dcjy+_rC{aC;3o!<%WcxmR^btv#ta1B5~2L{s}SwjE2`NhPO`# zv>!y1SH#|xeE={B*$MzVfK6~p%CT7}?K*!7^vRdc(7l2kn9Vp=hez{n~p zD@7h`xl)~`jvOZ{*}YkX-#@K??Rm>H#BhZ?fMh$Sh5%cwMwj2X@2kt|1nS{5MQDj> z{WR(2Bf|rVTPdF#yGAUnF|A(;YJVtos(Hl!jgL7|1BSngU>__i}Jnejn2AjOo5)xc_Qi0MSZtPrCM#3ihg2J5Jg``lU0G9n( z#+elF<72=LV>xnsU)?XF0>rpQekt2fdqo5#*7eT@>iwu_{`hK*ira4s*^7BGUH!|p zA?i9_7hrE>TETqR3Y+eij!W%9)uQej%MOf58wOJMOyUqxqwrTaq?XW58kV%qgJ9K% zk<^G=vB%DG>qV>U#Fk4LRvrbLK$P2mXB6m_tc&CurzazBlMU_DeycKjUo`5$cKv`> zalu0#%{*qG&P(6X%EL;SU26`FK|6m!>bHvZ zTiyy3BOa77SMb}c<85z~8w_Kg5z7f-sp;g|-e@a2GibsSP_6AL&FF+W4Rv%52$ZXl zJ-}e^U1&xwJ=W7N6KY&(s#2w`XuS77eNEI8r|B_qC}q`)cnH`PQ$y*;vvEFv)rG7m zvkI{kt4^mvBPb9DlPaw+Rn^?$!wQn+&-}n(iYowYE6=Q4Ga>TyaIy#!jA_e*r5+bW zxoyx>O?qSu#+r&)7+&n>)y#LRw0)-E2OCEm|=G(jdI1kU^#J|uYCgn zYvnHsNXD6i9S))uDX+lH-_t0v*aNrDnhvAnJ)6@;jR!d8dR545gD^9qSAU)}ACYKl z53-UMNj(J&2`E^(3@Ip-lWTC-i zu#wk9oiNx|*g`Nvgm5$wJ)wVGO{&$e(813+U}twLgIW-DQG`JEOMvFp$L;SQX5QTH-BK3| zCm~F8;H8d^#-ljM!<{6@W24FGt0}ECrT49wfsAIl%)QI5sCqX5VWe1;*rAUO=L4CU zvu!5nu@dP+XYoKOU^cBw*%+!{b_|KB#{qXCDBrMA!FWSA(~6F}vN%hTYoXiNg#fE6m<4nFUEI z7W#7>)j07A>DuVDdIOEtBbCeEJ3;rm5e0V$XD9*n8S}|;u=bx>7RM;%Ns$U9O^A)b zC0ZT@g@B-Vo{H<&CU4{XDOAEnAQG})x;ozp_KFQgID;MzmDv3kI1nYYwhH+5(&f}I zsRhz*GT%qoOjqwt@N6Vo&w!?cc$0MgS|@7j)3fM69(iZ zg}0vKP7PV!!hcThKx=uw#n-*syR{K3z;p`3N+4{9NQlD$&Ie)98i-E2n%9T!PU{V2duKfY<3a@;mZolWw(N;^RAGzT!EZ>+@T9$@_gz5e zF(DkVTn`U|C26&?^EFZ>5Fx28>WG~xTM3ahw>zY=X>hfI+DXn7ije#w)aTzybm*6R zPa@tm9JS(o$#iY4PpnQHKFgVI{OE4xZ1J=F&-M7%Q|_Fx2>d*S@dYUgXRtqb8h-ug zOWBiom13Q658+NI$Fo9ENgqIxnPa4kaGAYpNHK%GgBx|);*}C{9lv#%yH9b+w~3XF zWlJT_eY}@j!-k~??NqWFp9afgQSQECil^B9L}4Uk@G%Nol7>h<9K=#s0way^lmJBn zE-8n@64g|J$1(m_Du?iBEQvX*w2ttbeUB*Yh|2mPhp*fkqbc!K)U$LLnaL5Y58^+% zg7a~83cd|roE0IgUy+r>CiO8TrD80ig4~5$LNGMo)$D9(M%$P{9@}=(b)@|a@G6L- z&5>-&e!dKkNux%LJTL#sNd63(ev;^InXua7Kx9>xsZJ44Pk2lBt5(h<<-qZF6;2w6u?|0N- z%41aB-sR((Wi-I~woF&c@O(dEN{WHlskZM!^c4+=i>cfbpxn-dF5x?-sHhm}mGhq@N+pgjtUUlfp$(4T zIR?cT2E-k+?YHC2&x*q%`l3hzUzX84(a-I-s7J-fO83R_uyTo{&Slcx_&2dxgVHkKtx0OJ$bAY?;}4dFu;Cu?R-rv+gK#B0J<0Py{x$v~j!ay1-Hw z@j)Vd9&HV6P1QcL5QZ0vZ#6l0Nnstvn}px@0Fk}!Dlbsjjwiqwaj$W0*TS)mbPa#K z&)^M@c*^WVT9X)h3|Uf+#3NVWqfGKGModju_NlQ+Q07@!+C-QUc#D)NL|ly*$zo1N zU*nB9caV%wmfnN~Tk6YN=!``GpPp<_ExX;^X&GBEx z5p{lNn%~sG$|X5;n`adYOTY+^lSD}6H?q#~7*yqZfw;|ft#}6=zIa;wtP5r?l4QT; zWKJqfl!iJ;-^29Yyp-3!s@Z=nXliguyRdoQIlfDPSuR1{`zfrwU`r|728~X}OR8!r zIQyk3Mhp>I?Q#<3c;y5f2c6QjCC~%8I|q6Bhh9zZLGM^uIkLyzmU{~RDzJ>+-fTiljr0dE(%;4}6 znI*1$OUzdrnk6AGaezSBmkt=oiL&jooR&VlEM#5m#?Fmdj^FC%Kp@wX66rjM>UEjZ z77@*a0n#4@`r`WzhxpiIr`j`Cf_Wkd-S!TbL=WV|YIXZO)tZ#uKI}uKfNv;`&qhhx zSnk&Lj!NZy1&wY7AvlYH*&s+JEJ#DLTGTY|Kbf}>Y9~>TAPr8QZqn3v485T3!5Apj zSxO1&?l!WHXdOl%ss}tr9bLQed>X8K@XGsooi45q4WKn)^U0v4YWUs8_Y;H6>o0@9 z01q9DtK1#W+^y#KGpNu%Q!e>m2yCoOs61Ef98M$IkW~nXMt8Ol2yuE(F%CIQ$11E% z)DYFaqpKBw&bjx|#){nU)Ew!dEyC1vW$|2UG8h@(4j!0rKzlyuYuA~`^XXQ+AnbB_6Z48EZMtm|#wD?nnFg|0r?;|^DgcY|DErIS&1~I=)&IVZKv7o!wSdT~E=ZD` zCRQQr)Tkp;69?pSn5{Azwm4Tty~drdRc5&&F7IHMmatqto2c!2Wn-hhyPXsL?dQ%S6s|)>9P7>< z_u^z68PQmn%j9J?@ywld-h?{Pv<%0QvCGlWsh=(~^m%;lKJ2q1xc4U{D1|Ocz+tLY zZBW*}kd0I$ZINEQ3&j#345H+><}I6PEr#2DkP-coy3!?|Ca*%0_Mqq~wg+K!phisy zNPgfvG5mLZ3H}Ku^ve|(UHDPl64Z1Qb$c_}Y{a9*7;pq=GECA=oPs@qUv+ADlw>!w zia;d8Oh*?DQYW4?{z*dqr$z-X{B|smc54cKx>h&Elyfh@G}_B?l>1#>%q8QfXhz}( z#`^bner#gaDy&28hW2)|-IKcFOo`#8{U7JV+4VoQFQz5A8mSvsz1kN0Zkf&6=v1P? zqOSW6y33%WrM&k%0So`VxBKY^v0CBn_m8HtBixZk&2=dOCSCDfpMPJa!b-xHX-HSh z7>?q5-n|g4&_AtPHM>+?0~{oqdZZc(Aj+F+Oz+c2RwoBEz4&}-!*0`hRW&?HC#A6I zx#qzmPNL1$#y@r<3lT!#H9aRa5!PShU!9F(-aB7QOnYt`8M+#Vr?opPOMSSqx|KTo z2CqsxYSwRdaEVaG0}(WwfN^Lfvp7iJ%wRsmh zy6nq5{<#P?Os#;I-;r^ zjep|=>L4UZSPb`NQe?xIAQaoRMT8^-r<6SATviMIAO<^84$fb$riMeiB(xTJhv6I+ zy8O zs6qOQwAumY^6v5Gl77z5_du2RuN*Eau|$%L)=9+_NT~7|I46!%3g-NgN0?*}VVz=m zZi_BKSOb4Sjf{oAS!Xt6T$DR$K7e%P@lrgGUb)_L6w5*8vT@X(Y?S=3DCR$x2kJhc zx_r;|_o(z($FxA%Y|ST)$NPw3r=VKa9v))_JM&vwqK;oq#ZsH*gNyTBiJrIk2tK!- z`*4>8V88oD%8Z^#RsMVU(&Ix_pIpbo9;TKXyeHPI2Gx4_rgLBY<@j$Q*0f+d; zZO{gE^1YH3>tKG0w=8wSG~69{#IkdFg~>5>D$6nTE5zJcHbZtsgGKEyOX`eiSm7j~ zfbh3up;{Y%md8ZZ)>jm+-r(7NEA6E$6UX->#cKW(KB32(Dp9xs9w)q>UaO-Ez|Y8beGF-8_v3F)7tDzIIg7kuoM6-{CKk+ znbq?6>!ro{6Z^)t13cQCOV;$j#k-=c4t>#UBc;x+$IoUH&}-ZPTkK{go7Hi>q@FW< zw&@#p;etUPeC|FlUy@kQPHR^GRLCbJtQPiRAb5 zLAi&*u00}Bn|Hk(M_oFkC8G(;`$yAx9@_WSgdw-?Ej4Gd`CLbtJG*~)hTWpl?D+M$ zUbTPUGPW`HI$kGq6*k?!wZ{oEjJ7}!P*cw*aST4K9OB&W z^+xX@7Lh6nW(J8!#xTbRL4=^t2DASvY(@7QWQC&1tG>P^n)~0SnZIt`?Udj~d(QY2 z`^+baM&YIRj)eBNb8TAN%PpRGN3{a+TlxlV<_6vy4~QNjc6|_oErJR$cLJn?wfkul z3w@PFptjk!KfKeeGI6o_rRgswvPJapQM$c%@~xikm~?}(&o*QyYOaW3i7kfV?%(w> zjS|1f(u2KlXs?ch84bhPPsSh7bvH`PYZ~Ym+1IW|)XwhB(4kQA+EfJIN1OE+*>Q)C z)BMug{rnH`Nrq#0bRY9O;umg#mt%jq@awVAFWBn)_gK!GfQ0qnuSLVPrG^m?wD5(O zWQ(LUJ7F>WEZQC_jtH#M)=kR&fy2JKaBNWyUA9#f29RCOrO3)tsvoqSd7u>GAzA8Bg`UZk{tCLvFrvLgMS?2P%A zdZf75L5e++tLr?|Hz`&uel1nhJzR~5#$G$UvGthCuD>9nZeB-zmos4!MZL%Vx{~MU zKxWL@C?6WRrni2gvZbEoxyYH*cE~Psvn5Z}iE0IhvLF>Irxzwf+hp#8kS91y0pE$P zig%_n^w#2|Am^`bKYlRQp~<4our-R@7*A)Lh!jg+9fi>|*Dq2;}p-S-=EJa z%ToK~qX3t`JUlcYl^vH}v{5Zh4!w=~M{p->H$aToj;h{CTIIG$D`38FbSF!SkKf#7AU@2%)qGO0FwOAQlbh?R9 z)$hE?9Gb`s@KXwM8z}@mRpFb4mV7sYbFB@9T6<`W-NuAV83)+{8zLD;& z3}|{ieRS}?0JubGT_>)q6Gh2MoxKwS2Au*AL!!EFsa`z!$~ioMc$;(GrX>_j$#ZAW zwc08xX5rzjlYt|Iqou{PLtWG~-<6lP@%GBz@DF)9?Jz|x&3 zd^R6s@iMFe5SXuG_qD6_OAY=5b;?|F0>|to>NdY`N(37=CFVi0r`fZB^ru~5pON;e zGxj@kUfXD^&=~Tu$o?CbSHCFV2(mYOIbpx&usnR=Y%-iP;gh@J%If=Vmqv2dY5P}< zXuy)lnJ5aHpVRk#uqaVq`Tb;VVb&PovbJaMcbyXzOSL{YTELg~dw#dzOKs(=Fu8N5PslmNqq$A&ZR+J#chb(K>*@7<)IUA5Cw?()oz zR^-fCWi2pkj?P=q4(%S;KzG+e#2ZpBr%$(<+X!j-#gz%J_kyKv_l#U_jak$W*O`pW zk2daPP!~*&C=EINaQ_wDXjf^v(%j}IUEOot;+jlW@A2f~t)_l!Tk9R=$;0cw z(H(o~`B5Qf`n8~t>8rt$Bj)AzsLYPuXmALiL-@AePzc=t9w>eQso0E6$JWd^VuDsd z3={*Plr{VbqTbtCR-3^Wwv3u}vUGZPlxWAsU zDfe;8IyG*>Z%2wj*oI|vS^5YBKak0c(Z$i2`1?HLk<7V53(JujDto^58_!rI$fZ0bXTN{B2D}mG z%Z@ty(iUHd5%U^NkuX72zDk1RCqn<=X=9Amj-4VQVZ5h*2p4(K4`W?}1F}QxR4Ci- zTXq_fbtMjg2c`8fUF5^hhb8G>KBgJKS$8Ct(b=To^l<8Ju5;ABW!mhkLGK$mEJ{nNnJZdKoa#`9!`VV+Ne*-Pc0w54p7WE`uEJx-kDNi7Au0Mu zwU4BWipRiQVsqB`+p)$yu@MeIozgJ5Bmu>GJOZ*PehO|m@+Rjf2|vl6KH;j&t$`Ib zj;}ZL)=O3RUnIiL7J%i?-W!Z8%?M|ns>rLpi z2He;C#9GieefY7I`kQz#)Q-z2hJ*JPkTRX66;8d&7V_R2;!uoUH4W@akj;)%6{GpF zMZwd<{1_%|bJIECO>)^1JWxLaFJ0nVuHymee3#Bg_MtcpEc%TV_AYF)greZo=YfiZ zo+nkN@+RnbN;sZaSk%box;WKFnpgbF_o`t%H<3!7h+|wq`ZBr2U!z7fH80PZIqxj` zNe&llsh#@A9{zd>UNJmxlKpNDu}I0YXAgnSy}|#)(Id(nw6{}Nyf((dzP)vIEymx} zC%2aiSLI~KuwrQE=|`@oQ|grY9xO2oR?C-!fU63Hn2MT%e*3DivbmPw?{@$<=(>4> zROi9o_YX*zHqMzXDbL2fwy~K167Jp^fl0yB!dJYhPaka6{;Q4HObm=`EQxfIIs4xy zUTEGL$QOT0vjpZv9)m#b7)X?tIgA#30rtHWsfI@(uXva7;{PLA`rq3zw~q`c4r%)- zo!OhbIy3!YuP*>IC$s8W72yoK)5XD&cI|&-u~T=kf4nWSdjWvk)+zQ{eMmdDWOHPVXe>IP zypE_*nXdZqeb+xI{7!08m&IyR?TdS@+q}&y{jbQYM2fEV!<#+K@@=VSa8(3Y8=ViB z0Ay}6>pJnMs{XxsA$-`D+lO5ABYz_X=X9R*WUlL*zg|9`(TRr0xF!$czkJr~Z`ZR@SPzNMk zvVFJu2>dx7d^k_suQQp;W-wxoG+JcEU}E5I3xL&WRRnw|j_$O~*!u+)OtmJCzD&FK zeYL6HbzUk*+^4GhecRCp{=6*C96yjBbXo_1+;vyD(tqkfQpurM{lS|-!LG<%Q4H9zGrot8O%c6K?!dwMVs(1#< z3A(1HdA<~s+@@I^KuQVd3R1yLq?l+whY37c=K49nmP>B-Fl3hj@4}ssUx5sZp#RVl ze@;@V%{CjV(zlqovHO0HBJ!pQeJLFc80p|I#Q9YU{7;T!TVekq%&1}Q;*`ll5F1Vo=Wt`y$SNL8Jl$Laut@vwDCVc7_kK9EM3`6 z=OyJgxUWmR4@YCf?_{;oh2Ux9_!)rq-z%e9Yn8=J30hGhlq*!geyC_5om2mfHy;iXnWHi_pyR73?^d-S249|NjN*!_mHD$!3Mgca^H9cE_SK zcotLn0+qU|$Q)-?lblqlN1o0MsFxX(HvIpvU`kd4Vz2w4Z;U48=^cwT7~#GASo9caV~j z$^!=Mq-+3KhVC`WKFt<^)qEWSgWfxBk`I0iB~!7tKVU&_G%5Wr2{eFaWq4;tiB&!AQSK6@(K7t@ca*91{0(aEQ$%%`cT@UHD4IVNBCF*5; zVgT4l*?OUwi$IFKwA?W&D0!v9AbmYjwjEPGA?^00a6^fxXXoHA_rYS4{+-1ow z$!2XN--M!B@9_NLiIEX>8@MvxxXu^2yxV-yAU0%hYZ721-SxwS@OxFJ5cUU}lsp(l zI?2h&nR}rUKu$Xt3##?TmS42EF(F0V_0BUw3@^bHLamK@oy875nH=LfTU@~B$7b@U zS)u&B7x@u624%QA#Jvx}!y6^EskVm?(MbBI0a{}>z3?VV3qkPZBo8KgFIO{1aTl1c2tJD)}V`NscwaGUa@@T;fI zX%Dv)WHdU$@92S(^B$PQOp<0U<{cx7h!L>G484x>{1ChfM-k z#%ur;S|xz2IzH&52PbWQ-piC9GvHUotLYW*YLv!+Lf)A+#W*y`qqH#O zS2m!67Z`>ttsaA$81N1^uWXoKswhJCw;5$=JG1w%L#1EFA?qc^8c~qcvx_*HAMj8g zVwE%bkJxSa;AWcH=7yV`VHxcWpAjP^dn6;KiQk5+mgR0vJ@=={5Ef5>F7hh0$h1fX zeIQr3dU8LRRvf|Lg%S~i$l`~4#--kjnpvVgyLnSDW!jZg#vfHRN8wR$QI&sI^=QkI zz8uLE@y6c; zye4o`QTv$Q5yr()P*&ClAwAm;>e4JAY90sohMliW*1CWvR8kSldd#HJ2@*+){*x8f zNN>x8sn(!?I+#6((5Zu|>=_y^#GO4pjDdhn(Jzz=Dg!QYVzJy(pImU0GJXn^ zx}g*YY~5<-No8ehJn{rMw^I?CBzpJ>P+t3?JW&D0+TmgyUQk24Q!A2l%o%cVipE4m zF@7*4x7dk#pxDK|Ebt%5&R+oUISEpQlMOsg+AqeryzsoQ^`I&0K}Rmv4ilsyS~RIN(F#&QV_;o;8fwO9O+1Rdf}zP zTpDE~u=#(ZJw)ig&?tD-^wP>RwB!hcu-4<|y(Z0+K~wy&p~DnA$f!iR5qPm(rQfJ) zW6u5GyBITSmCD@lGBJVyO>XG++gV2DXb`?1D4l;R6@xH&>+)RpnbHM?;$vw*e0mpw zTP}rOf<7IUBQtnp7K7Af6!5ky0wAy9>*rZk3JO^j^f37A=b-x^3abz7MB>UuNBN_I zEJ45=EW5?>TnA9IvOGHtSh$Y>jcAPo3e$22OQW(706eb*Y(7htI$VjaEB+@fAdbO{ zw`_(Uf5V#?(z^yk3OZm5-O2c+vxeZAw}u9EF6eA-_lCv`Q(xKT0L99C&%Y<#YM}pL9zp6xE2K&f^(; z7Wx<6s}CI8D6bXCZXacgdOoksC}sRZl#NC8C{g(PgZdKz1<2C!au3su;*{`mEKA)t z7Hz>x>EzavR`>L~6sJ<2f5hfJ4g&El$i)_L5ycOX9|CiU96kjX3=<*ot5X#$dv4r* zU4dgNgVs$2Gev>v2RRBcGF&w9G?IR2`0y;C|0r)V*F^ddQk7VJX#+gx2gkjsTKO-} z!Cf3tebv3&{+ZM!1Yqc-Gm3R@KpUz~ww#vz&pHPNDVo52D$qaT_Ee6o7(`Ij`>BxS zk6%54Y$7a)I~_)I1l4~+bc?}?5>v?zvmoXzl+L$(2OkGj5 zw}@T4I)FXm@r-NRCy*^K2lU=!5bulogdPhS7mW>4?|khMs=QH<6(@WY$$k)}DG4 zqPIKStmxODaee$*d&wOlYTo^l4h#%O3Po`7?ppj80F79qJKb6#84>YVi9tqo31G(B zrd;kr7sc1ZZqOBR8Q1w5aLYx?{^9EP-(!*U`F>pz|IA%yNk7WA@=;c$!;@OA?z$tF zbbNgTB1aR9-$~HCw%yfCU`?nZ5EeX>@5S`tHORU#RbKyDEu+bq$X}3`QVjW7u|6Cx zjU9658|`T!Z%pV$Ab<3lQVhI>Yc79)B@t{*ynY7eN@%XNXK}t%hyy2(uOv9D(Rc3a z2zH1z0#IP-6=pGx{oeODV=+m;?GXP#pb{rS2h;`27+P;$~AUQ9phM^DyjE|jK9(=`7pB4ZJN-2m-7$$qaPnx(_OUeWsu!|0k%Sy^Ic(!mm8 zws!!;+*bQd%RK1hF787tCNSb_mciLd2dx~dz#{7lCeeHYNCo?EKF>tLL;1NFPk~7u zEWCf1e0BW|aBZdrWg7c=WTbpr#~8ZDQ&+X^X6ry+j<0Pu%qWtla!T>x&sQxROgFQTuvYvmxF`BMlQ3>Iv} z;nQEr^;dJ+(c;&?tGeOcxbcsl7--9uCFDxOxNvNm1Ufd7_d?iukZLa7^@;N(7f0*r zDu@(kXT0C;UkblTnU&v1>Mf7i23`0tS`MmX4%mKU9$C`j~G~I(AF`A z)(>#k35I-%qcBL&*Cv^i5{iI#A)YCoK!A*p(f6f4&^+`cq21B}B?LQhpdS8y16Y== zqj}1i@@$a$!T=bYinQdU7IHEY>3WhPRYUNl+M-Y`or7g3e}x>0fq{DsR9i2A8m<4t zt@Vb@cYJZ?o@1}@$VJgL1G+k`SkQfTo5{n-?2VW6DbMtI_lQmPbNnO`0B+alT$2gsCQ zOL`1lwv_se9pPE+sTj-Zj_VlYfkuIZ@wRfuPc@)Z-og~8S!3_eWAkR6k>Z>D+W1xb zzwXj9#OFll1;-EcAdKN?oGn@4fc$>iCquhZHAkg{M1<-$zkhg-0+GW|rnE8MPrcRK z;IoTTg-69QM^W}%4cvfISx#Bn5YmdR+!F#$pRQi=u2h#UI$iVC4N5zWN?sbe&I+iw z1gnb~eW9mAKmPii#Bh zZuo^7(x?x<&_4N7&UId;s1K1)QkAQLS$>hL1gjI0w~TEP34J@JeqrPLOC?rysTQ|v znO99e6?}DF5wo1h&Vt!wNvy^({E!5DxEEku7DXU1VqZ5LUmKOE8I|sU`bloIb5-dk zX2*l^l`e|dqc?6wfi4|1q`_R`GJrKWb4cXJfL#3$Emf_*RkEpdydM@O(ywGb`N z;WcJ~)zmFR!h;r{8u_#fP!xiuI*@qPX~ghpF!E(RyZB~1_A*FVz5HTg8uL<9BmWiR zXOzbw<$T*)QJ){SB_qSrG5Mw%zzhIsbNlZ8=|)8*m3O7P_xhV*W}?koo)+`n5Nb^E zaFZpSAJziyob`ShBkphNr#Z*RA!E!!)6|r{XI>O4K8OJ=KY)tjL zL;Az&X53wA#8!U`+-N94PNh{+8DpI`|E{%Xy0zym#rTnl`el|X#XkhWZuSj z#ry0_c?`pXK~{(CLOB5s1H#8wLK}m9s6CZNjT4NJ@S>%cu3dVA{8dzBP1*_R_>9}9 z)O71Dq?*F_rHtIvCOYO_SlPFI$mHwn6^1+_GBce~VFrla#o?+Vg32ysKym7ZZ%X_7 zILg(Y+}>$Ib0Z!6u$xectvM2j)x|ehTscC{Kki}`Cx(*R#xMFU=LTP_QtA%MP*osF zzL@Yv>5$pOJD|xdzF=ZK--1XBl`62e)lCT;oEaK7)IFh^Z zy9*HedU9-tSyrKr_k?i>9g7T0*spaZ_2WqwFoq3s{*z z@ObYH<4o@kDBRELe3DRvTR|2yp$~npl4Sh92j63AAd%1}&cTiIL`}l!%y%caYJDc{ z>mqlPZobF2@yP;voP!jDBGqx24_*svyC>zqo%7w$r?~=)RK9Itaz>7e&|1y%N|cD z<`tJ)ZFNY@mg_AGWw;$$+Q|0XBO|>K-u9`Nv;#w7dhkf*Ll`;`bLY%+ChH>M%W#hd&UI9tm~7_~3a8S(l# z;o?(}O+#dzRkCaD>KSecI+Pdy&&WHd2|eAer;k?p(X22?YFe>x!t7!E15vS^=k8oo zxU+JM#p+z`i&^Ja(gEw}+=8`ji^Q8B-bNgkFydJ&u2{=M@TbU$e={=1l(6|aPrWzY zBCkFBu3H@*$7r}63jc6#^RCQcq0gO1-oi6l>v^sP4x=vosUKH{3pDwUhR@V9HmK@G zC`YP<8fn~1Yd`j^We`FXxTZJr1{8QnXRyTrY6e*<$!PCbu?r`qUmImo`y_2v9*|;i zirt~oNz??j$b1t!hqfMj#oJ7$iIdm-%xdLY(pH@KCde9XySIFTcUzA zPN)vYDqbXN3x9f&JciAnRU@Cjb3p)SW}2*cOnQbN!%aK~L-1uaHGXpG#GrWm)bd5q zXy_>q1|uBxrI?FGdKcCJhc}MUAq;utL!j1pklV2cUKXZqB>nDnnY7b5?#aDMqffDF z;i-jBzhVg#dU-pbL@hXUG4VrPE?JgQ(=^>|2nzSQZZwMeUh2n3 zq`Q1EtgvckwTbbs&C2jr9Pc__kc-v#B3n4;cbOHjk=Ib%2@m?FqqqikEXkF9#F56^ zO@rMdYA?q?X>GVjHe%MPvR{dTo=U@ZEcrT$MJyxcWr94Oz`d-*WKM#7u8BG!r_?5| zY4Ranxatj@SyEAq+WJ{BL$Tznj$R*RcRO2O45x~Y!ZQC3z5PwyiTlvY3c2~s^My;> zokaPg>-6l$raJWNT$S}a*@ZtfM&Dy+7oDt$BX?jn(H8PL(<^0#86MJB;S?GQNhK zHP@)Gk@>6W4US#G^SK!Enc*zHF5dnQjUVA!BtvA!)MLN?etU}^kk%}g&t2b2)o@e5 z#k1dtkZHH-GR?I~5=9hGF;O$@61hV_O}l<;6z6oy1O+-=n1gU{mjaO=QxZf{_dAlg7$OT(=B=77cVk=V?@(U2tV$lk_Hq8$978-|g zfls;YII=#f{#KC1wcilv9~j_2zJ$y<2XYHRUM>Dcv$w+SfL`Yb1sXBudUhW{M>02G zX#C7C6JT8zoD(X~!-)y~^F?Nd0gh_5-lV;c0+Cg$irhv`LC&jC1E)tAYd4!n53~AE zK`~Qg_ENAl0w4;Sn7;$++qs008M54t;lt#lUochpN!p?Kny{|dx zIp|(s3G+c+=D_%A)h?NfTf92!(P{gWEdHzsSl+!&Gw>W$1RRL&k}RWYC~)*ZpJEqiJbzL?^n zK5y#hJ-51LLvu%PFs1gTB#aBBG7aIp6zb=;0x8rY3|H{toN>(6qi%FGN3((3QJt zSKykZAZ0PNZyNmoENQ01S&KI#a1g1Ndb{!NuBh_DFlqv_oEhskhZo`5dB@shX_isE z+aiXnB(!|SiNPojBoCQ>Ns2~sWNPJ5={$R7j>gENsnh$cf8W3Ua~JDL421~v>?Eu& zA0SAEcw>4Z1ePf5dxx?GSa+>bsb{D1P>XS^cwGJNF1E(@;HAY3FVwD~jbk^T|8Z+~ zlr3We@ueok2zymsdz?ZzbsTTRjYYgZvb?);YAM!KmM$-fI!`xJxm?LB_do+j(=O*6qeG)|iyRxGK8hGAfvHSHpD z8Crs`{qGS@X1AyfRj!KVZJZTeQUHeowlm%%a5t|hpnjwN_l+-(5WRD7>?Ob7q3ya} zr{^6x+gSyio^Hqs%R=QB%38lMu4#_*VO6&>sdu|@Xp!{GrNk%+T>&J$oq`hd%~Z;1Dc-qcwBWv zO2qpG9z*EHHhkBuuDjj3vJ88j%*h93mwvYiN@a6W#1-Iqf@hx6*Wk+s^3BCUl>+hGh;2IroQ1k z-w=T!I>S41MdoVjd(U?rgqiiV+PXS~DAq?~>R^ZNE;wiDW%_&>Pap!d3JqKsqO9#Q zxYbiz79)>-y~GZVC(dHTAW(e zg9F@b?K_Er$Uc&A3uqYJl<=(~4c2#HTvtNgIVM^>&tv4EB zOLo>RPpp=Pl)xbZf%7?nkJf0CaHwO+~?xl;!_}@=rBa#|mxmSQ| z<7j|UU-i561^EOk(^~0GK}PGOqf%}Gloo;RrUi+&w!v`1kM-WI1^HHF>A&ZE=KZ{3 zGw*-AswkPb#0QFos>A7_iY1iNo#f(k6)+(M4mvCqAp`_j*@r!#(BRUuTjR z`2N1$3t<|p)J`i1JXGzQ!gDVfxb&h8xjHC#W1BQ1!PSL|GJS@qyAt$t*&k#Ej!Iohqt9)O^w`Zl_YYj zrX%MYW^=!lw}1D7*2fY7t=JvC0-~CRd`I2i$`gY9^_^8^UTMR-K3UH30jU0A-(JSf zfg_^pGqvj3* zV>S!OshfYLO$D>O^51zgY1&47eZQO}$nIGC0IJreRQGsTaMIThxwLC#a|stoo?Z6_ z(?X5O3-Tdr`QVA|KKkA;W_dbRt{^{#>}` zAKdK(w%rvY#1=kN^5w6oU(~0n??pqrt?%8xR;=AQZrf|=I~DIK5D1x>6{!w3^QS~7 zhW*c1*ph|}p+JuwBK_=!a}O8xOQ809 zWxYl&W6snjWsSs+gL%&hK?^?hBYpJv&roBuu*<_RylPd+6p;eBX<0x<^iuVAQDBt`H6W>1a90L}%cn8$+jE zj2j&Js;-mk2(*}P*{k;;mR`<`u-fpD)Ees!B0u2emPc};bIT01FN@p!KepaGp6dVo zA1_H{9V7{5WJT7ocUF>-?6Su}_9lB1QIS20%#f9ty?2t8O-NQo_V``r^{U?A_xtnv zr&qUE#yQXPd|r?1y01&fC7cwWT!>?NJUpbM*HQpwK4abNGU(DZb7(ECyEfiH986nV z-hFk>y=%jEE#B=H?1ZlB^GfG}rgn^U*oD$tAIo%1z$A~qr&6Bt5pnGjgFyG&dvfzq z)SeiyOVq_$TU|EpM20-(8{d`1YN^9|tq86o8QYqfNgoUBH`v(y%}$sXgismwdJZE7 z!6qYqLZw)_%$TR>ln`G%|O70Y7Mg9nv$ ztv1Qk7MqO*3xH$up#=&>B$?V%m&R?O+Sq~Cm2HLSSZAB=ZItbXCs0v3Q@7LZ%YA7Q zwR@Oiad^d6bT=!Jt}*UM#5rP}dOFB!&fnJmrGeB)W2J3x(lY{BYQaj{R`*WItW@K zy%mxyuqwEgY-eVYgYB?7U0vrJE>(|xl*g-}i4(una8B?r;~c$Oafw1wMNscWOd4#R z5#AS6Hn|6zbYj(Q2~lPJL=suosPIE*5WR2d$~rnkS1pB_eAtuk1q7v?V;)(08C9iX z^$0OFqiS_iejm?uOv{rk;1Sqvl6iRjCmdx=+T^tT;u{^E2V;_beb{BbeeKrA9WEYe zUe9uhL874h`F5H*BFerfh{Pmzz)JY1CVpert1^7{E>r6mT2 zYj%Y4sTYqOo>A~AE^Fs_)9N&ivcwK-CDhbBX8C_=%~>L*tC%<9n6EA>-=X=Z$9>Ll zR?x8R8HFkA9$Ln#t#(>okV0Xbd?uX>T$S^S=eP;I@C+s*aqk>$x2*KXAbwuw=YhSh z&ABe)c6VH*D+_sF>0<>8CM{pNk6qP9U1jtLHOOTVW0Xc&$2=q>LiR95iq}$gybxd026GhK!$Pf6~#i(!P{ZXkGM&(mRD z4j%WE$8v)qsmH~8Gl%k{3_bF{(j%XZIX4lK^i~34*K5FoElGCYo%~UR$nIyLEyDw4Z zZ0%wE&EV#?PF+(Y_v29l6O+k4NcaEYmTZ=@-Ia@Ak9(iRf<+?BaAE;zOsuVDZGw)jq$5kdAn8$cLusr+`g!;Kl#X9@~Ele z$fQry+BsjfMXujGGwp*V6;h$IdjLnX0>)s(ucKbT~Wngy)5&GfzE8%Ek%~^<1NZq?iQ4^A?p$8 z@(j+yIj(m(qMknAl%Bqh(Jdom>vt?nvmD16o{v`Uo-!MYWe}H0k@hY~TX|eooxx5c=FYAHk7gI_FK^C3Y@*KuCC7eDC)Qe>XN9C74x6@_IW}*Ol8KP zGFqh6H`LL!O?LZ{lO+!+Vaag}PF5TA*lowK0HCU{gE7h0F9+m+s&60`ClL*}1%7_k z*`6NQ$Pfo(mD2bzLvWYpHVE>1(0T`L75AML^Uj!CiFaQ>_V zopPfs2BiClbmmctRa*0{5EIS1dmRr@Z81HWOFD#7p{N+)O&_hpeg2X`0y&uq(q};ZYnHK1HI;@HnNDcFC#8$obCm=WaAiCm;-c@2aTvprM&hnjby%KQ<&JWD=62yeMIpMntM{)mCS-p(5sz}} z7n2}{?+N;9H1Q!|w8+li+;B`)kUBx@U{AK>Ad1i`aX2o|H&!MT#j9C_m(#U zIhLvOP8~@v7wg&KaGMpm*m+OB@^Zd>;E;PFmSn-xQk){ZwyLJ5?@zQ#I?I;+eHE|PYt5y39?4IL zE(#gM)o~iekM0O*e@#(oHdL?j_4Eel<@z0Y0pqo%y4@ic-XBUg=2 zjj%j|$@7#5K0#jt93jo+9qq0jGV8tqGI@c{Q$ zYYmi=-yuh-llbA3=Yr6NVo0O7@ve8P6IM^VoiYx}KKwrEUtsSBjZauNkn-c00YUib zjL-A5D?bY#d{19^?N4CucQtp09M8^?p-(rU!UM)ad;;VhO1pr>Z_|7^6}Tu{?dE+B zUb`u`u3P1Cz=pS>%(eatuR!;X)KnPGLGNE;f4k``#%HyS!V?^RwEan>VAATHhFjgQ z<@sA~M>ORhzvbNdXnyLFQ2uLo-g>ku#C71p_D0!zy+y0I?ULPl<%*M?r_Y?-mg`Q3 z4wpjCeH=^;x9f5UBK);5>GG z?&?=&j*DF1@cqh5NpX^}b5oC-RuITYG(FE_?KV^6;)-NnU0)q3>$#=E=oB?1zt?@Z z@u@7u$x_h%e znvIDS-g$0xHtLxQqkB|@(0GX=6PwMk(v-WH%hGiI$#-vSw>5l?Cl2pV%i%?jYT$1y zOgJY$(%qkYG|ArPyu*7UIC|^7>z0X4=Utteo)VPnqu5)&GQWDVc`k6qmYXyPuMZDI z?#9#|&)wR^&D*+kabKc$tH#=G6j#ZuZs*60W{F`(RQkuMUXh8EMbgR4 zrGbwfA`zQj-iJII&P{JqKk7vkE$;i*^_GxccXKG9`mwp!WIFVMNm8qfM)`u1Rg&mn z2?27FyP9xEdRF-KYgdZt*kxj?MA4s=HixbF)}zU$?s$~AZOuh?;Wr`#TvH4%D2Vg; z`@&d-h*`Zwj`?l6j@+!thd6?d8Qcl@$yg>`N9XM#7)Bjh1nBGt1Y*5rDf{*hg&o%R z34ZEOZ%phh3oC6Nou;=$9uLo3eVEEI_f*{2i+HiudpuNE-sbZBl5pSh_-ViI&gpl_ z*eo$O$>}7A-i==VIlR7$4x6Y8xoVhCna&DH4vnGS*L^gMa!TFEv$(hNLtEzrc#9ec zT1J{DJGYkb+09C=1IXs`elf+p*BugxYG9oV;{=-+(n^!%z03M!3cks-)(a)CwTFkq ze|jb+EKJKQaxQ(%BFdJ<2FxN9SKCV@Ok+&~nX?H9Gxsy==@n>?48Lk!@d4fLw*Awdqmi{LYy{c)d3VkagrCSM!9y!hhQ7K&nA zF^|82yXLr7cCw1SHE~pfz?p!jV(7k2i|4M(et>&|N%G@PZcAg{zBucfAEu_hEb}oH zuNE(+a9D^Qq~?6G_AW8+WM9*~_b`j>bEY|eq_$=5b%&1)G?_Dn77BxOCpdRF*JYM% zB}Oh*6G|L&AMO6K7CJ#>wq2Bve`ej5$OGl#S7TzS)jro^r~hG36}wouHDgxX!>p9~ z&ApNl!AQ%5jYNl{(K5sMu_47{`~79B?<|xLu?;@VzFO4Q%{V5ocbiNdvvOzW%2-Cl zi{(iwxh*$7@U9nolO9vIS6bAFP}%n(z$&L4f53m|ZI83JWmjcGD80qcPfUz&_RF=G zC9Wx7-c1bBm}XieHz5HKOo~wJqq90<5XenaJ9Et4-q&_Tb2FILt z_Rg0-7LQ{XIXYQj;SGPlSONm!q&X$#M=_;tJMzf3Yb+5Q0S&ZLTEDCrD}+zF>yDq0 z3F4Mtui(4tWpTr%r|o*&zRRR>lVGx;dhKaM{_wTsYwndEQ#m;v%e<($$f?BKJI*{# zy@Gtjt1s_dhYLCsUH+z{tUGZzqRoZ)p-pna^wjqs6k#6*+1KJKoR%(C=rTN3K<&){H^2O&ZfZ?x9uBV7*vD%G3^nc%x(3s?R8 zY?D)k0J)F-sQUL~mW0Q`wMQ z%-fgrCL%YhMN;YD9qoDuDyC*TJZIPYm=69e%2ou4m0}b~dm-`3G5e0jok^meyb_wM zgmJsNjTSDi1r$qy*7me_QZ_vk{8%CZ1d5s0m}ox)rT+D~NVSghEBLAt=MWTvOl`^I z?QP0SiI*oFszS;e3FEyYtL=Sy!E2qTIrj3#c<-Ty?uv*tA=BSmhEY$d+@^F<(n=!IGtROLJrxrb60M#{l28Qcg7!|7v|l0BF;Lu=wR(Ug1D`)>O#v)ldyl>qoHt& z%l-_0BUi0ird(E2I{dy`Crhs7y5r7LkM+K;0_*Xxi@hbMHpxC>5$`@>t1& zLg)3oj|aDZ40Z*oKYhn)eBOW`4H7s^`(CIrEgqpAvTB{rAQot|j-4>UK^5Oq9Q#W! z{_fZ6d!+$zN?!I@^~nFQhF|N@(L21?{m^pmdYq2j$-MT<(U|j^f{BY4`oq^hKk&&1 z@$9Im*r;)|@|=C8ZCNBw?3i-gyOJ5XaQvoOU642N@K~J82b6+S0qJ$*%9v6_6T>Bl ziG$*5%xI*2e);TpD!2^w(aRLo-7apN*4WNSAi-fY0D*eDjnWI%>$ONov*!!G_9Q#8 zGRZoSw>u$T#J#L&CU%zhja9W~R^e^`6T6r&mS`mwn9>+OeSP)^JyOAlVpQTqdp@d% z(Hl2&jCE}7R_P0?CIX*rt&Q?gd4}F1+tJ8p)uyw?ZD(dQ^@@U`;E|WdR=&2Wu5Zpn$hPf@GVX zj{Z6f#aEuJYW|_%&YzXysOSJM)F^r{0mf_h0UB9zm{MmC@{H9N{yKmqUci-?$ zXC(@u@xcx}1yd?proOZQ7`G*&2O$%+SO(;CkH~w- z-0m?pF)^uLljn=pXHYS``9~-9_Y)Li1lHQQcPmppOgx2{I;mwS|4|PtflP32e=2PC z{H6BvP8AC-M#NCSeB-=)uyB9=@NnVKyVeE-dbv0`QqwvGZ3gfw*A{uxUJ0 zaf*Ojqj!O(40eOZJV_QE+<}$^uT?&~ix0O{#HjmvjRLF;m(P%URjlIKIws2z#mQy$ zFV6Y@{3%3_z8;+enKERg792h0>ymN}2VD%g6f&S# z{Qh&Y(0D_!qo4lqd^RaLS|yq0;Dt5*bcs`vq4(NS8N1N0#?-CnOhjqvmZQa?#SSLN zpcU^niPc$X4EYoT%Fjfo;T2n33yC&CUM}_~ZPIx!??y2Q?8ZTxRk=<%b)hym$tZ3! zc@8-=1?CJSY-3T7LEoU*u@}i4Ft7(vJqh#Ldbz4OFP~#!#DbfB=opKE^-@%W6RBwe zr%`JhEE1@g>Xal9XqHdn??*Gs)?lMBTyw{V9g~Fa<|&B#9vwI9?0DJ_QFzS%wv% z`wSY9gcPPft_e9?%KS296alMTJ8u#pmOhcdi@om3rWR`U&v3mJz<@td$v+p41cuV8 z8`e?x6q|J6v0ZdzxS4V14Cj?KF2_QK#81@xPbpcL_7cvP%@ZCxD4ygC>p4>pe2Z22{qqML`y7KLwv@zI^@w9e@7> z&!FuU*)n`^xVgD1e`+rK*%ZE|*lAt-a}}mi$2uJQ$R*=o*^@>zdJXLPXa+ z)APq?u``Iexk2Lin1mr5kZGiKW6zu5YddSeS@z#Lb{#z!cU4IE#XHR56i`1v()A4vHuTJg)Ux=A+E+LW8DmVB#dU zN~-NmNxSjLxtc4<>ZO>yv8Ux5&bWaVoa^hGe+r=i5fcJ~zjxX?iWN`Qmz$N$`6jfd z;;N*7t1uA;_5)Y8HiIBUC%+x-W7yvQ0j*G>oj)R!-=Q`p?yVTTyRr=GHLlZx;X1su zxM^eBanm@}fe#iMk|8?dkEg)XPy+CWjKCR`X%%^Z$$XM{}ZS=oU52Nz{p3 zh~_LN65ZrMmcGMI3)rQd2v`~<@6yLW_p5X4q;kIt_wu-$A(^Lj!^Wb7>~HtE|1jql(HVIYV%^o483U z6TBf_B(sz8`8%+(pb{Zv7w_Bxn*vSI5_v|BMrLEMq4NHGlg`RY6HPNtlI;G)9gfCU zQo6S?Fn!Jq1?S7c<@rg4rnU;O1C-IN9=gmYuVdNY+pp4uZXIb12228gOJV^7>a{;_S=dh!dOw*ztlh7^^5ltJ@>WlPrGb| zQSm`Bj-vtRA+`=>Vi4i=wFBY^k)4r|ywVsVp1A@+h(B=v5l)q!qfq&_3 zl(uX(dg2My*JN08g?-sNIz?l|f*0-1lyt_;NDDh)GNTP%BrE!3lq~xDaMmYNn*n#t zmM3kQoD;JoTs`}g1rLL`SsG7~cJIwV1cwrOZGnc4liH2uD7`6gmRpG)Z>#W`$=w-) zlCW+nJqZaP#s#1`Yqu{ZT*5}#;#Pqbc4CFUmv9voLz(QZDPM=yGzlYx*e!n!PhERK zvMGYd2>cMK4^@`Qf+3Oe{ z8bmMcCb|CB8lJNOY}j%{Co_A^>t;O(JSx_*BlIY0WMSjF+5IGbtFPSUYXIoo(^3*V z50k|AuXpx*|9>>X)U2P6_O}#3kEH-c=vjiDRtg(#fErVmO+&imjm|s44w1Q_Pm18K z=Mv5$VIylmuFGEq{;KL-=*iiDexL(fqP#w5i_XzP6%3cB_>1!Y86OqzqCefu(wu(j zQ1Sa5{&AS@Mp*lPeo>&`6nu$AK=~bI(9-+UuvLhS0h<9_ss&8O6&3dxF({fzHCYdF zXz!}6ViIJpBj?#{#iHLv=&&thC7Ne4vZ1*^#E=6)l zQ^QlzF|EsM(s^l7Ge{Pzh?ceo`jWSKXjkx>;M4q5nqW#|QZIAZ=c>r@1U9H- zpw)VZHCF^3%>-MvO2c7}e5cfT%P#8|&Y;)%mw172gUhzos*4M`OzvqVkFHsmGP76%o4chcyw9l0= z{rt$CLkI8_siB>GR!S|;A$ftwKNy=XWSuGo(L?>#4NlZ#o?<<$J24u1o`Z-B!mKn2 z20}>+-?uMjqP0%?MM<)85~I+Wk6YP8mvV=QDQCyDusyq+vPOEAzN}3v4+4nnhTC9~s6c~!+LUbF5UkC* z>cvQ8%y5r?dO85zO)#>=u)9I~fs0y|`h8+cQJ+1_K*vGO$WOy~yZ_T5c4GXE0Wice z#^K!B-j$<7A-ZkfUrDlzwoH`Y`onk4(g~-?&D!ei>s*^02t1RQ(%B+3&2|MAoe@2ZKDVSOobs_ z_=bGUt{)=-?ii~kmvxGxL-iNnfpbvHm<_1LpGt<#OL(*(O#9lo`H=R`SoZZKlPmYL zkh|@4k>P^s5-uAxjLjMha7@UX<>X->N&8q_+c^n%X7n7B<~l8}6c?Tkhrhr8gak;u zGniAllBI9x-TgpOZ5>*76k@bL#duaig4}wvxJBUI`CS!6Dt#O?_K&Ywe{NQBYogb6 zz8yjkz@e~oGi2l{pT_tFx7w~SILLJGt0n*KD}Mjw{vI~yIQDu&AF6g^H(x~Ydq`al zd3YtnD8@5Re*yY<9=waQ`Y%~$)cw=(hFZNEMf?jzih8eliLQ4K(Q4nn&w+IMp~~mZ zGAK?rM)$;EsK#dS2+r|%h?}VYc}*Tq4wQS9C}^v#dCo<4-<;dSnUfL(WnVW8{wemE zSN&l>na51X*xtHW%WV#l9T6O^pJI9*8!d|A0avmr=mpjHt+~YePRWzsfm-ibW4*Xg zflNSo=MB&!;M{t3YYlU+Mz_ND4N2$EQ_T!HQfODG7BBjrKSfWfR#MvTfCEh@Jw~L^ z)^C#-Bp{rwIek$+$^GOa^$hy~QA|)}%svH8p(JI3IX0j7;kZYvJ_Db5F590T&{ql* zd+G?56jYyFOqs)BQNW%BvX=4djr3pgnOdc0FGy~|PA`#kD~FQ8|8W=m1+wVTK$ZyK zV=Yb^1Vh}+Cy-%-pnDFFgdsp2)4!`54#ec>FC2z~!Bp$-sz?;g~mynmyWN}5k zgbq6(rt`8XMu2XkG8(qagy06n=f$85s&+YHbVxvNBSH6NWKW)-O`4v@pGiP?LTkTz z*QJTa3}OP=-l`P;R0w%oQHuw{U31U<7t9UvUiXJY|6ua2B-FmE;AaAz zlyDmfuV5C=;uQ%2m+zk%1lku`j}4r^!VT-3ZBFs$gZM+vjqJk>Te6jm{7?}>Bzq$c zQi?*+P~!OOS!jYEA8aofJ=s|y7kCoD3I^)pHx4&P()FnElnvE6yYQAC`Bf3WQe8<21wVh za_GYDeQqj36KUHY;xzo4Sc)I*U}}8&x(Uw>YEjw#Zr$l>fUsjUy&N8|IxOqFdDwsF zI!~nVW(ZAyG;MGKSkbJhyV(G;Pj#18yQ(=-WE4!{gHIyJAuESXu#!%)Ds*41F%k|D zCy6wGDd<_}Os88VM^Yg&49%zn9E$7vZYdT^jofGq#iQV5)#8i|wm3JN9jp7K!*OMV zv-AjHt{;@aqF@@wSa!v;(j?M^yN!rHR4~AU=DBQM%p;*YAtmtd547Ojf4d(bWQz@21>W_1T@ zJrCvIMcia>kiSH5>wo(+AM9_O01<6oDa&e<6}WR_n^mTjf@8DGTg zOz`yx`?xo{D0?c~`m>6zoF02Wv+qkmC`y{cs|KsL5btBxBVN(CQV93-5RTCiMnLQp z=;Q^UF6fLfU{cY`MgJ_BIFu&S`G$!ExqA3Ao{`L{Rr$n%WdhEGDg@AETM?byXKbTj z`BC3WuH18uP#8h_GW4P?-RrGqWiwtX5TGSnQ;~_@6Nkmw4g}lcCSAO@_iK4|^_WV? z=j^HXJ(tcua7{v+Cfh(p+fpKAE(=6i6wM5^`V2csuyYCPO*e?Wlhi)cO?qcZ7THYI zV$I0^Ogh{@5oNDl;ezu#=uoy)sm!GQ(o8FWGe&6UzD}^jX<41ja2cRW$Hf9b;9dxO zwo^e%^^M@p-~(YC>a-bB_nHo?tCciEGrRFmURGAmJ68|nz$4+vl=HV86L-epa6>_b zT&on`aeK)jCp>rE@zZVc>i*WUJAUz+v=9GF?E6pMXupU4HS{`zw=kHorxX0fo~GLR zHk{3Xowp}90Vcm<>T(2KdovD->6;4!jpHcHpA%)+;*h@hO^Q12UNquk_!Z7ZfNXoF zll*XT8!t+6<6*9qPkC7nK;7>D2yPkW!H>|@qJB;{1o4tQFall*%jJrMCgSD~us{(w zslOqPn16YX&2FQ2v<#-ZAcSh^VPO*i65C$TWsUNK*k#-E)a!GRVldK_+DW{ON19&M z#n#LwSxl0`DJKgM=f{}t_D6);UgaM_H-;ZzH$bj(B8lilwoqbg-tJOK**Qi^*R_f{ z0`Gntf4`Zxh@<-CfY%|;=S^pbZhi}*unw`jzGLtuTX_LSHo`7@TFQXCny9%;QhP7J zjMqSgY^XTkoPlBLGN7OVf>A{$T`56ocfFnNaVS4*sD!QUouyJD^32>-TWDQSF{0<8LjM% zeaM1=gG0@5+g5_?~Y8;<_xRZWTSeoUCB49Y7_Z5fgB3RFpt&bxj?;2#WOZ2pw7JZzVAli`zO=xRP?8`_0Z81A z23ut?o@^hk;d!;ezXHi=lIeYl*oO!B5yG3YD!Ho6u`M;kQP$tX#J~9s+)TCe&9K23 zj{n=o{~vHQi5LK`EX)rz|6ES-7qmY5SY)A)A4!`&_fnsMPWvV+1`$RGqupJ)FV|+H z^l3e)8s)T0?CFY9(ZDfg(|AU1?AhyHWQd0V3Fct+GCM7fdFJk?_ zTniM`=g{s8U}pFH`y-tRF!%wZ<5oP_R9`D)uH?V5w1(x=C)a(3gEGFd_xGUAg?99vULL?f}+%& z?{!csIUW$i#>0}}O4|nkOswDGOuwCac2(~W=*W9^+=QrsT6Dqd9l+vPF62@zHzafq zW-^F|3u~beG6?y_Lurdg?_5N;TW^<>634dTHZBj%75(2{hA9aREG8{V=ikJ_6c!Tl zB%|=6Wwp|)>5R@(7h&yM87b|EX3`VoUhjKGq3xCP@Pp)5RQ{3CjE73*?WO?fvhHM) zPG0L64l(7{p%z?)oP-ZOY#H~0FYh}{JS?%8zd7SZF_fsoqJFVw%s^FITxD#J9?Pj0Sjt7;^YC)czt8EowQ8ZB_)_g% z;DXy&d3^qm?;Cml?Ix3bQmc58foQ9*<9e(^>k!ElmU!$6L1@*z6H*-5ZO!$^5GI?P zE&Kfm4oafPECc)Pje7B}k8WGz;qx!)?Z)b6v{ANkGrJfKc;_T3_^i3n z*h&V8_7*M0V#5VEg3sjUUi#B9h9KaTUGM(hpN>y!NV)TpzPWom5e;jQm0)=h^8xTcd5LnThha+&h$3SG9?$*g#Xez2%-rmB^P6lb*tp@pv%wtMgJ+ zdiT0bts&^rM^x9HJya)KJH!&TV)402$IAE=)+@wrMh0rd>gw|dj7$i5(-AEn6Wbg&(U z{=rRUIRR8mRwiSYK;ptbt6uVC{K~-3r_1uMBniX5I!|bjbRRt`;Cw~6A8YP9kFV?& zV#5C(#F9mLsbM5Ntll%sB}en73KOT*^`L5(`%;#erNo0|6CRG9DtTt^HAScF)?zmU z9V!Kwv0CbFeun3$v_eu4-tSujPdYALKi5f-aH1($=VY( zLyqese!;mth-2~cxK)aWiHr>H7U{TLxxeT}#F;lQZJ%|3UH^jxW9nOUqNTFhDAIze{AEh`bPJ44sX^tGSE1y`urFzNhWYvTuQre#zn!}6>_fkKFhna#esJ3m>w@lM-lL!S8<=gD0!hBPaf?V;zFFpvx`>bv6u+s1Wn!+=5~^&>cS=EpvC_)3 zAI}L2R#WIx{sIu6lM?mRC(X_5d3!IDs#JN!nA~5^K=K9e0g982H3?4~IQZO7FpOh9{P_V8Qvd?STI5(q(J=z%F z4o4D$luz~oz#F`=I?h^+Tn6O!aX9H|PPAZffZ{ifXM7?CBj;&0KK7e3RL@lhP-x%D zS1K!nCGTW6Uw?EmYEr%#_ZffV(st@12u6!0F)Qkx^ z?!Eg&Me;ScY|cV@J1cWU{oS1|Q}%}ODCe=4gO4>i+b)$`4f))YkDs^-($OROn4F=E z>am#Py|nnsVFI3NO@rI%?`-Vd6uCFc&CsG&MOJ_8Ov|kp)beIV0aXYpmuixpHYUgE zVAOi7g%JJWB8DwL(7aC2p7*y2UaPZJ!MAENqVA7tiCx61;)nzXrtU6E_%4}oIL?# zch3rr@3EGG=nvjbOl3(AF-wd&YWddiW2F+$`Sk)eDdb?)HH#K5GNB^*RozqgPEki2 zDejVQMZrm$SZ})6%F=DY8L+~sZ7Gd(Nzjptv2XK#r!-Fxe3jzNK~Pf2nGlN93b`T3egTzob9uCkPJCE z;}j_E#5a(m#JB1q=HxjH)|E6fRg^?{&?hS;$~JHRdwQfifEDAc<~v1Sf;#DrUW!>< zjiqQLOmZ610@#~ASN>1?;+rP#W6G9N{!+xjWN{CI{memMFdNW0Ix0F~1w}DBuJeC8 zx%%FJD2%O-IfK$6^=XG|+}I+W>qW7oV!~IPj6+Z;J+C*U>e1XiYgF@~1UxH+L89kWw=7C~ew8;V`rn_=>ban-k}GqodX-KQB#kr)@pg7% zb5^64&J@l%Qt*HJO48zgO?jB_x;#g#Jg@m(YLr-gkQr`n(4cI`dGUYxHZSi$H$mPjM=s!wSN|rY16q2sJ_z;w(X12nB7tdhCnsqVT!94&- z=)m#QEUVI)qEt%);>iFr)DZn*B9;0|zkd5G^!sM-4_BhyuQu&F%RE2;-2F=jwF2xL zwDp!I+S+@mERY1Q%GrFAzndF|qQ{=jWQaxT$DyR3Z@eSi=z*DDTL?zL*g__ni-;ad zw{I`dT^LT+yjl?Df7=RWgX>`5m5#vg5FTkG0T4;c`YW1S@lr_vH6t3|KXy!!ebnjoMH}-(sE^fKJe=9^YW|`F(%Ijp`l&s7i zppZBQP7uf3TIDy>0FUGMLov3sUeEa4Y_!#0}!4`lkB1(Vli(h{v6 z1wE)Kg1Fpr^fQhLf>{FqAc4({YPuwI(Y@(&jP`2~_CzxJ5r{i9TK+~29e}<7C=Vy- zE+3kCS-+2NlD8&N^ZY-w3qRUE3l^G(|NheFk(gKX(Rth55d6N1HB#-kWC*Fl7C<1` z$c=CqEZx9CeSY(nix#1HMj0(OT$8v;^wkVf*PPCi%iiARa{W2|6JK(u_!wYA6gn~H zBzX6$1-t(;o;fPIM_ujapX>Wqh7^I8A+1Gc-~RXd?BDhw zf5CtMBg7?Pk%gf(X=t`Wpfj39gU#wq_>?*h%7gd`nQu2XKq)OAz_It%WI#{806-iP zfF~pXIy_SzThB-;z%L|Vt|8}1!XR&ZP7pjS*5f0EYmju~c)InE?D=dDs|o7vR$bSr zM=spwHzhj%a*a%nF}=`$jZ~`%VX&wklVn9V2wkrx9Tq265H`(33EF1O#D}}{uT8-N zN1>4~!PP?3fAP<~|7Yw(_-a!F@$(-sj}YNmZF<`TS7`ToKrqmwe22;ey=MR=!)2B- zp{NHVX3DzH!-o~v(`-%Q^Jq^X;x4upXnMu`KZwzMM&xR{&IA$-$E)V+m08AW_)7 z*~i(58ee|87f|vo1&6HnqbxseaUELn4xgfkH5qYt^MAc1CRI#Z&&evMcZts*W?xnJ zd1gR-y?59k^zesN)E*+%=4&albqQ!RD@6M$!k?4MUrB+5)@aeAK{Y_frk7Gg-^%3^ z`_iI02wL~YxTn6HQ6bkYS3F2`E?qoTUKzjjO`-=sJhj3MHf4O(`%;a4i5UY(LnLTI z-noI?2QOw8aseHZi@L*EAz!~NkV_OEiQjhvtPdE#(ZEiIE|-1_V5KS!`3qEz&*S;+ z(nto9>{`jq#XfCNhn&d*2C+A})dqi;65ISr2sxK=$f3wb0sa1*z@fjma8!7l$#cadwyK?kb~O`67o}-vrNd&?T#I6y zZwcD)s1X@;Y*&O{u%CnPeJO|uyKCNr|=7CR=40Y5aLVdVyo^Z-8hd#r`{Qi)9}*B z3ogVNY1b`)z2jO(Eo|QCfnWgq-U)uIwg`VT3$~C~(rdqf0m^}%R~`E=l9&ClSDMiT zL#UE2gMt|7*0n3nT}sKuZF&HUr;kEh@D?O`ogxEnieo=}WuZI4&S$sT@h1!5QrVok`+sl(YIbz5N~WszAEk)_ zy|~_0f=|F$^6-lzmxOtV1e0-U+c{5oQZVnY&I<4H?%>Fdva$z!x_)B&h&O;MKh zKEmsr{vJ&ky&R^e-}c#Je8UL3NMQ(XWK1o6Jb1II*-ZPJ`SnAbpv@b_XNV|5cyFf~ za&T%9l1cx_vSug_7RdW_+V)o9t2R7&`lNQL@uiEq1`w9j@a3IGU!_(FRRrf-M@%HY zAyP5q%mNw;9Lpf?z8_-r=KUu02@b;3ZAHkGW@Ebu8dfTZGg{N0`-INt3MTCrBx3Ty z%&QR3xq>LPTM>T8x^1~f-lxkg5m^B#v?(>y0Sohka_&Vx^WNPlP!}_9NA%s~5^>+S zr^$X;nwAi-KiX5cCOio`goOSD&;o9*NOLUl4vF@l6_GDvI?OYvR(A7zn6d^hb*|>$ z96kgNJ-N^dG8DJ-^cf7ioO>-AJGt5m{i{=I8X)n9v?su)hIuD%OP(R|#w`oUkFKUk zc0s23T~RSAnQ)Zb1Ibi*y@>FA3TYKXO$y_?j;hWI!Ih>|Q>t;{L-CZ=su99E@}1jL zC5Bzb)wc?T*XZ*!TPcvJ@NzJbVORt^v;L=cR^IhFYygVf-C3L#CI+qH)OYGnSOiz* zZ%viQyXV)DDpMYM{OkK?8{tKgKa1}mI@CF!}b!A ziSfm}ygXUGlxGiSv}i&et*=kX4E~&STcq;dokU9?Hdm$ih9ehEN3b!hYn~lUt8?ng zQ9)%X(YvwPYZqlI&Gf>_;JVp+(&dWc=*5a_UV8?8GEqOTSZqZle_8L;3?}zh8?T(yY!iWGU(gope94jmmMc3P}O+%Jh};Y1NxzCI7!mYfk1FOSpCe83dNqUPsKW@zw`>n-3m)xG|C#T3a zFR>#7K3~dUkyA*zi#>*jDZEFQ!pm#c9U}JYi^|;7ezv%lOteZM5cLFlN~4l-E;)@a z*&KK(zaF$ZUlUNwHdg+$1|-x1IMk6qr4Z&LElmUoklAWD4!1!penL8U?Q8vR=Sf_Z zhbw1d>Nae8s9IM5th*a6jqeq@Y4A0K<$@x+X3HCbh3c9?!l1 z`>i!=mauSQzx#dm6ThHo2>*y9E!j_)?7@{z#@_PG%1br#D-yA$2S%KP)>XmWoGY(i z=uwk-xdOkT@-JM)CqG5c7jql9JCZ=>@N$x7bmuRCW(TxBETm0l9r*X2#A>dieJ>Qf5>$)&fV*U8A7wwU zhU@=ZRlh;Pnp{F%T8G}M($Z)sC^!rjG5jQ<@6f-iWi->kQsaah<7muP!gLXbG$*fE1hjSQvVYD71Ws9C8@6 zMi46*y*Kwc_zZ8sWXc$rFO1NK{208fOmxx)X#K1ow{oY+3eahvODjp(g^=@cujl}^ z^rIi6%@UZoNorkm4&#gqanV$B>8)S3)H$;jKWQ!rwW7#u%YY&(Kmf+3HHl3l-%})j1 zMG#(|&0O7?sMK%P7N1@eNHU-Okci?s*!VFv(deQDoD$*U5FiNy=7gIZfl>ZXs)&RD zG%zBhSwdi{@;%5-J3i~Sm3uCcv@yYvMDi{t;P}g~Gqr-t@tL-lF_$xo6Tn-7iS)^+ z>;zs4sk4Xh2i_T{IqvCTU4?PT4WLD#k4`60e+r0j5U_r=qg^ z#^h-As8o%_%VYj9xL7LK^k)G;>MwaoAKooL9%Kg3EId&fcA!?TgQy0xfiU(1%3 zC+4nQ?3-ahum@@RnVH5Ca0`+oYx;38z^rjX=n_1(a350H^tSmC!W2oXsw_A)&Ky1G z0E`|c76T;seA7L|U1o4fNhSobM5U-E1jQ{E&5nW)!CABZFLxag>f5tEom+Q>cBYqV zFlgKV8~GoHH-SpE7eK8ZsBvr>8%$(fey~60EGLxV!d*BzWv?_;`P%c$$(gNXnK@OZ z-t_;{6(ZzyAn>h@CXB308MDfB0O+b!=iFx(W=1q%b8I1QAFbHUSpU!vBD~=ETHeow-^GwEF{LvL=Vn2d_Q!;q z&%thXU$Bp^I9c$7_(LAFRrY3x3%Y7W_(_BT-c#D%fZWV8#VKi9yeB=!9JaUo6@^+; zsajZLV*m^}b#{QdFei1e2U~HnC3WJ~n7J*C=cJ3O7jF54mF>9XK_dqXQ%CITLcV{; zb@fcmer_8UgoXylL1|z}IWdj)Knx=b!7uv>(gxD-&50-z^YJ)k<}~D1%l$qJt9i8v z{8&d7%xsVIh@KB2{rwIxFwDv>3xo{s%k9!8)|+gJ_bOf-1}{zE>#V=)4;!=4`T~$c z!U6+42Df=zqD&OTlJ=pyLxHI2?^Co*`bJi9vP33wCS zA9xNptqUJZSI%=e4mr{%o!`sdnt*oMwQE@HE%zz$9~^H^W(W@aqzl`ukSJ^O9DIqA z;az?y{e(Avr&L77*{_)5@Qw*{nt_5r0|WtUvSI8o;C0?#k0w8A?D7lt+a}`9dO
      G*g?R_4a;y7I|aPovTWQ_N^p zNU?IHZTJKzITl{REV5-fpyzE3rjBn_y+4k=jFXW|BDK8*0`^J#bJ>Szb$Rh-+^n%}<@A_%M!(`3AC|(1YL1`KWcB?t zeAiS6r%Cn&bFq3-6>lkWt~?XP^~pk6!$^3onN6$`4b%GxSOm5oSbD%@Roq>sK;wit zbpo8DdFeskIQnYa4q;erc^`R})l9Jo0Bkoa8JYI%sfx4Aj#R;i6&ao|RcFi^uB)#>3+N0hGx9twYDJ*_X}-&lGr*+*4A@{%vNcnb8;iOpV z00Osd*mD_a=GRIn?(OO6vS<<4#T=1aJJ$0GbPE3$ni-U!34tD#E?D?$Z!$m9M5|1! zV(7OJuFcP%4u;rDM`DXYa%~d@1!}<;e2^@d8c8pjI{+hz@Gy@oYvC8I&G!9`&p~^q zyR4@FDmU1Zv%s!p^npu53&)Lb9Fq=j#oI;;(FDRS^iVfbH@+)|qIdSPg;-b= zbwSRNN+auw>g2sAwLhq|U>F4vgn#;QoK{;@9^i1Drh!MQ%R1r)Ce2DMm57wAJ z&xQ^|1)YYLai;IUgk~EOd2WH((a6*A4Of;@WNuaF?k!Y+0Q?e18kIfp@fN*~#PYVr z>s=)wTmG%Qbj&MIIjNM{G6T`_BIc|uW^ooVySwIomAs{XZ&V#KstNYd3Jje2P@Z?T zJu8d#u5Uw&qGNB9H=;O&y`7ZU+o26MM;Y|Z(S#|>%@ZA@2TxD}D-q~;hX)EG~DU5*NasH;%?>~qzIU6Qz z)fAKu=yJpviLNr*mLe)+3<@-ApSoo2++}IjN(~HAUyP7GkH7{fThC~s8uIQrW$I)Y zDvmLeT$53bgwLcAv^Kn_9K#CGdJr)x!m(Y8x4Suc)}HAGFfUPmc&V+0$0kVMOz=bG zj>_{6I@>K5KY(l|yP`HLXaE>-rcaObd-khE-bG0~P{&rD6+|}=6Q3!TT7|Vb$R8)& z)ro{b$a=@U{jy{9skswZLtI0StCL_f(u46j`G`7q2}i63GOyZelI$7d46DSRlAKS$b|4B)A23T-ZLKX9=cdZ zrkPdRyhXY~Zt7jV(+D*c3SlKZbib5T+wVW(Sii$QQR%j)T*OIhDPmo@o@p#~97aU{ z+ZhG9?K%0V5UmK5-Fd~LBTc7Us$}rwS`}+*F3}YAlT2;mP>Gr6*lN9pYcq`jNosta z0qu{{nxFeS9nY-VP9tG6*8E-gYbyT3BHCaqsiC!mR)w&lbqwO)5q92IOR`uQ_sicmQ#t!ZY~m>aO9G)xoN9%?c@QJ! zW^F2Y%NN?YxR4|Fv_U2|@#Ovenpp|0915~5we=8tsRI&)6;-f3<+z;wM^Y6>9itKt z3!me>gM&i|xDTJ`5X8Iz%r+|<5qH2spE}f%U}Y!mg@xS~16n4U&Ss}S)j({~x-5)| zu0Rw3y^67zYV5Z+kNYJfYK4i40G#z9IpOa643~8DXf`GnTZt}ogP08KlQjXe7}&J^ zOE{e;=W$w2QNL43d*FE z(n6o;36fYXARO4YBJLV&B%UJ`Bz||tB3qtaV~&V;|5YUhQGLUOkgNcm4oU;b3Nm}u z?`{?na_c;5KyH)8XvQM{jd}9(A@RB z4MpBBz0OP4OmI}Ewd`02W{5v4`g?#iON<{00JfK9X87l~G|DmQIa)?!8AOKI)Qna^ z{<_D|N_+x*jtPQ&_z;-NWZb0}c}S;)=G3&r$@@zRqyqM=Tdw7~M}5t+8CjmiyFvq3 zT4{iu*G~+(@JGQf^%{MPy%Z&GKAjwiv`BbONY*n91_`` zqj?OA;@}+S?^Y;;al4lQqlA45ty>UbpT@_`!%BY7MK@wYFC=_I+chMIURn|C=Cc}& z&YTBW=MJ)9Ji#FR+{NDqm}z8P$j&#c_cATd(VrQW`8^>ypPOF7Jiy zI7(c9l}IxvF+d&$QUPlT{Kp}GvFV_60?gbq0bDs4zuSNqI3v9p+c7$TtWIj;Z_!Dk z;IwG?d*t80Zqm`fSfRuw*TU!!j%$!?BUip}#X=kD)r}_N9Fz%9Y*h6KxaHmGI6hBO z6KeewVF7>o?y49xTgzonF)qOGlw@sXl&Ol$YRZ4e#Y#xj7y{?2P|$Bca8HqDS1uApoSIuMzK_oth zjZR)z_H7?exW~u}XfaKmp<7?o0;srO&)Z+W0c~k$BPRjUbuW>Jjm+L3G<&S>Ugmt+ z!+4eVqV70D9`DN$(Kq0=rmm{5udg6~Os=fgjFra)3699Ssc-m#go2!;S&lxQ2uq_P z_vpsAYhC_F=9%_)#U}bTIn4U~vh5s~lWUK>yb>qU+y*k{#X4T$o7Sh4v700AhuM5E z>i_X-VT;0>{m8WAjK9+7HNOm3YGo*CPn^5~mNzvPa}Ssq9u!;q)@pBlNc-rps|rBU zcIiN^>+%W(1i%t^LawfRe@*bdrL|i&CHIno1>VqnRoVtk{)kGOC5jBD@k+%x48m3m z{O8f6kA))oSl@{7xdzv|4V;Fj$6R9fLxX8lS1SdeaTxzR0t;bHeu9w1xsSms9>>jY zA`udN!*R??`-)y~wcv21Kc$1Rmb|G`a2gnSsmO)5eZU_HKkGuH1t#i8Eu6J&!GK0 zR?k%59PIzm{-k%95(E&Zh=}MS(nl1%Z}??qny}=QX@!>YD}sW8CaX!T4b#BaA|-ue z#lcKmG1VG_3vt*c7O1_hhZGK3qFNsymF~rWFf_@#KzK!a5CQpM1k^xj$F}k<&}}XU z+aG}R?M?4h9F_wvKD1l_s2aRT@Sn5x0Ihp1Fl`<#c}Z$$B&`?s$$9$zRibugxUhU5 zbji-O1@qhuabL_ujpO6BJ3u?@CfeUQGGo*>@Bxi70SJ(q39qi{CC}&dgDxZ4Vk-`A zu^Ccmq#TNOUK3Iq>_jk93lk|w-hM?GOx=5JxmCovLFideieQb*lb@f+39QPukpYt* zAH5Jj=1lpt7ZK#D+AtF_a0K&Cg~45LIx%_>Q8SJjZcvFiBY zn7Y75>1@txx zY_lEMT&XS#T`qUVU~4q}!pE#n&p(0_N`3e^JoFq8=(q?lAwb6@9g`W4&VGB4(dCL% zI?_ZeHsHSAD@8=`v0qV?7&7JsNXlw!EfYDkt4bfgjENb&G8qhj@WWIqYh5veAlTh% z5yqvV^$HKTg!F5CPj>G=!dsy#Ql6XIoph@B6|fG~Ii4Xh${8y)y_<8bSf@xCh~MO? z(2aL0eMusvGkRkf>V3`A6DAl)p=haaD`Qg56=B_C&SunnUz&57+OJJgND$YyH^rVn zrRNmI6%^6tt!v^Fdfa|LxQtHONN*>Y7@-Ky4rW`bDVG?8{+0$T3@D+XbsqR^e}KqQ`+5AyQE$8AxbmJOU@a|w)D zKZq~|ww<1|QYQ8sC7q>#=3zfC`G9wYQgql!^K;mBGQVbtSt5jRFlb6WN@_j3&fLBI zGb93Ui+5XrpudeW2!)|2i)zhAf*R*^NDD6 z*YXQYQ)9Y^w)Ehq1~;M&zj~+jC$E{J!CHW!_oz>F=Brt{|X#L84E@_5QoD07D*vKF_&()h(|a z?^e>|+vIxUZpse`A`H@hy8$eKY0}r`cb^~e=OaX4IJdO6szkEp11wV>-{!Z;Ozndt zCefonz5EKYB4tUTUnhEbH2U*Y8U6OAYS8b>+<^xxI+2OWP#3mpS>Ca0`b79I>b+-p z;?uHO*(WQXOs>?7DtYL)@aroIisG{;ld$uU*^54sb?6DhbK*$dGyUKYNt!re5NZ!D z#1p2#HRAJ&J5>i)$ZCht6wBr-bqeQi_enBh7oPE5Qq6rRSI!h0b@5_jhPk|Kq=ot7fhE5UY4ulSLkSE&xkt;r zX?c{PY9K9LcOJ`@HA#+Xe6Hl|{zTy2Dwm%`4_Oxb4-9rC1-b*W|C4` zHH&(zlF44X1@|Q<9x)4H$J1nSrFN~-%$}(Kdt!S*<>N{fG1i>e z_=@!VJ3K9G6yi$hyl{wx3?JI~O^3GMhv}B+^_;#yvlq!C9(`lg7fNJEdQS9jkY&Pr z#u0c1hba)#N$5p6Oxc&3tP+W0$PhQ(R^$t;R-Fw#OX68i08?4<7dtYP$8$fe!inhZ z08!MldPzWQoS1am1B<-(_*6P@ffF6J8QH9+2HRV`&3jv*5CH>|W|Zf~{Vyz4jsw}A z@wrwV0_J>LSVqvM*F^p1@OO1D4vIYsM9r(1^jz59quNgQWWBeoGBSdO=^4JwK5GRt zT|W5x=3){G5#2idIZanE{Za|#_*koLOrCGmL18$-@%IFg*T9}_!DAL~&|Uf(uO!{n zLP0U+d?+<&GuHyp$SR>JloSaj0i2@!F*roPJ!#B_X0agLjR!{**RLVrzg-e|L?Uko zg?wNh^kkcRK}|Fg`)NUq5g=sMnq0v5l;|IPY8D~$!sL9kHDmUhed7MkZ$Y^twHGWn zQeN5#RDP%VQ}=5$@UARp*q%$kcj~wk-s<>uS(G>@oSOxd$A48iD|px_p0L;+8s0UU z6OeSCC8fDMrLM&DAYJlautrj{%u^}0_q3H>ucm%hs=VCyzopJVWS)Kyv-tSCMpY7T z4%^jaf{M+{$YiX61GNMyx6RTi^9wodsghSk)VI}l1^v$oZaC6+>DO2%)DJd(S8uxv zD0p}!p19bqs?z;BXIZnMGdn5J7bjuSGFwy|3y&hcenXn0D@p=s-16yZLW|&mZbJCA z6o=wUu}93NJcb$x0T)N@q*R_}c(OCR>K5w-_^!6?BHSYvS8alB-;gp?4QXr>P9w>g zgz0SWeSCT>NiVlH?N&zfjec5M2$}7AdYfb6Q|K5R?VhKR#&PB>`t3)uJ&zA3hD-{a z+wAHvq&R53&WuUd_})F5F!E)m^O@_)={@d|w_XYL(#8Tk9;Lx7Z9czC^`DoqrSU2h2j`X5de$p znW$x&XfgHR_(i>4$!Xl;#TfYv;CAa28* zy0hd(-nmJD1$S)@Aw|{B=Bfc*v+9U4aL`Q#%M}QPz^bi0AZ>7N_K$wQN4ROko|tH~ zlP=~?1544>QD%5;5PTUJLfmHyX`}}z?-YRQTa)D|O6`{>@68v5XUG1Vs{5ukfppj& z#4;&gPxQgQ>cl6{rJtvq&PWOD9t@CpG`w!i>FSw4E3A0>BJP<}>So*1@ejJq(YHUE zB>zqL{{)eL&QBcCY-z9ehv#5BcaP>Qt4|CxXfdS+ncxy%yjE0>u(V9zh{zADImQd(R4QF->?r%pPZVw{t zbqM^m*#s=09`gmI#ZKJlmu`72JyxL}+1yGR;lPwEnR`lZSc6*x~i_oaDR^ z2ztnIIFHl5eXA>py@b;Jjc#&Y+Fqh;B63=qO==ObSyAv1H#j-Y>$-;C`>KQw7E0WQ zr%Y}+^R~8&i_+KFbYdp*8H|D(!C%>=t!W0tqaxtk?+_}_88__8@hi2y&W^Fav0{b_ znBLd$JC2kjrY)4a!Q(Aw!RdNHmZ z*Hg0PZiwV){kf2S-3FgB?Mn1j`vzccIZVk={VnVIlm!;n{3*w~Y{*qWgliKS8*vn{ zi2U$!|2cmU_*69e+)M$O7bjd7LlSOv;}Uy2LXmiq9I2f3#D5m}-d1~{%yYI^q$U)b z9+qEmD+x~53QMo;gbcg}--@N^N5*AR>fTEJencgCpNSqZ6gtGq%xhT0gldj5DFEb! zB#;DjgKcgPhyc5wbM^amJmsjtRK695icBvXW(l@cW5DsY^#ov^G?n2frrET=gd#+a zeJ2yP)579#tTU?|`W{!~^^+A|X0z&4mO)t$7gXsjTkM8=wB4#hoF}~ z4vN+y@3mv|%g*?FAB8jl*kyoU`3IWpdQVER#hh5e_Tv~$w0wm3`&DM#75#sH^_$HQ{`YiTW>8-pj}V`U;+ zGlck}^c!Qt?sFMkQd`dBPlw};ErhbJ4u3YdeiNeqby5GTKW0tJa_i`q!)Ld>Fz)r4 z>30D?Zi!8s9EA7ZE$09~h>1*__&t+byr|JC>?9a_ejIusn&Vq^RB`!v(0%s3=ew^9 zs#{xf;7?AcXoj21byEedB#c*7a&DI$GKz2I(93nW+YFX)-1V*Rmpf~}xG)PS6TKMD z`=l;8wOVgR`@Q%=3f$?OTAda?L++O)P$|Kk%l3(xG@`2+w|C=C#_s5!E^7it$twdY z9&NGqX^mYS)%D}gTvhyRtepRO*)?jI(fy?7=k%hBQfM4oZDwrj!N!d&a)uj8h(vy|mNA$tGZ58TV& zRI*-OC|zx+(oH^_JTlQ7KCo~6E%Rk&$9lN>>QFbvcfkE|Tb&efBi~Vl;8owpqan(7 z5g}*pmj_FlT0YV?0gc?tyX?br76a)5eOd4Jl29G)s1?!20iS=$9WAXC4}8&f8PY#G zEcDGiT6p_bJNJj!`^r&6+snHvX-DG47pS^-3(pQjv$BMYR@!IooxLP6Vdhq)A8vNe z($a{q`6-uAt(qfOvOJ4?6i_Jk&Z+UDbdPi^hv6dV*CJ8@e6Gz6;_qi;qf=WOgCpb( zTZ~^S=z>Q4Mah2BR*qGq6E%*sySscBm(ty8^bWW>A0yLNJv$Paj)9DwjLRMVj^bc9 z5(&Nd(zid*>Y?3@sj;$?(&c_}>M<pF&0p2~&hRMeV2PUc5zOUs|KU?T2k|*Bhe_|jUpdCfYF9HOD`Zfm`jyHaO z`H`UrG_PuDr1me`7h^Y+PyR=c{cJ^6bcsx=uyxhgAvfl2yly5s6#?mM(7MLweY9UypT z*o^pLIkGRAysf~0-6T1|!Ksz{rlKo}%)08NU$%(SKCN7=*x|E5N#-S#REwf90B1()&E^M7`M(9Hp5?_d>f8G3g+BVsn1B~6 zl1uyjw~*0Xo##WUhR(n ze2Cht#5GkK1fOCND?87S0H1014E``;Ta((UzoU=MeHgdv?CZkg>=)CFC9X-4k`yco z-4pD~>yP>viP+U@YMvy;F<;Bq8<2HF-wP^`aYM>NxY@EH>^96k}Y`P__99l6F;5fEZ5uMJ3rk{^ed8MMa3^ocvc#- znND(6`9P#8opCbdH6Fc)xfd(Kd9P0L_pLbOh8eq8i6@WNuqL>#`gKnf^J3|fXRDT8 zhx7|SpxP8w3wx`ToBd^JH}jW)LoYVP=I=%!?H!lLrEoDGW;iRJz`Z*!34K+^S_LJ# zxpra~jpizokZNDXI5hQ!=A~xfNeZdOv{z<4p@!Zc&MB?aXSuF%-jJB#Vopf9TorYz z6F26kV(%RiP#B{W9Ep{iC^i~9nbf}{dAg{VQwS0ZcH?16D4iqhF^|oaTtc-CMWg}q z#J23gm7vz$=zYf)PDme81!Mk!WsSJfYW zfT9!dKVa;x@y#LE&3--j*7{o^4$U0P!{#=4BagWe2&AWVp@f7K?0G|TZvlUdEA8q` zF8yQZzNBJ!+WuVchrfN~3YZ?2xnCbH*dbpKi3BYIa};CB{SAi-)LPYX3ZP-1_rR{o zuFK|*-{M!2G$0DZB*S5@aB*?b_q=@aO>1)7i zLPKLivtS47%cK!C4^?=<7G%=#RZjHOFR~V{&>e8QN5alO^x<-M%ZWk$QHeukbUbt@ z+SM{XQ$t37|8-D@_1+pg1rJm)$#tPoILba+E5boQD~k&!dow|v&vud5k*q68v?ht> zwa`bxUFP&4wcIx8Rx*U6B7?H1C z#Cd5wdyZ>X^f||{%;D>i4f2p~!-xmh&v6)q3Y&c#d&gKKiMuOZ zFz>bJQN*zzVZoeUd-F`1d+LInU#O~=j6Gd)*Oi!E{(Y%ZDErsD(#8RqCCU$Z3r4=` z_Sw+9B>>CSNL|+PzTN$L%r$| zxulWy(dT=24Zpt6GAlSAnSi#4GBf6-AsfBeASn(bd+o+k7IL8z6t3x z1Vlx&djdFZS_SyXd&fhgLj6)PN)LCQ*FE2R=RX@9E^tgIl`u%jP?f}`&(aRZIF4qN za#sT?m6CNjUYF<3Cu-da%R{!Gf`;jL=6qN`A#vJn>C%6C>BkwO#X|0adU z5|~TaTyhutiJ8(~I^hpm4u~2!ncX=ksZcEMaYCzr-WmNa_bWVg^S5^hgHmtgij#aM z8?yq$FSXAI+m>U{n{Ma(p#AU0-qykzdQ4K$c)y-ruQ2F%sdp(YMD5)e3P7sdVLXN8 z^D=40zdRwi@|D{Z%&Gg$Ktxu)((CBQYZl+;?*q+Rf3OjW`m4?ks@=G|G>UMHt>p4Sy4DroiRRkD}mp zIC|tl#w;sqaYSQ_a{rZ36zBXR^cMEb|6eQ12QqtKHT2Fmd;)k@A|Ru?yLdF;VwtjI zf*Ual9-O%JLBtgy4}lsK!=^~8I-W!Q%0+Md-(b>;JtF$HXvHy0YCl5} z<6<8F<|FzYI$2fRn@Gn2hWGbMl7Zm5vSE>1oloGI9f0R&0SxawOTo!$c{~dE?MVQ^ zoj|#~6}Z>v@28(Tb+@RQ4}AsH065*@TYv1WKYcfuBn*ahrL@@a1Jus%XyxW;QLZXN z&=CBHo;H;&n*5hLFiB#;eJeSYpSnKHU!v~EKWYM1JwD~FCVO1wH+)Jr3kn|itmz5a z3JNFx(>(+4CCG^ZLeSEybL&rSmS6bNdW@6bByX^(sW^W%tk377m3?&$38obM8qdKn zatWY)kabtra0%i-s%8LYRXmW|&EA`C%UaKW6{O??bilX9fPf95VPJ{km>v8S?1#9( zG%%)dAfNg(X4$5|f`^&_@pkiiZ+#2@6MMhrjn#4PRF@>CwZuR-Xd71zKY~O8*aZ>M z>oxeE+?4EjV+>DG@JS{zM3#Q>JNuNx_uly>N&(bFgd9N+{=6!9-o621v3H-LE7QN- z-B}r|u!jzS3!h?G=RcVxi!^!weSB1eE#}03d6LOX=VGyvHDdsV%66cmAwbegz$j}D zIA82wFC+oRxK!iblX!Ge#s>i_h8dFaZ+l+>Bi9g!XcL1&DBxp(IA2E&up~e`z@{7P z8wf4XZqdhn6NSk4R@rtELDBVR!rQz&HW3j6P$lw#oVMBth743O>q+Jxu1wge!Q#z& zMKAsCRqJQU4F~r;D~`90fh&J64(T=r`b!Nzapn8_rIfKi(a#I(E6R5lJzmO@euXXe zu=If=*5gsKM!MR#xlhoe9vI#S_*{#@$A|jUx>JG!8R8WdOkpYyAt6a%^8DVoBAcAg zWKf0@HCzvPpr;IHpcU=z*K=m;wK+wSgzo5<8`pV0^?TJn6*wv3e~y}MFav%hi-0pX z@&mM^#{AH3XuVm|#y~MkwV4G4qzTo)D7HLyFzY%I-Qdv$tcq-fA6PKi4=+DO#GC?! znFBWr#6#6H1qFp=U)yT~_?}xo`2jU?cmRTyru>32@KtwX6crG07HS3h{C(K<$iO2& zOb&(@&SppiNuSzx3Gwl1!Nk_uBFWM*Hx+;v+&1-b7!2Toc3c zDVwv$YBobGaH)gUtiWA=U69 zky!Rl*j|lQGuB&(CAg4JnB)QAGR_3?Pl41_2az|8jk1=LlcTr6`Qgn)^!f;thviBY zO@~9-AT<8dZ`>pcgcIf_BImJr?=X1JVrE5B&;zC8*Fb4N0}RwRjn(Y&OSFJcrXUmo ziQ~-nZZSUv1CT1`X{qMlG$tLB>Dx;I0J-v6qG8?fRFLD=DWN`*KWvgv=N?TO7>THz z%836xcLgxb$*kG=5p6Keu?kB|IRZ83r6>2fYCroq`GFX9gNEV1yLk}1G}3`UhH^fw z_jR%QVC&P5-nfc4JlwjtUguVP2MAqli#%m0nqr=>1cZZty%7J;KnV8HfJ?nxL42|~&1$KZ9H93m*JcL1XnZAVq$^=z}4p6AKX`qTY^C&Z` z`5wy;c&MXME3*=>e7u1*%xfS-wk9h-A_At|3YNG8)NiO}%1kO1ql|Y~1}d_i7`QqG zy`go!2_v7A0oEJH+3`0DA^R7~(bw{5*!ZT}6@TJW39JgQh5Q}^EMZn)!!xY&ef399 z_tWbeO;4ABgf3}B#4I+Vf${bW!&ekqaS68LKT&k|ASO6%1R|XCXAh@95q|sSZ2$<-1KEtBKT3Ja(w?6g^LnyX>eW@7sJ{lBRPRGM z-o%IkR>mjNE8kDkYgIpywvu3rm^{J7#A{)qfgW`iYNh4j@W85>tQ96fs9XXDLCa^J zup!``q+i!$@-v_{_+G?gBy0oR%2MaBHU?BOB9X97GPw&DKl_swn_CUw%rhyG)Yf^? zyYL6U3Nr0xWv}hvlhWn65X0u8qv3ZYV$T7x&8boxTO3}duiIz7FrUVeoq@il|{u%@4 z)q7-n%MNsR_6aS_xqc)9Y*IL7PePL)mWe%3Uu>Y01H!~FaBy8K)3GdVtkq8eXGk5; zB({t-tnn@3b3!4gZWDDIHi#RLA-C<-6#SBJOKN+MpdsnqM=U8eHsuOW1sVG`r%zhP z(!mtG0HE^S@|1t?n@>h?+CE4B9y*yp=QGbpBO)V*as>c}f)x@9^^!lIwZ6uHP3`Ra zs9@pu;nNK&9MMk+Hj;mGX-hWvS(Y)o!?cDa-HTmYG4=q7E`9#YW_>yK>NLVZssdhzY4+ z0m4(YG#<8SM}z$YK#wG!jE6Pdz+Yi92{MzxmV%5SRNUarkG_|tQ5Kqf50P&-k;hlP z5xoSsWTQt+{5{P$xKYROfoDL~J=qlcY3B*%SmUbdyd7$6_A^bnAc`1Tn29EI(uq6* z?dorzo|=7Vf)L%D#f|-{nF)U;0#0LmmpDg=LxOE8O5g|t>QXeMMv8X%-%H1hDI?Sw zDj@K+k`%ZHi%m+hfV+v5j_ygr!%vRKpd3<)vR9v##q^B~{kpV0*LuInfhGaE6S-5{ zmZH4Svwo4@^-QJY-fdW=6%L-F$Xpb!QHRw%+*k$jaKR;{&@?EGD4VH`D!Zy91ao0q zvs-8f9uES?q!5hjmfqGMPP=(4)HDuDyQ+K=D|*@v`hBV3qT;FeQW)Yb91fIViykni z{$j$cp4Jo!Idk|?^GtW}3@~ed#mU18t(s{KT!YiV92mcR%|HXL8l?G>`LN06GoNV{ zTTueIm`AV_elre$Umj+mjWA@Iy<_58&*D1-0(Wj}D9bs?<`}b9LN!82O+r@#nn#2B z!j=MWB#Cmav?3m$A?4gBn|nKWeIEzfFJdz2b+T)Z$-8(3bUaRfKFn1N?LFclt9k8x z1=LPXZ^*ERMXtd?;AxTqHAU$MYmg_QH*pGSQ^>P6me5-)0^20E)$?uc}}=G@u9HkcE|me6qoTD zMY<4x`4qm0gRn6A(mWe{qk!dO=(K@4mB0}#=jc8BlaQ%3i9=@{&VgIxz7m-XOb8)@ zM1~_L;En~NRP0S7Mu z0gHvh;}uu+Vj+Sao*1OYfi%@z61h8TL2-Rkz0k8iX}3(Ww`qeWYKSkfESSbtfu}{> zR1=kgTSx&8$FY>Qv7|1j11{l>d>mm&B?8CA7a!xG%p#b4Bf2d^RpxwpnzRMqc%tjfuM=b>EQ;i)mWX^v#c1EdU$G@ zv{$(dU`J!c6DXSVKlp68V%yB9*kUUKWG!^3@}FM;h{W)~O#_>U0=?*J&Je06l*q$E z`EQ*hhNV}wU@dN>aKo80HZ~rhBB52XP>Jv+APMr(p1Xn0wq3LVH6JD3CVc$Oxs5ff znr|MWbTcKv3inH}5bjPGF@sD|%@D&Rw`odTx{A}feviPD9)JO7Qb|3toHI!s`6pw9OAk|5Gt$ZWpCf>a$- zeOcok`|8{$sdIyO^99OfZKMUTE;ynb)(faXn&DdrUi>LjzF`32TLb{a({$1(C%s}qCNg50uCgA2muDNw^oBR2eVr_}fd(T;@4OE8wl=f^w2KAwPKK4yxNGtE~c zc{EZKk5<+=?G))91;1wpx^w8(p@In)-{l7_2=S{p?NurR4Fdi(7m$=Q*@KEJzc;-0 z&mvi@kY2Jnj0MFS}D@gQaN_l7mH1nAt-;BB@ z(;OQ_36@91M+;U!=9UG}u-7!`VaPv$1Ps4(Fv<&&-3Q=HzX-x)z$O>8n0hoOTkbqV zBMLIzKc)Sj495aXf6q~4Bsh)Ki~V_}*1LIjcBDG~21jD8&AlC^ugv1GE|dOJX$F z3337cZnZ!Us5^p$^&>tZLh$>yK+J2406vo>>9)MOt#PLoG#=JI?GRuAqNPtn(X}HQ z$O|UEmRf$Qg0PhvGhbhNcSgs; z)(>Je=s!PtBeLg3i!8tz2x+df{+p?J<6@e#Ha{R9Q#a{~x=!1#g)h@(J9( zf5VCCWJ7ahUdxVDAcH<0RtU8y7W9{NtIbmDaJ@rE(TgsecY(UoWBu!jHx$^e?LaA! z%@Z`Sf-o;Mk`G@Q&@;J{S>lq~(Ccl|WOP3iyL}Bv6y}388mluM)Sq3T$G~>;rXeVq zc;Fcd!J0O}N1z(w0I*I5pb9tv{&nsUFVyUlaioIffcj< z(HI&UI_An{j{+6m)i-6AkRh#v`dbkTB%qrb05uJ;i|h)o!5Q3zhH-&PV`Q!` z9%>CyBm~Q%76lsPK`3lz5m;^$6c_({9PADxH~~;ffBBtjsISMH2!-rID)xc4&|_=y z!^*(}VC3=|SYaqKjR!r%VWCi(4c=DaYV_K&ARqe$#FmC_s5NUIq5A3%zMDyvCg>CC z2!LYgHP9WS4liw(&jg|-6p*KIU9t;6lqmNs3L4gSeGj@8_o??lz54iPWKYv`+bxqgg=}ZM~dOy zkKZy1&CxZDni8^(Wa!z8#b^)(6B_4udNA6Zapla>#EyFcG{Qz*Vqzp3WA`z0p8EFh zsNA${@cjnl&#{e44nJ+IAFkgHnBOJuW#ee^`;)MupZ`w-Qmx4hYVy)vB&C8)f&T}$ zc$zBP-5rBG!yC>U91Go&wJr-`l)ds#Y}1&Mn=fvoD3f{aY2d5#?G0BED&S?pKm+V! zU>l{EH{=o1W^>DU66L^yT2~ch6Y*TZ?sA`#*AcRaDC(*^nZIP(dfk~R4G*5wj5ULW zgQo`4)4n5}MDA`Suvv&;Aj8D;F4g#FS!O4&;nsw&frz^1K92N!7E3aa)HmJuL|cREK1ZYM8`CjI5dR z$&75Q*t>vJfR$GSr(;cuRtmi==z+9CCjOKv|2(Hc$JtYZv}GBS(W2#uDHxd<&-R8E=o&Y{7gClz)SdTaqh7$x=iQNxFaS zF7;p?r32j-jaWKK_uCP6Ov#lTy~4ja{XIN=B7b--gE-xv-}UJaxD`D62FafvIL+s9 zzKUqX%Z=lj;7ipXs}>F@Pk!T2wi#-pHbUg}Z(bRQT_1?iR;fn*_2)v<40`ov?a^PN z3c3XU^Lh!SD37(|()-mKfJn>>dSS`n{9OxQg=c+599QY6fdT=OC1aZ#OWJdNa8nq~ zxY!hoyv|5N^B%{UQztVHl&QB>D)Hy3a=>^6-<~P8>osqR=c{6q$~-Wqk`VSTH7vEPO0qzxxn`v}-|Ace-U2K>UjvPEuz31BgqM5dLQg9kV2BnJi zof1U$%(J_znU0Mj+KT!mJ z3mgpQ+Nm1=X`T;~q_m_}q5sA|=o%cgwozD?#HPxERKvA;reYmy%Pf_NL z2i{)B{@u7P>9!7ftybz?4gcG?zm#SjQes_?+DPKPmpqGkQ;A{$S@)t2EP2P>tl9F2g4bVjBcmVi(j2`M>G zKH+r+7Sw~wP(=}P+X(?DL=K43IB<8^>TfWSJOTu4QXs{Y0q_Cc-MS6?Wk4Oi<=z8^ zNgL=Fz8aS4zZw!`NH%+DtH%ylv126z_1Q8624*Bu!`E8`A2j$h4x*JJ{7YIwU$N{0 z^)o@Odx_yU)F#J(4zm;U^7)q3z5U169EQpn4brO4{_eS z0Qco_K^Py*q*VuSk^xj6mbqa7b|&NyKQ|#$)aar;2ODD(1IWd3P$F^*uYY0NqtwqLI0w*bh6uMOZDwQ#^fQ1IY(y?*_ARiGth3eOVEzo#H0 z69M@xvYnls0dO^GXDnmVH`u1_RJEhT;l{)lH(UmF1&fgaMnu$yReC;JV2f7dfJJyI z(T8>2VNi7&PCI%|8qP5E_irK;+}x_7XEHwtc^pQEWN(^7gy7|hvAj2XueZvB63<`(HT2-%mobkxEaKmTe4#wZ6p&QfOtKNTh=ZGnL15z@LH6w3@*LF42GJ_egyWT= z+&Jw9?@8^8nyvbu%?ZFgTRsns*a6jm-5_HXs^k0p&KWd(dy13Ij%oihxEZUBwAyag zugrQv70oTgA51QM_{QVn&z`&v@zGg6Wi-F*_J{qgX}u#}A)UEd9$`=#zW^@qiRnw> zP0BUg*#Ma>N;*0zK{b}Pr{H?{-aGAczkgG(uqZ%PL||xWb~O_xN%RVss_o6ehB0ow zK3e>hPmEgzk~8ql3HxS!?ALO3B?VTo)=rU!0&|-LvWnl0i*x@uF*ed9>z|J(Oiv71 zCqt#{->;I2Z)yli3k@NuaA%&;XGbyjeE#Rn6yT)ZZMusS-7K2{GGyZkCZPR@4crya zXf+0s6GV+*=baKjLv;t3Q1D6Tx%0+&#y3vsScV8NxJMM+V)UW=5g8`3Fv%mg*+ASf z$6oNn`I8zBOMUs1dhSP?`Og?9Yh2<$gQqkM_QttVm>eL4=m+HDuo~x$GK>r`x(c!- zlkFhPx3s@2MqAv4Uj)*7_yB;K9LJf%}|o4Bhp^^XXhSPsE@ z6y;L+Xrb&RI-gyKujRc+j;6Z^JQ(LfGy!{cV30N&=-8elN+lqftg;v7-PI?kwIf7x zpMBZjx?>0xX4Zn)upOo#y#q4?Qv6>7LL)C^I#Tw!o=1RoVBiLnOy8Yf`$OQj?abhd zlejuIn$Ewa6G}!&!`&Z_)}HRe6+F20=IvjP0C<-KAJTZ=q`M;Q!ZRQTAV$LN`xC8| z1f$6lgxcehcRt~hrzn!f0C)cR8NHpOFdG6pxFxLYD(1!WK3MrFktv^65J-cD!@xpJ z4CYqiBr#}J$Pjt$Kd*M(`Q#if3?mP4E?EaR6i1bf8vky6s~N)XacITJ=i6uo2+>7O zQrB#SkA9mCjD88g#8@`n4`2}Y^Z5dB{Xo5!$40FG97ynRqtAv%%&;ke@zIYSkm7?}g%(D0C(O=Ac$B=h9t@ysGuUVy zkPfsFA^wh=jJxy-&=%$0A=Mwog^n}8taDh9q$aqi7N=Jxl}`iB5~LzcHIy|gtY`sU zRM}~8$1ede>CzxTz$}9^BY30EqDlc0A^~ZBN}(o?0J-5j#{(i==U8FaT#z9(Csj1e z#Q52hCaAaMONj;2N2d^R;pMhxb$y_0q)0#|kl`SmNUcbnjV+)obPXBgL3AJk^ou)+ zYT`PT2$X2s1pa}Z7wL1yFWE&hE?9;N^!|Gn6>@CYj7$~@cFla7H_0CeqXa!*L15pi z-3#*sfhCIjG`OtZ7p(_4igY1g_@`UIs{JsG1ETmOz+iqdsNf4spH;y??Ml>N1h-{^)}I)Jp$0Go@v#VM zb1E=)(!kwOl97=KC$#cHBh0~62ihHjO#mRP;sJzVy3@0G?Ja)=-TEEZe29VD2qgw9 z%%3o&8+aj4z_NaS^n_fe4is5mHPlhe7()WYr%C!JrLwI7?}EM=_gz3oSv~W`0-GbT zsD8I|iX>fV&kJ-3KPhOCKU^5Qn z2&8s?e{(wi*y@)60VvSP-rJi=b;YVX=dyx?FnwT{&N7YG1!?b!Yv!1 zC<4m_3^0|Ou0pkg2?{FefDPwz5JwPxK!ixD$toBZ(`eF$Yzgi!U<5ZtzPCZEy`t|C z(A>L$5{MleX@o(~Qvg{T%c>HUYvaR3Q3R?d@{xlwJ{wS)kI6>8d){EujkCe#kEZD% z!v37aNHP-ovlS?$`d2pf7K$so?=tZc?6|eqQ1QNcIGBMQ!zX?D@RC8J&TW*C;2(M1 ze^8{t;;$fPC+D* zC!oO=pVcq`XQ39%ZYu%f+cymN2Beug0rmh170yy_l>2pI5PDcJ*hY*Mo>>O6cluifQq{v)ELm(rLkgm`4JO3 zpcC=Y022I3$uXd*!sP%Am!$sAckk*kgxWBD@JzvUR80(jG(ACj)+Kv`_f=n@S_|Cr zio--dd@adhLSSO(L8-%kX#_QtR=uwzTu&>plwL-ocSmRJ?L}IDXW1!r6`Ier;jaSQHBE?IgjWuz zV9inZCM1#j;Q8cpRB{&|f{`D^FMg1@t>srjF~I0hHi!w?z#a3DAGe47{{8!9bs!pU z7dVDxx8*?5IwcjA_z~L2u)Fr5)sf#`KZrC3pp#9%@z&!+TFc=)$jY3Yt`%m0LaN09 zASMiyrrAY6#jiU2&?^Plq*+9Rs;W~6c^?F47E1*43!PCCXr3T8FxH5^Iy^84-v{(6 zU3(*A2Dnz_NdOChNtc`;rP}NTn)I?GGZ>fI!cxqV>B-wQgEYT{`K)a`;2Yf^0O{7j z_W1s1j6_J>huBaqw;y*Z=Y-6s?gbwsBA#`9=aKtIQkbyVTboHOJPW=^L@YH06k6Zk zA{A;^f10$Eie;d6Q;CE@Kuz^jxpM9M8J*MF+$8ncU=B;4}H}G-{s{Ok8Mym z-+}#z1MENQeK*BduuS>BWYmz2s+=7l&Vg=`VD}>;jHe z3d9`yt1;24ed$J(u5_4oPvPEZgc5(@>br9j9ya><&~l2~@Ld!cyX6EMdljd_7H z+x)LV8I@SHC)WKo zgD^ails+h7c$(<|>H;!AY&w21BpTFg6Xl}{Cx3sS+g7^@#Fqr+wSdbTTwgFcX5f$mSV6M&J)xktHkxsPUIPByspo%*Jw()@_K71!Ri(bH0F`V^Fm1y?@zdY`I4Q=65Ji z?Y~a$N|2Cw*sUJaN|=jKB=z_RKg8pnYoJdixMEu|QwAUMk3(O3uKhW9g%QI;X%mR! z1`clnrySIasfdRW(n8=${{aCoO+ID-Shle*h1OAB({PZ4(k}yMnvhj7=9(Y^)3`sC z9}^#&HX)|_7Q$^fVYoj5CpUg&6#%_^mXrs`h|@fR5t1_W6!ka)*Oe zm1-qvK?Li&HRPYFuX<)H*t_?`O_;#K^vj zp`oLc!i}3@5XOA?FkR0-hFqoSt6b{=&~ET0>9}y(Uw+j&s_|%lqw%#3X>Ht)s{5@; zIX_BU?K%6db@J^9lN&Z&w3>km@xbqd{Z-|# zZ~qgEQP@|Pt%7Ilchwd>w$Q>xc~MAyQT;+BO+|lyHwr#*SF$+rS;mXEWRYC2h&m(K zYh2KiKZ8hQ8x`K(Wp2LhAj#oifP)9yL0qpiU8B(#4ak}o3g)`#uRM0c_Q{0-}2ky-nV3v~0M(@r@ept>(4qf0o zoM=8bM`q%!@#E(Jn70OKLA1d70@1$M8}ECaWe}o?pG~^{(FY+J;+v_3 zWCjt4!XXzT9)d@zQECz+r^Bnr5cTH4O~TKL;)BSOz^Si{N&@GqC?;&3MFuVDVB{XB zswpd|qzWO!c=U)4prF{$Bu=S~I~?f;pBay5xIa_*FM(t%4EO4s{TT}`(dC(+ti_>& zC^3LAzI0c+VgB0?Vs1YJcK-Nxo@39ofaIuwWps>4l%c8yEnFe^?BWGF4VlE@e7nY4 zOQ`|*H>GP2;kbJP2>EFR`!pB=(Xe9yYKF3&p6}q0q~TM=ZW-`!+5DoBex*nEO!{FY z=VL9YdU!W}bL4fvlLMpnwsDfzWnq5jXNkdqX(vvy4%87w3-b1fD-8l!%UheV8@VFepQ#E{+!>MP~djQ1o#9% zyMd4K&g;LJtch(Y?++C$n(`aFK$fKO00Ec=lf6^x65A2stK2^bWeWsp`~PkBh2RCC z13{c*hYp7AK!3(@wXhKo!gqr^3l>((>36mJzhuaqDE3(^DmH=sz+13J9pqLp76z(xt1+LJ-1OvG$X+6jV$dk9l0E{Hiy)-I1&>Va zw%LQIu{*~`tD0T~-PsTc>at$)3d)Q9$1&AICqXaXB zO9Pb&Kw3b0wWveT#e1@vTR6WR(XzXaCNFi;wUGRiMT_(bDv`jU!DqTgX>+?gH}&L^ z?}}z5ZxO(w0!f|{nkLY1=o>d+HPa2^F-kTnk*6-NM0T+|k{;;H@?2RHM&w^A zWYeF6!n(JDRbh2s57I%#3ljrl2FJ^Y`r3KiyfzX*?)zS82kW&!jJW|!CrpDM-P!^% z9l+Yufx$S@7yf75Q#4vPeh7{p!SIuj@sCAU7DQED z&4GfFLy0jNlXLm4)6;@=a{YVIclc;wR@rZ4{yA;g!o;UQRjUEq99i%96X)9J6@L{~6}fdXG^(!Veirt`WfVk- z0d^}tdfos?ZJ*3;ZJ1F5kg4k@W|io@8Xr-KQNQ4Nq=F=FqZf+UGx5$t*_!#SUXOWj zTOHKU_SM#GjQu~>W19t7H`mdC;+kvgwh7Ty?Td(qXI!>Z(GWqm*)|yyH@!@Gg0|?G z_k8%qf%_^Wi#-$TY<=ILIvdZ{J(#VuVjO|WY#Ie}eA+e6vOz{)T~GXKzgGs&_a#jX zeK9_RK7ZyA0V8&$qiL>W|BGNc@Rz&5)zx^VjS2sEQ4gU-b;%T`T`$T8%8|BbQUfAa zL_}mB)FDQDp6qor9-Z+HlUQC$Gu-DMLP(L!lAKPsyugVV=ti*>WyAscXNT&9R0tv0ocV~ zDUj0_5M3v}h944;(=RrE7aSbL?{U}xI?^(FZfB&cUD||kbc|oGnnM3J@aViH7Au-# zm1iHITUixB4;q0*F(`5K$wf{EL`a(_oA|ppIx?M$!qQy17UwHvFGY?QV@hqH_}P$5 zzt9yMWzh24P4#k2>pwEGGXgTI+L|HhQbf<4+N#)@Fi6M zU<0__w+wpq+KJ^h6pZ5>PIHROG~gJeEdpD<{x-A%bx@~VLWHlENjy!>Wc8^z%x9z^VpZA&VGo01{RXqETP5NKQ< z6d#tpE#U_rZA%7z=IW(t7x|a_nt^Cf`!8eqde=sfFBWV7GpMGtOY*$3Z~j7JrDbLEei0gK(m&ca72>|t)Yri>g<^X5NjE@yl zp>RimFT1HEtA%!dit{t!Kh-#p&8~q&q+{xLe(eIbUx3rZ&FKYR+TPzh`~Z|mFDo^Y z#k8XWUzRKx1@$t!5`dp;t;KnWuJ`Tw)dgb0YkCmQK;b52=YBvBZ*>Y@LWpk+R61lr z%+1;p|C4$GEo{KlO@ui7kCFo)uqgt>@xO}k#?O%F7~Ox)GKVL4b8P-sp4pfHeHoQ( z#WV25*5K!z3j77vf4iPvf#9n**|64;ZmbtnM^n7=S-*|dJ5To7k2`~Pq^CT#jPzlL zzDy?33gitNCm^X?vv>WcD5(k!Qe6|OYd}K+_a4#(qn{Gs<&XNcr6Jh>>yYH-9j1W0 zqD>N>jNt&OR|5XAZNfBq?mvo&3t6&mnId9HbVBe%*Vg_$F!{&DoL4Ir8iydRvvZy# zd>?d9*v(5AA;tSI7PAinM`Qm+8JT4fW;7 zQQ$nKo@+yV6%pXcTstvIl-i?37L79f;{DCbSG$`*{#VOt~5tk*6BaWM0UcU-JuISeWys;W`Dk0QYR&ygAvgTbBI}u&q zEIUBH&iGqf2Iv=f-Qtx7`F?p>E~K@a+2#f#!0fUmgXhE-KwSTeb|9w>`VGNqq^VcDe(@e8I>^-p z!lz%3>OBdyEQ{{OW$s=N{7J#^L}sz?SoiSU zQD}F*oALfo4pU+6lvWPE@{snF!)^EkH+Gzk)yw=CQKT@Kj7*4fp0;pe#S4n_DOU}^ zhcX6BTlgi&zOspMW5-24bzkUGq17q~*=$J?)s6BCL`$3y;iZo)j7`zH#M%Go9%_M^ z%n^JSZ&2^ilL9lQxPi8nC^O^TCB1InI-~{T4q95p^de=qqLO{Db4o9{?ysg(W2K$* z=6cW!5R(cb+*ALP`0ZZq&de_S&eT0TCy)p~gm(X`_U7MZ16$Bmy7Z7s{AVk@A?0h} zF?fID!o#7hlzsG98S_v~1>9eS;JldcNDwu>*bW`cQxa8^lMN~H>XutMG-mFM6D+h6 zEc)RoBFgep?5#HFh{j9z%y4j^n-2+?MF06I?!5p3Q%a41d4Yc@!H8`~V;oZFuRkMn#0U~^CCpz($RyZEOrl&?l7h#lY0p zrwY*LVML_CphCclN5Og@!6gibs^A0v@WU-c8vQ`{yFKc&qO+9Gq2Ksyps=uD)ta?6 z%548}EwhDdfM;(x4Q&RrDh9dfONL`JrV`_`%P!`Nz~}o3w^4gKsvKgv_2*kZzIjOd z3CDfMPgymA*GnKdIk{+U8HYkDSs@KwXX2pwYYag+m5zmq3Z++DnMGQF+|%;)*P>_d zN#rlI)k~ax?L%ITR5`3X>NuBjeb%R!lbrjsZ7-L)?Zqr!^=r^#r$17hzp9ePLc^F~ zquUVb@QrRRw_WY!pdYJsnSMxsvGG`uDf{Wml|qrH(&cM?`8o~tdD>q!YuYa82+JJy zFjWG@MNqM&l>L<>vNdxt#pQ_#?n@~28_6^RX^{eH;j0r$`C>c-(n7H3;Q)f!1A-a- zLq31+uc(CJP}Q?<-DX!k)pymn7M>P(55krkD+?B%Akl_aqnWW zG`qeYB70dNyc^v)=zPv>-aDUI$UwyJ8nUuSJ$qC#eVfHwXD;Z7Sb$XQ6*wW z_v5p)La#lh(XR%)k2nh7dy9IkBt3|3l==BJzsU9oZZJ#h9y!%r&cy+>*dD#taQs1J zqM0v8tIR^{HR>wNe?8!>SQi=JH!m_6q1#^*K*l_jOn8boyrumXrm02ah0^D?&vPv0 z+lUHOL!CD4vrq^0Q%QYt3jD(&Yq&e6R%a(WtF%BqH=@c@^YO)B^Wv;!yZTKLDR__H zQ4!F-RO0uCj5GW!b2Au3rI~*MN9{r1dG1nn4wJz9ZTgVkUNS1SksQ4_9h`}@q>CNS$wJM*M8B#v)S9?MpHe3RKf%e1<%KY&Y$Pmm;v#N>b;j*E|n5$~5V~VMdy6LvRw-W>Jiw#tyNRd#& zHyrxO*el=Qu=Gn`c9GTZ^tUqOT$(NAJCA7eH=tv6hV}d4>R5q;2Bb5Z1GJ~&bl!FH zT6zjO$gNcky_M(KE){j{#*&(NB(@8{2-`<1efEY+-h0(3nq zOd?Z|F8BkeoHTQULTiaxYVSXKl24!8X83jwFUmd;-WLNrKL(6Y#5awkv9U*92z@~b z#w%qmO>50c>De6!{}8zrJg{%&Z`fbOfTR#l4o(}7CZY7Tx@=1TU8%afr}1|dz$<IB~eArX7^4~YAXA%qyr!hGCMxo4WrgR&+++<6`Lc-fNZuT*&KOt~;ALbiZZE=~^! z=4Ima^0)YlAHR*F5`Q+bTJ>_aq_EiAIy}6;UWs>z3CKhJ@_D?VWrSYPX|?rM=VMqh zMZ~z7jlSv8;j14d2E2kx2bObLk}V4P&L&Yh)Ae4WDMI1h*+VTK>#` z?X`z4waENMlTxSFL#mv_LcNX_otXPw8zVuE6yvFSgYM(UDdBXosO8cPZSaA62D4q& z787MC?5qa!59fQL9{Y{+5lS<@^|X;ZxPlx zSU=S&k3r08D9$w|;Bx92Lil8Olxiwi^*n=adzpaIp2&--UXg?aQhD*WMl=|^;HQ9E z)_&+*6hPRepgkzq!lCQgFHx{t5V&KvNaCJzPh=l$;`&TzipW(T~wct4!Z zkk960ccWgxwFs8y@I#5T7G+s&zTG(aLJcnIP#LwZ}@M z;of7-KW~pw=4NLS_}kRC=u`FhcZT+IQNOxQ+W?V#+l%Xn$_`I7>@T*4CGx#JS_yGN zAr=e69CIx!)ON0Umy==9)Y5XBoElxFDPg2g_wz`j&5QBV`(Ai{9z;fD1qvkLkZ>^H zwa{QRL&9OP!}t=nYB!+C#u6MC7l(?1WNKyCjDkg{pKUS5@CSkl^IsY|7(WT^u@=?W0=(8`qS!!dfkUu zJ^zr*3Gur|l05fZ=P&+AkwxZD5lv?FCznMj*W2kX!O`X33RdNf!}yl7z~bHZqTFq$ zqj-4YCu;DoHD z;d@w_wI<7%ZF+w^&YDX;TYX1Yd@CXVSimpcV>6aAbGUa=N1Hr}eV>?5BsZ-0N4X2N zUdz6-l%j^|WLOL=lA-t!=qJNfX41eKDV!1-(u`qo-?g*Su0c%Ea#B)p8MeBV&`A?8 zQ0V_m+^_aOv*R0%1?<+mRd0euYRjoglHL9cDjaUjQ`X)GS8c3JDM@Q5G>>&(K?(S?570v4x98;Qllz zuNudYHIaqWrAlWVGF@ShgwwD0nqb66#9LP;<|$=~ad$x2lOPfiZvy-mdLl!FH6@(f;Th;Y?&7yTRcR>#OlGG@3f0?)JOTBd6okKn&un%>xOV8pY&hzc8nb#@m!0`O5$u$XAo}cHdUp~ueL43`d2HnrN2AOaG#jSsN8}TGvr6yQ1?i-eh6?=I3Z)k0TT1U5vY_ov*R&qIdr|P2}ZJ- zxU!E0v9Kg$pZ{dgWhXwx74k+jHCDLX^e=unD;R#L|nK5?aUcYT->8$py18ujVY^ z?9;_tdIu!db2#@{UmcRQo>Imp&JBn1R$WeeadSV_-^p=XUAphZc5YVFqrq-2s3+E# zJ!iJBvpiLZrdei*T0I@Bscy1WaBh+ICz)C>_g9s>l1gioMLH_x%w%Y;P#mxrok=oNK5#Qc;k&`_vpRZTPVkUi+$`eCO-2;4hzDJIUJW zL3C?)?DONzLmo_kNKwouvY8iCB?Q9?N$G+A?KpLC{+Cld1CXrEJB@$qS`!&)z+1Li z{xNuZ`r_gh7oTrC+f3ferYd!sc3;j-N8jx{y5DE zZhXY_dY$`9qQy$|N@Ylu=MHMvi-rV7JtAvvU^Xs2ENxD>#ORCd-$}wv$M1K^O0s)GzDoGG0)rJrC)>Q zd-MH)Zrx`1z7NOLm3YMqM4JV6%9%aJU99~dIpyZ;l+z8W=`qC6sN5~ZkyV-4Z`ils z-PLX8bJ)VX;Bj6KICY@4spVELHfP18KG)S*oT+blp`D93&z0cit+BV?$qvBcb3~VU z=^_D9_vJ6FIj0DRd~LqkAAJ&lqlrgpn|+83VRRAX;Slq)KRmZC8FVw6E0xOL(d_Pp zGwkk(03c18{}41<3wr%|cv6a^B)G<)Q`3l?>*;z4hk230Zk>wiL|9#f`+(fLPzvi; zV~BQeSs5X#K~atZ^_H1jYH)E2Rn|K%#Ywqw<*rXirt?dLC-`FC1zlP!_vOq5Cx(8| z^>p;p|D^6~K7J7OfZgUia2b=yDM|XB<+F6jV}b99YL`*MHb_71Ud`_wRNs2#WHpAJG-Ca1DRtvVg(Lk|jm+=@ z=xzQ+mwPKpx!(LUq7elJc`!mshF_R=5?}DI@qVvUG8O0H!tpFWe$4HN520n9d8%J4 za-MKo46rEY>Sz!bc&Fa&atlGJ!Zd_@G#(>$<~6v7LZ2c>AjI`Qw;LyJj2<#%^d$Zo zy+1T8+_ zlHTO%^%!Hd21%!6qG7V}G;nv`Zx+Hc>`pE1&i}wV&}zmU*xBA@ahA@Auh7x77*XvV zrJ}z8Rxd4jGL6LnHI`8m?&On{-lrE0E0b9oUS+G_We^?qH+J3kP8koh=64Z874x}^rkuBlzIWa82tqUjnE^DD;DQ24te!+b%-G$2d zn)0pudONKmLv+-KeP-)u>uw>pt3-TBpr=N7LL}mg0YwN13cc})&Gm|K@)sWUDrl;( zZ+Kh5%Fg)1w$VA84*Sgl>pwKfC6P78pGtX1Yz6amtKOR+7th1XS(QZ1$9%`obg!p_ zZvx$Ff9Pqc+c~FZZl)I%BiBJ=NOGm_+*9#jX*cFzeOaxPg_&nRTz*3v6=k*0oott}DJJJJ#=wq|ct8L9sX!8XRp5=7IV(?Km z)}NLjb}CW*bjeP8wr9%p$$Rsci^Z4Iu^*!=Mj7Uls-u->KBp%N@S*~7l$z4nAd)_H zC)%2>lc@frqD)fb?Eh$)D=!Y`IQ!$cyrgut{ZEMm8SKHmc$sD{QZitR-V`|~{>xmU zg1EpN848Mk_TWIma(#0RaJ5v0>ba}kPZH^#Z`JX6>GzT8MR(xJVaD$0e!7%smkQ40 zt=#&ZF+4!?d_XK`JlInMdvIaaU!tloX6gOs^Tn5j)&kVjUx?)n4tsfF`a*5I-0?2D zC$f70RS5g>NJder77FrdV7Of5?IG;!y2gj1v9K7;-4Bl=HicNCNeNogA)?1;A7F1q zjxASY^l-^%r%I{&Ni%TLBi?zq*j@%U4-wLpAqmRI?|iZnLAQ^>LugclpS!ReVtDw#mVcDC^s|Gn6-Zk?2MalI-`HM2UZCTm*m>2%2Y9$HosIjk;#i_%t=-kIA*C~#D0!I<%$$9_K= z^%C~ti`|YNoof`sGer|h!Il+iyZ+DpEhFI%zz!H|^UzK-l(SVh4t*t_U_$+9FYKB)p!y$ga=u^Mazj>5HFLAxk`s) z72&xCh<3T+7^vW|@aNU^O)v7EZSU{zJ3Y;&BF`r^0eDxXyhFR%4Mp3*bdTc@qWl2Q zgN<4L0Z|JekI+~dHdhd|hNF5<#YuktV%SxMuW6DHsTr8?cFF~Rtv^*jqMqT|;Mw^X zmjq>>o!woL$*xe64PFz;Pl!QWo4VFzr^*DEM{(ZMn2HfO0jG*z6h&e2CV9i?IS!%k zPEGX+0ha!*sjjLxkvozNFCihJXJqWJEE)YhxW7WC#CCoAZ9I>8SRNg9aZmEl6IY|R zds$f9g&2_J#MF6c|1CLngV$*{!H5qfq*SS7AcWhS`*9WJVZ4NdY12+ls}IE`4B6%v z+V^renj-w$zt`#Emc1BxqJRZ^Vca#kqFypXT|E| zqwVF|q=sE5II-V&I+P@%sd$>GJ`v6|YfJaN)U#!}BZ0c6Gd$F?@`GcpjfK{vc)2pY zTol};$KJ|Mv-w_a_3~crYc3{7Qv|zPN3*<#&)vQu$8c_>xWxK~M!0l78yC2C8e_(1 zb3yV7+(Gp72^q3!;(;E3)|F{f2Rs7SZs;=zC(}?oe5}DU0Lt+GRlh2G#J4aEv2p$rZHI+kUx2}~ zdfoL+0aFQ!Vk+d1CquW6T#E988O2rmDA!)4R zXG})t2Wwm%37Z}>X5IBpbT2+_MaRaP1grWXJU2$cWlFZljjj~3@p{vlTc#U{BQx;T zqH$Xw{;4+=Ral}Q06K=P0i;w$UiA@loaOYKKBcAXsS|vi_f5>uH zWKG}kaNcCEkhG*Rf3V1hmt z)^qV6=U6Sfz%c0WyK7viKR!u3%Re1@0N5$dgX5f>7AV%Af4X()LhMxL{OmmupKAW= z^o4K+5QE5|?=OWC#V6DlzkX1^BcMz-2MZ)LXDzd7KkDLuLo|(LP!EISe@$X}I9=qv z#S8PbJeDEwv4V~09FTSlljIqXW?`!_*F~riGwraq_X#_YgYtVlfiLtk> z(0`Fne%8BtfWhUhP5871DMo6zF#|2G*lJQ_zAH|NcyVbhc!@cJT8XsW_KKqTwRNc_ zdEv3Rr_muSjeFsLF^QDBwknv%^|fLRF`KE>aL&-_{8ZB4gUE}h{&fh@Ez-FzjeoJc z09@Y{ynRF2pdmjo9}qhTzC7GWLNqO%rX>@9X$r77vEUUJ7s`S_0o^(uEutrg1m}Y1 zzt})@^*GnoCq%^&-T7-O4H>H4|}bh-4|NOB?(=b2RQ=T>qg{ew4WUw`hCz zaNbu;0DKB<+_%xs)LvkVe`1+e=qRa0Vg6pZM)+R-y+NUJ!4HigM6V;dSTIXE_qD|J z_72wvadTty1CMYN*lgLz+I6taR1Gjpg(s&+8pDKnU12qFwUQ_`;#e zYcI@#W2ivGj6yON57Q^Y68XgsQPKRToDw5bDW3O6CTJy15}bHdbE-|klM4;sT7*|9 zxaVfp>mV7POw+5Z<%EtOc-$XDIN+;idPBg#1Qh9;BoFDojbt>C>mQOEU&BDc^6J8q z&wU>jLsZ%L(wQqTE)I8dst%2rSsnn(%@uG#8vqLd5MTCjt-n-B2v=WUJPtWU?ZmBi zcZ)-1C`xLG9%N%k=?KZy$n)PmEnj};e}?|~4?}e+`X{|{cnU18FuTOB5E&p z7to}z^RhH4p>QU#(wZ#EU&nyT^LRU+&x24(?O3Om`jxeA12!O3B%-sPgB$EI)8&$+ zHqZc4^rs-95GFZ-e%`FXrOd2_l$x4~$K~~qPKCa(!sF6%alRUl*UB%aZw~<5m+MpL8<$qr zcOx8o6FBAT`qfwpQCF9F7X)}M`Wt_AK1a0Cmc|`%5vFSaACCz9p4yN_x*fhsm~g<|Lq&0JPp;2KsH9M5u-SP@XIW=(7>^{lrT11L$Ke$e%jyGCUfw$%eJnMo*y948M;N$fWR`JSu_Ymd9-NZ}ICv;y)VO>$?%Z zDwHc2;zQL%hR#e4Anw{WiFj;Br68vnhP1ccM83Z{KrDeyq=YRspF{EMxvpiGAtvm zBu0v0DK4fF!PGce`)C{PbFskz74~j~HJEE77WQlGIp9E}v(=?IvrUGh8(2)2UB%vD zz!4nfiRV0_J07FnlzuTIKfF|6HTKN2{@kA5QM#>mA=q$+zF}T_WNXsg zLF;<4UR^k;xH;AI;{muNci3Btlh&JA4HJys+UBqUS*37hSFJM3cYt3#9VZ?j(6wxE z<2CJYbxH)24PJNH&ZP1?q0`3|JU3ZK3R_>=vPHKAT(v}bEL=&4?aE?Tl4${iLRKkd+3BmfojrOEZ8(nE@o|@#kl^(59{_RkfcN^3Yj4xdx{{HsfKfN<5M-}OtG!BZLt~n#g25CW+PE$EO z*S6)lUbukLQ$WJYS)M5jric0*b)s+bhvXAfk`EUae+Q)dR*iR+K-LjU)hl~7#=9Uc zIh$3N-Yjc1>y8}38m%@3+>VFK7JkcPLP8eTm#^mPI0}K@^~wj0n974AKKk<~=a#ND z4-0vk+c zv3B}1zW^`_AwJM{y8h%>{uD$Y{#=w5In=KAXLS71-`*i?1exM>{_2+gx%2UO%4c$* zLPXLlbG{UNAQ-{K)chkB%0tPdJ6c*fG1>m$PYB`|eG_u;UtZP~x1g$l1K%9fEL|cE zS=HTQq}5F86*H6oHL`DS}OLGhuZ>s<~lO-^xq(b zff|_M1qL3hzrPfISOf?dWd>RWiU!p3blEg2Aw+%_rJ@(!^Sx;k#(&i05N|O(2ss;3gUIwh z4cN~B-iS^Jph8cZM#~rYP#|6 zVAWBz)SKfWld3|l92PEdIZO9Ol1tHYAtl|Dh57k_PRF*7#tB;nOkS8;C_O#NPmqj) zgFM1PE>pePHVY>y6hvL~0;Y6l4xyn?4vwmAY z8oF=jB=3G(;;Z4$e*rVdEQmBe#Pl1h@o31=Cu8(yGwqzQv`Uo;-2Qzc4a4{-^G&h- z5Xo8e^P^r8Y$XuBtFQm&0l-ZScOXo1+$1#dNl&_Bq=3J&c@9VgPt|&(nfE^N*m>y{ zhdMCdqaf5ft8+51IQR0H#vZ_NvUs-|C*A8= zURGn)69p_9Ui=T?V<|XP1duaN5K^-L5Q+lax3Eh5+XHC^f*J?ig8#U+8)J?U3*?O= zEgy9R`8tS+eGWwV$J_4cvgZA#>iQtwHd%t~arVxRaP%J71VKYi*|Ap)obA0;&owpc z)--DmGVf+rZr3&!`VVr9H3mPwGU5puJwe~#4FTr1sSslTIQ8c_`fgA*3dANNAQU~X zeSxCe5l_sxh+qnz*xzsnzvzzmlIU`?J$VlygHkC*k;8sAkD$c#@*X`G^U24J923hQ zrAm4S)f3M8{)b5;v_mGglSPk#x;-Bzg?_-q>_@9>OXsp_{8 z%Fq3-&5y^5N9n2dZd+=eSRlx~+k^K|`{OOd9#F8 z+q>WB@dj)u3|rrX;iFNVjWZ8vrkD2~&~rU#8j}npOvhIKMDg}};TcJ~WD+W<5m0KE z%)mim?O=O#!obbTo9kpwTl#8?^ySK!aG-W(SduS0b^q_p6c1QFBFV1hknmH>GqPvz zvf7aLM}AWGD|b`kS8ff;fr7E`++xkQs@ZV{aw2P+SS!!DJ!fbrgrey6YY@4aWkDj_@BLN-Z~-Jr~n%uqsBD3q;aWu=fkva|Q*Ip4Uc z&-eE`p6~G-&mW)TxIcI9_xrle@jB;qooxHH{T7ML-opBJrf}tvMr|)RNI394qGBkFh9{31Dh*>1l+k+*H)fd1k*p$sE-X`RYob;F-VhqT#}unhn3<|+b zQX_UD8(>uaDJFA5ulru+;p)RekTJs7EsIpWcsroJD#XqoE5m zBBFQgtO&VzPR{2WL&pHr8+GJUA4CsiCGlN*bBWgO!xi;kxrd9JZhluL2F1b+inF>=$xMe&rNmWge_O-Ri`=++#aB0KM)T#DCVW8zJ>!csYp623i zxb~{nl&t`a(VC_a{c-FokP|z7dhm#i%oicgojfA3kJFm*fm{ZqG;4L%RA{_ww5%T)6os z+ow2WS)QWcr-N&y>%dXLrbGDe~rydn&XNSai^7 z++@|{Fb@!SUKdBqD-=tOdV+|Nw#@mPtO51|6$5WHWf*l9Z&kH(W)@k|zG%4hD=EBC zuwyQspMgADdj_(+&aBm9R0fb*&5QZ0#{HvF{bJCp!wX8rbxa zn0IhEEC1yU3);lxD%a~FX&i*wp*WWa&E&%clXzb&d{ZrSQwV5fC6ozR-T6#kaz;6E zWGM$y(*jD{p_XEDoRhfRL`JrTvRN#N)c9C>3uBkcACdi{JC`RlZzs1sRT)5hS~cmLx&1hF!XtI{AWHG%FGdPs zOwE!)jhzlc1LNbV5BLbP!=}9T0NXQ&s-crk65_r&mM<%ah;18yh1mJnf96oez*-{7 zItBp|Qq-5{q5rkYEStMInJ?65 zZ){>?ch(py8Ol}_4b}UEoc4X&CaNlN=>fm{Hs#yWdTId+vb5HB>=o#`KFepHVmfa7 zG-W?k*NPH1JEP-l?Jec%tiCYD;g#GF^GJ1AH?RN~>BrJpiX5icmTeU8XuWH(M9&dF zPf~LNn=Yv(&AI0H`1oUs(`IP}!zGU#=$|KYZRgz#WulMd}#gMnG~HBT>UkX1rx zNug<{IpuRRC<-^FTqFH5oj+A%h?9uy10h1iXWUH&I>RvxxG(BBt$T|!F-dRgu_xX3 z4_MPnf52zmEsZn*On!lMU~{qp6Y-mn%k*ap^RIOcb4hU1arpl*znt=zJ^HQd)@w|D z%eHjefCanC?sCPf#;t5<$=&b4oVV+gwuzT=J>|1Pohd0sSYG=^;~J}au9s#GbJns* zoh2dOyw#Uy&=Oq0z9bS+u=p%Qy*-N8yx3Y5S*kgc5m~BW_(wyk*dMH9NV)fGAgSDS z{{oE4p${pZ+YH?TvKxH_JWt5^j@>=mm8QQ`P-IEVjr}!AA>zzwv!L_q0T!*C*a@}f zBj2~_YQm&QUu5VdP!smE9pytKbO5C34~B?gyWE}+;r&%Ga~^mH=mY;uz>6dt0@%!x z_ED)E56$&NeT%J1h1Lcow!XN>BH0gPi@s^-J7KlZ(673>qmL%5%|RZ?5>-ZN+gJSX zox5nFhOZf;^3^m~q6Q6|EQ1n3Hg3A9$9JhZGdg));BJlE8colp3V4asTP1x0$h|~QSfv#VaqXb<5&j{A zQmSR*2k5ufVE8I5f5W2nt;AiMuEYmC_ph)6htZx9$B@LR_k{EZshEDnUD{X>8_kK{AfumPYAKQ^>YL z7N@;zlm>^C3(G=;xZAX=>g?E0C$IZ=dq+cY#0Vd-8YBg@1*N^_!Y8Lt1;FrV92P~I z#3SzqP8fc#DSdCrK3_&&x$xX4_i`93Z+M!g-D6X{@0xGUHMgDUq9yiOKQWbbS0S8n z&6z$tRB)?EHt*bmM?kLG?FKCp$f#E>u7#;f*KK(0w2?>7Df@J>NPBxBuAlsq4Tuw6 zk)F!9c*&W)p2}VB)6fHEU@Pb~Ufr(@NGD)S3UHq$i~T|DQLVy}OUt3LSgGnA)PptHA6sUo<+^4!!|w|^2?!u$*Ag0hZ&|B4l$e8TAjITylm!#W7O%_&$y+Rp=qdL zfd( zS`OFp*NlAg^?s?+v8cZrz%kMR`zpi0bZxhKxD6%n??iyX&2&T6Jn~dM%qZ z1(n=tPRPWmgc7>U6qT6UIWwi`qZUpA=5u%Aec!HB91o}}j>1K9XqnN?D+JN;M@wvO z8dgyp(*nkQ03P!A`#*$_Vn~v&kxJMu0_7**sPv~mDr@2ATbFYv*LL%C_OJ4Q+#hSh zzjpAyJW+;@q!4C>3ml6f1Tuc47i=@n`ZWPl$t^yrD_hY$XLh(SDVFzh)S_i$DP3rw zNl>C5YF;uVsrA1duM3;=_$;1%RXQ8NwSBaxh1~!jN+}xQm+7sc-#{}{PhBg_l7lxQ zH@-GRQtAzFkJ7GhOp21oL4eDYX2X4~`WVT_P%s-uMa zruvB~iML|Wxt2F6laHT&^UYU%<9oz>Wm^BYBr8Uah(-79l0V+$J82KbXd{+A^JS~2 zr&{<`*JL|~<+U%y#TfYKHivu@?d{?nchtz#z)obsUzy0Jw&fGzPW)JWIhLPiIj()X zqTpen8Y`W`l^lpt23B`;d@G-jpS`jCjt~0+G;xqSN{%j=bNtXTbXhNKB}xrVyp(Ee z=?WQSLX0cW{ah>VKgv;2u76R(inD|`toFzhT$E&|@t7PtqM%14la(V6ddpP{IBM2)|?&wtdf7|@6ky}R0-iLT0DZvG>jpZg^%8cxj3UikIi8LilEj)}JgK;)_uVT0*wlrzGWgfJZI?7d$o*dafwUy4#1OPH(PKU5 zaH5K@*mR$fpiFE^qF8r*CM5>v4aTN&;6{1hg?aL3o%5Kv@|B6VniDbk>zlTaN=e_l zqjPf=a(I-@q)RcIo{=nX(D_E(8u=I>dMva~ z2S0p)@43rK6gNDO7!lvaZEEwHA)~=(@m1F)af9l~&ivz&9zeFX$-r zlhWar-tO}|r||yk>dNYlmPkk%?}>CFjc`8tnvg6N{hLk04-~KS(zqwzd2(7vaPfsA zpiRx1V=`C51;HPFm($8H%y@*j2fhEP6itQsP$^$(loGjNAld@#}LZ ze&D>kpSv^Q;4#Gy`XR*^Wd;6vO{_qe!Ov*xbj{?GRK1>WB|iGF-eEwCR>~|KfSzq6 zKdqW_)s(k)G$!ul`UM?(VwP)Io*XYNCi8vD73+MaS{(T}|9G+$%#Uz)+F&wrJ5DuY z8gRf}#*t64=~8IS<0jKWLz^5|-QszjaD+ufQaz8VzDjYZ^LeYE;@4!vIJ4hhA7-;% z0u>}Fa$5-2(UD_WG_=!5+SyO-YHdamH{>3~x#9l~t-+L)+iIW@@Po73> z_U85#FkAg&V+k4s*M0hMpZn&%?{K;I!Qth)U+y{97ez$3hwGloUY$7K*(gtZCRH|( z>xYkQz8FOGe%wDot42e`OlYAQgHU39=jn(|3|Y~ZRV}?yFeD#M+CQCtt5H_Sqi^7{ zK19wK9F?5bUE`+e0={HGy+)cLW;Y~>;2@GL+(oiDeii8@ys5s`?7TTy9`ML@-jwAv zUQ(yOy8Bx5Z8&c+)%z`-_OyB6`L%DRb5mVHn=g1thde~@*d*#GZrwU5A^iJ;ai{=> zna7=;_0oi6X8E@`QbluD7kobpS!gXoXa0Kq#Aw(bRYLA`^%C?q9FYe8ZZ1Ud`z-^z9)pw`#2N9a4UVXjJpC!~S03+I zi<+~_1GbY~9$cEs`^F~b?*5s>;B6h*3=lb7CF)DK`jNydStoD(Oiij4VR);;|7#}g zi`=dJo1y-enppzN)1COKlzfm_xYeFPwT?ewbGu|c25G9o;cuPLtnBmT5a{F^-(V1? zM|+*o;aLGajf)Lc=_|87P5IZMJEh#)6aUrB_qf$Wm!pG`(28bUyJ^b$_5&3BO^Qn2 z@AXEN55=Cxt{=0>dO!Nj2lC*WpDDH|=UJ!T4@F(Bxz)aU{;m3yE7q_%G-T?0^-!5H zvj6@-33of{XsXB1uXDtnmT(pb*SrTwM)iL$kVr%K3uw&}gY>EPC*z{? zC1ZZr@p)9yHlvf2)*>%JmHO>8r1U3+bIEfCH!Wk;H0c-B6RppF(kl+=JYi}4y@uL1 zZt)@c|1Vry;c9g~G3k?>xx*b~z&&b*H?>jn;L%EX0N(fX%u4}e*YX_Ulwc^1k+|zR zrC!(a*H>F|E#j}vMn*|lof^90xpsR8(spnVP1G-(-MBk(CEUBj#~4mpSx)-mQ#;Jh z(_ZqYY9M>v#1QUum%7XEs{$eU2EDy%(S@Vp-*t}G{{HYdBsV)$Q`6~8+t+72M*{}q z#P6g3axh_g5cW2?TW1oj4`#{RYq3AJ4F|8=A&mVsJtZBM`cc)sG}Q zHZ6Z^*!b|w{o;C%%2dvf3p4@|%jn@!XgLmcUR@H`FY`!D8>ulbf-bo#zA(e@3?JFj z3Xyo!vi=wc!8zh5iHV(PZVWpR6R;?m^7xP(kC<=0P%$OLY>|xPF;cvG)DF2Dc%O zXIr z*RZdRBCgKm>UJEdJz3Hk_UJNB!E=>Cu5L+-+@0q1c;uKw&-&eK8znn=x26g4ruir_ zaYie?ggchZ;MnW!5b7V3h1zh+J1W7(iG_aX19&a-FyGP<-0(C){}moWTNbTc9QsG6 z_%s!XzspC7iYUbk`=6Fm{#@I9D)ncQD%@&)M#ANj!z#2wa-00HUXrxk{KTyDn%l=J zT=!;(A1mSZv&+=K!x?Uv#Y#Dze|-LC8HStLjzq&-oYT(%ZRvvG7@GQM$Y?Ay%M`mV zkU)t}%jjI{7_Z4^BBB)%W}HB1(M~7(__j~BVLI#Y8grE| zypYxX$r{!2%!tw7jbzy6G8-$@s(sZj6}XPZr6tpK4KfAzig+r^`P7du8U1Mmk$@1Q zidrBh-Ri}Le>{z(;EbL>l+(W!K( zEh9gSZK2gtsD{fiW`7LMN2|UHEx2O#_TmLPZn{@~ZrA<#;TUI)0W%j#=6c=6a7;#B zL|@0xVYTx(smZh&0&bkhVPC0C)@n$}1nM<5HZrT_5Z%ZBldQABpV3PMCFSxE|BV2W z^SsVo$uI4P`gsIAk=~HE=i`SSk*JJy**sJDbTMrOx+F0;a%n;`Ca$O)<-5Jvp*H#* z&XMbu-orFb5+0Y!q;I=SIkpD7P2%)=Zh1 zi!!WSc~d_K1^#IM6vF%y4s{+L2Lj07_#$>S!5*nHdhbBQR}qYka(@tYzW^MKdgd^k zfztg*T0=W;a=u#+_|-dGY9iV~&dIGCVbOAjDN~7^g|h$`lPrgMY}enGQyTM`(BGQZ z#>MR}bEPh`Y`q+sByX1c8GDS8K6X~oDu*5{*>6ZR_jEbyq{mRCaj3)b>wxmWCWp`N zTpS7X(!Ym?v9W{XrCI4;B;?+lpAbb(3d`YB4G!07$wOCuDE(DDi2BQX){CyPuFAKP z&nd_7Wa0>{iM1bduGv!1c&n|mM2B63VHz?x?0A+*pORiFnpq`Y3j146fx8yw9YTw0 zI6sL$P~j`Iu?S}}u2voWmkK*b>a)+s^`Dd$C8XIOBvzZCYUJ6-DM=C|ydU&{uxc72 zkWPUX+0dAJ+RrhpNtVCgcWEq=cOMPRyDXqPsa6gF@i(w7;!?V-|Uk!u}- z!>X41hZl-I8XBB}Q`Zw&BOmpK&)2_#1g+w&KV5AFZ;%pJ>=DV3&VH3Abhe643mh! z{o;%33oAH(f$v9~#b+tUXLKL^ulA5~wIRJn+HHL7jcvsq6uRQ0K3O_eDOx&p9MBaD z-NC(#wo8M)!DKz2gu1%A-;=J8#(XlAm<&P;np^ z43YV5usV4ZE#LJ&bbQO46}>1A`zCmB;^NPI>-Liooce;(HMGS?m*cvPia(Bkfy`JN zpY5DfK;nn{oyA(v<)aJluO}Y7_t%neFqGgiYj9>9NC8ONxtU7w7mc z1yG&>(7_6~>Q~5A>xUC{_IK`F`qsjdv4HNPL4@T4`~F-$_=+ey0THmTL+V5c(viqH z%6bXaUeH~@)?Ffag(H1&4EPTs_V1X;His2Wu8lABA~O2l&c*)SR{K8S#;V}JKS-^8 z0d{qT`SwAS`T()=*{k=scVC8a5%y%*Kc|ADtpb0DYkZp(Lf?8|$>|X)7P}`XegH`> zgZq#Zdi- z4T*@3dK)79XP2Z>+p7?Wg5=5;ZM8^7oT00_YT_E?3;`Lu@O$htV7&<@8 zyU)mFQ0o8*DfeD6fPGL5JU zMx?Wm{gY7R?;etZ4s2K-o;cNIG+d-z`@EtO80tqN@bWL+bi*h10xWG8u1(Zk0K25t zehPcnoTs@*zQ6Z>(!A1R$O+2AZE-QoJ7~_%&M>qcXJKUL@dbwYMCqL3bvSj7^aHqh zlPVh+cNB+XQ8%7~!2r_TaKmfwqa%NjlPLQUyy%6>5GCqMj4Ozg&CMC^3isby;FXfX z^iH?nfx}=mt$D9Cvqo*}gAa}%gI?(Q9J7;ijxbaLqdBp%9ELZY61jb|tCUv%pSF&S zOF%w07lLBEeZ`SLdZ3z=<5!e`c{FzrPe#u(?j?F*`A54x`;}?E05TDD7F8yhKp%}o zygih8wW^FcLyL%gOYpjiYmX|AkW zUV7G71x75Xr>WO6&O9VVRSI?$#0uHdnRuM6r~7*{NA}clbaZNWPv?+5jTz0VPU`np z_~N(cS&<6bc0NI`oKMKMLMsxYMIPcUl+|mz5IuEoc?>g}-{JubH9z%_CKF{N-EJfg zhWHOe@8Dn&vPrBs_~+fDGudxI^xEzYRh@uYEXNx|UaI8j%X|$Wt_V%(*F}D8eObB_ zCLQ0UpwP5F|3}^8J6zI!$)BVldD@$F|H_R$UA01rCDHLGvjX=w#)J;Xw3cqPn60^s zxl9*dMFg{rW)@mP1IW4eeC;HE0bRl@Z}htyv+GM%8Tut>s+Fm#XNLW0Z@lZ9?0hJM zBvC$=Z#YwD+l`*r74bX^w{$;FPfvG$I6IAUQg$W72 zyAZQ4NY;ocy>VZsSaa{K(qzP|(0%!WQ_l}3zyDsrVR)9J(#U;3rI=&)53(82xRklN zOC3nB?C3m&i4Lz|_C?zrmtqo}_RMm)sy^F(;6it?`_ZJ__!E4lb%q~FiXFftd0xD}fGJ*f|Mz4qZhPTfCKz>EEqMI=ogpKl>|C!$snF#R2s4}L?q|GZ)=%aRO_nzv z|7kCYyik*^f4lN*1ebn=_e zEn~8TW94a9EV)5AJ3CtrlRMOJjkLx@*mK+oft9{(bt znMAlc`K@Xa4zzF?2^}lG_BX{gtwH}h@`alK+joWED;}L%%Hu1HYMC3GqiYRixw@|I z5i}^f|E~-f^cicL9aj|3ir~UD-%7Y5pM!^E6n4eVKD)MHj#yooh2_mudd^&*^k!2S zapS3%9Bzz=?NFgv#ON-&*WZ?RL)c{q&sML@ACH_j0q&`mkK{HQ(<5s7$B2j_Ud>4= zUb~QeT*5_1ZUrfHV$;mJ9+=U=m#8{*d$QRU7eDBiJR+5{nBv_MfH$<19nO?6??-NJ ze%NMF>0SpB)&^A1-M_%3ONZ4OqwZ37+_K@CN4jf{{SoasU$z?-PD1^dn`?IMC#kOZ zVDcAUuDFs1{{FbSdU_hS80-7Q?Vjze0g-+$^jAo*!z^_qE^hx@?-}&@m~F&r!cEov z(*r@v5<2H}0^SbohfI&2l*3J3Ifm=TZtJs{509O=0A9z%A@SJf;E@D)<(d~d3?73) zjt@VWH__;g@Yh5&VPX?j`@#(urb=I~BiOik3C-g3;z;WaT~SZWl%TlE2<7RTcqu7A zB9;drwOe1=1`c}rc7e4FF;6oeMqlpdI5L#_VJ@t8zBT#s^cHCnYr#2ZZ%R$)z+#$R z)@Hk-DJv`MmfD|4C(V+B!Dh|LS1G#6SbEVgC#9vgrzG802{u+{s>wO{PqX;(5i%$w zT;Q8KU3qcxQ(31sI>MxEC+{pOgSoNKr^Sm`u;9c>WteXhfxvC`p}Gism-!*1C%@XL zxwGOANm-tZ_~fb8mHzv^7>{hw)(D5bg|m_I-Nl36JwMT_X%)>+%XldBp?ZZxQ{_#h ztDEC|`R}@(vXQ<^gyFS+>Qdu9iN)!_%O*lgtw9V@teEpj7>=Mpj8h@z^Rtt0>j9hq zweb9X?tc9(D23phlMBQ%AH_N^av~Vvkl`sbt}MINjJ)u$Z+B<<+{=LkbF6{BEl};+j#|UyDV|MiuWlh61{L38)_Y`6eqA}piFLF^88On%A$@Rm`gGdp_l^@ApD-?eK-c6dF&#%cEHylQ*Bw)PI>38qm-IXbiNs`tkdG>uNT`Oz$cO|a;5>OQPc`&t9+V=pA zTlCr$h|5;qM2H1PS#iF}%gb(G@*`5%dP*ts9;a5`%jchHk(po}f&Oj2e&Stx1Sw6oMiw zY8QJ@h=l*(7&9tLYWD8u6=e?F1EjZlJm5PgSHQnxA4)qJ)v*WH74$zaZ?k+21<$_j}8c8!U64R)6(> zv!{UVSzc}(YyF>(!U?@&aEwAGb~WePtNRvTuMm))3_7`tTOkGxBD|3r2T{A2Uv@e7 z=kAN&pT&Uj?Q#*EdIVhh#ne>QFaK}5^m0ccTI!}K=ly%NvR%+pxj(qA-Jb0Fh_ByQ ztWv6Dar0ZW{$n#rO0w9Twd3^^yIMqx#>K_;$@6YC@yChw4^Gsjwt+i&ANl(?GT-=X2S5_!n5wxQ;)}6&f6Z-B{`2Q)Dg*J^v4PWI-h3RHdI(rl>0zJ` zn(4RaJf0V*_QUk=7;Tw){_~xlSB7?a`~L~(ktZ1;QE>K>xQoypmB3=s7(CH0yn_wW zSPgR=X=hH;2l=vdMm=M2WfZn}MZPwrycL{(Zb!KUe?hqT{O&_^r6+zIzvZb=Bst^R z-6LT?I^rqp`3L=-Ug6Uxr|8b<72aWG4uc#N_q#7$yJz9OpAkOWX+xsgt&J7AM_8vW z{Na!Nt0`zN=XL>H_9&GHqld?Y;=I%&MV$T+1yM@{IgU1_`thBj6QQ$eWPd^_!29}A z^Y*2{M>U=4n+`!^l*Om#Z|xEb%hcQMnPGkP3N_M`;kMd0(IrG}zcqiN`2L&@rs;dL z20yqs@to`OJy58j|RUV+#(qdO3iJpp(N)Dz)~K=&qn zmL1?$Wm4&9y7}}J-7({;fTzL^ziEuVJo1hYpxc*GG%RtKc?`&~d{2uhNZ)A;pprP# z*qEV1euTmqRd(55S2hb!#`=%LoH5F8M^vZ(28_Ts+FoWyUFbA(GBx+}Uy(A+J#_Fg zKX>L?(Gqi*j(2=ug6Z=aX)%~~W>o(~?Fdub;Kr4JJaKIOgNz*_zYmzXjlN(Y{wkep zfHVwr*C>jnQL3!iXAbbI2cW+cfOnv`#1)QldVMM^d=1X3b=}RC_>=$SRzNop@ylN1 zcj5XALGCiyk2apgqZC%j!+m@G10$>Y+auuP7diHyIHbT8YA%K;*{}%l7^goBh952tr@g={7k8{Pk1bBZ z)dylc)3bW?9HMt8pFpN%H97%Ylv|y-EM2^7p##Tu zRcmj_$j5x7Ion23NFT1(Jrqs*{&FOYP3+pr6V{fA%#DSWPv$w$1-&C zz737Cx%)w|Y4Ytk3tTrGTKe?wK8;<%8CD>hnXMR1`g=1U%fWeYSf0Edb{Fj_A;TAV zV0pgc@>WNG59-ed_`Rtl?)PtRZ9Kc|;lW|kl`m83wgzP7qO|?{Y7Rt|Optf99~~V2 z>ny2?GzOKFM*xruPJCDVA{B*%fz0~i_?pZ~Db@p?mg9MYGj1|e6Y^&?9Y&1Ng6`Z~ zoqZL39{>ALLkua*r1F6~Hp%%Mng1pcLM`n?@O0W%)$d(Bcp8!zk~V~Br@h#PPh3L6 zJ&;{38ShU^>d}1Dd6|m6gR%&r%MH9C-!=$A8*2djD>4hu@sSZ9h;y-T5)-LsOP`;7qzJ`H(?l9sD)q=)KH>%N7bi>ha4_N9`hI;8G&8tn%S9W9r@Q1 zSFPuV@g9UpN8FOz ztAn4m*C!J1PIZp!-M+|IYw1y&=Am$}!}lM0@Ty50GV)EBwH&OBSltjL*`d=SC8-N- zvT)+vcpF+zq0^P4eBkK?blDbh=zFXUFGh%J={belM6r&!8h7sfSh^XrbaTFLb*`E^ z(P6O4#VG0xL;)p(ADSfnDeQ`QG<6*+izygiMS=CKq;j1!x{)kSeEi_W@S#Q=AxV1F zsnaO#s2h5R(8*OnrUHoq9fm^WlG$qROm~ZH4J#2oO9kN8z0)i+ZgA0g{0BpRpT`EK z$DEq?xZ+C`aT25ny*lo8*^sV9jl;0AV6M{DbG9W*Z2;9H=Xfwwi+ujE%P((cRI zE`Pl1i3lQV>kG*R5Ya=vlEx$!9t`07VK4@sGOb-v62f`5T3wgna0^2-B$9^2{hb&u zMEJ7wFd6u4P(OT%(I~Ofy*d(O_xr^STNeA)(wiF5ty%^>`HBobTA%*SjXHg4L$i)w zgbL`aE~e!eCc_$3_t*O>Lvc z=Xwn2_TPNOdxz_LiR;ShcuM>ajwq-`&h2mspZjN@83eFTKi+7JgMG>n+*@pxON7zB zxQ|RnAoW^J?dg`0-)U(f&Dasjva$g4Xypjs=WwXKdy=)!JMY)H^lTefA$s<~BUkOm z;gcx~d+|44X;i2%G0eW1XapSY7xMbxum!Seq_N)-JSP&L!5wCO{F!ydb1CjHex+^J zLZEOyj`pQS?EU?e|Hdr5J9Wl$d(9kCEOb8ql-uEdlaHK*hC3|8l8bzC7sw4VQKFm9geyAlGVx!kKX@|3E1*N|$ z{MMv>CHr<1>fexOM=`^4pK9=#{k2>sZj-72`R#QVkWhcn>UGl~p@;iFQjtY}DeB}G zEnrpUg?4l^Ktnd!_Tt}*oTsPZR*OqBVm~Ck9}BllXD*m_E9*}KJ`iyQzlB+7JTnO* zsEtUUM`wz)zt946?blakxVY5_o;e==9#qmER1%LXVc<|Dt-TFAw*-`6w08T=u&cjg z9UD(YrnYB2?AZSkQ+l}AW>Xjt$Rw{-(;spk*!9mt(z_0!k48E{92=|td5R?&E@~l1 zyp3@-7k?@@gUG%$DD#MQ8HqyYt6cmUi`xIQa!5P8HmMHEsXAlzwUX3;9abCq|Grvk zk5yW|>&Y-8b^J14{>`-ZnZu>haXXIG3y;4EGtSIw^TXx*ByE^%t=;pF(HOoAU+RWe z82+V}%Kcq-Wr5&Cd~Lg7cNXHAoG*%VtGSFQYsEYZdh<0kCGN~b#s?(`8EzOROEWNG z|3!mm9q8zMQF>B|OeiUQ+mEi6toRf_O{T)<#Ncx^B_M47%)@aMVd)U@;14JU$&-Uw z`@ly!&RveaJ&UrdgoXn=TCNqN#j``C6t8Q>A~FdLSaX&9V-? zE~9JY>HnLh#=9?H*L9n#%-LG*s`lL3=zFV^XNgJ5i5k zX>)R`-B)!+LHjPO7Mv!CWN~KTp*d6n8Pe6EFy+?};OG2Q603a56vxc1c1M&0MZ3p1 zo2!Gt4$B?pa)5k4`xWynTXAeA&<_L&`EWBC?7Uf9!&}s^FtFaBgCH2`-XBlOnRr)J zdFwVLPN<&f8>9*uLgwa%#|Y0kVM#8&^@JN3q29FtBcMx^$m9~u6^%e;-T ziUFOQ%RG15-B)@B#}b1{B3XQ1Chs%A`wK=Xuxkv)(p!IM5OnyHnu1eLbZl7s;0f@7 zR~xMGLx1zJL$39DY)pNE(XzW{@9QZ!tonNlDETv`nH`QWkcDjb>uZU!%>|C;-ch{V zPPm6O#K3wk1bREKd1~;`u&LmABiVe2w-ROiNt$0>JPttDegJgLiiQxOI5f+U%D}+y z!8c(_gpn+8{psINy_pSUJx1E}{gAAPF!J1+?Qb`acYh5dXVLleQHU)~j^(yKo`RUh zb|7~msIEs9>rpkB|8pp_(k_Sy*b(zk9lofNAX3=D80rS}AX3D~sok;-Mu;ku)b{^E z+6bN6eeoJ(3%Krfm_{H-1FAsweBqFM09=L$aB;@HIsh&LC_r53wy!vmv$MS+2W7$6 zm%~|AP(;PJ%rc8OlR#N2FlB)z!4jH=$n`DtPfxH zwEQBz1QEn+ern1R0^o;-USrQ1TbyTotPdB=M~L3^ZRrPu%1i8Ji>rCwcPGKZ)J?-&M9Po^ZT{(gWkSnLY@jbbwa zDe)enU=FEn*cK!ibh2aDJMB{vd}2CkcYXx)G}1NdislhMK_H)~mZFqX$5}MA6%hW& zluY>2i}MO(B{5?D0o&~hGJ>ysxhP<1x^b0AMuWQOzW=v z*Ji!(0K;puACPmR#Pf*vCOQC=WAW@4T*U2c2jhofHa{qQ;31vw4^x(WdWExqe!0iF zPxzBf7eD{P_lx+IZ?7f3hKbKPJ$Jigk}ik;UK@=Mrq6I24%e!(OwW7~$M$7P;LxZc z@NpXiQcVfhMEfuJIA=c?D3t6u-VMplw^~_o2HixMS1AtZOsZ>tp8j*x!;_-Sow*jL z6%0pUy8&=vDB^nkjQ?m0&Juv&dBhF9#?iNY6}RWx$HV6XPoL3(|3@F=jpeDqk9{8g;2kj{p7i2skl6GS z5s@xI2BRoQeOzy~!;a(pTYza!V_=x^zPel`k0QLv0A?vzGHu5O0aEO*P*M>_kQP!= zfrU;Joc8Y9n`=Byf7EXrQ(ygfd|&9Z>Ae9d*f~pAe@6;fX?ETLvlTd`Tla#)WU@Uc z1j7Oe(&ast)2<~}h1!ma9`Fkn`=k*?zRMvlaN&kXiiMdXr>Y6JGdf@_ii%7Bg3O)ylsd zzK(e48eEA7n)0?BJy>E{TQQQG7HCZ3^ruCkf=5f&L8f@A?FNrwxfj2D*etzK6gZfi zwuR%2K>Plc%9cHPdH=?C+g=-W7Pt?J+tn`SvfJUrLZF#dRC~x7h zbe4XJF}QdB)^&Hjv7~%e5}Uf2UZ>jr=bte5|6qqn=T)nYTnr(t@u{+T#(VS7Wj z)d63`ML_uXGu+gyDemm(OJ{w=arQ|4Kz1bp1$nr*h*hL=Uu-V6i3-h(v}{ca-_Fn| zxxe%{X5$}Q{eSR*iIolOBY7N}Bv!s6fgkARHNXS;e0<@NNR#=-tb&o~5DcqL)s){Q z)Mko%TYU}<5L{&eaJZK}o8u?o9x0TpKHfGMzqN!yp8s3i@fa7uw?@&43@GWFb-qOs zkkthxo%uEt5JM|e@E44_9S8z*v@`@@Kc(k4*B0om8;yLykkh0ly|U(xmdgoA{q3wZd2XtjpE}EgqTm%0GD)|4 z;$R8J^A&H{l{oDJ67<6{IJZ1N>BH{cc_B+i za;RUQo+fR7VNpq}6)@x$ct(Ka=T8Qdig+_%2axeVcf{7pu9pH*b;WY}KUkH3U=>Nj zvqP*xwAL2VAke;cmr53{*dA;*30}JLQv4Ju3F#e*?FRM{3X=itfQ*UIW=`FY##jS-Un%NTyQ~o-gX_nV^s)q8W0$+td)fxVith9Wjo2v z5C69ZR3TB2^*G*M%7}2nsgD}>RM18;zB}6q;)lNEJ}I;D zFj%$TQ7YU@2KX5N1)f}G6@?uoczUKt668cP`$HoadK3>KKn9ATz1~YQcw3)Zg-FqO zb9HVG!2N4WYT2c{Gi+Zkr?))SVap_8%Zzo?6G+p@3gP%Efd5~4C^yC&sgEP}tdArq z+YuDln)ztp8F1aR;mPoe^iwA&1Ov<(qALO1KD4`jI&>i<5n(ph3)stAZcd;}ZO&d4 z-&*`>p`EPS8l7{k#Kw5*#6-1Uo>uJ|ZrV`RTgzmm;E}#LVX`3oKi2S`AX3OvpZ-tY@o!_|@e1LLdf{wpRCdUt~$C=k;G zku{YRJbEZ!(Ev!zvHQm1It#QCEZ(6=MjXJj){L`7(;bY0?f3jMV$&54^=JRr-*oy@ zW>UUhX~GLO@Q5Y^P&endYGc>bb83C>5wLOa_w1NJ#w4#ld&zeiH4I4zbrJjFCNSL9 zZaZ3H;_o9S7Z_b<{%tle3`GeP6S5UC!5mRgm+iaR4 ztaQRH&=eWRAA5wm`LY~rpvmG`vq%?@1o_VOEPd;;iP9XMmwE4P;}|cYo{n;owWHBJ zcedn;d5o;x78}`e%oikHo7TO^`R&KX*&tUa^ncL}MI!JysDHzMLCQ?Z3KhIDwxu?J zM*^o)jO+gcL`S?$S!dT$W~v^I%2st+y(5GIZy@mBJ}RiX;=mrffb77Bn{*tzawM&Z zv+KfHw`WHhm_BZ|SlKdZ$P=ph<`PYWS`ms~h8DP+qD#K_=EjY924OG@g98VfYH*Gs7Iv&s=j|jq9S{EYG7YR7onLSF3u!^D zZpiD*{aDp9ju^3dy{#!`R`I;v8$}5eZ?o$$B-ad8i|04rw%c}PB56QKOa__?lHebJ zvG#kf^7_!g+&z)L&SL*d&$*HrW`vnaJgh}sT`Hi6D4W)q3NfB2=6?+i%1<_TA z&u=N|>}rp91`@#*hDHw~i`>ax3-Df1TH((U@_d9#xbq9z-*a;2( z*RkHDeVHaHx{mN?vwk=kZy*}`i;EV^G|C;;UO7psn`b~xF2HHsX#H6{I@I0 z!%Dyajxb37+$-(edaD{vz}{l@FT$uVWRPTd zbeQJu+i4~cS$_BCe}E|aMR=a+lbL4JA_)K9`kl@t6*$)< zMI7(8s^k{C(6`u^QrS6?K~3?i>)c68XKU-wg*@i?kBnEJ{L*)kEU7l9E+b8UmoICr z=IXP9)Ry*lU%iOzk`5#4S zl}{i91A_1Nlq&;Jwf4_^G$kU{MAr=4GNN)8G}Dtavr3I_@!RCj7`y7bcepsrOg%K7 zkQJ-4!4J4$-Ie4tms(BbCuUp7J54Q;(;h5;fqA9RNl(|+G+zFK&|~+z9qu!qX6Iu} zhBY+VvTKWD39b+-7A&pT(G{4VkEdsMtjt>())rtHniO87Uc1g?H{HFc6Mw}nV5^I&K)z_`Ylq&+Ur)lMUrQ{l{B$h=3(O0tLlhWo1NB; zO&*i`lr6?}?P&ui9a@+0|G(0V<|jIz-Hx3xW#228jQ5r=$;1Zg&Na@*n|bamnHL(@ zO`JB6SDwsv{BWz|&$G7?AI>RecCuCfQj-jBPNWLp3C0fuhkrOjSWW0%$yBqp=fkU{ zE=uu^qE&-*)Ba}!BCcq?=_s)9*LDxg`wa~?HP;1(f8Lvon;1-7>AS3DQLq?YWE@oR{19+xfA>1P!-iKiqPbrKWR)XveQ zHwwDxvGuOhF+`4mHvWZ}9YNXlyrZsoe}233&c&Y^7C|;;a-DZq$Ao?saQw)@Q@(l8 zka6JN?DWK-U#WQ|gH|t<>&&lGyvN=9PEj04)<|pplRbaH+m8cKC1=8J8BtgjZ!jsW z_H$Qvn^fj8csZc;LE+99BiC?dZoZ*t+`;^bjTE+&J2OtEl=idNTu!dx>)*G%6Wd(i zUU<1~L~eFziUS>Dj*DnP?Hz_i(T-?D^iX z5_J7jt#R3m`|{JduZb(wQ}~iG@AN~v?(LYxR6F;15Rd8!bDx~HH=Z6Z&LUkBW|2Kv zBqsW@lg_p<-=Ia`BK)2xleT)nBU zTjg5>1^fGmwWGbG==oK@=b!hF83akCnp>!|=*`-Fs&Fxig^lygu#VK{^;QhzY(kyWlVV80=gscaq>W1gx|Jq^}=0 z^H^J}zGE7ukX1&cR=Ub=o}L(P9M+H@P;%p=|51FAbgBixG~&^2#zN;yHB(|HxY?{ zLq&@Nju9OW=J`Z?xuSHWDe%NB3AsX}k0nK)-c1P~kSmn6Y#)43T~OC= z^NDd3r(dXd1c&i(b_7A3nh-S=#~R3L29O=o%k;Zw>OAr3%!jXggq{Tm+Z;M5zNkx@ zaM0c7J<$H`{zq40e~a6QZDij$YzN<|Cf`eD`cVd}rsK+Xs6ubeUhHDnVQ5<-d0cr) z$14`iAJ&&$fJ1dujZW_EHq4#X?nhA)TT_MmCQ$N=<^^9UnR~S zOYxlZV&squrHTh`;(p-gCT_a|HnYxTD05=W7#yJ$X4jP^Z`Y*J0K{2+JJZn&O(o9E zt=&c^vwX6&h`e|`I9=Pm`!~Wd^Vg5K8u4_eVP~G0>;;s-6wH&uUMs|syxvA7oCfoKz9jTNPmtTUi@%q zigDtf%SIn)o0aWvu}WCu(8*7zMmVVzuCjWvkGJ((`XJB$6;|f*x_)NG z{Ikw-{Pb8pTlwlW-I;71H_G5^iA1Cpdp`-DWXy6O&dG6<{~||cC<&R-7zs#+Ergkh zb;WLuGtnha%OaR^P1!n5H>wT#k_miRH!eDzQe;f3dkgzj4bUKaMn3@Ubg zxSmy*VFxh^L_M64ey9fyiRt13ac4q5Ap)E#SRihhU?sTnjDURWkyR zml?6K8N3MCv8)vVr$ng5_l+QVogNm_phzsd=xTS?o%(Ax*mL zr)#Gz~99-%khxO>V)sfokqHS&pG zWM&S!hmaC=Sqdcn2^|VK>}prQVof=MU%a-KS$s}+B;6TA$JLqA!?J8S$S%jPUgTa^ z8$Hi4tcA+iqlX2tLm^G5tcgFHV%h`*n|o5&ETTjOSE0C44S0M8gE_ z9Bu%}#&_)|67D4YXljVp5^KnDI_c z*@}~Tmch9)9C`=8eEgf~vP)R;{lX0~V%+ zp9A~$9R-^>8qk&u19ml$Kchqo=ts4{zExz@1$|ahh<@l`{ZTWoy?gGiEQ+$rhwCGaig+g=YCNVLt#%l>uT^u?}>{PRne(&nz(cL%& z?hFR$k`Uv?Q{2>y{r@LmzO@3@Hq9i?QY{TL*o5nX{`YUhQ78$D=z&;!#Iq(LY z3tTnJf7NrKNpwL@uX(<8X^q@(ubf~QvQ43?MkL`~l;$4RFeW*j*js1%dt7h>MO+-d zxfYE=n&hA;?b~Uvq2Nbi*G~4r8?RCQ@{|~^Se93TW{YLpeIdGclzwLgj*|siu)9nL zi+C1$sh{$uYVWv6=ajWImgM_i7nVSi{n^3S8X{4TnT1xoL7&1k+WtUe;}=~{9qB~V zG^x1$HkZV3^ku~y1_Xnu!h03Gkm9lgA%-Ow^)xi9jxB-{?@q$Y&eYu5GZ~SoN2=#m zJFD~R!m>Z>f(l7=qDY`;e%XwT=TN&s=ICyJdo4{a{AxrG2RS5tIwXBAx2mzhsCFu7 zIA)PX2UWiS_E~xjRLEwxCI{ru=lA-V)6>=_46H@=TP+(r=p3cf-nY+xDK-Py%0*|t z5Q(+R<*(+J&mym!DpjspnwwW1M048)m65Fs2gK~FP9!1;2$I9vjm#^b)$pR%lqv(;*d95!@{>W0mvx^Y(@l zZ@T%157vhci7B9py>lB{+*;8O&CqCr?Jk}Zve~qX*)S=mN%~G0Lz4= znN89xa}-!6p|WMeia9cnWn2;hs+Fe4>l&ZC+p^_>guXHAOLkqmQ}au0R^|muYgOCl zJ8VB^HCgace2|0(4}<*r)=+ZYjuH!R?>kS{lCIJt|Ga8jeb~ksfw5~5Qy#WiQy(}zAFWs*&}Ceb-^^dOs*mBHj-S`(S(;7b6@RA1 zA%dJUiCJoS>`gEM$8*sfPHfLLyfap(#TPS*?Zo=EiwZ>g$SUpW_PTY;*N z78Z_iU+dQPT4p3P?=7x*yK4LFvDD?6vNgApEhutw$=5`9S{3EUG5J5a`n~2&MJXTN zI4->GS>@%t+)_|Q_nGkiI<{fHT>M_g3+8+B*9*Wze_QVG4;a!?{~vo#G%P%5SHT*Og&VtlxQr*8|;tr~Zgk zJb-;S=F1NHtv{S@IH76Rk1Gv?@8R`#KihZ}t6$vKcGGq}l!~UcrB&{LLIjs$iqaHkLMZ^fU79(`iGLs=_y|RV7 zR8*hxnC+tuCKr?>DrJ_~wC*5i>s9nv;lm`?++5_PPMDF)xw_bh{XI7ydrf&*PYB#| zQ0*`nOBH!6IO#al$2XQAu8RA>FT9hVgr`;mq+2%;wsf95MX~9N5Eoq_3@JR-k?vKT z(R`%IJF4RnTwC?_2&jtO2+zG_5UV_=#Go#}gL}E~?8jbR3%hri9wFM4%gb?QcSAYz z>cb|P90t|Z_5fp0`yixFu=$xhe#Idx#>})(!H%}cadVM46T`eLsRv->=kW&zTphTk zS0g(3Mo&{$=jKEzj#_bNQpk3+F7}Vh;(??zDAT3*Y6zP_6MXsw*pmo?G$e7@^l-$o zaSf@njOeY}_|>@2Z(#zZdfH~1>-65N@nC@%5f?=1TE(+qYmC6x$JxZMtF|&ZHp;_X z8iV5#YzVC=`L36M5Kj^*uZn?_z1ejOP)raefaiZ`0ubMKB6IvmUDjJ8f6wLT$+sM^ za+=X&b~SvUv4R*IPNveDSGMP#z9t==&R^z&1Q)3CE|xmnBS( zM_`?5hwauXpBrU)cGZ~vHq%IrC?%MjgaA?>J%5605W39*eftwo{v1}Wn9~qltQE7< zsBnmLZ`yA6?G{H8lAj$Zz>ZW~C>~ld&sOWr3o|xczM{YVf~^YGMFjwN?+R*}xcD^y zhCP*QD)MhHaeIr<0Nm-F}{R- z2u}YUoxTt4p}+z%=(pI(KT%`HlneW)j*VfeN^=sZV1mgd8(kEmysvSEknD$D;k}^+ z@_&ey2z)?K4twf-e81R0Eo^Vt!=@Y^B z&0mS2g>+tb%7C|B&#G78vJO+Dc@s%>Ms(Q=zc_6hg&zXp^NFHm6BKk+qnx^N?rS8q+sjIBFtw1Pgd8B~;R}a63hjshy z*Slg~T30yEmIoO1^F~{7I9c@8eqNkZ1kWYmbKgrZ%}#h~P yC|~G4@EF4gm|}3f8R#v9T}|0NqfH zUQ{2-c28UF{K$1VQJ7-*94s-@VFK^D`=Qx+yV`t~m@}%PlhaHiI=>_3wUE3f=kn6S!gxbW%U~6`kHX=| zZ{(3)@h%Ztc!6YP)XHgQ8m*y)6ssAs{w=>q*(jX({MWxEs7vQ!UR`C^OxGx>yfj7b zzEnyFDzU9lc+GL=Re(^hD7sBf z9FGmN&JP7SnyH(f=v64sAgw;8%4^EO2}90AkN^zpr|P>8Yv(tzzzI~*-YyR8Tc`|V zWv}U%Qn=jiI(5wDMS4+A2g0f4a^ozYEzjGWhWBd_Br1xV(HR?K&#<&#FdeNfD?F&s z&FVe(- zA-O-LqJz36&JVX>?m>wfpF+9Ky7uPjUS+7%!W%}|>+Cmc>bgQvUdLby0P?s~Kw*e+Ju4M0R zIfSq;f1BYuN5*@Lu8}Q>wNiyRup%OuqVQ!g{IGS93A0bF;kJK;?a~&=T&_s3uHTYJ?vn_VmI&SEV2b02@{Ll zt%`QQr%FPwDudwrbY?@(2Z}hMBzbY{*XW`9Ul~o%jOLLuMW|wW)jJ04u52M@>}ljl zfbUoa+$<@hx3KoZLwPg>Px3veAeT9Gev>|E0(FF*FnyY(mG9(1uv6el0^d~&fR}cT zBm*LXGPZ|^$!}NE($P^3f)&lLxu^|}vX$Q~#Ot{C?vDeS#FRC zwe3r5Q%9Us6Js-1E`qvJ*91S48f3g6*zN~YRBu(b>yMA?bCI9&TNUr~=uNOA#Fp>1 zW-EAORzwTUIk%vGYMLbi!i-RT0xCs1I5p6y{1;_FGR1fG(q`ARPJIAvkd&AOtHA&NmABjofpVODl!ppafBdWl-1SpcZX%79p~htxbbJt({wo08ToY zo~A?Vr?W$i>|nXyHXy6y?c;QmD+@{HE%s@hB~B%db#bNw`+|7>tekHWJ!a-CE|6KY zxNZ)r$!AHQ9&OyuBnwz#vAw;1WAxj6CLu*`V{s&{>#H3H+N})F1ZXIDXV_nrQ1!V( zzm0>{jj{kGR(1Datojj^rC5jfs_h~lQqwXH3->IT+-ZoS@qih@1SGx>?Ygn?Fxz}C zLJCjxACbE^Y<(dU{CB(RyiLyVx)Q`hlP=K=Fm7omP}JgG7RF5JNFQM)&Yt?5r z8XO*Pu$JN1zSSqLh6;XqdTN`c{v1_c4DLEh8o}W<9=v-~sCkpWsa>!G@({08Crj&6 zi-)Enhm?6$20(c9gLUS4^(xVqPSY4;Kb4PvHz@|AOw{_cL^B8-^-fCB26q#5U+!9r|INJFYR^M`b}rrOhE3Xats}ThF)Nlx zD~&M#1BV_$2-6I_Ng#k6Z990lU9nfU#1I#7;P2t0t50Z9It&Q&>YH1gY=62g7V5LB z=lQ+nr49eZ7`W_}!F2-71nj{4oM)m?G-uu%A=KX90R~AgX-8|jf!O z4P%(C$rKy3ncRqH6D`PBF8eEcAN(`PPJ`Q}}E`f3|%GBSdV8)9CTobZtc@;Myd57Kx3| zT==UJ6bIROOG);V&814#}ahuPL0Rp+-S1X2%QN+4X2^{En2{0)SY@Isr zAD$hO{{T(VsqV>7XIZ8@MN>6XiUrt4f1dkoKIz9INFQ5><4YXzZQ?wH2frQg1?*Il z1rMbyPVFz&zYj?B;Aq3c*_ypPMo;z00gP4|dhbQXHuEzm!qJ=}xpN0l^!hPjSdX!l z&nuj4|4V8TI~v1y;=|;YRgOcvmhIA4Zfs8D&huqN8Axcw)uGK9Ia%(Vj@9f5_1Rz6B#=^-+#m4SGg!wd@gdW_ z;MsoR-qc4f%|A%0Aiq$_-j(PjL%+4<-P%qH8Tc;;LOg`cek`Qwa`l5cL9B7 zY*lJBdbx!TlxKh*v2b0s!sCr5K23jnh;Ua{kB z6(W4P1wGu0eeN^h*Z{^H=koJgb6I-~{1@w#H?AAA>cjARDR=}vh#5DxP?+5^z2`$% zfb+A|w$$(e1dW*V59iy-l~{?JDPuiiaQ~uavJN|to-+aZwjXF1Ybfr^-QqQwya1tV zH)Ea3hEXJS_ELb%2hLqDdJ1r_pN-dL94!&DJ>n#cQfUvelh|AU-rqHm9el*c zI6^q4-0ztC)bWy;a(76@&ON#rWkGPThDconev!1z{z76UAPum9vrl}(4Py>X*yc%Z zFcnuKCyvcuiu`#Q?c@rpY?AOg6=L9e9%8pm7S|y*l%qg}pMFU#+u*m{%>wg}^4-|< zoj?Zp^gcMNV$j>R{8U=24mXQ+u7kCn?L;y*YOSE|W2fg&k;P~7(9%TKapD(QThOm7 zXX*Ezm$uF~eF*8Xj34e7@&!kXnBiazTa15|?NDr%3|68MkdI0a0Hs_Ikbwx+1bM>~ zsYDm+(l0{U@@q1;I6z|nP$!-%z^R0P9v84-v*hF*{ATNnYTgtf@p`(C9_#q-TksL- zknP;cft94O76MSIexz&g56Y@o2E2rf z!*v-dBAV&>s;#=<>nSzdUnXmo)ik>nmHgt8A752QeaR&R9d9vO$ul%snW;zwT5|Zg zc3p>s&it{=&p-{P4Gv?pu2OFtzk78vjQhkv5LjBCrsq=e**J<}33w0zIxM5Z&|6HL zN|}#S`7wZ1js&cszk8DEtj89EMP?Y+DqZey#x6DNC1nNbGy?fO8T#NuDu8bQJ)(A`4<=X50`}kxRe Date: Thu, 29 Jul 2021 22:42:53 +0000 Subject: [PATCH 085/279] Explain work done in PD CSI in more detail, add statement for the system API --- ...021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md b/content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md index 0dd00f223e..e90bb9ca03 100644 --- a/content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md +++ b/content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md @@ -37,7 +37,7 @@ Before we reached GA we wanted to make sure that our API is simple and consisten CSI Proxy is compatible with all the previous v1betaX releases. The `csi-proxy.exe` binary deployed on Windows nodes still serves requests from v1betaX clients thanks to the autogenerated conversion layer that transforms any versioned client request to a version-agnostic request that the server can process. We added several [integration tests](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/integrationtests) for all the API versions of the API groups that are graduating to v1 to ensure that CSI Proxy is backwards compatible. -We've also considered the scenario of a version drift between CSI Proxy and the CSI Drivers that interact with it and provided a way for CSI Drivers to perform a smooth upgrade to v1, GCE PD CSI Driver can recognize which version of the CSI Proxy binary is running and is able to handle multiple versions of the CSI Proxy binary deployed on the node. +We've also considered the scenario of a version drift between CSI Proxy and the CSI Drivers that interact with it and provided a way for CSI Drivers to handle multiple versions of CSI Proxy for a smooth upgrade to v1. [For example](https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver/pull/738), the GCE PD CSI Driver will use the CSI Proxy client libraries to connect to the v1 API first, if the connection is unsuccessful because the v1 version is not installed it'll connect to the v1beta API. CSI Proxy v1 is already being used by many CSI Drivers, such as the [AWS EBS CSI Driver](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/pull/966), [Azure Disk CSI Driver](https://github.com/kubernetes-sigs/azuredisk-csi-driver/pull/919), [GCE PD CSI Driver](https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver/pull/738) and [SMB CSI Driver](https://github.com/kubernetes-csi/csi-driver-smb/pull/319). @@ -45,7 +45,7 @@ CSI Proxy v1 is already being used by many CSI Drivers, such as the [AWS EBS CSI We're very excited for the future of CSI Proxy. With the upcoming [support for privileged Windows containers](https://github.com/kubernetes/enhancements/issues/1981), we plan to use CSI Proxy as a library in CSI Drivers in addition to the current client/server design. This will allow us to iterate faster on new features because the `csi-proxy.exe` binary will no longer be needed. -API support for the iSCSI protocol is in the alpha stage, we plan to make additional enhancements before graduating it to v1. +Support for the [System API](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/client/api/system/v1alpha1) and the [iSCSI API](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/client/api/iscsi/v1alpha2) is in the alpha stage, we plan to make additional enhancements before graduating them to v1. ## How to get involved? From 0398ce4e27e86f0fe349109f27b8e70088f8231c Mon Sep 17 00:00:00 2001 From: Mauricio Poppe Date: Mon, 2 Aug 2021 19:12:10 +0000 Subject: [PATCH 086/279] Keep some sentences in third person --- ...-windows-support-with-csi-proxy-reaches-ga.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md b/content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md index e90bb9ca03..c322fd4c8c 100644 --- a/content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md +++ b/content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md @@ -23,29 +23,29 @@ A CSI Driver in Kubernetes has two main components: a controller plugin which ru When a workload that uses persistent volumes is scheduled, it'll go through a sequence of steps defined in the [CSI Spec](https://github.com/container-storage-interface/spec/blob/master/spec.md). First, the workload will be scheduled to run on a node. Then the controller component of a CSI Driver will attach the persistent volume to the node. Finally the node component of a CSI Driver will mount the persistent volume on the node. -The node component of a CSI Driver needs to run on Windows nodes to support Windows workloads. Various privileged operations like scanning of disk devices, mounting of file systems, etc. cannot be done from a containerized application running on Windows nodes yet (Windows Host Process is available in kubernetes 1.22 as alpha). However, we can perform these operations through a binary (CSI Proxy) that's pre-installed on the Window nodes. CSI Proxy has a client-server architecture and allows CSI drivers to issue privileged storage operations through a gRPC interface exposed over named pipes created during the startup of CSI Proxy. +The node component of a CSI Driver needs to run on Windows nodes to support Windows workloads. Various privileged operations like scanning of disk devices, mounting of file systems, etc. cannot be done from a containerized application running on Windows nodes yet ([Windows HostProcess containers](https://github.com/kubernetes/enhancements/issues/1981) introduced in Kubernetes 1.22 as alpha enable functionalities that require host access like the operations mentioned before). However, we can perform these operations through a binary (CSI Proxy) that's pre-installed on the Window nodes. CSI Proxy has a client-server architecture and allows CSI drivers to issue privileged storage operations through a gRPC interface exposed over named pipes created during the startup of CSI Proxy. ![CSI Proxy Architecture](/images/blog/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga/csi-proxy.png) ## CSI Proxy reaches GA -Since the introduction of the [CSI Proxy KEP](https://github.com/kubernetes/enhancements/tree/master/keps/sig-windows/1122-windows-csi-support), storage vendors integrated CSI Proxy into their CSI Drivers and provided feedback. We learned about use cases where we needed new APIs, as well as getting bug reports, bug fixes and documentation updates. +The CSI Proxy development team has worked closely with storage vendors, many of whom started integrating CSI Proxy into their CSI Drivers and provided feedback as early as CSI Proxy design proposal. This cooperation uncovered use cases where additional APIs were needed, found bugs, and areas for documentation improvement. -We've updated the [KEP](https://github.com/kubernetes/enhancements/pull/2737) which now reflects the current CSI Proxy architecture and added additional [development documentation](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/DEVELOPMENT.md) for people that want to contribute with new features or bug fixes. +The CSI Proxy design [KEP](https://github.com/kubernetes/enhancements/pull/2737) has been updated to reflect the current CSI Proxy architecture. Additional [development documentation](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/DEVELOPMENT.md) is included for contributors interested in helping with new features or bug fixes. Before we reached GA we wanted to make sure that our API is simple and consistent. We went through an extensive [API review](https://docs.google.com/document/d/1sBP8f_mwV0N_xRRQQGDwHZpU_nTHtpFxdi7LKSUtgX0/edit#heading=h.inwrahdkakje) of the v1beta API groups where we made sure that the CSI Proxy API methods and messages are consistent with the naming conventions defined in the [CSI Spec](https://github.com/container-storage-interface/spec/blob/master/spec.md). As part of this effort we're graduating the [Disk](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/disk_v1.md), [Filesystem](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/filesystem_v1.md), [SMB](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/smb_v1.md) and [Volume](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/volume_v1.md) API groups to v1. -CSI Proxy is compatible with all the previous v1betaX releases. The `csi-proxy.exe` binary deployed on Windows nodes still serves requests from v1betaX clients thanks to the autogenerated conversion layer that transforms any versioned client request to a version-agnostic request that the server can process. We added several [integration tests](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/integrationtests) for all the API versions of the API groups that are graduating to v1 to ensure that CSI Proxy is backwards compatible. +CSI Proxy v1 is compatible with all the previous v1betaX releases. The GA `csi-proxy.exe` binary can handle requests from v1betaX clients thanks to the autogenerated conversion layer that transforms any versioned client request to a version-agnostic request that the server can process. Several [integration tests](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/integrationtests) were added for all the API versions of the API groups that are graduating to v1 to ensure that CSI Proxy is backwards compatible. -We've also considered the scenario of a version drift between CSI Proxy and the CSI Drivers that interact with it and provided a way for CSI Drivers to handle multiple versions of CSI Proxy for a smooth upgrade to v1. [For example](https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver/pull/738), the GCE PD CSI Driver will use the CSI Proxy client libraries to connect to the v1 API first, if the connection is unsuccessful because the v1 version is not installed it'll connect to the v1beta API. +Version drift between CSI Proxy and the CSI Drivers that interact with it was also carefully considered. A [connection fallback mechanism](https://github.com/kubernetes-csi/csi-proxy/pull/124) has been provided for CSI Drivers to handle multiple versions of CSI Proxy for a smooth upgrade to v1. This allows CSI Drivers, like the GCE PD CSI Driver, [to recognize which version of the CSI Proxy binary is running](https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver/pull/738) and handle multiple versions of the CSI Proxy binary deployed on the node. -CSI Proxy v1 is already being used by many CSI Drivers, such as the [AWS EBS CSI Driver](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/pull/966), [Azure Disk CSI Driver](https://github.com/kubernetes-sigs/azuredisk-csi-driver/pull/919), [GCE PD CSI Driver](https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver/pull/738) and [SMB CSI Driver](https://github.com/kubernetes-csi/csi-driver-smb/pull/319). +CSI Proxy v1 is already being used by many CSI Drivers, including the [AWS EBS CSI Driver](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/pull/966), [Azure Disk CSI Driver](https://github.com/kubernetes-sigs/azuredisk-csi-driver/pull/919), [GCE PD CSI Driver](https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver/pull/738), and [SMB CSI Driver](https://github.com/kubernetes-csi/csi-driver-smb/pull/319). ## Future plans -We're very excited for the future of CSI Proxy. With the upcoming [support for privileged Windows containers](https://github.com/kubernetes/enhancements/issues/1981), we plan to use CSI Proxy as a library in CSI Drivers in addition to the current client/server design. This will allow us to iterate faster on new features because the `csi-proxy.exe` binary will no longer be needed. +We're very excited for the future of CSI Proxy. With the upcoming [Windows HostProcess containers](https://github.com/kubernetes/enhancements/issues/1981), we are considering converting the CSI Proxy in to a library consumed by CSI Drivers in addition to the current client/server design. This will allow us to iterate faster on new features because the `csi-proxy.exe` binary will no longer be needed. -Support for the [System API](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/client/api/system/v1alpha1) and the [iSCSI API](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/client/api/iscsi/v1alpha2) is in the alpha stage, we plan to make additional enhancements before graduating them to v1. +Windows system APIs to get additional information from the Windows nodes and support to mount iSCSI targets in Windows nodes are available as alpha APIs in the [System API](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/client/api/system/v1alpha1) and the [iSCSI API](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/client/api/iscsi/v1alpha2), these APIs will continue to be improved before we graduate them to v1. ## How to get involved? From 4bcfded6d862b1ba9a413bbdf4c73bdd843d08c9 Mon Sep 17 00:00:00 2001 From: Mauricio Poppe Date: Mon, 2 Aug 2021 21:20:09 +0000 Subject: [PATCH 087/279] Moved section about alpha APIs to be along the APIs that are reaching v1 --- ...021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md b/content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md index c322fd4c8c..a81595bb3d 100644 --- a/content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md +++ b/content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md @@ -35,6 +35,8 @@ The CSI Proxy design [KEP](https://github.com/kubernetes/enhancements/pull/2737) Before we reached GA we wanted to make sure that our API is simple and consistent. We went through an extensive [API review](https://docs.google.com/document/d/1sBP8f_mwV0N_xRRQQGDwHZpU_nTHtpFxdi7LKSUtgX0/edit#heading=h.inwrahdkakje) of the v1beta API groups where we made sure that the CSI Proxy API methods and messages are consistent with the naming conventions defined in the [CSI Spec](https://github.com/container-storage-interface/spec/blob/master/spec.md). As part of this effort we're graduating the [Disk](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/disk_v1.md), [Filesystem](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/filesystem_v1.md), [SMB](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/smb_v1.md) and [Volume](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/volume_v1.md) API groups to v1. +Windows system APIs to get additional information from the Windows nodes and support to mount iSCSI targets in Windows nodes are available as alpha APIs in the [System API](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/client/api/system/v1alpha1) and the [iSCSI API](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/client/api/iscsi/v1alpha2), these APIs will continue to be improved before we graduate them to v1. + CSI Proxy v1 is compatible with all the previous v1betaX releases. The GA `csi-proxy.exe` binary can handle requests from v1betaX clients thanks to the autogenerated conversion layer that transforms any versioned client request to a version-agnostic request that the server can process. Several [integration tests](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/integrationtests) were added for all the API versions of the API groups that are graduating to v1 to ensure that CSI Proxy is backwards compatible. Version drift between CSI Proxy and the CSI Drivers that interact with it was also carefully considered. A [connection fallback mechanism](https://github.com/kubernetes-csi/csi-proxy/pull/124) has been provided for CSI Drivers to handle multiple versions of CSI Proxy for a smooth upgrade to v1. This allows CSI Drivers, like the GCE PD CSI Driver, [to recognize which version of the CSI Proxy binary is running](https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver/pull/738) and handle multiple versions of the CSI Proxy binary deployed on the node. @@ -45,8 +47,6 @@ CSI Proxy v1 is already being used by many CSI Drivers, including the [AWS EBS C We're very excited for the future of CSI Proxy. With the upcoming [Windows HostProcess containers](https://github.com/kubernetes/enhancements/issues/1981), we are considering converting the CSI Proxy in to a library consumed by CSI Drivers in addition to the current client/server design. This will allow us to iterate faster on new features because the `csi-proxy.exe` binary will no longer be needed. -Windows system APIs to get additional information from the Windows nodes and support to mount iSCSI targets in Windows nodes are available as alpha APIs in the [System API](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/client/api/system/v1alpha1) and the [iSCSI API](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/client/api/iscsi/v1alpha2), these APIs will continue to be improved before we graduate them to v1. - ## How to get involved? This project, like all of Kubernetes, is the result of hard work by many contributors from diverse backgrounds working together. Those interested in getting involved with the design and development of CSI Proxy, or any part of the Kubernetes Storage system, may join the Kubernetes Storage Special Interest Group (SIG). We’re rapidly growing and always welcome new contributors. From 02ebc799d7c60d0b6ec2e84b25ec67f28794b49b Mon Sep 17 00:00:00 2001 From: Mauricio Poppe Date: Thu, 5 Aug 2021 16:16:40 +0000 Subject: [PATCH 088/279] Change publish date to 2021-08-05 --- ...si-windows-support-with-csi-proxy-reaches-ga.md} | 4 ++-- .../csi-proxy.png | Bin 2 files changed, 2 insertions(+), 2 deletions(-) rename content/en/blog/_posts/{2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md => 2021-08-05-csi-windows-support-with-csi-proxy-reaches-ga.md} (99%) rename static/images/blog/{2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga => 2021-08-05-csi-windows-support-with-csi-proxy-reaches-ga}/csi-proxy.png (100%) diff --git a/content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md b/content/en/blog/_posts/2021-08-05-csi-windows-support-with-csi-proxy-reaches-ga.md similarity index 99% rename from content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md rename to content/en/blog/_posts/2021-08-05-csi-windows-support-with-csi-proxy-reaches-ga.md index a81595bb3d..f00ff04060 100644 --- a/content/en/blog/_posts/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga.md +++ b/content/en/blog/_posts/2021-08-05-csi-windows-support-with-csi-proxy-reaches-ga.md @@ -1,7 +1,7 @@ --- layout: blog title: 'Kubernetes 1.22: CSI Windows Support (with CSI Proxy) reaches GA' -date: 2021-07-27 +date: 2021-08-05 slug: csi-windows-support-with-csi-proxy-reaches-ga --- @@ -25,7 +25,7 @@ When a workload that uses persistent volumes is scheduled, it'll go through a se The node component of a CSI Driver needs to run on Windows nodes to support Windows workloads. Various privileged operations like scanning of disk devices, mounting of file systems, etc. cannot be done from a containerized application running on Windows nodes yet ([Windows HostProcess containers](https://github.com/kubernetes/enhancements/issues/1981) introduced in Kubernetes 1.22 as alpha enable functionalities that require host access like the operations mentioned before). However, we can perform these operations through a binary (CSI Proxy) that's pre-installed on the Window nodes. CSI Proxy has a client-server architecture and allows CSI drivers to issue privileged storage operations through a gRPC interface exposed over named pipes created during the startup of CSI Proxy. -![CSI Proxy Architecture](/images/blog/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga/csi-proxy.png) +![CSI Proxy Architecture](/images/blog/2021-08-05-csi-windows-support-with-csi-proxy-reaches-ga/csi-proxy.png) ## CSI Proxy reaches GA diff --git a/static/images/blog/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga/csi-proxy.png b/static/images/blog/2021-08-05-csi-windows-support-with-csi-proxy-reaches-ga/csi-proxy.png similarity index 100% rename from static/images/blog/2021-07-27-csi-windows-support-with-csi-proxy-reaches-ga/csi-proxy.png rename to static/images/blog/2021-08-05-csi-windows-support-with-csi-proxy-reaches-ga/csi-proxy.png From b480f0fb5338dd39388bedcb6a04639eac9ec0d1 Mon Sep 17 00:00:00 2001 From: Elana Hashman Date: Fri, 30 Jul 2021 12:41:33 -0700 Subject: [PATCH 089/279] Note deprecation of the node performance dashboard --- ...1-00-Visualize-Kubelet-Performance-With-Node-Dashboard.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/content/en/blog/_posts/2016-11-00-Visualize-Kubelet-Performance-With-Node-Dashboard.md b/content/en/blog/_posts/2016-11-00-Visualize-Kubelet-Performance-With-Node-Dashboard.md index bdb43b49b9..548c91e7b7 100644 --- a/content/en/blog/_posts/2016-11-00-Visualize-Kubelet-Performance-With-Node-Dashboard.md +++ b/content/en/blog/_posts/2016-11-00-Visualize-Kubelet-Performance-With-Node-Dashboard.md @@ -5,6 +5,11 @@ slug: visualize-kubelet-performance-with-node-dashboard url: /blog/2016/11/Visualize-Kubelet-Performance-With-Node-Dashboard --- +_Since this article was published, the Node Performance Dashboard was retired and is no longer available._ + +_This retirement happened in early 2019, as part of the_ `kubernetes/contrib` +_[repository deprecation](https://github.com/kubernetes-retired/contrib/issues/3007)_. + In Kubernetes 1.4, we introduced a new node performance analysis tool, called the _node performance dashboard_, to visualize and explore the behavior of the Kubelet in much richer details. This new feature will make it easy to understand and improve code performance for Kubelet developers, and lets cluster maintainer set configuration according to provided Service Level Objectives (SLOs). **Background** From f2e2995d2364ee0e067d12db169f63bc5141f833 Mon Sep 17 00:00:00 2001 From: "Renato B. Boaventura" Date: Thu, 5 Aug 2021 15:40:29 -0300 Subject: [PATCH 090/279] fix small grammatical error in operator.md "una falha..." -> "uma falha..." --- content/pt-br/docs/concepts/extend-kubernetes/operator.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/pt-br/docs/concepts/extend-kubernetes/operator.md b/content/pt-br/docs/concepts/extend-kubernetes/operator.md index ba20161490..429e546818 100644 --- a/content/pt-br/docs/concepts/extend-kubernetes/operator.md +++ b/content/pt-br/docs/concepts/extend-kubernetes/operator.md @@ -52,7 +52,7 @@ Algumas das coisas que um operador pode ser usado para automatizar incluem: como esquemas de base de dados ou definições de configuração extra * publicar um *Service* para aplicações que não suportam a APIs do Kubernetes para as descobrir -* simular una falha em todo ou parte do cluster de forma a testar a resiliência +* simular uma falha em todo ou parte do cluster de forma a testar a resiliência * escolher um lider para uma aplicação distribuída sem um processo de eleição de membro interno From 788b9ce1329bb43a09ba54a4b54832840d8debbd Mon Sep 17 00:00:00 2001 From: deepsan Date: Tue, 3 Aug 2021 11:34:24 -0700 Subject: [PATCH 091/279] Reword Go requirement for Aggregated API Given 'Aggregated APIs are subordinate API servers that sit behind the primary API server, which acts as a proxy', the comparison table indicates a requirement for the subordinate API servers to use Go, when it is not a requirement as long as the subordinate API server follows the expected contract --- .../extend-kubernetes/api-extension/custom-resources.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/extend-kubernetes/api-extension/custom-resources.md b/content/en/docs/concepts/extend-kubernetes/api-extension/custom-resources.md index f37a71f278..3d72f279b6 100644 --- a/content/en/docs/concepts/extend-kubernetes/api-extension/custom-resources.md +++ b/content/en/docs/concepts/extend-kubernetes/api-extension/custom-resources.md @@ -167,7 +167,7 @@ CRDs are easier to create than Aggregated APIs. | CRDs | Aggregated API | | --------------------------- | -------------- | -| Do not require programming. Users can choose any language for a CRD controller. | Requires programming in Go and building binary and image. | +| Do not require programming. Users can choose any language for a CRD controller. | Requires programming and building binary and image. | | No additional service to run; CRDs are handled by API server. | An additional service to create and that could fail. | | No ongoing support once the CRD is created. Any bug fixes are picked up as part of normal Kubernetes Master upgrades. | May need to periodically pickup bug fixes from upstream and rebuild and update the Aggregated API server. | | No need to handle multiple versions of your API; for example, when you control the client for this resource, you can upgrade it in sync with the API. | You need to handle multiple versions of your API; for example, when developing an extension to share with the world. | From f39fdce2071569bf8d27c0fdd2f6b5c1480454ca Mon Sep 17 00:00:00 2001 From: Arhell Date: Fri, 6 Aug 2021 03:13:52 +0300 Subject: [PATCH 092/279] [zh] fix typo --- .../docs/concepts/services-networking/topology-aware-hints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/concepts/services-networking/topology-aware-hints.md b/content/zh/docs/concepts/services-networking/topology-aware-hints.md index 63aedfd938..58baaea5cb 100644 --- a/content/zh/docs/concepts/services-networking/topology-aware-hints.md +++ b/content/zh/docs/concepts/services-networking/topology-aware-hints.md @@ -20,7 +20,7 @@ weight: 45 +{{< warning >}} +只使用来源可靠的 kubeconfig 文件。使用特制的 kubeconfig 文件可能会导致恶意代码执行或文件暴露。 +如果必须使用不受信任的 kubeconfig 文件，请首先像检查 shell 脚本一样仔细检查它。 +{{< /warning>}} + -## 一般配置提示 +## 一般配置提示 {#general-configuration-tips} -## “Naked”Pods 与 ReplicaSet，Deployment 和 Jobs +## “Naked” Pods 与 ReplicaSet，Deployment 和 Jobs 其输出应该是 `mykey: bXlkYXRh`，`mydata` 数据是被加密过的，请参阅 - [解密 Secret](/zh/docs/concepts/configuration/secret#decoding-a-secret) + [解密 Secret](/zh/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret) 了解如何完全解码 Secret 内容。 -{{< feature-state for_k8s_version="v1.16" state="beta" >}} +{{< feature-state for_k8s_version="v1.22" state="ga" >}} ## Introduction From 9f305881018f2dfc8a5329f85ddecf66faf889aa Mon Sep 17 00:00:00 2001 From: Mauricio Poppe Date: Fri, 6 Aug 2021 17:14:04 +0000 Subject: [PATCH 098/279] Non-critical updates from feedback --- ...08-05-csi-windows-support-with-csi-proxy-reaches-ga.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/en/blog/_posts/2021-08-05-csi-windows-support-with-csi-proxy-reaches-ga.md b/content/en/blog/_posts/2021-08-05-csi-windows-support-with-csi-proxy-reaches-ga.md index f00ff04060..6c1a65e350 100644 --- a/content/en/blog/_posts/2021-08-05-csi-windows-support-with-csi-proxy-reaches-ga.md +++ b/content/en/blog/_posts/2021-08-05-csi-windows-support-with-csi-proxy-reaches-ga.md @@ -29,13 +29,13 @@ The node component of a CSI Driver needs to run on Windows nodes to support Wind ## CSI Proxy reaches GA -The CSI Proxy development team has worked closely with storage vendors, many of whom started integrating CSI Proxy into their CSI Drivers and provided feedback as early as CSI Proxy design proposal. This cooperation uncovered use cases where additional APIs were needed, found bugs, and areas for documentation improvement. +The CSI Proxy development team has worked closely with storage vendors, many of whom started integrating CSI Proxy into their CSI Drivers and provided feedback as early as CSI Proxy design proposal. This cooperation uncovered use cases where additional APIs were needed, found bugs, and identified areas for documentation improvement. The CSI Proxy design [KEP](https://github.com/kubernetes/enhancements/pull/2737) has been updated to reflect the current CSI Proxy architecture. Additional [development documentation](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/DEVELOPMENT.md) is included for contributors interested in helping with new features or bug fixes. -Before we reached GA we wanted to make sure that our API is simple and consistent. We went through an extensive [API review](https://docs.google.com/document/d/1sBP8f_mwV0N_xRRQQGDwHZpU_nTHtpFxdi7LKSUtgX0/edit#heading=h.inwrahdkakje) of the v1beta API groups where we made sure that the CSI Proxy API methods and messages are consistent with the naming conventions defined in the [CSI Spec](https://github.com/container-storage-interface/spec/blob/master/spec.md). As part of this effort we're graduating the [Disk](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/disk_v1.md), [Filesystem](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/filesystem_v1.md), [SMB](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/smb_v1.md) and [Volume](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/volume_v1.md) API groups to v1. +Before we reached GA we wanted to make sure that our API is simple and consistent. We went through an extensive API review of the v1beta API groups where we made sure that the CSI Proxy API methods and messages are consistent with the naming conventions defined in the [CSI Spec](https://github.com/container-storage-interface/spec/blob/master/spec.md). As part of this effort we're graduating the [Disk](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/disk_v1.md), [Filesystem](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/filesystem_v1.md), [SMB](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/smb_v1.md) and [Volume](https://github.com/kubernetes-csi/csi-proxy/blob/master/docs/apis/volume_v1.md) API groups to v1. -Windows system APIs to get additional information from the Windows nodes and support to mount iSCSI targets in Windows nodes are available as alpha APIs in the [System API](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/client/api/system/v1alpha1) and the [iSCSI API](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/client/api/iscsi/v1alpha2), these APIs will continue to be improved before we graduate them to v1. +Additional Windows system APIs to get information from the Windows nodes and support to mount iSCSI targets in Windows nodes, are available as alpha APIs in the [System API](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/client/api/system/v1alpha1) and the [iSCSI API](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/client/api/iscsi/v1alpha2). These APIs will continue to be improved before we graduate them to v1. CSI Proxy v1 is compatible with all the previous v1betaX releases. The GA `csi-proxy.exe` binary can handle requests from v1betaX clients thanks to the autogenerated conversion layer that transforms any versioned client request to a version-agnostic request that the server can process. Several [integration tests](https://github.com/kubernetes-csi/csi-proxy/tree/v1.0.0/integrationtests) were added for all the API versions of the API groups that are graduating to v1 to ensure that CSI Proxy is backwards compatible. @@ -45,7 +45,7 @@ CSI Proxy v1 is already being used by many CSI Drivers, including the [AWS EBS C ## Future plans -We're very excited for the future of CSI Proxy. With the upcoming [Windows HostProcess containers](https://github.com/kubernetes/enhancements/issues/1981), we are considering converting the CSI Proxy in to a library consumed by CSI Drivers in addition to the current client/server design. This will allow us to iterate faster on new features because the `csi-proxy.exe` binary will no longer be needed. +We're very excited for the future of CSI Proxy. With the upcoming [Windows HostProcess containers](https://github.com/kubernetes/enhancements/issues/1981), we are considering converting the CSI Proxy in to a library consumed by CSI Drivers in addition to the current client/server design. This will allow us to iterate faster on new features because the `csi-proxy.exe` binary will no longer be needed. ## How to get involved? From cb0d216f72d9873c3fb8e21ffafb228d2e7c933f Mon Sep 17 00:00:00 2001 From: Elana Hashman Date: Wed, 21 Jul 2021 09:38:25 -0700 Subject: [PATCH 099/279] Add alpha swap support blog --- .../_posts/2021-08-18-alpha-swap-support.md | 142 ++++++++++++++++++ 1 file changed, 142 insertions(+) create mode 100644 content/en/blog/_posts/2021-08-18-alpha-swap-support.md diff --git a/content/en/blog/_posts/2021-08-18-alpha-swap-support.md b/content/en/blog/_posts/2021-08-18-alpha-swap-support.md new file mode 100644 index 0000000000..b9f5551cc7 --- /dev/null +++ b/content/en/blog/_posts/2021-08-18-alpha-swap-support.md @@ -0,0 +1,142 @@ +--- +layout: blog +title: 'New in Kubernetes v1.22: alpha support for using swap memory' +date: 2021-08-18 +slug: run-nodes-with-swap-alpha +--- + +**Author:** Elana Hashman (Red Hat) + +The 1.22 release introduced alpha support for configuring swap memory usage for +Kubernetes workloads on a per-node basis. + +In prior releases, Kubernetes did not support the use of swap memory on Linux, +as it is difficult to provide guarantees and account for pod memory utilization +when swap is involved. As part of Kubernetes' earlier design, swap support was +considered out of scope, and a kubelet would by default fail to start if swap +was detected on a node. + +However, there are a number of [use cases](https://github.com/kubernetes/enhancements/blob/9d127347773ad19894ca488ee04f1cd3af5774fc/keps/sig-node/2400-node-swap/README.md#user-stories) +that would benefit from Kubernetes nodes supporting swap, including improved +node stability, better support for applications with high memory overhead but +smaller working sets, the use of memory-constrained devices, and memory +flexibility. + +Hence, over the past two releases, [SIG Node](https://github.com/kubernetes/community/tree/master/sig-node#readme) has +been working to gather appropriate use cases and feedback, and propose a design +for adding swap support to nodes in a controlled, predictable manner so that +Kubernetes users can perform testing and provide data to continue building +cluster capabilities on top of swap. The alpha graduation of swap memory +support for nodes is our first milestone towards this goal! + +## How does it work? + +There are a number of possible ways that one could envision swap use on a node. +To keep the scope manageable for this initial implementation, when swap is +already provisioned and available on a node, [we have proposed](https://github.com/kubernetes/enhancements/blob/9d127347773ad19894ca488ee04f1cd3af5774fc/keps/sig-node/2400-node-swap/README.md#proposal) +the kubelet should be able to be configured such that: + +- It can start with swap on. +- It will direct the Container Runtime Interface to allocate zero swap memory + to Kubernetes workloads by default. +- You can configure the kubelet to specify swap utilization for the entire + node. + +Swap configuration on a node is exposed to a cluster admin via the +[`memorySwap` in the KubeletConfiguration](/docs/reference/config-api/kubelet-config.v1beta1/). +As a cluster administrator, you can specify the node's behaviour in the +presence of swap memory by setting `memorySwap.swapBehavior`. + +This is possible through the addition of a `memory_swap_limit_in_bytes` field +to the container runtime interface (CRI). The kubelet's config will control how +much swap memory the kubelet instructs the container runtime to allocate to +each container via the CRI. The container runtime will then write the swap +settings to the container level cgroup. + +## How do I use it? + +On a node where swap memory is already provisioned, Kubernetes use of swap on a +node can be enabled by enabling the `NodeSwap` feature gate on the kubelet, and +disabling the `failSwapOn` [configuration setting](/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) +or the `--fail-swap-on` command line flag. + +You can also optionally configure `memorySwap.swapBehavior` in order to +specify how a node will use swap memory. For example, + +```yaml +memorySwap: + swapBehavior: LimitedSwap +``` + +The available configuration options for `swapBehavior` are: + +- `LimitedSwap` (default): Kubernetes workloads are limited in how much swap + they can use. Workloads on the node not managed by Kubernetes can still swap. +- `UnlimitedSwap`: Kubernetes workloads can use as much swap memory as they + request, up to the system limit. + +If configuration for `memorySwap` is not specified and the feature gate is +enabled, by default the kubelet will apply the same behaviour as the +`LimitedSwap` setting. + +The behaviour of the `LimitedSwap` setting depends if the node is running with +v1 or v2 of control groups (also known as "cgroups"): + +- **cgroups v1:** Kubernetes workloads can use any combination of memory and + swap, up to the pod's memory limit, if set. +- **cgroups v2:** Kubernetes workloads cannot use swap memory. + +### Caveats + +Having swap available on a system reduces predictability. Swap's performance is +worse than regular memory, sometimes by many orders of magnitude, which can +cause unexpected performance regressions. Furthermore, swap changes a system's +behaviour under memory pressure, and applications cannot directly control what +portions of their memory usage are swapped out. Since enabling swap permits +greater memory usage for workloads in Kubernetes that cannot be predictably +accounted for, it also increases the risk of noisy neighbours and unexpected +packing configurations, as the scheduler cannot account for swap memory usage. + +The performance of a node with swap memory enabled depends on the underlying +physical storage. When swap memory is in use, performance will be significantly +worse in an I/O operations per second (IOPS) constrained environment, such as a +cloud VM with I/O throttling, when compared to faster storage mediums like +solid-state drives or NVMe. + +Hence, we do not recommend the use of swap for certain performance-constrained +workloads or environments. Cluster administrators and developers should +benchmark their nodes and applications before using swap in production +scenarios, and [we need your help](#how-do-i-get-involved) with that! + +## Looking ahead + +The Kubernetes 1.22 release introduces alpha support for swap memory on nodes, +and we will continue to work towards beta graduation in the 1.23 release. This +will include: + +* Adding support for controlling swap consumption at the Pod level via cgroups. + * This will include the ability to set a system-reserved quantity of swap + from what kubelet detects on the host. +* Determining a set of metrics for node QoS in order to evaluate the + performance and stability of nodes with and without swap enabled. +* Collecting feedback from test user cases. + * We will consider introducing new configuration modes for swap, such as a + node-wide swap limit for workloads. + +## How can I learn more? + +You can review the current [documentation](https://kubernetes.io/docs/concepts/architecture/nodes/#swap-memory) +on the Kubernetes website. + +For more information, and to assist with testing and provide feedback, please +see [KEP-2400](https://github.com/kubernetes/enhancements/issues/2400) and its +[design proposal](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/2400-node-swap/README.md). + +## How do I get involved? + +Your feedback is always welcome! SIG Node [meets regularly](https://github.com/kubernetes/community/tree/master/sig-node#meetings) +and [can be reached](https://github.com/kubernetes/community/tree/master/sig-node#contact) +via [Slack](https://slack.k8s.io/) (channel **#sig-node**), or the SIG's +[mailing list](https://groups.google.com/forum/#!forum/kubernetes-sig-node). +Feel free to reach out to me, Elana Hashman (**@ehashman** on Slack and GitHub) +if you'd like to help. From bbb3ba317afc08108845f868c2a68c3153beeeda Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Sat, 7 Aug 2021 10:31:55 +0800 Subject: [PATCH 100/279] Drop left over pod-priority-preemption page When attempting to keep the localized sites well synced to the English upstream, some files were found MOVED. It is difficult to detect such changes. This PR removes a file that were localized twice. --- .../configuration/pod-priority-preemption.md | 729 ------------------ 1 file changed, 729 deletions(-) delete mode 100644 content/zh/docs/concepts/configuration/pod-priority-preemption.md diff --git a/content/zh/docs/concepts/configuration/pod-priority-preemption.md b/content/zh/docs/concepts/configuration/pod-priority-preemption.md deleted file mode 100644 index 4af00bd2f1..0000000000 --- a/content/zh/docs/concepts/configuration/pod-priority-preemption.md +++ /dev/null @@ -1,729 +0,0 @@ ---- -title: Pod 优先级与抢占 -content_type: concept -weight: 70 ---- - - - - -{{< feature-state for_k8s_version="v1.14" state="stable" >}} - - -[Pods](/zh/docs/concepts/workloads/pods/) 可以有*优先级（Priority）*。 -优先级体现的是当前 Pod 与其他 Pod 相比的重要程度。如果 Pod 无法被调度，则 -调度器会尝试抢占（逐出）低优先级的 Pod，从而使得悬决的 Pod 可被调度。 - - - - -{{< warning >}} -在一个并非所有用户都可信任的集群中，一个有恶意的用户可能创建优先级最高的 -Pod，从而导致其他 Pod 被逐出或者无法调度。 -管理员可以使用 ResourceQuota 来避免用户创建高优先级的 Pod。 - -参考[限制默认使用的优先级类](/zh/docs/concepts/policy/resource-quotas/#limit-priority-class-consumption-by-default) -以了解更多细节。 -{{< /warning >}} - - -## 如何使用优先级和抢占 - -要使用优先级和抢占特性： - -1. 添加一个或多个 [PriorityClasses](#priorityclass) 对象 - -1. 创建 Pod 时设置其 [`priorityClassName`](#pod-priority) 为所添加的 PriorityClass 之一。 - 当然你也不必一定要直接创建 Pod；通常你会在一个集合对象（如 Deployment）的 Pod - 模板中添加 `priorityClassName`。 - -关于这些步骤的详细信息，请继续阅读。 - - -{{< note >}} -Kubernetes 发行时已经带有两个 PriorityClasses：`system-cluster-critical` 和 `system-node-critical`。 -这些优先级类是公共的，用来 -[确保关键组件总是能够先被调度](/zh/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/). -{{< /note >}} - - -## 如何禁用抢占 {#how-to-disable-preemption} - - -{{< caution >}} -关键 Pod 依赖调度器抢占机制以在集群资源压力较大时得到调度。 -因此，不建议禁用抢占。 -{{< /caution >}} - - -{{< note >}} -在 Kubernetes 1.15 及之后版本中，如果特性门控 `NonPreemptingPriority` 被启用， -则 PriorityClass 对象可以选择设置 `preemptionPolicy: Never`。 -这样就会避免属于该 PriorityClass 的 Pod 抢占其他 Pod。 -{{< /note >}} - - -抢占能力是通过 `kube-scheduler` 的标志 `disablePreemption` -来控制的，该标志默认为 `false`。 -如果你在了解上述提示的前提下仍希望禁用抢占，可以将 `disablePreemption` -设置为`true`。 - -这一选项只能通过组件配置来设置，无法通过命令行选项这种较老的形式设置。 -下面是禁用抢占的组件配置示例： - -```yaml -apiVersion: kubescheduler.config.k8s.io/v1alpha1 -kind: KubeSchedulerConfiguration -algorithmSource: - provider: DefaultProvider - -... - -disablePreemption: true -``` - -## PriorityClass - - -PriorityClass 是一种不属于任何名字空间的对象，定义的是从优先级类名向优先级整数值的映射。 -优先级类名称用 PriorityClass 对象的元数据的 `name` 字段指定。 -优先级整数值在必须提供的 `value` 字段中指定。 -优先级值越大，优先级越高。 -PriorityClass 对象的名称必须是合法的 -[DNS 子域名](/zh/docs/concepts/overview/working-with-objects/names#dns-subdomain-names) -且不可包含 `system-` 前缀。 - - -PriorityClass 对象可以设置数值小于等于 10 亿的 32 位整数。 -更大的数值保留给那些通常不可被抢占或逐出的系统 Pod。 -集群管理员应该为每个优先级值映射创建一个 PriorityClass 对象。 - - -PriorityClass 对象还有两个可选字段：`globalDefault` 和 `description`。 -前者用来表明此 PriorityClass 的数值应该用于未设置 `priorityClassName` 的 Pod。 -系统中只能存在一个 `globalDefault` 设为真的 PriorityClass 对象。 -如果没有 PriorityClass 对象的 `globalDefault` 被设置，则未设置 -`priorityClassName` 的 Pod 的优先级为 0。 - -`description` 字段可以设置任意字符串值。其目的是告诉用户何时该使用该 -PriorityClass。 - - -### 关于 Pod 优先级与现有集群的说明 - -- 如果你要升级一个不支持 Pod 优先级的集群，现有 Pod 的有效优先级都被视为 0。 - -- 向集群中添加 `globalDefault` 设置为 `true` 的 PriorityClass 不会改变现有 - Pod 的优先级。新添加的 PriorityClass 值仅适用于 PriorityClass 被添加之后 - 新建的 Pod。 - -- 如果你要删除 PriorityClass，则使用所删除的 PriorityClass 名称的现有 Pod 都 - 不会受影响，但是你不可以再创建使用该 PriorityClass 名称的新 Pod。 - - -### PriorityClass 示例 - -```yaml -apiVersion: scheduling.k8s.io/v1 -kind: PriorityClass -metadata: - name: high-priority -value: 1000000 -globalDefault: false -description: "This priority class should be used for XYZ service pods only." -``` - - -## 非抢占式的 PriorityClass {#non-preempting-priority-class} - -{{< feature-state for_k8s_version="v1.15" state="alpha" >}} - - -配置 `preemptionPolicy: Never` 的 Pod 在调度队列中会被放在低优先级的 Pod -的前面，但是它们不可以抢占其他 Pod。 -非抢占 Pod 会在调度队列中等待调度，直到有足够空闲资源时才被调度。 -非抢占 Pod 与其他 Pod 一样，也受调度器回退（Back-off）机制影响。 -换言之，如果调度器尝试调度这些 Pod 时发现它们无法调度，它们会被再次尝试，并且 -重试的频率会被降低，这样可以使得其他优先级较低的 Pod 有机会在它们之前被调度。 - - -非抢占 Pod 仍有可能被其他高优先级的 Pod 抢占。 - -`preemptionPolicy` 默认取值为 `PreemptLowerPriority`，这会使得该 PriorityClass -的 Pod 能够抢占低优先级的 Pod（这也是当前的默认行为）。 -如果 `preemptionPolicy` 被设置为 `Never`，则该 PriorityClass 下的 Pod 都是非抢占的。 - - -使用 `preemptionPolicy` 字段要求启用 `NonPreemptingPriority` -[特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/)。 - -一种示例应用场景是数据科学负载。 -用户可能希望所提交的 Job 比其他负载的优先级都高，但又不希望因为抢占运行中的 -Pod 而丢弃现有工作。 -只要集群中"自然地"释放出足够的资源，配置了 `preemptionPolicy: Never` -的高优先级 Job 可以在队列中其他 Pod 之前获得调度机会。 - - -### 非抢占 PriorityClass 示例 - -```yaml -apiVersion: scheduling.k8s.io/v1 -kind: PriorityClass -metadata: - name: high-priority-nonpreempting -value: 1000000 -preemptionPolicy: Never -globalDefault: false -description: "This priority class will not cause other pods to be preempted." -``` - - -## Pod 优先级 {#pod-priority} - -在已经创建了一个或多个 PriorityClass 对象之后，你就可以创建 Pod 并在其规约中 -指定这些 PriorityClass 的名字之一。优先级准入控制器使用 `priorityClassName` -字段来填充优先级整数值。如果所指定优先级类不存在，则 Pod 被拒绝。 - -下面的 YAML 是一个 Pod 配置，使用了前面例子中创建的 PriorityClass。 -优先级准入控制器检查 Pod 的规约并将 Pod 优先级解析为 1000000。 - -```yaml -apiVersion: v1 -kind: Pod -metadata: - name: nginx - labels: - env: test -spec: - containers: - - name: nginx - image: nginx - imagePullPolicy: IfNotPresent - priorityClassName: high-priority -``` - - -### 优先级对 Pod 调度顺序的影响 - -当集群启用了 Pod 优先级时，调度器会基于 Pod 的优先级来排序悬决的 Pod。 -新 Pod 会被放在调度队列中较低优先级的其他悬决 Pod 前面。 -因此，优先级较高的 Pod 在其调度需求被满足的前提下会比优先级低的 Pod 先被调度。 -如果优先级较高的 Pod 无法被调度，调度器会继续尝试调度其他较低优先级的 Pod。 - - -## 抢占 {#preemption} - -Pod 被创建时会被放入一个队列中等待调度。调度器从队列中选择 Pod，尝试将其调度到某 Node 上。 -如果找不到能够满足 Pod 所设置需求的 Node，就会触发悬决 Pod 的抢占逻辑。 -假定 P 是悬决的 Pod，抢占逻辑会尝试找到一个这样的节点，在该节点上移除一个或者多个 -优先级比 P 低的 Pod 后，P 就可以被调度到该节点。如果调度器能够找到这样的节点， -该节点上的一个或者多个优先级较低的 Pod 就会被逐出。当被逐出的 Pod 从该节点上 -消失时，P 就可以调度到此节点。 - - -### 暴露给用户的信息 {#user-exposed-information} - -当 Pod P 在节点 N 上抢占了一个或多个 Pod 时，Pod P 的状态中的`nominatedNodeName` 字段 -会被设置为节点 N 的名字。此字段有助于调度器跟踪为 P -所预留的资源，同时也给用户提供了其集群中发生的抢占的信息。 - - -请注意，Pod P 不一定会被调度到其 "nominated node（提名节点）"。 -当选定的 Pod 被抢占时，它们都会有其体面终止时限（Graceful Termination Period）。 -如果在调度器等待选定的（被牺牲的）Pod 终止期间有新的节点可用，调度器会使用其他 -节点来调度 Pod P。因此，Pod 中的 `nominatedNodeName` 和 `nodeName` 并不总是相同。 -此外，如果调度器抢占了节点 N 上的 Pod，但接下来出现优先级比 P 还高的 Pod 要被 -调度，则调度器会把节点 N 让给新的优先级更高的 Pod。如果发生了这种情况，调度器 -会清除 Pod P 的 `nominatedNodeName`。通过清除操作，调度器使得 Pod P 可以尝试 -抢占别的节点上的 Pod。 - - -### 抢占的局限性 {#limitations-of-preemption} - -#### 抢占牺牲者的体面终止期限 - -当 Pod 被抢占时，做出牺牲的 Pod 仍有各自的 -[体面终止期限](/zh/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination)。 -这些 Pod 可以在给定的期限内结束其工作并退出。如果它们不能及时退出则会被杀死。 -这一体面终止期限带来了一个时间空隙，跨度从调度器开始抢占 Pod 的那一刻到悬决 Pod -（P）可以被调度到节点（N）上的那一刻。 -与此同时，调度器还要继续调度其他悬决的 Pod。 -随着被抢占的 Pod 退出或终止，调度器尝试继续尝试调度悬决队列中的 Pod。 -因此，从调度器抢占被牺牲的 Pod 到 Pod P 被调度，中间通常存在一个时间间隔。 -为了缩短此时间间隔，用户可以将低优先级的 Pod 的体面终止期限设置为 0 -或者较小的数字。 - - -#### PodDisruptionBudget 是被支持的，但不提供保证 - -[PodDisruptionBudget](/zh/docs/concepts/workloads/pods/disruptions/) (PDB) -的存在使得应用的属主能够限制多副本应用因主动干扰而同时离线的 Pod 的个数。 -Kubernetes 在抢占 Pod 时是可以支持 PDB 的，但对 PDB 的约束也仅限于尽力而为。 -调度器会尝试寻找不会因为抢占而违反其 PDB 约束的 Pod 作为牺牲品，不过如果 -找不到这样的待逐出 Pod，抢占行为仍会发生，低优先级的 Pod 仍会被逐出而不管 -是否违反其 PDB 约束。 - - -#### 低优先级 Pod 间的亲和性 - -只有对下面的问题的回答是肯定的的时候，才会考虑在节点上执行抢占操作： -"如果所有优先级低于悬决 Pod 的 Pod 都从节点上逐出，悬决 Pod -可以调度到此节点么？" - - -{{< note >}} -抢占操作不一定要逐出所有优先级较低的 Pod。 -如果少逐出几个 Pod 而不是逐出所有较低优先级的 Pod 即可令悬决 Pod -被调度，则优先级较低的 Pod 中只有一部分会被逐出。 -即便如此，对上述问题的回答仍须是肯定的。如果回答是否定的，Kubernetes -不会考虑在该节点上执行抢占操作。 -{{< /note >}} - - -如果悬决 Pod 与节点上一个或多个较低优先级的 Pod 之间存在 Pod 间亲和性关系， -那些对应的低优先级 Pod 若被逐出则无法满足此亲和性规则。 -在这种场合下，调度器不会抢占节点上的任何 Pod。相反，它会尝试寻找其他节点。 -调度器可能能找到也可能找不到合适的节点。 -Kubernetes 并不保证悬决的 Pod 最终会被调度。 - -对此问题的一种解决方案是仅针对优先级相同或更高的 Pod 设置 Pod 间亲和性。 - - -#### 跨节点的抢占 {#cross-node-preemption} - -假定当前正在考虑在节点 N 上执行抢占操作以便 Pod P 能够被调度到 N 上执行。 -可是只有当另一个节点上的某个 Pod 被抢占，P 才有可能在 N 上调度执行。例如： - - -* Pod P 正在考虑被调度到节点 N。 -* Pod Q 正运行在节点 N 所处区域（Zone）的另一个节点上。 -* Pod P 设置了区域范畴的与 Pod Q 的反亲和性 - （`topologyKey: topology.kubernetes.io/zone`）。 -* Pod P 与区域中的其他 Pod 之间都不存在反亲和性关系。 -* 为了将 P 调度到节点 N 上，Pod Q 可以被抢占，但是调度器不会执行跨节点的 - 抢占操作。因此，Pod P 会被视为无法调度到节点 N 上执行。 - - -如果 Pod Q 真的被从其节点上移除，Pod 间反亲和性的规则就会得到满足，Pod P -就有可能被调度到节点 N 上执行。 - -我们可能在将来版本中考虑添加跨节点的抢占能力。前提是在这方面有足够多的需求， -并且我们找到了性能可接受的算法。 - - -## 故障排查 {#troubleshooting} - -Pod 优先级和抢占机制可能产生一些不想看到的副作用。 -下面是一些可能存在的问题以及相应的处理方法。 - - -### Pod 被不必要地抢占 - -抢占操作会在集群中资源压力较大，进而无法为高优先级的悬决 Pod 腾出空间时发生。 -如果你不小心给某些 Pod 赋予了较高优先级，这些意外获得高优先级的 Pod 可能导致 -集群中出现抢占行为。Pod 优先级是通过在其规约中的 `priorityClassName` 来设定的。 -优先级的整数值被解析出来后会添加到 Pod 规约的 `priority` 字段。 - - -要解决这一问题，你可以修改这些 Pod 的 `priorityClassName` 设置，使用优先级 -较低的优先级类，或者将该字段留空。空的 `priorityClassName` 默认解析为优先级 0。 - -Pod 被抢占时，被抢占的 Pod 会有对应的事件被记录下来。 -只有集群中无法为某 Pod 提供足够资源的时候才会发生抢占。 -在出现这种情况时，也只有悬决 Pod（抢占者）的优先级高于被牺牲的 Pod -的优先级时，才会发生抢占现象。 -当没有悬决 Pod，或者悬决 Pod 的优先级等于或者低于现有 Pod 时，都不应发生抢占行为。 -如果在这种条件下仍然发生了抢占，请登记一个 Issue。 - - -### Pod 被抢占但抢占者未被调度 - -当有 Pod 被抢占时，它们会得到各自的体面终止期限（默认为 30 秒）。 -如果被牺牲的 Pod 在此限期内未能终止，则 Pod 会被强制终止 -一旦所有被牺牲的 Pod 都已消失不见，抢占者 Pod 就可被调度。 - - -在抢占者 Pod 等待被牺牲的 Pod 消失期间，可能有更高优先级的 Pod 被创建，且适合 -调度到同一节点。如果是这种情况，调度器会调度优先级更高的 Pod 而不是抢占者。 - -这是期望发生的行为：优先级更高的 Pod 应该取代优先级较低的 Pod。 - - -### 高优先级的 Pod 比低优先级的 Pod 先被抢占 - -调度器尝试寻找可以运行悬决 Pod 的节点。如果找不到这样的节点，调度器会尝试从任一 -节点上逐出优先级较低的 Pod 以运行悬决 Pod。 -如果包含低优先级 Pod 的节点不适合用来运行悬决 Pod，调度器可能会选择其他的、 -运行着较高优先级（相对之前所评估的节点上的 Pod 而言）的 Pod 的节点来执行抢占操作。 -即使如此，被牺牲的 Pod 的优先级也必须比抢占者 Pod 的优先级低。 - - -当有多个节点可供抢占时，调度器会选择 Pod 集合的优先级最低的节点。不过如果这些 -Pod 上定义了 PodDisruptionBudget（PDB）而且如果被抢占了的话就会违反 PDB， -则调度器会选择另一个 Pod 集合优先级稍高的节点。 - -当存在多个节点可供抢占，但以上场景都不适用，则调度器会选择优先级最低的节点。 - - -## Pod 优先级与服务质量间关系 {#interactions-of-pod-priority-and-qos} - -Pod 优先级与 {{< glossary_tooltip text="QoS 类" term_id="qos-class" >}} 是两个 -相互独立的功能特性，其间交互之处很少，并且不存在基于 Pod QoS 类来为其设置 -优先级方面的默认限制。 -调度器的抢占逻辑在选择抢占目标时不会考虑 QoS 因素。 -抢占考虑的是 Pod 优先级，并选择优先级最低的 Pod 作为抢占目标。 -只有移除最低优先级的 Pod 尚不足以允许调度器调度抢占者 Pod 或者最低优先级的 Pod -受到 Pod 干扰预算（PDB）保护时，才会考虑抢占优先级稍高的 Pod。 - - -唯一同时考虑 QoS 和 Pod 优先级的组件是 `kubelet`，体现在其 -[资源不足时的逐出](/zh/docs/tasks/administer-cluster/out-of-resource/)操作。 -`kubelet` 首先根据 Pod 对濒危资源的使用是否超出其请求值来选择要被逐出的 Pod， -接下来对这些 Pod 按优先级排序，再按其相对 Pod 的调度请求所耗用的濒危资源的用量 -排序。更多细节可参阅 -[逐出最终用户的 Pod](/zh/docs/tasks/administer-cluster/out-of-resource/#evicting-end-user-pods)。 - - -`kubelet` 资源不足时的逐出操作不会逐出 Pod 资源用量未超出其请求值的 Pod。 -如果优先级较低的 Pod 未超出其请求值，它们不会被逐出。其他优先级较高的 -且用量超出请求值的 Pod 则可能被逐出。 - -## {{% heading "whatsnext" %}} - - -* 阅读结合 PriorityClass 来使用 ResourceQuota 的介绍： - [限制默认可使用的优先级类](/zh/docs/concepts/policy/resource-quotas/#limit-priority-class-consumption-by-default) - From d711ae1874444a968da58ba4b9b6c7c2268ddb7e Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Sat, 7 Aug 2021 19:23:48 +0800 Subject: [PATCH 101/279] [zh] Translate production environment --- .../setup/production-environment/_index.md | 634 ++++++++++++++++++ 1 file changed, 634 insertions(+) diff --git a/content/zh/docs/setup/production-environment/_index.md b/content/zh/docs/setup/production-environment/_index.md index 8ee244e33d..b16ed481b8 100644 --- a/content/zh/docs/setup/production-environment/_index.md +++ b/content/zh/docs/setup/production-environment/_index.md @@ -1,4 +1,638 @@ --- title: 生产环境 weight: 30 +no_list: true --- + + + + +生产质量的 Kubernetes 集群需要规划和准备。 +如果你的 Kubernetes 集群是用来运行关键负载的，该集群必须被配置为弹性的（Resilient）。 +本页面阐述你在安装生产就绪的集群或将现有集群升级为生产用途时可以遵循的步骤。 +如果你已经熟悉生产环境安装，因此只关注一些链接，则可以跳到[接下来](#what-s-next)节。 + + + + +## 生产环境考量 {#production-considerations} + +通常，一个生产用 Kubernetes 集群环境与个人学习、开发或测试环境所使用的 +Kubernetes 相比有更多的需求。生产环境可能需要被很多用户安全地访问，需要 +提供一致的可用性，以及能够与需求变化相适配的资源。 + + +在你决定在何处运行你的生产用 Kubernetes 环境（在本地或者在云端），以及 +你希望承担或交由他人承担的管理工作量时，需要考察以下因素如何影响你对 +Kubernetes 集群的需求： + + +- *可用性*：一个单机的 Kubernetes [学习环境](/zh/docs/setup/#学习环境) + 具有单点失效特点。创建高可用的集群则意味着需要考虑： + - 将控制面与工作节点分开 + - 在多个节点上提供控制面组件的副本 + - 为针对集群的 {{< glossary_tooltip term_id="kube-apiserver" text="API 服务器" >}} + 的流量提供负载均衡 + - 随着负载的合理需要，提供足够的可用的（或者能够迅速变为可用的）工作节点 + + +- *规模*：如果你预期你的生产用 Kubernetes 环境要承受固定量的请求， + 你可能可以针对所需要的容量来一次性完成安装。 + 不过，如果你预期服务请求会随着时间增长，或者因为类似季节或者特殊事件的 + 原因而发生剧烈变化，你就需要规划如何处理请求上升时对控制面和工作节点 + 的压力，或者如何缩减集群规模以减少未使用资源的消耗。 + + +- *安全性与访问管理*：在你自己的学习环境 Kubernetes 集群上，你拥有完全的管理员特权。 + 但是针对运行着重要工作负载的共享集群，用户账户不止一两个时，就需要更细粒度 + 的方案来确定谁或者哪些主体可以访问集群资源。 + 你可以使用基于角色的访问控制（[RBAC](/zh/docs/reference/access-authn-authz/rbac/)） + 和其他安全机制来确保用户和负载能够访问到所需要的资源，同时确保工作负载及集群 + 自身仍然是安全的。 + 你可以通过管理[策略](/zh/docs/concets/policy/)和 + [容器资源](/zh/docs/concepts/configuration/manage-resources-containers)来 + 针对用户和工作负载所可访问的资源设置约束， + + +在自行构造 Kubernetes 生产环境之前，请考虑将这一任务的部分或者全部交给 +[云方案承包服务](/zh/docs/setup/production-environment/turnkey-solutions) +提供商或者其他 [Kubernetes 合作伙伴](https://kubernetes.io/partners/)。 +选项有： + + +- *无服务*：仅是在第三方设备上运行负载，完全不必管理集群本身。你需要为 + CPU 用量、内存和磁盘请求等付费。 +- *托管控制面*：让供应商决定集群控制面的规模和可用性，并负责打补丁和升级等操作。 +- *托管工作节点*：配置一个节点池来满足你的需要，由供应商来确保节点始终可用， + 并在需要的时候完成升级。 +- *集成*：有一些供应商能够将 Kubernetes 与一些你可能需要的其他服务集成， + 这类服务包括存储、容器镜像仓库、身份认证方法以及开发工具等。 + + +无论你是自行构造一个生产用 Kubernetes 集群还是与合作伙伴一起协作，请审阅 +下面章节以评估你的需求，因为这关系到你的集群的 *控制面*、*工作节点*、 +*用户访问* 以及 *负载资源*。 + + +## 生产用集群安装 {#production-cluster-setup} + +在生产质量的 Kubernetes 集群中，控制面用不同的方式来管理集群和可以 +分布到多个计算机上的服务。每个工作节点则代表的是一个可配置来运行 +Kubernetes Pods 的实体。 + + +### 生产用控制面 {#production-control-plane} + +最简单的 Kubernetes 集群中，整个控制面和工作节点服务都运行在同一台机器上。 +你可以通过添加工作节点来提升环境能力，正如 +[Kubernetes 组件](/zh/docs/concepts/overview/components/)示意图所示。 +如果只需要集群在很短的一段时间内可用，或者可以在某些事物出现严重问题时直接丢弃， +这种配置可能符合你的需要。 + + +如果你需要一个更为持久的、高可用的集群，那么你就需要考虑扩展控制面的方式。 +根据设计，运行在一台机器上的单机控制面服务不是高可用的。 +如果保持集群处于运行状态并且需要确保在出现问题时能够被修复这点很重要， +可以考虑以下步骤： + + +- *选择部署工具*：你可以使用类似 kubeadm、kops 和 kubespray 这类工具来部署控制面。 + 参阅[使用部署工具安装 Kubernetes](/zh/docs/setup/production-environment/tools/) + 以了解使用这类部署方法来完成生产就绪部署的技巧。 + 存在不同的[容器运行时](/zh/docs/setup/production-environment/container-runtimes/) + 可供你的部署采用。 + +- *管理证书*：控制面服务之间的安全通信是通过证书来完成的。证书是在部署期间 + 自动生成的，或者你也可以使用你自己的证书机构来生成它们。 + 参阅 [PKI 证书和需求](/zh/docs/setup/best-practices/certificates/)了解细节。 + +- *为 API 服务器配置负载均衡*：配置负载均衡器来将外部的 API 请求散布给运行在 + 不同节点上的 API 服务实例。参阅 + [创建外部负载均衡器](/zh/docs/access-application-cluster/create-external-load-balancer/) + 了解细节。 + +- *分离并备份 etcd 服务*：etcd 服务可以运行于其他控制面服务所在的机器上， + 也可以运行在不同的机器上以获得更好的安全性和可用性。 + 因为 etcd 存储着集群的配置数据，应该经常性地对 etcd 数据库进行备份， + 以确保在需要的时候你可以修复该数据库。与配置和使用 etcd 相关的细节可参阅 + [etcd FAQ](/https://etcd.io/docs/v3.4/faq/)。 + 更多的细节可参阅[为 Kubernetes 运维 etcd 集群](/zh/docs/tasks/administer-cluster/configure-upgrade-etcd/) + 和[使用 kubeadm 配置高可用的 etcd 集群](/zh/docs/setup/production-environment/tools/kubeadm/setup-ha-etcd-with-kubeadm/)。 + +- *创建多控制面系统*：为了实现高可用性，控制面不应被限制在一台机器上。 + 如果控制面服务是使用某 init 服务（例如 systemd）来运行的，每个服务应该 + 至少运行在三台机器上。不过，将控制面作为服务运行在 Kubernetes Pods + 中可以确保你所请求的个数的服务始终保持可用。 + 调度器应该是可容错的，但不是高可用的。 + 某些部署工具会安装 [Raft](https://raft.github.io/) 票选算法来对 Kubernetes + 服务执行领导者选举。如果主节点消失，另一个服务会被选中并接手相应服务。 + +- *跨多个可用区*：如果保持你的集群一直可用这点非常重要，可以考虑创建一个跨 + 多个数据中心的集群；在云环境中，这些数据中心被视为可用区。 + 若干个可用区在一起可构成地理区域。 + 通过将集群分散到同一区域中的多个可用区内，即使某个可用区不可用，整个集群 + 能够继续工作的机会也大大增加。 + 更多的细节可参阅[跨多个可用区运行](/zh/docs/setup/best-practices/multiple-zones/)。 + +- *管理演进中的特性*：如果你计划长时间保留你的集群，就需要执行一些维护其 + 健康和安全的任务。例如，如果你采用 kubeadm 安装的集群，则有一些可以帮助你完成 + [证书管理](/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/) + 和[升级 kubeadm 集群](/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade) + 的指令。 + 参见[管理集群](/zh/docs/tasks/administer-cluster)了解一个 Kubernetes + 管理任务的较长列表。 + + +要了解运行控制面服务时可使用的选项，可参阅 +[kube-apiserver](/zh/docs/reference/command-line-tools-reference/kube-apiserver/)、 +[kube-controller-manager](/zh/docs/reference/command-line-tools-reference/kube-controller-manager/) 和 +[kube-scheduler](/zh/docs/reference/command-line-tools-reference/kube-scheduler/) +组件参考页面。 +如要了解高可用控制面的例子，可参阅 +[高可用拓扑结构选项](/zh/docs/setup/production-environment/tools/kubeadm/ha-topology/)、 +[使用 kubeadm 创建高可用集群](/zh/docs/setup/production-environment/tools/kubeadm/high-availability/) 以及[为 Kubernetes 运维 etcd 集群](/zh/docs/tasks/administer-cluster/configure-upgrade-etcd/)。 +关于制定 etcd 备份计划，可参阅 +[对 etcd 集群执行备份](/zh/docs/tasks/administer-cluster/configure-upgrade-etcd/#backing-up-an-etcd-cluster)。 + + +### 生产用工作节点 + +生产质量的工作负载需要是弹性的；它们所依赖的其他组件（例如 CoreDNS）也需要是弹性的。 +无论你是自行管理控制面还是让云供应商来管理，你都需要考虑如何管理工作节点 +（有时也简称为*节点*）。 + + +- *配置节点*：节点可以是物理机或者虚拟机。如果你希望自行创建和管理节点， + 你可以安装一个受支持的操作系统，之后添加并运行合适的 + [节点服务](/zh/docs/concepts/overview/components/#node-components)。 + 考虑： + + - 在安装节点时要通过配置适当的内存、CPU 和磁盘速度、存储容量来满足 + 你的负载的需求。 + - 是否通用的计算机系统即足够，还是你有负载需要使用 GPU 处理器、Windows 节点 + 或者 VM 隔离。 + +- *验证节点*：参阅[验证节点配置](/zh/docs/setup/best-practices/node-conformance/) + 以了解如何确保节点满足加入到 Kubernetes 集群的需求。 + +- *添加节点到集群中*：如果你自行管理你的集群，你可以通过安装配置你的机器， + 之后或者手动加入集群，或者让它们自动注册到集群的 API 服务器。参阅 + [节点](/zh/docs/concepts/architecture/nodes/)节，了解如何配置 Kubernetes + 以便以这些方式来添加节点。 + +- *向集群中添加 Windows 节点*：Kubernetes 提供对 Windows 工作节点的支持； + 这使得你可以运行实现于 Windows 容器内的工作负载。参阅 + [Kubernetes 中的 Windows](/zh/docs/setup/production-environment/windows/) + 了解进一步的详细信息。 + +- *扩缩节点*：制定一个扩充集群容量的规划，你的集群最终会需要这一能力。 + 参阅[大规模集群考察事项](/zh/docs/setup/best-practices/cluster-large/) + 以确定你所需要的节点数；这一规模是基于你要运行的 Pod 和容器个数来确定的。 + 如果你自行管理集群节点，这可能意味着要购买和安装你自己的物理设备。 + +- *节点自动扩缩容*：大多数云供应商支持 + [集群自动扩缩器（Cluster Autoscaler）](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler#readme) + 以便替换不健康的节点、根据需求来增加或缩减节点个数。参阅 + [常见问题](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md) + 了解自动扩缩器的工作方式，并参阅 + [Deployment](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler#deployment) + 了解不同云供应商是如何实现集群自动扩缩器的。 + 对于本地集群，有一些虚拟化平台可以通过脚本来控制按需启动新节点。 + +- *安装节点健康检查*：对于重要的工作负载，你会希望确保节点以及在节点上 + 运行的 Pod 处于健康状态。通过使用 + [Node Problem Detector](/zh/docs/tasks/debug-application-cluster/monitor-node-health/)， + 你可以确保你的节点是健康的。 + + +### 生产级用户环境 + +在生产环境中，情况可能不再是你或者一小组人在访问集群，而是几十 +上百人需要访问集群。在学习环境或者平台原型环境中，你可能具有一个 +可以执行任何操作的管理账号。在生产环境中，你可需要对不同名字空间 +具有不同访问权限级别的很多账号。 + + +建立一个生产级别的集群意味着你需要决定如何有选择地允许其他用户访问集群。 +具体而言，你需要选择验证尝试访问集群的人的身份标识（身份认证），并确定 +他们是否被许可执行他们所请求的操作（鉴权）： + + +- *认证（Authentication）*：API 服务器可以使用客户端证书、持有者令牌、身份 + 认证代理或者 HTTP 基本认证机制来完成身份认证操作。 + 你可以选择你要使用的认证方法。通过使用插件，API 服务器可以充分利用你所在 + 组织的现有身份认证方法，例如 LDAP 或者 Kerberos。 + 关于认证 Kubernetes 用户身份的不同方法的描述，可参阅 + [身份认证](/zh/docs/reference/access-authn-authz/authentication/)。 + +- *鉴权（Authorization）*：当你准备为一般用户执行权限判定时，你可能会需要 + 在 RBAC 和 ABAC 鉴权机制之间做出选择。参阅 + [鉴权概述](/zh/docs/reference/access-authn-authz/authorization/)，了解 + 对用户账户（以及访问你的集群的服务账户）执行鉴权的不同模式。 + + - *基于角色的访问控制*（[RBAC](/zh/docs/reference/access-authn-authz/rbac/)）： + 让你通过为通过身份认证的用户授权特定的许可集合来控制集群访问。 + 访问许可可以针对某特定名字空间（Role）或者针对整个集群（CLusterRole）。 + 通过使用 RoleBinding 和 ClusterRoleBinding 对象，这些访问许可可以被 + 关联到特定的用户身上。 + + - *基于属性的访问控制*（[ABAC](/zh/docs/reference/access-authn-authz/abac/)）： + 让你能够基于集群中资源的属性来创建访问控制策略，基于对应的属性来决定 + 允许还是拒绝访问。策略文件的每一行都给出版本属性（apiVersion 和 kind） + 以及一个规约属性的映射，用来匹配主体（用户或组）、资源属性、非资源属性 + （/version 或 /apis）和只读属性。 + 参阅[示例](/zh/docs/reference/access-authn-authz/abac/#examples)以了解细节。 + + +作为在你的生产用 Kubernetes 集群中安装身份认证和鉴权机制的负责人， +要考虑的事情如下： + + +- *设置鉴权模式*：当 Kubernetes API 服务器 + （[kube-apiserver](/docs/reference/command-line-tools-reference/kube-apiserver/)） + 启动时，所支持的鉴权模式必须使用 `--authorization-mode` 标志配置。 + 例如，`kube-apiserver.yaml`（位于 `/etc/kubernetes/manifests` 下）中对应的 + 标志可以设置为 `Node,RBAC`。这样就会针对已完成身份认证的请求执行 Node 和 RBAC + 鉴权。 + +- *创建用户证书和角色绑定（RBAC）*：如果你在使用 RBAC 鉴权，用户可以创建 + 由集群 CA 签名的 CertificateSigningRequest（CSR）。接下来你就可以将 Role + 和 ClusterRole 绑定到每个用户身上。 + 参阅[证书签名请求](/zh/docs/reference/access-authn-authz/certificate-signing-requests/) + 了解细节。 + +- *创建组合属性的策略（ABAC）*：如果你在使用 ABAC 鉴权，你可以设置属性组合 + 以构造策略对所选用户或用户组执行鉴权，判定他们是否可访问特定的资源 + （例如 Pod）、名字空间或者 apiGroup。进一步的详细信息可参阅 + [示例](/zh/docs/reference/access-authn-authz/abac/#examples)。 + +- *考虑准入控制器*：针对指向 API 服务器的请求的其他鉴权形式还包括 + [Webhook 令牌认证](/zh/docs/reference/access-authn-authz/authentication/#webhook-token-authentication)。 + Webhook 和其他特殊的鉴权类型需要通过向 API 服务器添加 + [准入控制器](/zh/docs/reference/access-authn-authz/admission-controllers/) + 来启用。 + + +## 为负载资源设置约束 {#set-limits-on-workload-resources} + +生产环境负载的需求可能对 Kubernetes 的控制面内外造成压力。 +在针对你的集群的负载执行配置时，要考虑以下条目： + + +- *设置名字空间限制*：为每个名字空间的内存和 CPU 设置配额。 + 参阅[管理内存、CPU 和 API 资源](/zh/docs/tasks/administer-cluster/manage-resources/) + 以了解细节。你也可以设置 + [层次化名字空间](/blog/2020/08/14/introducing-hierarchical-namespaces/) + 来继承这类约束。 + +- *为 DNS 请求做准备*：如果你希望工作负载能够完成大规模扩展，你的 DNS 服务 + 也必须能够扩大规模。参阅 + [自动扩缩集群中 DNS 服务](/zh/docs/tasks/administer-cluster/dns-horizontal-autoscaling/)。 + +- *创建额外的服务账户*：用户账户决定用户可以在集群上执行的操作，服务账号则定义的 + 是在特定名字空间中 Pod 的访问权限。 + 默认情况下，Pod 使用所在名字空间中的 default 服务账号。 + 参阅[管理服务账号](/zh/docs/reference/access-authn-authz/service-accounts-admin/) + 以了解如何创建新的服务账号。例如，你可能需要： + + - 为 Pod 添加 Secret，以便 Pod 能够从某特定的容器镜像仓库拉取镜像。 + 参阅[为 Pod 配置服务账号](/zh/docs/tasks/configure-pod-container/configure-service-account/) + 以获得示例。 + - 为服务账号设置 RBAC 访问许可。参阅 + [服务账号访问许可](/zh/docs/reference/access-authn-authz/rbac/#service-account-permissions) + 了解细节。 + +## {{% heading "whatsnext" %}} + + +- 决定你是想自行构造自己的生产用 Kubernetes 还是从某可用的 + [云服务外包厂商](/zh/docs/setup/production-environment/turnkey-solutions/) + 或 [Kubernetes 合作伙伴](https://kubernetes.io/partners/)获得集群。 +- 如果你决定自行构造集群，则需要规划如何处理 + [证书](/zh/docs/setup/best-practices/certificates/) + 并为类似 + [etcd](/zh/docs/setup/production-environment/tools/kubeadm/setup-ha-etcd-with-kubeadm/) + 和 + [API 服务器](/zh/docs/setup/production-environment/tools/kubeadm/ha-topology/) + 这些功能组件配置高可用能力。 + +- 选择使用 [kubeadm](/zh/docs/setup/production-environment/tools/kubeadm/)、 + [kops](/zh/docs/setup/production-environment/tools/kops/) 或 + [Kubespray](/zh/docs/setup/production-environment/tools/kubespray/) + 作为部署方法。 + +- 通过决定[身份认证](/zh/docs/reference/access-authn-authz/authentication/)和 + [鉴权](/zh/docs/reference/access-authn-authz/authorization/)方法来配置用户管理。 + +- 通过配置[资源限制](/zh/docs/tasks/administer-cluster/manage-resources/)、 + [DNS 自动扩缩](/zh/docs/tasks/administer-cluster/dns-horizontal-autoscaling/) + 和[服务账号](/zh/docs/reference/access-authn-authz/service-accounts-admin/) + 来为应用负载作准备。 + From 3cafc8c8a548464eed33c3b294d2c14bdba529aa Mon Sep 17 00:00:00 2001 From: Arhell Date: Sun, 8 Aug 2021 11:38:24 +0300 Subject: [PATCH 102/279] [ru] Deleted reference to removed file --- .../docs/contribute/generate-ref-docs/contribute-upstream.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/content/ru/docs/contribute/generate-ref-docs/contribute-upstream.md b/content/ru/docs/contribute/generate-ref-docs/contribute-upstream.md index 223aba429f..0834caa522 100644 --- a/content/ru/docs/contribute/generate-ref-docs/contribute-upstream.md +++ b/content/ru/docs/contribute/generate-ref-docs/contribute-upstream.md @@ -113,7 +113,6 @@ On branch master hack/update-generated-swagger-docs.sh hack/update-openapi-spec.sh hack/update-generated-protobuf.sh -hack/update-api-reference-docs.sh ``` Выполните команду `git status`, чтобы посмотреть, какие файлы изменились. @@ -122,8 +121,6 @@ hack/update-api-reference-docs.sh On branch master ... modified: api/openapi-spec/swagger.json - modified: api/swagger-spec/apps_v1.json - modified: docs/api-reference/apps/v1/definitions.html modified: staging/src/k8s.io/api/apps/v1/generated.proto modified: staging/src/k8s.io/api/apps/v1/types.go modified: staging/src/k8s.io/api/apps/v1/types_swagger_doc_generated.go From f805b220d8b910693ff2f9ed2b446a45d571e76a Mon Sep 17 00:00:00 2001 From: Kenneth Endfinger Date: Sun, 8 Aug 2021 01:56:17 -0700 Subject: [PATCH 103/279] Fix double usage of "simplify the process" in kubelet-tls-bootstrapping. --- .../command-line-tools-reference/kubelet-tls-bootstrapping.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping.md b/content/en/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping.md index bb9609b9eb..5d2458079e 100644 --- a/content/en/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping.md +++ b/content/en/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping.md @@ -18,7 +18,7 @@ The normal process of bootstrapping these components, especially worker nodes th can be a challenging process as it is often outside of the scope of Kubernetes and requires significant additional work. This in turn, can make it challenging to initialize or scale a cluster. -In order to simplify the process, beginning in version 1.4, Kubernetes introduced a certificate request and signing API to simplify the process. The proposal can be +In order to simplify the process, beginning in version 1.4, Kubernetes introduced a certificate request and signing API. The proposal can be found [here](https://github.com/kubernetes/kubernetes/pull/20439). This document describes the process of node initialization, how to set up TLS client certificate bootstrapping for From f45f67739ea63871dd110fb4701d833de8066d61 Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Sun, 8 Aug 2021 19:59:56 +0800 Subject: [PATCH 104/279] Update reference for kubelet The kubelet reference is not auto-generated. This PR is about fixing the outdated information by manually comparing the reference against the output from `kubelet --help`. --- .../command-line-tools-reference/kubelet.md | 554 +++++++++--------- 1 file changed, 279 insertions(+), 275 deletions(-) diff --git a/content/en/docs/reference/command-line-tools-reference/kubelet.md b/content/en/docs/reference/command-line-tools-reference/kubelet.md index 3362dfac5c..0531f0847a 100644 --- a/content/en/docs/reference/command-line-tools-reference/kubelet.md +++ b/content/en/docs/reference/command-line-tools-reference/kubelet.md @@ -6,31 +6,33 @@ weight: 28 ## {{% heading "synopsis" %}} - -The kubelet is the primary "node agent" that runs on each -node. It can register the node with the apiserver using one of: the hostname; a flag to override the hostname; or specific logic for a cloud provider. +The kubelet is the primary "node agent" that runs on each node. It can +register the node with the apiserver using one of: the hostname; a flag to +override the hostname; or specific logic for a cloud provider. The kubelet works in terms of a PodSpec. A PodSpec is a YAML or JSON object -that describes a pod. The kubelet takes a set of PodSpecs that are provided through various mechanisms (primarily through the apiserver) and ensures that the containers described in those PodSpecs are running and healthy. The kubelet doesn't manage containers which were not created by Kubernetes. +that describes a pod. The kubelet takes a set of PodSpecs that are provided +through various mechanisms (primarily through the apiserver) and ensures that +the containers described in those PodSpecs are running and healthy. The +kubelet doesn't manage containers which were not created by Kubernetes. -Other than from a PodSpec from the apiserver, there are three ways that a container manifest can be provided to the Kubelet. +Other than from a PodSpec from the apiserver, there are three ways that a +container manifest can be provided to the Kubelet. -File: Path passed as a flag on the command line. Files under this path will be monitored periodically for updates. The monitoring period is 20s by default and is configurable via a flag. - -HTTP endpoint: HTTP endpoint passed as a parameter on the command line. This endpoint is checked every 20 seconds (also configurable with a flag). - -HTTP server: The kubelet can also listen for HTTP and respond to a simple API (underspec'd currently) to submit a new manifest. +- File: Path passed as a flag on the command line. Files under this path will be + monitored periodically for updates. The monitoring period is 20s by default + and is configurable via a flag. +- HTTP endpoint: HTTP endpoint passed as a parameter on the command line. This + endpoint is checked every 20 seconds (also configurable with a flag). +- HTTP server: The kubelet can also listen for HTTP and respond to a simple API + (underspec'd currently) to submit a new manifest. ``` kubelet [flags] ``` - - - ## {{% heading "options" %}} - @@ -46,66 +48,66 @@ kubelet [flags] - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -119,49 +121,42 @@ kubelet [flags] - + - + - + - + - - + - + - - - - - - - - + - + @@ -182,35 +177,35 @@ kubelet [flags] - + - + - + - + - + - + - + - + @@ -224,28 +219,28 @@ kubelet [flags] - + - + - + - + - + - + - + @@ -253,140 +248,140 @@ kubelet [flags] - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -397,177 +392,185 @@ kubelet [flags] - + - + - + - + - + - - + - + - + - + - + - +WindowsHostProcessContainers=true|false (ALPHA - default=false)
      +(DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) - + - + - + - + - + - + - + @@ -581,21 +584,14 @@ WindowsEndpointSliceProxying=true|false (ALPHA - default=false)
      - + - + - - - - - - - - + @@ -616,42 +612,42 @@ WindowsEndpointSliceProxying=true|false (ALPHA - default=false)
      - + - + - + - + - + - + - + @@ -665,56 +661,56 @@ WindowsEndpointSliceProxying=true|false (ALPHA - default=false)
      - + - + - + - + - + - + - + - + - + - + @@ -725,10 +721,10 @@ WindowsEndpointSliceProxying=true|false (ALPHA - default=false)
      - + - + @@ -753,48 +749,48 @@ WindowsEndpointSliceProxying=true|false (ALPHA - default=false)
      - + - + - + - + - + - + - + - + - + @@ -804,176 +800,182 @@ WindowsEndpointSliceProxying=true|false (ALPHA - default=false)
      - + - + - + - + + + + + + + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -984,63 +986,63 @@ WindowsEndpointSliceProxying=true|false (ALPHA - default=false)
      - + - + - + - - - - - - - - + - + - + - + - + - + - + - + + + + + + + + @@ -1050,21 +1052,21 @@ WindowsEndpointSliceProxying=true|false (ALPHA - default=false)
      - + - + - + @@ -1075,46 +1077,46 @@ WindowsEndpointSliceProxying=true|false (ALPHA - default=false)
      - + - + - + - + - + - - + - + - + - + @@ -1125,84 +1127,86 @@ WindowsEndpointSliceProxying=true|false (ALPHA - default=false)
      - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -1220,24 +1224,24 @@ Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_R - + - + - + - + - + - +
      --address ip     Default: 0.0.0.0 --address string     Default: 0.0.0.0
      The IP address for the Kubelet to serve on (set to `0.0.0.0` for all IPv4 interfaces and `::` for all IPv6 interfaces) (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)The IP address for the Kubelet to serve on (set to 0.0.0.0 or :: for listening in gll interfaces and IP families) (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --allowed-unsafe-sysctls strings
      Comma-separated whitelist of unsafe sysctls or unsafe sysctl patterns (ending in `*`). Use these at your own risk. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Comma-separated whitelist of unsafe sysctls or unsafe sysctl patterns (ending in *). Use these at your own risk. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --alsologtostderr
      log to standard error as well as filesLog to standard error as well as files
      --anonymous-auth     Default: true
      Enables anonymous requests to the Kubelet server. Requests that are not rejected by another authentication method are treated as anonymous requests. Anonymous requests have a username of `system:anonymous`, and a group name of `system:unauthenticated`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Enables anonymous requests to the Kubelet server. Requests that are not rejected by another authentication method are treated as anonymous requests. Anonymous requests have a username of system:anonymous, and a group name of system:unauthenticated. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --authentication-token-webhook
      Use the `TokenReview` API to determine authentication for bearer tokens. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Use the TokenReview API to determine authentication for bearer tokens. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --authentication-token-webhook-cache-ttl duration     Default: `2m0s`--authentication-token-webhook-cache-ttl duration     Default: 2m0s
      The duration to cache responses from the webhook token authenticator. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)The duration to cache responses from the webhook token authenticator. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --authorization-mode string
      Authorization mode for Kubelet server. Valid options are `AlwaysAllow` or `Webhook`. `Webhook` mode uses the `SubjectAccessReview` API to determine authorization. (default "AlwaysAllow" when `--config` flag is not provided; "Webhook" when `--config` flag presents.) (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Authorization mode for Kubelet server. Valid options are AlwaysAllow or Webhook. Webhook mode uses the SubjectAccessReview API to determine authorization. Default AlwaysAllow when --config flag is not provided; Webhook when --config flag presents. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --authorization-webhook-cache-authorized-ttl duration     Default: `5m0s`--authorization-webhook-cache-authorized-ttl duration     Default: 5m0s
      The duration to cache 'authorized' responses from the webhook authorizer. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)The duration to cache 'authorized' responses from the webhook authorizer. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --authorization-webhook-cache-unauthorized-ttl duration     Default: `30s`--authorization-webhook-cache-unauthorized-ttl duration     Default: 30s
      The duration to cache 'unauthorized' responses from the webhook authorizer. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)The duration to cache 'unauthorized' responses from the webhook authorizer. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --bootstrap-kubeconfig string
      Path to a kubeconfig file that will be used to get client certificate for kubelet. If the file specified by `--kubeconfig` does not exist, the bootstrap kubeconfig is used to request a client certificate from the API server. On success, a kubeconfig file referencing the generated client certificate and key is written to the path specified by `--kubeconfig`. The client certificate and key file will be stored in the directory pointed by `--cert-dir`.Path to a kubeconfig file that will be used to get client certificate for kubelet. If the file specified by --kubeconfig does not exist, the bootstrap kubeconfig is used to request a client certificate from the API server. On success, a kubeconfig file referencing the generated client certificate and key is written to the path specified by --kubeconfig. The client certificate and key file will be stored in the directory pointed by --cert-dir.
      --cert-dir string     Default: `/var/lib/kubelet/pki`--cert-dir string     Default: /var/lib/kubelet/pki
      The directory where the TLS certs are located. If `--tls-cert-file` and `--tls-private-key-file` are provided, this flag will be ignored.The directory where the TLS certs are located. If --tls-cert-file and --tls-private-key-file are provided, this flag will be ignored.
      --cgroup-driver string     Default: `cgroupfs`--cgroup-driver string     Default: cgroupfs
      Driver that the kubelet uses to manipulate cgroups on the host. Possible values: `cgroupfs`, `systemd`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)/td> +Driver that the kubelet uses to manipulate cgroups on the host. Possible values: cgroupfs, systemd. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)/td>
      --cgroup-root string     Default: `''`--cgroup-root string     Default: ''
      Optional root cgroup to use for pods. This is handled by the container runtime on a best effort basis. Default: '', which means use the container runtime default. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --cgroups-per-qos     Default: `true`--cgroups-per-qos     Default: true
      Enable creation of QoS cgroup hierarchy, if true top level QoS and pod cgroups are created. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --chaos-chance float
      If > 0.0, introduce random client errors and latency. Intended for testing. (DEPRECATED: will be removed in a future version.)Enable creation of QoS cgroup hierarchy, if true top level QoS and pod cgroups are created. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --client-ca-file string
      If set, any request presenting a client certificate signed by one of the authorities in the client-ca-file is authenticated with an identity corresponding to the CommonName of the client certificate. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)If set, any request presenting a client certificate signed by one of the authorities in the client-ca-file is authenticated with an identity corresponding to the CommonName of the client certificate. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --cluster-dns strings
      Comma-separated list of DNS server IP address. This value is used for containers DNS server in case of Pods with "dnsPolicy=ClusterFirst". Note: all DNS servers appearing in the list MUST serve the same set of records otherwise name resolution within the cluster may not work correctly. There is no guarantee as to which DNS server may be contacted for name resolution. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Comma-separated list of DNS server IP address. This value is used for containers DNS server in case of Pods with "dnsPolicy=ClusterFirst".
      Note: all DNS servers appearing in the list MUST serve the same set of records otherwise name resolution within the cluster may not work correctly. There is no guarantee as to which DNS server may be contacted for name resolution. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --cluster-domain string
      Domain for this cluster. If set, kubelet will configure all containers to search this domain in addition to the host's search domains (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Domain for this cluster. If set, kubelet will configure all containers to search this domain in addition to the host's search domains (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --cni-bin-dir string     Default: `/opt/cni/bin`--cni-bin-dir string     Default: /opt/cni/bin
      <Warning: Alpha feature> A comma-separated list of full paths of directories in which to search for CNI plugin binaries. This docker-specific flag only works when container-runtime is set to `docker`.A comma-separated list of full paths of directories in which to search for CNI plugin binaries. This docker-specific flag only works when container-runtime is set to docker. (DEPRECATED: will be removed along with dockershim.)
      --cni-cache-dir string     Default: `/var/lib/cni/cache`--cni-cache-dir string     Default: /var/lib/cni/cache
      <Warning: Alpha feature> The full path of the directory in which CNI should store cache files. This docker-specific flag only works when container-runtime is set to `docker`.The full path of the directory in which CNI should store cache files. This docker-specific flag only works when container-runtime is set to docker. (DEPRECATED: will be removed along with dockershim.)
      --cni-conf-dir string     Default: `/etc/cni/net.d`--cni-conf-dir string     Default: /etc/cni/net.d
      <Warning: Alpha feature> The full path of the directory in which to search for CNI config files. This docker-specific flag only works when container-runtime is set to `docker`.<Warning: Alpha feature> The full path of the directory in which to search for CNI config files. This docker-specific flag only works when container-runtime is set to docker. (DEPRECATED: will be removed along with dockershim.)
      --container-log-max-files int32     Default: 5
      Set the maximum number of container log files that can be present for a container. The number must be ≥ 2. This flag can only be used with `--container-runtime=remote`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)<Warning: Beta feature> Set the maximum number of container log files that can be present for a container. The number must be >= 2. This flag can only be used with --container-runtime=remote. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --container-log-max-size string     Default: `10Mi`--container-log-max-size string     Default: 10Mi
      Set the maximum size (e.g. 10Mi) of container log file before it is rotated. This flag can only be used with `--container-runtime=remote`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)<Warning: Beta feature> Set the maximum size (e.g. 10Mi) of container log file before it is rotated. This flag can only be used with --container-runtime=remote. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --container-runtime string     Default: `docker`--container-runtime string     Default: docker
      The container runtime to use. Possible values: `docker`, `remote`.The container runtime to use. Possible values: docker, remote.
      --container-runtime-endpoint string     Default: `unix:///var/run/dockershim.sock`--container-runtime-endpoint string     Default: unix:///var/run/dockershim.sock
      [Experimental] The endpoint of remote runtime service. Currently unix socket endpoint is supported on Linux, while npipe and tcp endpoints are supported on windows. Examples: `unix:///var/run/dockershim.sock`, `npipe:////./pipe/dockershim`.[Experimental] The endpoint of remote runtime service. Currently unix socket endpoint is supported on Linux, while npipe and tcp endpoints are supported on windows. Examples: unix:///var/run/dockershim.sock, npipe:////./pipe/dockershim.
      --contention-profiling
      Enable lock contention profiling, if profiling is enabled (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Enable lock contention profiling, if profiling is enabled (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --cpu-cfs-quota     Default: `true`--cpu-cfs-quota     Default: true
      Enable CPU CFS quota enforcement for containers that specify CPU limits (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Enable CPU CFS quota enforcement for containers that specify CPU limits (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --cpu-cfs-quota-period duration     Default: `100ms`--cpu-cfs-quota-period duration     Default: 100ms
      Sets CPU CFS quota period value, `cpu.cfs_period_us`, defaults to Linux Kernel default. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Sets CPU CFS quota period value, cpu.cfs_period_us, defaults to Linux Kernel default. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --cpu-manager-policy string     Default: `none`--cpu-manager-policy string     Default: none
      CPU Manager policy to use. Possible values: `none`, `static`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)CPU Manager policy to use. Possible values: none, static. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --cpu-manager-policy-options strings
      Comma-separated list of options to fine-tune the behavior of the selected CPU Manager policy. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Comma-separated list of options to fine-tune the behavior of the selected CPU Manager policy. If not supplied, keep the default behaviour. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --cpu-manager-reconcile-period duration     Default: `10s`--cpu-manager-reconcile-period duration     Default: 10s
      <Warning: Alpha feature> CPU Manager reconciliation period. Examples: `10s`, or `1m`. If not supplied, defaults to node status update frequency. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)<Warning: Alpha feature> CPU Manager reconciliation period. Examples: 10s, or 1m. If not supplied, defaults to node status update frequency. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --docker-endpoint string     Default: `unix:///var/run/docker.sock`--docker-endpoint string     Default: unix:///var/run/docker.sock
      Use this for the `docker` endpoint to communicate with. This docker-specific flag only works when container-runtime is set to `docker`.Use this for the docker endpoint to communicate with. This docker-specific flag only works when container-runtime is set to docker.
      --dynamic-config-dir string
      The Kubelet will use this directory for checkpointing downloaded configurations and tracking configuration health. The Kubelet will create this directory if it does not already exist. The path may be absolute or relative; relative paths start at the Kubelet's current working directory. Providing this flag enables dynamic Kubelet configuration. The `DynamicKubeletConfig` feature gate must be enabled to pass this flag; this gate currently defaults to `true` because the feature is beta.The Kubelet will use this directory for checkpointing downloaded configurations and tracking configuration health. The Kubelet will create this directory if it does not already exist. The path may be absolute or relative; relative paths start at the Kubelet's current working directory. Providing this flag enables dynamic Kubelet configuration. The DynamicKubeletConfig feature gate must be enabled to pass this flag. (DEPRECATED: Feature DynamicKubeletConfig is deprecated in 1.22 and will not move to GA. It is planned to be removed from Kubernetes in the version 1.23. Please use alternative ways to update kubelet configuration.)
      --enable-controller-attach-detach     Default: `true`--enable-controller-attach-detach     Default: true
      Enables the Attach/Detach controller to manage attachment/detachment of volumes scheduled to this node, and disables kubelet from executing any attach/detach operations.Enables the Attach/Detach controller to manage attachment/detachment of volumes scheduled to this node, and disables kubelet from executing any attach/detach operations. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --enable-debugging-handlers     Default: `true`--enable-debugging-handlers     Default: true
      Enables server endpoints for log collection and local running of containers and commands. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Enables server endpoints for log collection and local running of containers and commands. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --enable-server     Default: `true`--enable-server     Default: true
      Enable the Kubelet's server. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Enable the Kubelet's server. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --enforce-node-allocatable strings     Default: `pods`--enforce-node-allocatable strings     Default: pods
      A comma separated list of levels of node allocatable enforcement to be enforced by kubelet. Acceptable options are `none`, `pods`, `system-reserved`, and `kube-reserved`. If the latter two options are specified, `--system-reserved-cgroup` and `--kube-reserved-cgroup` must also be set, respectively. If `none` is specified, no additional options should be set. See https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/ for more details. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)A comma separated list of levels of node allocatable enforcement to be enforced by kubelet. Acceptable options are none, pods, system-reserved, and kube-reserved. If the latter two options are specified, --system-reserved-cgroup and --kube-reserved-cgroup must also be set, respectively. If none is specified, no additional options should be set. See https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/ for more details. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --event-burst int32     Default: 10
      Maximum size of a bursty event records, temporarily allows event records to burst to this number, while still not exceeding `--event-qps`. The number must be >= 0. If 0 will use DefaultBurst: 10. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Maximum size of a bursty event records, temporarily allows event records to burst to this number, while still not exceeding --event-qps. The number must be >= 0. If 0 will use default burst (10). (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --event-qps int32     Default: 5
      QPS to limit event creations. The number must be >= 0. If 0 will use DefaultQPS: 5. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)QPS to limit event creations. The number must be >= 0. If 0 will use default QPS (5). (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --eviction-hard mapStringString     Default: `imagefs.available<15%,memory.available<100Mi,nodefs.available<10%`--eviction-hard mapStringString     Default: imagefs.available<15%,memory.available<100Mi,nodefs.available<10%
      A set of eviction thresholds (e.g. `memory.available<1Gi`) that if met would trigger a pod eviction. On a Linux node, the default value also includes `nodefs.inodesFree<5%`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)A set of eviction thresholds (e.g. memory.available<1Gi) that if met would trigger a pod eviction. On a Linux node, the default value also includes nodefs.inodesFree<5%. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --eviction-max-pod-grace-period int32
      Maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met. If negative, defer to pod specified value. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) Maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met. If negative, defer to pod specified value. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --eviction-minimum-reclaim mapStringString
      A set of minimum reclaims (e.g. `imagefs.available=2Gi`) that describes the minimum amount of resource the kubelet will reclaim when performing a pod eviction if that resource is under pressure. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)A set of minimum reclaims (e.g. imagefs.available=2Gi) that describes the minimum amount of resource the kubelet will reclaim when performing a pod eviction if that resource is under pressure. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --eviction-pressure-transition-period duration     Default: `5m0s`--eviction-pressure-transition-period duration     Default: 5m0s
      Duration for which the kubelet has to wait before transitioning out of an eviction pressure condition. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Duration for which the kubelet has to wait before transitioning out of an eviction pressure condition. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --eviction-soft mapStringString
      A set of eviction thresholds (e.g. `memory.available>1.5Gi`) that if met over a corresponding grace period would trigger a pod eviction. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)A set of eviction thresholds (e.g. memory.available<1.5Gi) that if met over a corresponding grace period would trigger a pod eviction. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --eviction-soft-grace-period mapStringString
      A set of eviction grace periods (e.g. `memory.available=1m30s`) that correspond to how long a soft eviction threshold must hold before triggering a pod eviction. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)A set of eviction grace periods (e.g. memory.available=1m30s) that correspond to how long a soft eviction threshold must hold before triggering a pod eviction. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --experimental-allocatable-ignore-eviction     Default: `false`--experimental-allocatable-ignore-eviction     Default: false
      When set to `true`, Hard eviction thresholds will be ignored while calculating node allocatable. See https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/ for more details. (DEPRECATED: will be removed in 1.23)When set to true, hard eviction thresholds will be ignored while calculating node allocatable. See https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/ for more details. (DEPRECATED: will be removed in 1.23)
      --experimental-bootstrap-kubeconfig string
      DEPRECATED: Use `--bootstrap-kubeconfig`DEPRECATED: Use --bootstrap-kubeconfig
      --experimental-check-node-capabilities-before-mount
      [Experimental] if set to `true`, the kubelet will check the underlying node for required components (binaries, etc.) before performing the mount (DEPRECATED: will be removed in 1.23, in favor of using CSI.)[Experimental] if set to true, the kubelet will check the underlying node for required components (binaries, etc.) before performing the mount (DEPRECATED: will be removed in 1.23, in favor of using CSI.)
      --experimental-kernel-memcg-notification
      If enabled, the kubelet will integrate with the kernel memcg notification to determine if memory eviction thresholds are crossed rather than polling. This flag will be removed in 1.23. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)If enabled, the kubelet will integrate with the kernel memcg notification to determine if memory eviction thresholds are crossed rather than polling. This flag will be removed in 1.23. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --experimental-log-sanitization bool
      [Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +[Experimental] When enabled, prevents logging of fields tagged as sensitive (passwords, keys, tokens). Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --experimental-mounter-path string     Default: `mount`--experimental-mounter-path string     Default: mount
      [Experimental] Path of mounter binary. Leave empty to use the default `mount`. (DEPRECATED: will be removed in 1.23, in favor of using CSI.)[Experimental] Path of mounter binary. Leave empty to use the default mount. (DEPRECATED: will be removed in 1.23, in favor of using CSI.)
      --fail-swap-on     Default: `true`--fail-swap-on     Default: true
      Makes the Kubelet fail to start if swap is enabled on the node. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Makes the Kubelet fail to start if swap is enabled on the node. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --feature-gates mapStringBool--feature-gates <A list of 'key=true/false' pairs>
      A set of `key=value` pairs that describe feature gates for alpha/experimental features. Options are:
      +      		A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
      APIListChunking=true|false (BETA - default=true)
      APIPriorityAndFairness=true|false (BETA - default=true)
      APIResponseCompression=true|false (BETA - default=true)
      APIServerIdentity=true|false (ALPHA - default=false)
      +APIServerTracing=true|false (ALPHA - default=false)
      AllAlpha=true|false (ALPHA - default=false)
      AllBeta=true|false (BETA - default=false)
      -AllowInsecureBackendProxy=true|false (BETA - default=true)
      AnyVolumeDataSource=true|false (ALPHA - default=false)
      AppArmor=true|false (BETA - default=true)
      -BalanceAttachedNodeVolumes=true|false (ALPHA - default=false)
      -BoundServiceAccountTokenVolume=true|false (ALPHA - default=false)
      CPUManager=true|false (BETA - default=true)
      +CPUManagerPolicyOptions=true|false (ALPHA - default=false)
      CSIInlineVolume=true|false (BETA - default=true)
      CSIMigration=true|false (BETA - default=true)
      CSIMigrationAWS=true|false (BETA - default=false)
      -CSIMigrationAWSComplete=true|false (ALPHA - default=false)
      CSIMigrationAzureDisk=true|false (BETA - default=false)
      -CSIMigrationAzureDiskComplete=true|false (ALPHA - default=false)
      -CSIMigrationAzureFile=true|false (ALPHA - default=false)
      -CSIMigrationAzureFileComplete=true|false (ALPHA - default=false)
      +CSIMigrationAzureFile=true|false (BETA - default=false)
      CSIMigrationGCE=true|false (BETA - default=false)
      -CSIMigrationGCEComplete=true|false (ALPHA - default=false)
      -CSIMigrationOpenStack=true|false (BETA - default=false)
      -CSIMigrationOpenStackComplete=true|false (ALPHA - default=false)
      +CSIMigrationOpenStack=true|false (BETA - default=true)
      CSIMigrationvSphere=true|false (BETA - default=false)
      -CSIMigrationvSphereComplete=true|false (BETA - default=false)
      -CSIServiceAccountToken=true|false (ALPHA - default=false)
      -CSIStorageCapacity=true|false (ALPHA - default=false)
      +CSIStorageCapacity=true|false (BETA - default=true)
      CSIVolumeFSGroupPolicy=true|false (BETA - default=true)
      +CSIVolumeHealth=true|false (ALPHA - default=false)
      +CSRDuration=true|false (BETA - default=true)
      ConfigurableFSGroupPolicy=true|false (BETA - default=true)
      -CronJobControllerV2=true|false (ALPHA - default=false)
      +ControllerManagerLeaderMigration=true|false (BETA - default=true)
      CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
      +DaemonSetUpdateSurge=true|false (BETA - default=true)
      DefaultPodTopologySpread=true|false (BETA - default=true)
      +DelegateFSGroupToCSIDriver=true|false (ALPHA - default=false)
      DevicePlugins=true|false (BETA - default=true)
      DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
      -DownwardAPIHugePages=true|false (ALPHA - default=false)
      -DynamicKubeletConfig=true|false (BETA - default=true)
      -EfficientWatchResumption=true|false (ALPHA - default=false)
      -EndpointSlice=true|false (BETA - default=true)
      -EndpointSliceNodeName=true|false (ALPHA - default=false)
      -EndpointSliceProxying=true|false (BETA - default=true)
      -EndpointSliceTerminatingCondition=true|false (ALPHA - default=false)
      +DisableCloudProviders=true|false (ALPHA - default=false)
      +DownwardAPIHugePages=true|false (BETA - default=false)
      +EfficientWatchResumption=true|false (BETA - default=true)
      +EndpointSliceTerminatingCondition=true|false (BETA - default=true)
      EphemeralContainers=true|false (ALPHA - default=false)
      ExpandCSIVolumes=true|false (BETA - default=true)
      ExpandInUsePersistentVolumes=true|false (BETA - default=true)
      ExpandPersistentVolumes=true|false (BETA - default=true)
      +ExpandedDNSConfig=true|false (ALPHA - default=false)
      ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
      -GenericEphemeralVolume=true|false (ALPHA - default=false)
      -GracefulNodeShutdown=true|false (ALPHA - default=false)
      +GenericEphemeralVolume=true|false (BETA - default=true)
      +GracefulNodeShutdown=true|false (BETA - default=true)
      HPAContainerMetrics=true|false (ALPHA - default=false)
      HPAScaleToZero=true|false (ALPHA - default=false)
      -HugePageStorageMediumSize=true|false (BETA - default=true)
      -IPv6DualStack=true|false (ALPHA - default=false)
      -ImmutableEphemeralVolumes=true|false (BETA - default=true)
      +IPv6DualStack=true|false (BETA - default=true)
      +InTreePluginAWSUnregister=true|false (ALPHA - default=false)
      +InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
      +InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
      +InTreePluginGCEUnregister=true|false (ALPHA - default=false)
      +InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
      +InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
      +IndexedJob=true|false (BETA - default=true)
      +IngressClassNamespacedParams=true|false (BETA - default=true)
      +JobTrackingWithFinalizers=true|false (ALPHA - default=false)
      KubeletCredentialProviders=true|false (ALPHA - default=false)
      +KubeletInUserNamespace=true|false (ALPHA - default=false)
      KubeletPodResources=true|false (BETA - default=true)
      -LegacyNodeRoleBehavior=true|false (BETA - default=true)
      +KubeletPodResourcesGetAllocatable=true|false (ALPHA - default=false)
      LocalStorageCapacityIsolation=true|false (BETA - default=true)
      LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
      +LogarithmicScaleDown=true|false (BETA - default=true)
      +MemoryManager=true|false (BETA - default=true)
      +MemoryQoS=true|false (ALPHA - default=false)
      MixedProtocolLBService=true|false (ALPHA - default=false)
      -NodeDisruptionExclusion=true|false (BETA - default=true)
      +NetworkPolicyEndPort=true|false (BETA - default=true)
      +NodeSwap=true|false (ALPHA - default=false)
      NonPreemptingPriority=true|false (BETA - default=true)
      -PodDisruptionBudget=true|false (BETA - default=true)
      +PodAffinityNamespaceSelector=true|false (BETA - default=true)
      +PodDeletionCost=true|false (BETA - default=true)
      PodOverhead=true|false (BETA - default=true)
      +PodSecurity=true|false (ALPHA - default=false)
      +PreferNominatedNode=true|false (BETA - default=true)
      +ProbeTerminationGracePeriod=true|false (BETA - default=false)
      ProcMountType=true|false (ALPHA - default=false)
      +ProxyTerminatingEndpoints=true|false (ALPHA - default=false)
      QOSReserved=true|false (ALPHA - default=false)
      +ReadWriteOncePod=true|false (ALPHA - default=false)
      RemainingItemCount=true|false (BETA - default=true)
      RemoveSelfLink=true|false (BETA - default=true)
      -RootCAConfigMap=true|false (BETA - default=true)
      RotateKubeletServerCertificate=true|false (BETA - default=true)
      -RunAsGroup=true|false (BETA - default=true)
      SeccompDefault=true|false (ALPHA - default=false)
      -ServerSideApply=true|false (BETA - default=true)
      -ServiceAccountIssuerDiscovery=true|false (BETA - default=true)
      -ServiceLBNodePortControl=true|false (ALPHA - default=false)
      -ServiceNodeExclusion=true|false (BETA - default=true)
      -ServiceTopology=true|false (ALPHA - default=false)
      -SetHostnameAsFQDN=true|false (BETA - default=true)
      -SizeMemoryBackedVolumes=true|false (ALPHA - default=false)
      +ServiceInternalTrafficPolicy=true|false (BETA - default=true)
      +ServiceLBNodePortControl=true|false (BETA - default=true)
      +ServiceLoadBalancerClass=true|false (BETA - default=true)
      +SizeMemoryBackedVolumes=true|false (BETA - default=true)
      +StatefulSetMinReadySeconds=true|false (ALPHA - default=false)
      StorageVersionAPI=true|false (ALPHA - default=false)
      StorageVersionHash=true|false (BETA - default=true)
      -Sysctls=true|false (BETA - default=true)
      -TTLAfterFinished=true|false (ALPHA - default=false)
      +SuspendJob=true|false (BETA - default=true)
      +TTLAfterFinished=true|false (BETA - default=true)
      +TopologyAwareHints=true|false (ALPHA - default=false)
      TopologyManager=true|false (BETA - default=true)
      -ValidateProxyRedirects=true|false (BETA - default=true)
      -WarningHeaders=true|false (BETA - default=true)
      +VolumeCapacityPriority=true|false (ALPHA - default=false)
      WinDSR=true|false (ALPHA - default=false)
      WinOverlay=true|false (BETA - default=true)
      -WindowsEndpointSliceProxying=true|false (ALPHA - default=false)
      -(DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --file-check-frequency duration     Default: `20s`--file-check-frequency duration     Default: 20s
      Duration between checking config files for new data. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Duration between checking config files for new data. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --hairpin-mode string     Default: `promiscuous-bridge`--hairpin-mode string     Default: promiscuous-bridge
      How should the kubelet setup hairpin NAT. This allows endpoints of a Service to load balance back to themselves if they should try to access their own Service. Valid values are `promiscuous-bridge`, `hairpin-veth` and `none`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)How should the kubelet setup hairpin NAT. This allows endpoints of a Service to load balance back to themselves if they should try to access their own Service. Valid values are promiscuous-bridge, hairpin-veth and none. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --healthz-bind-address ip     Default: `127.0.0.1`--healthz-bind-address string     Default: 127.0.0.1
      The IP address for the healthz server to serve on (set to `0.0.0.0` for all IPv4 interfaces and `::` for all IPv6 interfaces). (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)The IP address for the healthz server to serve on (set to 0.0.0.0 or :: for listening in all interfaces and IP families). (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --healthz-port int32     Default: 10248
      The port of the localhost healthz endpoint (set to `0` to disable). (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)The port of the localhost healthz endpoint (set to 0 to disable). (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --hostname-override string
      If non-empty, will use this string as identification instead of the actual hostname. If `--cloud-provider` is set, the cloud provider determines the name of the node (consult cloud provider documentation to determine if and how the hostname is used).If non-empty, will use this string as identification instead of the actual hostname. If --cloud-provider is set, the cloud provider determines the name of the node (consult cloud provider documentation to determine if and how the hostname is used).
      --housekeeping-interval duration     Default: `10s`--http-check-frequency duration     Default: 20s
      Interval between container housekeepings.
      --http-check-frequency duration     Default: `20s`
      Duration between checking HTTP for new data. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Duration between checking HTTP for new data. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --image-gc-high-threshold int32     Default: 85
      The percent of disk usage after which image garbage collection is always run. Values must be within the range [0, 100], To disable image garbage collection, set to 100. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)The percent of disk usage after which image garbage collection is always run. Values must be within the range [0, 100], To disable image garbage collection, set to 100. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --image-gc-low-threshold int32     Default: 80
      The percent of disk usage before which image garbage collection is never run. Lowest disk usage to garbage collect to. Values must be within the range [0, 100] and should not be larger than that of `--image-gc-high-threshold`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)The percent of disk usage before which image garbage collection is never run. Lowest disk usage to garbage collect to. Values must be within the range [0, 100] and should not be larger than that of --image-gc-high-threshold. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --image-pull-progress-deadline duration     Default: `1m0s`--image-pull-progress-deadline duration     Default: 1m0s
      If no pulling progress is made before this deadline, the image pulling will be cancelled. This docker-specific flag only works when container-runtime is set to `docker`.If no pulling progress is made before this deadline, the image pulling will be cancelled. This docker-specific flag only works when container-runtime is set to docker. (DEPRECATED: will be removed along with dockershim.)
      --image-service-endpoint string
      [Experimental] The endpoint of remote image service. If not specified, it will be the same with `--container-runtime-endpoint` by default. Currently UNIX socket endpoint is supported on Linux, while npipe and TCP endpoints are supported on Windows. Examples: `unix:///var/run/dockershim.sock`, `npipe:////./pipe/dockershim`[Experimental] The endpoint of remote image service. If not specified, it will be the same with --container-runtime-endpoint by default. Currently UNIX socket endpoint is supported on Linux, while npipe and TCP endpoints are supported on Windows. Examples: unix:///var/run/dockershim.sock, npipe:////./pipe/dockershim
      --iptables-drop-bit int32     Default: 15
      The bit of the `fwmark` space to mark packets for dropping. Must be within the range [0, 31]. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)The bit of the fwmark space to mark packets for dropping. Must be within the range [0, 31]. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --iptables-masquerade-bit int32     Default: 14
      The bit of the `fwmark` space to mark packets for SNAT. Must be within the range [0, 31]. Please match this parameter with corresponding parameter in `kube-proxy`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)The bit of the fwmark space to mark packets for SNAT. Must be within the range [0, 31]. Please match this parameter with corresponding parameter in kube-proxy. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --kernel-memcg-notification
      If enabled, the kubelet will integrate with the kernel memcg notification to determine if memory eviction thresholds are crossed rather than polling. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)If enabled, the kubelet will integrate with the kernel memcg notification to determine if memory eviction thresholds are crossed rather than polling. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --kube-api-burst int32     Default: 10
      Burst to use while talking with kubernetes API server. The number must be >= 0. If 0 will use DefaultBurst: 10. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Burst to use while talking with kubernetes API server. The number must be >= 0. If 0 will use default burst (10). (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --kube-api-content-type string     Default: `application/vnd.kubernetes.protobuf`--kube-api-content-type string     Default: application/vnd.kubernetes.protobuf
      Content type of requests sent to apiserver. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Content type of requests sent to apiserver. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --kube-api-qps int32     Default: 5
      QPS to use while talking with kubernetes API server. The number must be >= 0. If 0 will use DefaultQPS: 5. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)QPS to use while talking with kubernetes API server. The number must be >= 0. If 0 will use default QPS (5). (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --kube-reserved mapStringString     Default: <None>
      A set of `=` (e.g. `cpu=200m,memory=500Mi,ephemeral-storage=1Gi,pid='100'`) pairs that describe resources reserved for kubernetes system components. Currently `cpu`, `memory` and local `ephemeral-storage` for root file system are supported. See http://kubernetes.io/docs/user-guide/compute-resources for more detail. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)A set of <resource name>=<resource quantity> (e.g. cpu=200m,memory=500Mi,ephemeral-storage=1Gi,pid='100') pairs that describe resources reserved for kubernetes system components. Currently cpu, memory and local ephemeral-storage for root file system are supported. See http://kubernetes.io/docs/user-guide/compute-resources for more detail. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --kube-reserved-cgroup string     Default: `''`--kube-reserved-cgroup string     Default: ''
      Absolute name of the top level cgroup that is used to manage kubernetes components for which compute resources were reserved via `--kube-reserved` flag. Ex. `/kube-reserved`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Absolute name of the top level cgroup that is used to manage kubernetes components for which compute resources were reserved via --kube-reserved flag. Ex. /kube-reserved. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --kubeconfig string
      Path to a kubeconfig file, specifying how to connect to the API server. Providing `--kubeconfig` enables API server mode, omitting `--kubeconfig` enables standalone mode. Path to a kubeconfig file, specifying how to connect to the API server. Providing --kubeconfig enables API server mode, omitting --kubeconfig enables standalone mode.
      --kubelet-cgroups string
      Optional absolute name of cgroups to create and run the Kubelet in. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Optional absolute name of cgroups to create and run the Kubelet in. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --log-backtrace-at traceLocation     Default: `:0`--log-backtrace-at <A string of format 'file:line'>     Default: ":0"
      When logging hits line `:`, emit a stack trace.When logging hits line :, emit a stack trace.
      --log-flush-frequency duration     Default: `5s`--log-flush-frequency duration     Default: 5s
      Maximum number of seconds between log flushes.
      --logging-format string     Default: `text`--logging-format string     Default: text
      Sets the log format. Permitted formats: `text`, `json`.\nNon-default formats don't honor these flags: `--add-dir-header`, `--alsologtostderr`, `--log-backtrace-at`, `--log-dir`, `--log-file`, `--log-file-max-size`, `--logtostderr`, `--skip_headers`, `--skip_log_headers`, `--stderrthreshold`, `--log-flush-frequency`.\nNon-default choices are currently alpha and subject to change without warning. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Sets the log format. Permitted formats: text, json.
      Non-default formats don't honor these flags: --add-dir-header, --alsologtostderr, --log-backtrace-at, --log-dir, --log-file, --log-file-max-size, --logtostderr, --skip_headers, --skip_log_headers, --stderrthreshold, --log-flush-frequency.
      Non-default choices are currently alpha and subject to change without warning. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --logtostderr     Default: `true`--logtostderr     Default: true
      log to standard error instead of files.
      --make-iptables-util-chains     Default: `true`--make-iptables-util-chains     Default: true
      If true, kubelet will ensure `iptables` utility rules are present on host. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)If true, kubelet will ensure iptables utility rules are present on host. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --manifest-url string
      URL for accessing additional Pod specifications to run (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)URL for accessing additional Pod specifications to run (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --manifest-url-header string
      Comma-separated list of HTTP headers to use when accessing the URL provided to `--manifest-url`. Multiple headers with the same name will be added in the same order provided. This flag can be repeatedly invoked. For example: `--manifest-url-header 'a:hello,b:again,c:world' --manifest-url-header 'b:beautiful'` (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Comma-separated list of HTTP headers to use when accessing the URL provided to --manifest-url. Multiple headers with the same name will be added in the same order provided. This flag can be repeatedly invoked. For example: --manifest-url-header 'a:hello,b:again,c:world' --manifest-url-header 'b:beautiful' (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --master-service-namespace string     Default: `default`--master-service-namespace string     Default: default
      The namespace from which the kubernetes master services should be injected into pods. (DEPRECATED: This flag will be removed in a future version.) --max-open-files int     Default: 1000000
      Number of files that can be opened by Kubelet process. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Number of files that can be opened by Kubelet process. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --max-pods int32     Default: 110
      Number of Pods that can run on this Kubelet. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Number of Pods that can run on this Kubelet. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --maximum-dead-containers int32     Default: -1
      Maximum number of old instances of containers to retain globally. Each container takes up some disk space. To disable, set to a negative number. (DEPRECATED: Use `--eviction-hard` or `--eviction-soft` instead. Will be removed in a future version.)Maximum number of old instances of containers to retain globally. Each container takes up some disk space. To disable, set to a negative number. (DEPRECATED: Use --eviction-hard or --eviction-soft instead. Will be removed in a future version.)
      --maximum-dead-containers-per-container int32     Default: 1
      Maximum number of old instances to retain per container. Each container takes up some disk space. (DEPRECATED: Use `--eviction-hard` or `--eviction-soft` instead. Will be removed in a future version.)Maximum number of old instances to retain per container. Each container takes up some disk space. (DEPRECATED: Use --eviction-hard or --eviction-soft instead. Will be removed in a future version.)
      --memory-manager-policy string     Default: None
      Memory Manager policy to use. Possible values: 'None', 'Static'. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --minimum-container-ttl-duration duration
      Minimum age for a finished container before it is garbage collected. Examples: `300ms`, `10s` or `2h45m` (DEPRECATED: Use `--eviction-hard` or `--eviction-soft` instead. Will be removed in a future version.)Minimum age for a finished container before it is garbage collected. Examples: '300ms', '10s' or '2h45m' (DEPRECATED: Use --eviction-hard or --eviction-soft instead. Will be removed in a future version.)
      --minimum-image-ttl-duration duration     Default: `2m0s`--minimum-image-ttl-duration duration     Default: 2m0s
      Minimum age for an unused image before it is garbage collected. Examples: `300ms`, `10s` or `2h45m`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Minimum age for an unused image before it is garbage collected. Examples: '300ms', '10s' or '2h45m'. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --network-plugin string
      <Warning: Alpha feature> The name of the network plugin to be invoked for various events in kubelet/pod lifecycle. This docker-specific flag only works when container-runtime is set to `docker`.The name of the network plugin to be invoked for various events in kubelet/pod lifecycle. This docker-specific flag only works when container-runtime is set to docker. (DEPRECATED: will be removed along with dockershim.)
      --network-plugin-mtu int32
      <Warning: Alpha feature> The MTU to be passed to the network plugin, to override the default. Set to `0` to use the default 1460 MTU. This docker-specific flag only works when container-runtime is set to `docker`.The MTU to be passed to the network plugin, to override the default. Set to 0 to use the default 1460 MTU. This docker-specific flag only works when container-runtime is set to docker. (DEPRECATED: will be removed along with dockershim.)
      --node-ip string
      IP address of the node. If set, kubelet will use this IP address for the nodeIP address (or comma-separated dual-stack IP addresses) of the node. If unset, kubelet will use the node's default IPv4 address, if any, or its default IPv6 address if it has no IPv4 addresses. You can pass '::' to make it prefer the default IPv6 address rather than the default IPv4 address.
      --node-labels mapStringString
      <Warning: Alpha feature>Labels to add when registering the node in the cluster. Labels must be `key=value pairs` separated by `,`. Labels in the `kubernetes.io` namespace must begin with an allowed prefix (`kubelet.kubernetes.io`, `node.kubernetes.io`) or be in the specifically allowed set (`beta.kubernetes.io/arch`, `beta.kubernetes.io/instance-type`, `beta.kubernetes.io/os`, `failure-domain.beta.kubernetes.io/region`, `failure-domain.beta.kubernetes.io/zone`, `kubernetes.io/arch`, `kubernetes.io/hostname`, `kubernetes.io/os`, `node.kubernetes.io/instance-type`, `topology.kubernetes.io/region`, `topology.kubernetes.io/zone`)<Warning: Alpha feature>Labels to add when registering the node in the cluster. Labels must be key=value pairs separated by ','. Labels in the 'kubernetes.io' namespace must begin with an allowed prefix ('kubelet.kubernetes.io', 'node.kubernetes.io') or be in the specifically allowed set ('beta.kubernetes.io/arch', 'beta.kubernetes.io/instance-type', 'beta.kubernetes.io/os', 'failure-domain.beta.kubernetes.io/region', 'failure-domain.beta.kubernetes.io/zone', 'kubernetes.io/arch', 'kubernetes.io/hostname', 'kubernetes.io/os', 'node.kubernetes.io/instance-type', 'topology.kubernetes.io/region', 'topology.kubernetes.io/zone')
      --node-status-max-images int32     Default: 50
      The maximum number of images to report in `node.status.images`. If `-1` is specified, no cap will be applied. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)The maximum number of images to report in node.status.images. If -1 is specified, no cap will be applied. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --node-status-update-frequency duration     Default: `10s`--node-status-update-frequency duration     Default: 10s
      Specifies how often kubelet posts node status to master. Note: be cautious when changing the constant, it must work with nodeMonitorGracePeriod in Node controller. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Specifies how often kubelet posts node status to master. Note: be cautious when changing the constant, it must work with nodeMonitorGracePeriod in Node controller. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --non-masquerade-cidr string     Default: `10.0.0.0/8`--non-masquerade-cidr string     Default: 10.0.0.0/8
      Traffic to IPs outside this range will use IP masquerade. Set to `0.0.0.0/0` to never masquerade. (DEPRECATED: will be removed in a future version)Traffic to IPs outside this range will use IP masquerade. Set to '0.0.0.0/0' to never masquerade. (DEPRECATED: will be removed in a future version)
      --one-output
      If true, only write logs to their native severity level (vs also writing to each lower severity level. -If true, only write logs to their native severity level (vs also writing to each lower severity level).
      --oom-score-adj int32     Default: -999
      The oom-score-adj value for kubelet process. Values must be within the range [-1000, 1000]. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)The oom-score-adj value for kubelet process. Values must be within the range [-1000, 1000]. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --pod-cidr string
      The CIDR to use for pod IP addresses, only used in standalone mode. In cluster mode, this is obtained from the master. For IPv6, the maximum number of IP's allocated is 65536 (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)The CIDR to use for pod IP addresses, only used in standalone mode. In cluster mode, this is obtained from the master. For IPv6, the maximum number of IP's allocated is 65536 (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --pod-infra-container-image string     Default: `k8s.gcr.io/pause:3.2`--pod-infra-container-image string     Default: k8s.gcr.io/pause:3.5
      Specified image will not be pruned by the image garbage collector. When container-runtime is set to `docker`, all containers in each pod will use the network/ipc namespaces from this image. Other CRI implementations have their own configuration to set this image.Specified image will not be pruned by the image garbage collector. When container-runtime is set to docker, all containers in each pod will use the network/IPC namespaces from this image. Other CRI implementations have their own configuration to set this image.
      --pod-manifest-path string
      Path to the directory containing static pod files to run, or the path to a single static pod file. Files starting with dots will be ignored. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Path to the directory containing static pod files to run, or the path to a single static pod file. Files starting with dots will be ignored. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --pod-max-pids int     Default: -1
      Set the maximum number of processes per pod. If `-1`, the kubelet defaults to the node allocatable PID capacity. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Set the maximum number of processes per pod. If -1, the kubelet defaults to the node allocatable PID capacity. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --pods-per-core int32
      Number of Pods per core that can run on this Kubelet. The total number of Pods on this Kubelet cannot exceed `--max-pods`, so `--max-pods` will be used if this calculation results in a larger number of Pods allowed on the Kubelet. A value of `0` disables this limit. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Number of Pods per core that can run on this kubelet. The total number of pods on this kubelet cannot exceed --max-pods, so --max-pods will be used if this calculation results in a larger number of pods allowed on the kubelet. A value of 0 disables this limit. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --port int32     Default: 10250
      The port for the Kubelet to serve on. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)The port for the kubelet to serve on. (DEPRECATED: This parameter should be set via the config file specified by the kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --protect-kernel-defaults
      Default kubelet behaviour for kernel tuning. If set, kubelet errors if any of kernel tunables is different than kubelet defaults. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) Default kubelet behaviour for kernel tuning. If set, kubelet errors if any of kernel tunables is different than kubelet defaults. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --provider-id string
      Unique identifier for identifying the node in a machine database, i.e cloud provider. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Unique identifier for identifying the node in a machine database, i.e cloud provider. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --qos-reserved mapStringString
      <Warning: Alpha feature> A set of `=` (e.g. `memory=50%`) pairs that describe how pod resource requests are reserved at the QoS level. Currently only memory is supported. Requires the `QOSReserved` feature gate to be enabled. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)<Warning: Alpha feature> A set of <resource name>=<percentage> (e.g. memory=50%) pairs that describe how pod resource requests are reserved at the QoS level. Currently only memory is supported. Requires the QOSReserved feature gate to be enabled. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --read-only-port int32     Default: 10255
      The read-only port for the Kubelet to serve on with no authentication/authorization (set to `0` to disable). (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)The read-only port for the kubelet to serve on with no authentication/authorization (set to 0 to disable). (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --redirect-container-streaming--register-node     Default: true
      Enables container streaming redirect. If false, kubelet will proxy container streaming data between the API server and container runtime; if `true`, kubelet will return an HTTP redirect to the API server, and the API server will access container runtime directly. The proxy approach is more secure, but introduces some overhead. The redirect approach is more performant, but less secure because the connection between apiserver and container runtime may not be authenticated. (DEPRECATED: Container streaming redirection will be removed from the kubelet in v1.20, and this flag will be removed in v1.22. For more details, see http://git.k8s.io/enhancements/keps/sig-node/20191205-container-streaming-requests.md)Register the node with the API server. If --kubeconfig is not provided, this flag is irrelevant, as the Kubelet won't have an API server to register with.
      --register-node     Default: `true`--register-schedulable     Default: true
      Register the node with the API server. If `--kubeconfig` is not provided, this flag is irrelevant, as the Kubelet won't have an API server to register with. Default to `true`.
      --register-schedulable     Default: `true`
      Register the node as schedulable. Won't have any effect if `--register-node` is false. (DEPRECATED: will be removed in a future version)Register the node as schedulable. Won't have any effect if --register-node is false. (DEPRECATED: will be removed in a future version)
      --register-with-taints mapStringString
      Register the node with the given list of taints (comma separated `=:`). No-op if `--register-node` is `false`.Register the node with the given list of taints (comma separated <key>=<value>:<effect>). No-op if --register-node is false.
      --registry-burst int32     Default: 10
      Maximum size of a bursty pulls, temporarily allows pulls to burst to this number, while still not exceeding `--registry-qps`. Only used if `--registry-qps > 0`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Maximum size of a bursty pulls, temporarily allows pulls to burst to this number, while still not exceeding --registry-qps. Only used if --registry-qps is greater than 0. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --registry-qps int32     Default: 5
      If > 0, limit registry pull QPS to this value. If `0`, unlimited. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)If > 0, limit registry pull QPS to this value. If 0, unlimited. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --reserved-cpus string
      A comma-separated list of CPUs or CPU ranges that are reserved for system and kubernetes usage. This specific list will supersede cpu counts in `--system-reserved` and `--kube-reserved`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)A comma-separated list of CPUs or CPU ranges that are reserved for system and kubernetes usage. This specific list will supersede cpu counts in --system-reserved and --kube-reserved. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --resolv-conf string     Default: `/etc/resolv.conf`--reserved-memory string
      Resolver configuration file used as the basis for the container DNS resolution configuration. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)A comma-separated list of memory reservations for NUMA nodes. (e.g. --reserved-memory 0:memory=1Gi,hugepages-1M=2Gi --reserved-memory 1:memory=2Gi). The total sum for each memory type should be equal to the sum of --kube-reserved, --system-reserved and --eviction-threshold. See https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/#reserved-memory-flag for more details. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --root-dir string     Default: `/var/lib/kubelet`--resolv-conf string     Default: /etc/resolv.conf
      Resolver configuration file used as the basis for the container DNS resolution configuration. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --root-dir string     Default: /var/lib/kubelet
      Directory path for managing kubelet files (volume mounts, etc). --rotate-certificates
      <Warning: Beta feature> Auto rotate the kubelet client certificates by requesting new certificates from the `kube-apiserver` when the certificate expiration approaches. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)<Warning: Beta feature> Auto rotate the kubelet client certificates by requesting new certificates from the kube-apiserver when the certificate expiration approaches. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --rotate-server-certificates
      Auto-request and rotate the kubelet serving certificates by requesting new certificates from the `kube-apiserver` when the certificate expiration approaches. Requires the `RotateKubeletServerCertificate` feature gate to be enabled, and approval of the submitted `CertificateSigningRequest` objects. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Auto-request and rotate the kubelet serving certificates by requesting new certificates from the kube-apiserver when the certificate expiration approaches. Requires the RotateKubeletServerCertificate feature gate to be enabled, and approval of the submitted CertificateSigningRequest objects. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --runonce
      If `true`, exit after spawning pods from local manifests or remote urls. Exclusive with `--enable-server` (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)If true, exit after spawning pods from local manifests or remote urls. Exclusive with --enable-server (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --runtime-request-timeout duration     Default: `2m0s`--runtime-request-timeout duration     Default: 2m0s
      Timeout of all runtime requests except long running request - `pull`, `logs`, `exec` and `attach`. When timeout exceeded, kubelet will cancel the request, throw out an error and retry later. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Timeout of all runtime requests except long running request - pull, logs, exec and attach. When timeout exceeded, kubelet will cancel the request, throw out an error and retry later. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --seccomp-default RuntimeDefault     Default: `false`--seccomp-default RuntimeDefault
      <Warning: Alpha feature> Enable the use of RuntimeDefault as the default seccomp profile for all workloads. The SeccompDefault feature gate must be enabled to allow this flag, which is disabled per default.<Warning: Alpha feature> Enable the use of RuntimeDefault as the default seccomp profile for all workloads. The SeccompDefault feature gate must be enabled to allow this flag, which is disabled by default.
      --seccomp-profile-root string     Default: `/var/lib/kubelet/seccomp`--seccomp-profile-root string     Default: /var/lib/kubelet/seccomp
      <Warning: Alpha feature> Directory path for seccomp profiles. (DEPRECATED: will be removed in 1.23, in favor of using the `/seccomp` directory) +<Warning: Alpha feature> Directory path for seccomp profiles. (DEPRECATED: will be removed in 1.23, in favor of using the /seccomp directory)
      --serialize-image-pulls     Default: `true`--serialize-image-pulls     Default: true
      Pull images one at a time. We recommend *not* changing the default value on nodes that run docker daemon with version < 1.9 or an `aufs` storage backend. Issue #10959 has more details. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Pull images one at a time. We recommend *not* changing the default value on nodes that run docker daemon with version < 1.9 or an aufs storage backend. Issue #10959 has more details. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --skip-headers
      If `true`, avoid header prefixes in the log messagesIf true, avoid header prefixes in the log messages
      --skip-log-headers
      If `true`, avoid headers when opening log filesIf true, avoid headers when opening log files
      --streaming-connection-idle-timeout duration     Default: `4h0m0s`--streaming-connection-idle-timeout duration     Default: 4h0m0s
      Maximum time a streaming connection can be idle before the connection is automatically closed. `0` indicates no timeout. Example: `5m`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Maximum time a streaming connection can be idle before the connection is automatically closed. 0 indicates no timeout. Example: 5m. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --sync-frequency duration     Default: `1m0s`--sync-frequency duration     Default: 1m0s
      Max period between synchronizing running containers and config. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Max period between synchronizing running containers and config. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --system-cgroups string
      Optional absolute name of cgroups in which to place all non-kernel processes that are not already inside a cgroup under `/`. Empty for no container. Rolling back the flag requires a reboot. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Optional absolute name of cgroups in which to place all non-kernel processes that are not already inside a cgroup under '/'. Empty for no container. Rolling back the flag requires a reboot. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --system-reserved mapStringString     Default: \--system-reserved mapStringString     Default: <none>
      A set of `=` (e.g. `cpu=200m,memory=500Mi,ephemeral-storage=1Gi,pid='100'`) pairs that describe resources reserved for non-kubernetes components. Currently only `cpu` and `memory` are supported. See http://kubernetes.io/docs/user-guide/compute-resources for more detail. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)A set of <resource name>=<resource quantity> (e.g. cpu=200m,memory=500Mi,ephemeral-storage=1Gi,pid='100') pairs that describe resources reserved for non-kubernetes components. Currently only cpu and memory are supported. See http://kubernetes.io/docs/user-guide/compute-resources for more detail. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --system-reserved-cgroup string     Default: `''`--system-reserved-cgroup string     Default: ''
      Absolute name of the top level cgroup that is used to manage non-kubernetes components for which compute resources were reserved via `--system-reserved` flag. Ex. `/system-reserved`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Absolute name of the top level cgroup that is used to manage non-kubernetes components for which compute resources were reserved via --system-reserved flag. Ex. /system-reserved. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --tls-cert-file string
      File containing x509 Certificate used for serving HTTPS (with intermediate certs, if any, concatenated after server cert). If `--tls-cert-file` and `--tls-private-key-file` are not provided, a self-signed certificate and key are generated for the public address and saved to the directory passed to `--cert-dir`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)File containing x509 Certificate used for serving HTTPS (with intermediate certs, if any, concatenated after server cert). If --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to the directory passed to --cert-dir. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --tls-cipher-suites stringSlice--tls-cipher-suites strings
      Comma-separated list of cipher suites for the server. If omitted, the default Go cipher suites will be used.
      Preferred values: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384.
      -Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_RC4_128_SHA. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.) +Insecure values: +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_RC4_128_SHA. +(DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --tls-min-version string
      Minimum TLS version supported. Possible values: `VersionTLS10`, `VersionTLS11`, `VersionTLS12`, `VersionTLS13` (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Minimum TLS version supported. Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --tls-private-key-file string
      File containing x509 private key matching `--tls-cert-file`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)File containing x509 private key matching --tls-cert-file. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --topology-manager-policy string     Default: `none`--topology-manager-policy string     Default: 'none'
      Topology Manager policy to use. Possible values: `none`, `best-effort`, `restricted`, `single-numa-node`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Topology Manager policy to use. Possible values: 'none', 'best-effort', 'restricted', 'single-numa-node'. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --topology-manager-scope string     Default: `container`--topology-manager-scope string     Default: container
      Scope to which topology hints applied. Topology Manager collects hints from Hint Providers and applies them to defined scope to ensure the pod admission. Possible values: 'container' (default), 'pod'. (default "container") (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Scope to which topology hints applied. Topology Manager collects hints from Hint Providers and applies them to defined scope to ensure the pod admission. Possible values: 'container', 'pod'. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --vmodule moduleSpec--vmodule <A list of 'pattern=N' string>
      Comma-separated list of `pattern=N` settings for file-filtered loggingComma-separated list of pattern=N settings for file-filtered logging
      --volume-plugin-dir string     Default: `/usr/libexec/kubernetes/kubelet-plugins/volume/exec/`--volume-plugin-dir string     Default: /usr/libexec/kubernetes/kubelet-plugins/volume/exec/
      The full path of the directory in which to search for additional third party volume plugins. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)The full path of the directory in which to search for additional third party volume plugins. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      --volume-stats-agg-period duration     Default: `1m0s`--volume-stats-agg-period duration     Default: 1m0s
      Specifies interval for kubelet to calculate and cache the volume disk usage for all pods and volumes. To disable volume calculations, set to `0`. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)Specifies interval for kubelet to calculate and cache the volume disk usage for all pods and volumes. To disable volume calculations, set to 0. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's --config flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
      From a6a5d359e59863ddd08ca84a69e5c8f8f7eb0b48 Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Sun, 8 Aug 2021 20:49:16 +0800 Subject: [PATCH 105/279] Update kubectl reference for 1.22 --- .../generated/kubectl/kubectl-commands.html | 574 ++++++++++-------- 1 file changed, 310 insertions(+), 264 deletions(-) diff --git a/static/docs/reference/generated/kubectl/kubectl-commands.html b/static/docs/reference/generated/kubectl/kubectl-commands.html index 6d1b082c61..06cfbabb1d 100644 --- a/static/docs/reference/generated/kubectl/kubectl-commands.html +++ b/static/docs/reference/generated/kubectl/kubectl-commands.html @@ -28,17 +28,17 @@ inspect them.

      create

      -

      Create a pod using the data in pod.json.

      +

      Create a pod using the data in pod.json

      kubectl create -f ./pod.json
      -

      Create a pod based on the JSON passed into stdin.

      +

      Create a pod based on the JSON passed into stdin

      cat pod.json | kubectl create -f -
      -

      Edit the data in docker-registry.yaml in JSON then create the resource using the edited data.

      +

      Edit the data in docker-registry.yaml in JSON then create the resource using the edited data

      kubectl create -f docker-registry.yaml --edit -o json
      @@ -158,36 +158,36 @@ inspect them.

      clusterrole

      -

      Create a ClusterRole named "pod-reader" that allows user to perform "get", "watch" and "list" on pods

      +

      Create a cluster role named "pod-reader" that allows user to perform "get", "watch" and "list" on pods

      kubectl create clusterrole pod-reader --verb=get,list,watch --resource=pods
      -

      Create a ClusterRole named "pod-reader" with ResourceName specified

      +

      Create a cluster role named "pod-reader" with ResourceName specified

      kubectl create clusterrole pod-reader --verb=get --resource=pods --resource-name=readablepod --resource-name=anotherpod
      -

      Create a ClusterRole named "foo" with API Group specified

      +

      Create a cluster role named "foo" with API Group specified

      kubectl create clusterrole foo --verb=get,list,watch --resource=rs.extensions
      -

      Create a ClusterRole named "foo" with SubResource specified

      +

      Create a cluster role named "foo" with SubResource specified

      kubectl create clusterrole foo --verb=get,list,watch --resource=pods,pods/status
      -

      Create a ClusterRole name "foo" with NonResourceURL specified

      +

      Create a cluster role name "foo" with NonResourceURL specified

      kubectl create clusterrole "foo" --verb=get --non-resource-url=/logs/*
      -

      Create a ClusterRole name "monitoring" with AggregationRule specified

      +

      Create a cluster role name "monitoring" with AggregationRule specified

      kubectl create clusterrole monitoring --aggregation-rule="rbac.example.com/aggregate-to-monitoring=true"
      -

      Create a ClusterRole.

      +

      Create a cluster role.

      Usage

      $ kubectl create clusterrole NAME --verb=verb --resource=resource.group [--resource-name=resourcename] [--dry-run=server|client|none]

      Flags

      @@ -284,11 +284,11 @@ inspect them.

      clusterrolebinding

      -

      Create a ClusterRoleBinding for user1, user2, and group1 using the cluster-admin ClusterRole

      +

      Create a cluster role binding for user1, user2, and group1 using the cluster-admin cluster role

      kubectl create clusterrolebinding cluster-admin --clusterrole=cluster-admin --user=user1 --user=user2 --group=group1
      -

      Create a ClusterRoleBinding for a particular ClusterRole.

      +

      Create a cluster role binding for a particular cluster role.

      Usage

      $ kubectl create clusterrolebinding NAME --clusterrole=NAME [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none]

      Flags

      @@ -373,34 +373,34 @@ inspect them.

      configmap

      -

      Create a new configmap named my-config based on folder bar

      +

      Create a new config map named my-config based on folder bar

      kubectl create configmap my-config --from-file=path/to/bar
      -

      Create a new configmap named my-config with specified keys instead of file basenames on disk

      +

      Create a new config map named my-config with specified keys instead of file basenames on disk

      kubectl create configmap my-config --from-file=key1=/path/to/bar/file1.txt --from-file=key2=/path/to/bar/file2.txt
      -

      Create a new configmap named my-config with key1=config1 and key2=config2

      +

      Create a new config map named my-config with key1=config1 and key2=config2

      kubectl create configmap my-config --from-literal=key1=config1 --from-literal=key2=config2
      -

      Create a new configmap named my-config from the key=value pairs in the file

      +

      Create a new config map named my-config from the key=value pairs in the file

      kubectl create configmap my-config --from-file=path/to/bar
      -

      Create a new configmap named my-config from an env file

      +

      Create a new config map named my-config from an env file

      kubectl create configmap my-config --from-env-file=path/to/bar.env
      -

      Create a configmap based on a file, directory, or specified literal value.

      -

      A single configmap may package one or more key/value pairs.

      -

      When creating a configmap based on a file, the key will default to the basename of the file, and the value will default to the file content. If the basename is an invalid key, you may specify an alternate key.

      -

      When creating a configmap based on a directory, each file whose basename is a valid key in the directory will be packaged into the configmap. Any directory entries except regular files are ignored (e.g. subdirectories, symlinks, devices, pipes, etc).

      +

      Create a config map based on a file, directory, or specified literal value.

      +

      A single config map may package one or more key/value pairs.

      +

      When creating a config map based on a file, the key will default to the basename of the file, and the value will default to the file content. If the basename is an invalid key, you may specify an alternate key.

      +

      When creating a config map based on a directory, each file whose basename is a valid key in the directory will be packaged into the config map. Any directory entries except regular files are ignored (e.g. subdirectories, symlinks, devices, pipes, etc).

      Usage

      $ kubectl create configmap NAME [--from-file=[key=]source] [--from-literal=key1=value1] [--dry-run=server|client|none]

      Flags

      @@ -491,16 +491,16 @@ inspect them.

      cronjob

      -

      Create a cronjob

      +

      Create a cron job

      kubectl create cronjob my-job --image=busybox --schedule="*/1 * * * *"
      -

      Create a cronjob with command

      +

      Create a cron job with a command

      kubectl create cronjob my-job --image=busybox --schedule="*/1 * * * *" -- date
      -

      Create a cronjob with the specified name.

      +

      Create a cron job with the specified name.

      Usage

      $ kubectl create cronjob NAME --image=image --schedule='0/5 * * * ?' -- [COMMAND] [args...]

      Flags

      @@ -585,22 +585,22 @@ inspect them.

      deployment

      -

      Create a deployment named my-dep that runs the busybox image.

      +

      Create a deployment named my-dep that runs the busybox image

      kubectl create deployment my-dep --image=busybox
      -

      Create a deployment with command

      +

      Create a deployment with a command

      kubectl create deployment my-dep --image=busybox -- date
      -

      Create a deployment named my-dep that runs the nginx image with 3 replicas.

      +

      Create a deployment named my-dep that runs the nginx image with 3 replicas

      kubectl create deployment my-dep --image=nginx --replicas=3
      -

      Create a deployment named my-dep that runs the busybox image and expose port 5701.

      +

      Create a deployment named my-dep that runs the busybox image and expose port 5701

      kubectl create deployment my-dep --image=busybox --port=5701
      @@ -637,12 +637,6 @@ inspect them.

      Name of the manager used to track field ownership. -generator - - -The name of the API generator to use. - - image [] @@ -841,12 +835,12 @@ inspect them.

      kubectl create job my-job --image=busybox
      -

      Create a job with command

      +

      Create a job with a command

      kubectl create job my-job --image=busybox -- date
      -

      Create a job from a CronJob named "a-cronjob"

      +

      Create a job from a cron job named "a-cronjob"

      kubectl create job test-job --from=cronjob/a-cronjob
      @@ -1000,16 +994,16 @@ inspect them.

      poddisruptionbudget

      -

      Create a pod disruption budget named my-pdb that will select all pods with the app=rails label # and require at least one of them being available at any point in time.

      +

      Create a pod disruption budget named my-pdb that will select all pods with the app=rails label # and require at least one of them being available at any point in time

      kubectl create poddisruptionbudget my-pdb --selector=app=rails --min-available=1
      -

      Create a pod disruption budget named my-pdb that will select all pods with the app=nginx label # and require at least half of the pods selected to be available at any point in time.

      +

      Create a pod disruption budget named my-pdb that will select all pods with the app=nginx label # and require at least half of the pods selected to be available at any point in time

      kubectl create pdb my-pdb --selector=app=nginx --min-available=50%
      -

      Create a pod disruption budget with the specified name, selector, and desired minimum available pods

      +

      Create a pod disruption budget with the specified name, selector, and desired minimum available pods.

      Usage

      $ kubectl create poddisruptionbudget NAME --selector=SELECTOR --min-available=N [--dry-run=server|client|none]

      Flags

      @@ -1094,21 +1088,21 @@ inspect them.

      priorityclass

      -

      Create a priorityclass named high-priority

      +

      Create a priority class named high-priority

      kubectl create priorityclass high-priority --value=1000 --description="high priority"
      -

      Create a priorityclass named default-priority that considered as the global default priority

      +

      Create a priority class named default-priority that is considered as the global default priority

      kubectl create priorityclass default-priority --value=1000 --global-default=true --description="default priority"
      -

      Create a priorityclass named high-priority that can not preempt pods with lower priority

      +

      Create a priority class named high-priority that cannot preempt pods with lower priority

      kubectl create priorityclass high-priority --value=1000 --description="high priority" --preemption-policy="Never"
      -

      Create a priorityclass with the specified name, value, globalDefault and description

      +

      Create a priority class with the specified name, value, globalDefault and description.

      Usage

      $ kubectl create priorityclass NAME --value=VALUE --global-default=BOOL [--dry-run=server|client|none]

      Flags

      @@ -1199,16 +1193,16 @@ inspect them.

      quota

      -

      Create a new resourcequota named my-quota

      +

      Create a new resource quota named my-quota

      kubectl create quota my-quota --hard=cpu=1,memory=1G,pods=2,services=3,replicationcontrollers=2,resourcequotas=1,secrets=5,persistentvolumeclaims=10
      -

      Create a new resourcequota named best-effort

      +

      Create a new resource quota named best-effort

      kubectl create quota best-effort --hard=pods=100 --scopes=BestEffort
      -

      Create a resourcequota with the specified name, hard limits and optional scopes

      +

      Create a resource quota with the specified name, hard limits, and optional scopes.

      Usage

      $ kubectl create quota NAME [--hard=key1=value1,key2=value2] [--scopes=Scope1,Scope2] [--dry-run=server|client|none]

      Flags

      @@ -1287,22 +1281,22 @@ inspect them.

      role

      -

      Create a Role named "pod-reader" that allows user to perform "get", "watch" and "list" on pods

      +

      Create a role named "pod-reader" that allows user to perform "get", "watch" and "list" on pods

      kubectl create role pod-reader --verb=get --verb=list --verb=watch --resource=pods
      -

      Create a Role named "pod-reader" with ResourceName specified

      +

      Create a role named "pod-reader" with ResourceName specified

      kubectl create role pod-reader --verb=get --resource=pods --resource-name=readablepod --resource-name=anotherpod
      -

      Create a Role named "foo" with API Group specified

      +

      Create a role named "foo" with API Group specified

      kubectl create role foo --verb=get,list,watch --resource=rs.extensions
      -

      Create a Role named "foo" with SubResource specified

      +

      Create a role named "foo" with SubResource specified

      kubectl create role foo --verb=get,list,watch --resource=pods,pods/status
      @@ -1391,11 +1385,11 @@ inspect them.

      rolebinding

      -

      Create a RoleBinding for user1, user2, and group1 using the admin ClusterRole

      +

      Create a role binding for user1, user2, and group1 using the admin cluster role

      kubectl create rolebinding admin --clusterrole=admin --user=user1 --user=user2 --group=group1
      -

      Create a RoleBinding for a particular Role or ClusterRole.

      +

      Create a role binding for a particular role or cluster role.

      Usage

      $ kubectl create rolebinding NAME --clusterrole=NAME|--role=NAME [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none]

      Flags

      @@ -1506,7 +1500,7 @@ inspect them.

      '$ docker login DOCKER_REGISTRY_SERVER --username=DOCKER_USER --password=DOCKER_PASSWORD --email=DOCKER_EMAIL'.

      That produces a ~/.dockercfg file that is used by subsequent 'docker push' and 'docker pull' commands to authenticate to the registry. The email address is optional.

      When creating applications, you may have a Docker registry that requires authentication. In order for the - nodes to pull images on your behalf, they have to have the credentials. You can provide this information + nodes to pull images on your behalf, they must have the credentials. You can provide this information by creating a dockercfg secret and attaching it to your service account.

      Usage

      $ kubectl create docker-registry NAME --docker-username=user --docker-password=password --docker-email=email [--docker-server=string] [--from-file=[key=]source] [--dry-run=server|client|none]

      @@ -1734,12 +1728,12 @@ inspect them.

      secret tls

      -

      Create a new TLS secret named tls-secret with the given key pair:

      +

      Create a new TLS secret named tls-secret with the given key pair

      kubectl create secret tls tls-secret --cert=path/to/tls.cert --key=path/to/tls.key

      Create a TLS secret from the given public/private key pair.

      -

      The public/private key pair must exist before hand. The public key certificate must be .PEM encoded and match the given private key.

      +

      The public/private key pair must exist beforehand. The public key certificate must be .PEM encoded and match the given private key.

      Usage

      $ kubectl create tls NAME --cert=path/to/cert/file --key=path/to/key/file [--dry-run=server|client|none]

      Flags

      @@ -1823,7 +1817,7 @@ inspect them.

      service

      -

      Create a service using specified subcommand.

      +

      Create a service using a specified subcommand.

      Usage

      $ kubectl create service

      @@ -2232,67 +2226,67 @@ inspect them.

      get

      -

      List all pods in ps output format.

      +

      List all pods in ps output format

      kubectl get pods
      -

      List all pods in ps output format with more information (such as node name).

      +

      List all pods in ps output format with more information (such as node name)

      kubectl get pods -o wide
      -

      List a single replication controller with specified NAME in ps output format.

      +

      List a single replication controller with specified NAME in ps output format

      kubectl get replicationcontroller web
      -

      List deployments in JSON output format, in the "v1" version of the "apps" API group:

      +

      List deployments in JSON output format, in the "v1" version of the "apps" API group

      kubectl get deployments.v1.apps -o json
      -

      List a single pod in JSON output format.

      +

      List a single pod in JSON output format

      kubectl get -o json pod web-pod-13je7
      -

      List a pod identified by type and name specified in "pod.yaml" in JSON output format.

      +

      List a pod identified by type and name specified in "pod.yaml" in JSON output format

      kubectl get -f pod.yaml -o json
      -

      List resources from a directory with kustomization.yaml - e.g. dir/kustomization.yaml.

      +

      List resources from a directory with kustomization.yaml - e.g. dir/kustomization.yaml

      kubectl get -k dir/
      -

      Return only the phase value of the specified pod.

      +

      Return only the phase value of the specified pod

      kubectl get -o template pod/web-pod-13je7 --template={{.status.phase}}
      -

      List resource information in custom columns.

      +

      List resource information in custom columns

      kubectl get pod test-pod -o custom-columns=CONTAINER:.spec.containers[0].name,IMAGE:.spec.containers[0].image
      -

      List all replication controllers and services together in ps output format.

      +

      List all replication controllers and services together in ps output format

      kubectl get rc,services
      -

      List one or more resources by their type and names.

      +

      List one or more resources by their type and names

      kubectl get rc/web service/frontend pods/web-pod-13je7
      -

      Display one or many resources

      +

      Display one or many resources.

      Prints a table of the most important information about the specified resources. You can filter the list using a label selector and the --selector flag. If the desired resource type is namespaced you will only see results in your current namespace unless you pass --all-namespaces.

      Uninitialized objects are not shown unless --include-uninitialized is passed.

      By specifying the output as 'template' and providing a Go template as the value of the --template flag, you can filter the attributes of the fetched resources.

      Use "kubectl api-resources" for a complete list of supported resources.

      Usage

      -

      $ kubectl get [(-o|--output=)json|yaml|wide|custom-columns=...|custom-columns-file=...|go-template=...|go-template-file=...|jsonpath=...|jsonpath-file=...] (TYPE[.VERSION][.GROUP] [NAME | -l label] | TYPE[.VERSION][.GROUP]/NAME ...) [flags]

      +

      $ kubectl get [(-o|--output=)json|yaml|name|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file|custom-columns-file|custom-columns|wide] (TYPE[.VERSION][.GROUP] [NAME | -l label] | TYPE[.VERSION][.GROUP]/NAME ...) [flags]

      Flags

      @@ -2362,7 +2356,7 @@ inspect them.

      - + @@ -2447,47 +2441,47 @@ inspect them.

      run

      -

      Start a nginx pod.

      +

      Start a nginx pod

      kubectl run nginx --image=nginx
      -

      Start a hazelcast pod and let the container expose port 5701.

      +

      Start a hazelcast pod and let the container expose port 5701

      kubectl run hazelcast --image=hazelcast/hazelcast --port=5701
      -

      Start a hazelcast pod and set environment variables "DNS_DOMAIN=cluster" and "POD_NAMESPACE=default" in the container.

      +

      Start a hazelcast pod and set environment variables "DNS_DOMAIN=cluster" and "POD_NAMESPACE=default" in the container

      kubectl run hazelcast --image=hazelcast/hazelcast --env="DNS_DOMAIN=cluster" --env="POD_NAMESPACE=default"
      -

      Start a hazelcast pod and set labels "app=hazelcast" and "env=prod" in the container.

      +

      Start a hazelcast pod and set labels "app=hazelcast" and "env=prod" in the container

      kubectl run hazelcast --image=hazelcast/hazelcast --labels="app=hazelcast,env=prod"
      -

      Dry run. Print the corresponding API objects without creating them.

      +

      Dry run; print the corresponding API objects without creating them

      kubectl run nginx --image=nginx --dry-run=client
      -

      Start a nginx pod, but overload the spec with a partial set of values parsed from JSON.

      +

      Start a nginx pod, but overload the spec with a partial set of values parsed from JSON

      kubectl run nginx --image=nginx --overrides='{ "apiVersion": "v1", "spec": { ... } }'
      -

      Start a busybox pod and keep it in the foreground, don't restart it if it exits.

      +

      Start a busybox pod and keep it in the foreground, don't restart it if it exits

      kubectl run -i -t busybox --image=busybox --restart=Never
      -

      Start the nginx pod using the default command, but use custom arguments (arg1 .. argN) for that command.

      +

      Start the nginx pod using the default command, but use custom arguments (arg1 .. argN) for that command

      kubectl run nginx --image=nginx -- <arg1> <arg2> ... <argN>
      -

      Start the nginx pod using a different command and custom arguments.

      +

      Start the nginx pod using a different command and custom arguments

      kubectl run nginx --image=nginx --command -- <cmd> <arg1> ... <argN>
      @@ -2738,12 +2732,12 @@ inspect them.

      expose

      -

      Create a service for a replicated nginx, which serves on port 80 and connects to the containers on port 8000.

      +

      Create a service for a replicated nginx, which serves on port 80 and connects to the containers on port 8000

      kubectl expose rc nginx --port=80 --target-port=8000
      -

      Create a service for a replication controller identified by type and name specified in "nginx-controller.yaml", which serves on port 80 and connects to the containers on port 8000.

      +

      Create a service for a replication controller identified by type and name specified in "nginx-controller.yaml", which serves on port 80 and connects to the containers on port 8000

      kubectl expose -f nginx-controller.yaml --port=80 --target-port=8000
      @@ -2763,12 +2757,12 @@ inspect them.

      kubectl expose rc streamer --port=4100 --protocol=UDP --name=video-stream
      -

      Create a service for a replicated nginx using replica set, which serves on port 80 and connects to the containers on port 8000.

      +

      Create a service for a replicated nginx using replica set, which serves on port 80 and connects to the containers on port 8000

      kubectl expose rs nginx --port=80 --target-port=8000
      -

      Create a service for an nginx deployment, which serves on port 80 and connects to the containers on port 8000.

      +

      Create a service for an nginx deployment, which serves on port 80 and connects to the containers on port 8000

      kubectl expose deployment nginx --port=80 --target-port=8000
      @@ -2944,17 +2938,17 @@ inspect them.

      delete

      -

      Delete a pod using the type and name specified in pod.json.

      +

      Delete a pod using the type and name specified in pod.json

      kubectl delete -f ./pod.json
      -

      Delete resources from a directory containing kustomization.yaml - e.g. dir/kustomization.yaml.

      +

      Delete resources from a directory containing kustomization.yaml - e.g. dir/kustomization.yaml

      kubectl delete -k dir
      -

      Delete a pod based on the type and name in the JSON passed into stdin.

      +

      Delete a pod based on the type and name in the JSON passed into stdin

      cat pod.json | kubectl delete -f -
      @@ -2964,7 +2958,7 @@ inspect them.

      kubectl delete pod,service baz foo
      -

      Delete pods and services with label name=myLabel.

      +

      Delete pods and services with label name=myLabel

      kubectl delete pods,services -l name=myLabel
      @@ -2983,10 +2977,10 @@ inspect them.

      kubectl delete pods --all
      -

      Delete resources by filenames, stdin, resources and names, or by resources and label selector.

      -

      JSON and YAML formats are accepted. Only one type of the arguments may be specified: filenames, resources and names, or resources and label selector.

      -

      Some resources, such as pods, support graceful deletion. These resources define a default period before they are forcibly terminated (the grace period) but you may override that value with the --grace-period flag, or pass --now to set a grace-period of 1. Because these resources often represent entities in the cluster, deletion may not be acknowledged immediately. If the node hosting a pod is down or cannot reach the API server, termination may take significantly longer than the grace period. To force delete a resource, you must specify the --force flag. Note: only a subset of resources support graceful deletion. In absence of the support, --grace-period is ignored.

      -

      IMPORTANT: Force deleting pods does not wait for confirmation that the pod's processes have been terminated, which can leave those processes running until the node detects the deletion and completes graceful deletion. If your processes use shared storage or talk to a remote API and depend on the name of the pod to identify themselves, force deleting those pods may result in multiple processes running on different machines using the same identification which may lead to data corruption or inconsistency. Only force delete pods when you are sure the pod is terminated, or if your application can tolerate multiple copies of the same pod running at once. Also, if you force delete pods the scheduler may place new pods on those nodes before the node has released those resources and causing those pods to be evicted immediately.

      +

      Delete resources by file names, stdin, resources and names, or by resources and label selector.

      +

      JSON and YAML formats are accepted. Only one type of argument may be specified: file names, resources and names, or resources and label selector.

      +

      Some resources, such as pods, support graceful deletion. These resources define a default period before they are forcibly terminated (the grace period) but you may override that value with the --grace-period flag, or pass --now to set a grace-period of 1. Because these resources often represent entities in the cluster, deletion may not be acknowledged immediately. If the node hosting a pod is down or cannot reach the API server, termination may take significantly longer than the grace period. To force delete a resource, you must specify the --force flag. Note: only a subset of resources support graceful deletion. In absence of the support, the --grace-period flag is ignored.

      +

      IMPORTANT: Force deleting pods does not wait for confirmation that the pod's processes have been terminated, which can leave those processes running until the node detects the deletion and completes graceful deletion. If your processes use shared storage or talk to a remote API and depend on the name of the pod to identify themselves, force deleting those pods may result in multiple processes running on different machines using the same identification which may lead to data corruption or inconsistency. Only force delete pods when you are sure the pod is terminated, or if your application can tolerate multiple copies of the same pod running at once. Also, if you force delete pods, the scheduler may place new pods on those nodes before the node has released those resources and causing those pods to be evicted immediately.

      Note that the delete command does NOT do resource version checks, so if someone submits an update to a resource right when you submit a delete, their update will be lost along with the rest of the resource.

      Usage

      $ kubectl delete ([-f FILENAME] | [-k DIRECTORY] | TYPE [(NAME | -l label | --all)])

      @@ -3111,31 +3105,31 @@ viewing your workloads in a Kubernetes cluster.

      apply

      -

      Apply the configuration in pod.json to a pod.

      +

      Apply the configuration in pod.json to a pod

      kubectl apply -f ./pod.json
      -

      Apply resources from a directory containing kustomization.yaml - e.g. dir/kustomization.yaml.

      +

      Apply resources from a directory containing kustomization.yaml - e.g. dir/kustomization.yaml

      kubectl apply -k dir/
      -

      Apply the JSON passed into stdin to a pod.

      +

      Apply the JSON passed into stdin to a pod

      cat pod.json | kubectl apply -f -
      -

      Note: --prune is still in Alpha # Apply the configuration in manifest.yaml that matches label app=nginx and delete all the other resources that are not in the file and match label app=nginx.

      +

      Note: --prune is still in Alpha # Apply the configuration in manifest.yaml that matches label app=nginx and delete all other resources that are not in the file and match label app=nginx

      kubectl apply --prune -f manifest.yaml -l app=nginx
      -

      Apply the configuration in manifest.yaml and delete all the other configmaps that are not in the file.

      +

      Apply the configuration in manifest.yaml and delete all the other config maps that are not in the file

      kubectl apply --prune -f manifest.yaml --all --prune-whitelist=core/v1/ConfigMap
      -

      Apply a configuration to a resource by filename or stdin. The resource name must be specified. This resource will be created if it doesn't exist yet. To use 'apply', always create the resource initially with either 'apply' or 'create --save-config'.

      +

      Apply a configuration to a resource by file name or stdin. The resource name must be specified. This resource will be created if it doesn't exist yet. To use 'apply', always create the resource initially with either 'apply' or 'create --save-config'.

      JSON and YAML formats are accepted.

      Alpha Disclaimer: the --prune functionality is not yet complete. Do not use unless you are aware of what the current state is. See https://issues.k8s.io/34274.

      Usage

      @@ -3300,17 +3294,17 @@ viewing your workloads in a Kubernetes cluster.

      edit-last-applied

      -

      Edit the last-applied-configuration annotations by type/name in YAML.

      +

      Edit the last-applied-configuration annotations by type/name in YAML

      kubectl apply edit-last-applied deployment/nginx
      -

      Edit the last-applied-configuration annotations by file in JSON.

      +

      Edit the last-applied-configuration annotations by file in JSON

      kubectl apply edit-last-applied -f deploy.yaml -o json

      Edit the latest last-applied-configuration annotations of resources from the default editor.

      -

      The edit-last-applied command allows you to directly edit any API resource you can retrieve via the command line tools. It will open the editor defined by your KUBE_EDITOR, or EDITOR environment variables, or fall back to 'vi' for Linux or 'notepad' for Windows. You can edit multiple objects, although changes are applied one at a time. The command accepts filenames as well as command line arguments, although the files you point to must be previously saved versions of resources.

      +

      The edit-last-applied command allows you to directly edit any API resource you can retrieve via the command-line tools. It will open the editor defined by your KUBE_EDITOR, or EDITOR environment variables, or fall back to 'vi' for Linux or 'notepad' for Windows. You can edit multiple objects, although changes are applied one at a time. The command accepts file names as well as command-line arguments, although the files you point to must be previously saved versions of resources.

      The default format is YAML. To edit in JSON, specify "-o json".

      The flag --windows-line-endings can be used to force Windows line endings, otherwise the default for your operating system will be used.

      In the event an error occurs while updating, a temporary file will be created on disk that contains your unapplied changes. The most common error when updating a resource is another editor changing the resource on the server. When this occurs, you will have to apply your changes to the newer version of the resource, or update your temporary saved copy to include the latest resource version.

      @@ -3392,17 +3386,17 @@ viewing your workloads in a Kubernetes cluster.

      set-last-applied

      -

      Set the last-applied-configuration of a resource to match the contents of a file.

      +

      Set the last-applied-configuration of a resource to match the contents of a file

      kubectl apply set-last-applied -f deploy.yaml
      -

      Execute set-last-applied against each configuration file in a directory.

      +

      Execute set-last-applied against each configuration file in a directory

      kubectl apply set-last-applied -f path/
      -

      Set the last-applied-configuration of a resource to match the contents of a file, will create the annotation if it does not already exist.

      +

      Set the last-applied-configuration of a resource to match the contents of a file; will create the annotation if it does not already exist

      kubectl apply set-last-applied -f deploy.yaml --create-annotation=true
      @@ -3467,7 +3461,7 @@ viewing your workloads in a Kubernetes cluster.

      view-last-applied

      -

      View the last-applied-configuration annotations by type/name in YAML.

      +

      View the last-applied-configuration annotations by type/name in YAML

      kubectl apply view-last-applied deployment/nginx
      @@ -3477,7 +3471,7 @@ viewing your workloads in a Kubernetes cluster.

      kubectl apply view-last-applied -f deploy.yaml -o json

      View the latest last-applied-configuration annotations by type/name or file.

      -

      The default output will be printed to stdout in YAML format. One can use -o option to change output format.

      +

      The default output will be printed to stdout in YAML format. You can use the -o option to change the output format.

      Usage

      $ kubectl apply view-last-applied (TYPE [NAME | -l label] | TYPE/NAME | -f FILENAME)

      Flags

      @@ -3532,7 +3526,7 @@ viewing your workloads in a Kubernetes cluster.

      annotate

      -

      Update pod 'foo' with the annotation 'description' and the value 'my frontend'. # If the same annotation is set multiple times, only the last value will be applied

      +

      Update pod 'foo' with the annotation 'description' and the value 'my frontend' # If the same annotation is set multiple times, only the last value will be applied

      kubectl annotate pods foo description='my frontend'
      @@ -3542,7 +3536,7 @@ viewing your workloads in a Kubernetes cluster.

      kubectl annotate -f pod.json description='my frontend'
      -

      Update pod 'foo' with the annotation 'description' and the value 'my frontend running nginx', overwriting any existing value.

      +

      Update pod 'foo' with the annotation 'description' and the value 'my frontend running nginx', overwriting any existing value

      kubectl annotate --overwrite pods foo description='my frontend running nginx'
      @@ -3552,16 +3546,16 @@ viewing your workloads in a Kubernetes cluster.

      kubectl annotate pods --all description='my frontend running nginx'
      -

      Update pod 'foo' only if the resource is unchanged from version 1.

      +

      Update pod 'foo' only if the resource is unchanged from version 1

      kubectl annotate pods foo description='my frontend running nginx' --resource-version=1
      -

      Update pod 'foo' by removing an annotation named 'description' if it exists. # Does not require the --overwrite flag.

      +

      Update pod 'foo' by removing an annotation named 'description' if it exists # Does not require the --overwrite flag

      kubectl annotate pods foo description-
      -

      Update the annotations on one or more resources

      +

      Update the annotations on one or more resources.

      All Kubernetes objects support the ability to store additional data with the object as annotations. Annotations are key/value pairs that can be larger than labels and include arbitrary string values such as structured JSON. Tools and system extensions may use annotations to store their own data.

      Attempting to set an annotation that already exists will fail unless --overwrite is set. If --resource-version is specified and does not match the current resource version on the server the command will fail.

      Use "kubectl api-resources" for a complete list of supported resources.

      @@ -3585,6 +3579,12 @@ viewing your workloads in a Kubernetes cluster.

      + + + + + + @@ -3685,17 +3685,17 @@ viewing your workloads in a Kubernetes cluster.

      autoscale

      -

      Auto scale a deployment "foo", with the number of pods between 2 and 10, no target CPU utilization specified so a default autoscaling policy will be used:

      +

      Auto scale a deployment "foo", with the number of pods between 2 and 10, no target CPU utilization specified so a default autoscaling policy will be used

      kubectl autoscale deployment foo --min=2 --max=10
      -

      Auto scale a replication controller "foo", with the number of pods between 1 and 5, target CPU utilization at 80%:

      +

      Auto scale a replication controller "foo", with the number of pods between 1 and 5, target CPU utilization at 80%

      kubectl autoscale rc foo --max=5 --cpu-percent=80
      -

      Creates an autoscaler that automatically chooses and sets the number of pods that run in a kubernetes cluster.

      -

      Looks up a Deployment, ReplicaSet, StatefulSet, or ReplicationController by name and creates an autoscaler that uses the given resource as a reference. An autoscaler can automatically increase or decrease number of pods deployed within the system as needed.

      +

      Creates an autoscaler that automatically chooses and sets the number of pods that run in a Kubernetes cluster.

      +

      Looks up a deployment, replica set, stateful set, or replication controller by name and creates an autoscaler that uses the given resource as a reference. An autoscaler can automatically increase or decrease number of pods deployed within the system as needed.

      Usage

      $ kubectl autoscale (-f FILENAME | TYPE NAME | TYPE/NAME) [--min=MINPODS] --max=MAXPODS [--cpu-percent=CPU]

      Flags

      @@ -3740,12 +3740,6 @@ viewing your workloads in a Kubernetes cluster.

      - - - - - - @@ -3960,7 +3954,7 @@ viewing your workloads in a Kubernetes cluster.

      diff

      -

      Diff resources included in pod.json.

      +

      Diff resources included in pod.json

      kubectl diff -f pod.json
      @@ -3969,10 +3963,10 @@ viewing your workloads in a Kubernetes cluster.

      cat service.yaml | kubectl diff -f -
      -

      Diff configurations specified by filename or stdin between the current online configuration, and the configuration as it would be if applied.

      -

      Output is always YAML.

      +

      Diff configurations specified by file name or stdin between the current online configuration, and the configuration as it would be if applied.

      +

      The output is always YAML.

      KUBECTL_EXTERNAL_DIFF environment variable can be used to select your own diff command. Users can use external commands with params too, example: KUBECTL_EXTERNAL_DIFF="colordiff -N -u"

      -

      By default, the "diff" command available in your path will be run with "-u" (unified diff) and "-N" (treat absent files as empty) options.

      +

      By default, the "diff" command available in your path will be run with the "-u" (unified diff) and "-N" (treat absent files as empty) options.

      Exit status: 0 No differences were found. 1 Differences were found. >1 Kubectl or diff failed with an error.

      Note: KUBECTL_EXTERNAL_DIFF, if used, is expected to follow that convention.

      Usage

      @@ -4035,7 +4029,7 @@ viewing your workloads in a Kubernetes cluster.

      edit

      -

      Edit the service named 'docker-registry':

      +

      Edit the service named 'docker-registry'

      kubectl edit svc/docker-registry
      @@ -4045,17 +4039,17 @@ viewing your workloads in a Kubernetes cluster.

      KUBE_EDITOR="nano" kubectl edit svc/docker-registry
      -

      Edit the job 'myjob' in JSON using the v1 API format:

      +

      Edit the job 'myjob' in JSON using the v1 API format

      kubectl edit job.v1.batch/myjob -o json
      -

      Edit the deployment 'mydeployment' in YAML and save the modified config in its annotation:

      +

      Edit the deployment 'mydeployment' in YAML and save the modified config in its annotation

      kubectl edit deployment/mydeployment -o yaml --save-config

      Edit a resource from the default editor.

      -

      The edit command allows you to directly edit any API resource you can retrieve via the command line tools. It will open the editor defined by your KUBE_EDITOR, or EDITOR environment variables, or fall back to 'vi' for Linux or 'notepad' for Windows. You can edit multiple objects, although changes are applied one at a time. The command accepts filenames as well as command line arguments, although the files you point to must be previously saved versions of resources.

      +

      The edit command allows you to directly edit any API resource you can retrieve via the command-line tools. It will open the editor defined by your KUBE_EDITOR, or EDITOR environment variables, or fall back to 'vi' for Linux or 'notepad' for Windows. You can edit multiple objects, although changes are applied one at a time. The command accepts file names as well as command-line arguments, although the files you point to must be previously saved versions of resources.

      Editing is done with the API version used to fetch the resource. To edit using a specific API version, fully-qualify the resource, version, and group.

      The default format is YAML. To edit in JSON, specify "-o json".

      The flag --windows-line-endings can be used to force Windows line endings, otherwise the default for your operating system will be used.

      @@ -4185,10 +4179,10 @@ viewing your workloads in a Kubernetes cluster.

      - + - + @@ -4197,6 +4191,12 @@ viewing your workloads in a Kubernetes cluster.

      + + + + + + @@ -4209,6 +4209,12 @@ viewing your workloads in a Kubernetes cluster.

      + + + + + + @@ -4249,12 +4255,12 @@ viewing your workloads in a Kubernetes cluster.

      label

      -

      Update pod 'foo' with the label 'unhealthy' and the value 'true'.

      +

      Update pod 'foo' with the label 'unhealthy' and the value 'true'

      kubectl label pods foo unhealthy=true
      -

      Update pod 'foo' with the label 'status' and the value 'unhealthy', overwriting any existing value.

      +

      Update pod 'foo' with the label 'status' and the value 'unhealthy', overwriting any existing value

      kubectl label --overwrite pods foo status=unhealthy
      @@ -4269,19 +4275,19 @@ viewing your workloads in a Kubernetes cluster.

      kubectl label -f pod.json status=unhealthy
      -

      Update pod 'foo' only if the resource is unchanged from version 1.

      +

      Update pod 'foo' only if the resource is unchanged from version 1

      kubectl label pods foo status=unhealthy --resource-version=1
      -

      Update pod 'foo' by removing a label named 'bar' if it exists. # Does not require the --overwrite flag.

      +

      Update pod 'foo' by removing a label named 'bar' if it exists # Does not require the --overwrite flag

      kubectl label pods foo bar-

      Update the labels on a resource.

      • A label key and value must begin with a letter or number, and may contain letters, numbers, hyphens, dots, and underscores, up to 63 characters each.
        • -
      • Optionally, the key can begin with a DNS subdomain prefix and a single '/', like example.com/my-app
        • +
      • Optionally, the key can begin with a DNS subdomain prefix and a single '/', like example.com/my-app.
      • If --overwrite is true, then existing labels can be overwritten, otherwise attempting to overwrite a label will result in an error.
      • If --resource-version is specified, then updates will use this resource version, otherwise the existing resource-version will be used.
      @@ -4305,6 +4311,12 @@ viewing your workloads in a Kubernetes cluster.

      + + + + + + @@ -4405,31 +4417,31 @@ viewing your workloads in a Kubernetes cluster.

      patch

      -

      Partially update a node using a strategic merge patch. Specify the patch as JSON.

      +

      Partially update a node using a strategic merge patch, specifying the patch as JSON

      kubectl patch node k8s-node-1 -p '{"spec":{"unschedulable":true}}'
      -

      Partially update a node using a strategic merge patch. Specify the patch as YAML.

      +

      Partially update a node using a strategic merge patch, specifying the patch as YAML

      kubectl patch node k8s-node-1 -p $'spec:\n unschedulable: true'
      -

      Partially update a node identified by the type and name specified in "node.json" using strategic merge patch.

      +

      Partially update a node identified by the type and name specified in "node.json" using strategic merge patch

      kubectl patch -f node.json -p '{"spec":{"unschedulable":true}}'
      -

      Update a container's image; spec.containers[*].name is required because it's a merge key.

      +

      Update a container's image; spec.containers[*].name is required because it's a merge key

      kubectl patch pod valid-pod -p '{"spec":{"containers":[{"name":"kubernetes-serve-hostname","image":"new image"}]}}'
      -

      Update a container's image using a json patch with positional arrays.

      +

      Update a container's image using a JSON patch with positional arrays

      kubectl patch pod valid-pod --type='json' -p='[{"op": "replace", "path": "/spec/containers/0/image", "value":"new image"}]'
      -

      Update field(s) of a resource using strategic merge patch, a JSON merge patch, or a JSON patch.

      +

      Update fields of a resource using strategic merge patch, a JSON merge patch, or a JSON patch.

      JSON and YAML formats are accepted.

      Usage

      $ kubectl patch (-f FILENAME | TYPE NAME) [-p PATCH|--patch-file FILE]

      @@ -4533,12 +4545,12 @@ viewing your workloads in a Kubernetes cluster.

      replace

      -

      Replace a pod using the data in pod.json.

      +

      Replace a pod using the data in pod.json

      kubectl replace -f ./pod.json
      -

      Replace a pod based on the JSON passed into stdin.

      +

      Replace a pod based on the JSON passed into stdin

      cat pod.json | kubectl replace -f -
      @@ -4552,7 +4564,7 @@ viewing your workloads in a Kubernetes cluster.

      kubectl replace --force -f ./pod.json
      -

      Replace a resource by filename or stdin.

      +

      Replace a resource by file name or stdin.

      JSON and YAML formats are accepted. If replacing an existing resource, the complete resource spec must be provided. This can be obtained by

      $ kubectl get TYPE NAME -o yaml

      Usage

      @@ -4772,11 +4784,11 @@ viewing your workloads in a Kubernetes cluster.

      pause

      -

      Mark the nginx deployment as paused. Any current state of # the deployment will continue its function, new updates to the deployment will not # have an effect as long as the deployment is paused.

      +

      Mark the nginx deployment as paused # Any current state of the deployment will continue its function; new updates # to the deployment will not have an effect as long as the deployment is paused

      kubectl rollout pause deployment/nginx
      -

      Mark the provided resource as paused

      +

      Mark the provided resource as paused.

      Paused resources will not be reconciled by a controller. Use "kubectl rollout resume" to resume a paused resource. Currently only deployments support being paused.

      Usage

      $ kubectl rollout pause RESOURCE

      @@ -4849,12 +4861,12 @@ viewing your workloads in a Kubernetes cluster.

      kubectl rollout restart deployment/nginx
      -

      Restart a daemonset

      +

      Restart a daemon set

      kubectl rollout restart daemonset/abc

      Restart a resource.

      -

      Resource will be rollout restarted.

      +

      Resource rollout will be restarted.

      Usage

      $ kubectl rollout restart RESOURCE

      Flags

      @@ -4925,7 +4937,7 @@ viewing your workloads in a Kubernetes cluster.

      kubectl rollout resume deployment/nginx
      -

      Resume a paused resource

      +

      Resume a paused resource.

      Paused resources will not be reconciled by a controller. By resuming a resource, we allow it to be reconciled again. Currently only deployments support being resumed.

      Usage

      $ kubectl rollout resume RESOURCE

      @@ -5053,21 +5065,21 @@ viewing your workloads in a Kubernetes cluster.

      undo

      -

      Rollback to the previous deployment

      +

      Roll back to the previous deployment

      kubectl rollout undo deployment/abc
      -

      Rollback to daemonset revision 3

      +

      Roll back to daemonset revision 3

      kubectl rollout undo daemonset/abc --to-revision=3
      -

      Rollback to the previous deployment with dry-run

      +

      Roll back to the previous deployment with dry-run

      kubectl rollout undo --dry-run=server deployment/abc
      -

      Rollback to a previous rollout.

      +

      Roll back to a previous rollout.

      Usage

      $ kubectl rollout undo (TYPE NAME | TYPE/NAME) [flags]

      Flags

      @@ -5140,31 +5152,31 @@ viewing your workloads in a Kubernetes cluster.

      scale

      -

      Scale a replicaset named 'foo' to 3.

      +

      Scale a replica set named 'foo' to 3

      kubectl scale --replicas=3 rs/foo
      -

      Scale a resource identified by type and name specified in "foo.yaml" to 3.

      +

      Scale a resource identified by type and name specified in "foo.yaml" to 3

      kubectl scale --replicas=3 -f foo.yaml
      -

      If the deployment named mysql's current size is 2, scale mysql to 3.

      +

      If the deployment named mysql's current size is 2, scale mysql to 3

      kubectl scale --current-replicas=2 --replicas=3 deployment/mysql
      -

      Scale multiple replication controllers.

      +

      Scale multiple replication controllers

      kubectl scale --replicas=5 rc/foo rc/bar rc/baz
      -

      Scale statefulset named 'web' to 3.

      +

      Scale stateful set named 'web' to 3

      kubectl scale --replicas=3 statefulset/web
      -

      Set a new size for a Deployment, ReplicaSet, Replication Controller, or StatefulSet.

      +

      Set a new size for a deployment, replica set, replication controller, or stateful set.

      Scale also allows users to specify one or more preconditions for the scale action.

      If --current-replicas or --resource-version is specified, it is validated before the scale is attempted, and it is guaranteed that the precondition holds true when the scale is sent to the server.

      Usage

      @@ -5196,7 +5208,7 @@ viewing your workloads in a Kubernetes cluster.

      - + @@ -5274,7 +5286,7 @@ viewing your workloads in a Kubernetes cluster.

      output o Output format. One of: json|yaml|wide|name|custom-columns=...|custom-columns-file=...|go-template=...|go-template-file=...|jsonpath=...|jsonpath-file=... See custom columns [http://kubernetes.io/docs/user-guide/kubectl-overview/#custom-columns], golang template [http://golang.org/pkg/text/template/#pkg-overview] and jsonpath template [http://kubernetes.io/docs/user-guide/jsonpath]. Output format. One of: json|yaml|name|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file|custom-columns-file|custom-columns|wide See custom columns [https://kubernetes.io/docs/reference/kubectl/overview/#custom-columns], golang template [http://golang.org/pkg/text/template/#pkg-overview] and jsonpath template [https://kubernetes.io/docs/reference/kubectl/jsonpath/].
      output-watch-events Select all resources, including uninitialized ones, in the namespace of the specified resource types.
      all-namespacesAfalseIf true, check the specified action in all namespaces.
      allow-missing-template-keys true Filename, directory, or URL to files identifying the resource to autoscale.
      generatorhorizontalpodautoscaler/v1The name of the API generator to use. Currently there is only 1 generator.
      kustomize k
      allow-id-changesas-current-user falseenable changes to a resourceId use the uid and gid of the command executor to run the function in the container
      enable-alpha-plugins enable kustomize plugins
      enable-helmfalseEnable use of the Helm chart inflator generator.
      enable-managedby-label false a list of environment variables to be used by functions
      helm-commandhelmhelm command (path to executable)
      load-restrictor LoadRestrictionsRootOnly Select all resources, including uninitialized ones, in the namespace of the specified resource types
      all-namespacesAfalseIf true, check the specified action in all namespaces.
      allow-missing-template-keys true current-replicas -1Precondition for current size. Requires that the current size of the resource match this value in order to scale. Precondition for current size. Requires that the current size of the resource match this value in order to scale. -1 (default) for no condition.
      dry-run

      set

      -

      Configure application resources

      +

      Configure application resources.

      These commands help you make changes to existing application resources.

      Usage

      $ kubectl set SUBCOMMAND

      @@ -5339,7 +5351,7 @@ viewing your workloads in a Kubernetes cluster.

      List environment variable definitions in one or more pods, pod templates. Add, update, or remove container environment variable definitions in one or more pod templates (within replication controllers or deployment configurations). View or modify the environment variable definitions on all containers in the specified pods or pod templates, or just those that match a wildcard.

      If "--env -" is passed, environment variables can be read from STDIN using the standard env syntax.

      Possible resources include (case insensitive):

      -

      pod (po), replicationcontroller (rc), deployment (deploy), daemonset (ds), job, replicaset (rs)

      +

      pod (po), replicationcontroller (rc), deployment (deploy), daemonset (ds), statefulset (sts), cronjob (cj), replicaset (rs)

      Usage

      $ kubectl set env RESOURCE/NAME KEY_1=VAL_1 ... KEY_N=VAL_N

      Flags

      @@ -5478,7 +5490,7 @@ viewing your workloads in a Kubernetes cluster.

      image

      -

      Set a deployment's nginx container image to 'nginx:1.9.1', and its busybox container image to 'busybox'.

      +

      Set a deployment's nginx container image to 'nginx:1.9.1', and its busybox container image to 'busybox'

      kubectl set image deployment/nginx busybox=busybox nginx=nginx:1.9.1
      @@ -5499,7 +5511,7 @@ viewing your workloads in a Kubernetes cluster.

      Update existing container image(s) of resources.

      Possible resources include (case insensitive):

      -

      pod (po), replicationcontroller (rc), deployment (deploy), daemonset (ds), replicaset (rs)

      +

      pod (po), replicationcontroller (rc), deployment (deploy), daemonset (ds), statefulset (sts), cronjob (cj), replicaset (rs)

      Usage

      $ kubectl set image (-f FILENAME | TYPE NAME) CONTAINER_NAME_1=CONTAINER_IMAGE_1 ... CONTAINER_NAME_N=CONTAINER_IMAGE_N

      Flags

      @@ -5615,8 +5627,8 @@ viewing your workloads in a Kubernetes cluster.

      kubectl set resources -f path/to/file.yaml --limits=cpu=200m,memory=512Mi --local -o yaml
      -

      Specify compute resource requirements (cpu, memory) for any resource that defines a pod template. If a pod is successfully scheduled, it is guaranteed the amount of resource requested, but may burst up to its specified limits.

      -

      for each compute resource, if a limit is specified and a request is omitted, the request will default to the limit.

      +

      Specify compute resource requirements (CPU, memory) for any resource that defines a pod template. If a pod is successfully scheduled, it is guaranteed the amount of resource requested, but may burst up to its specified limits.

      +

      For each compute resource, if a limit is specified and a request is omitted, the request will default to the limit.

      Possible resources include (case insensitive): Use "kubectl api-resources" for a complete list of supported resources..

      Usage

      $ kubectl set resources (-f FILENAME | TYPE NAME) ([--limits=LIMITS & --requests=REQUESTS]

      @@ -5732,7 +5744,7 @@ viewing your workloads in a Kubernetes cluster.

      selector

      -

      set the labels and selector before creating a deployment/service pair.

      +

      Set the labels and selector before creating a deployment/service pair

      kubectl create service clusterip my-svc --clusterip="None" -o yaml --dry-run=client | kubectl set selector --local -f - 'environment=qa' -o yaml | kubectl create -f -
 kubectl create deployment my-dep -o yaml --dry-run=client | kubectl label --local -f - environment=qa -o yaml | kubectl create -f -
@@ -5829,16 +5841,16 @@ kubectl create deployment my-dep -o yaml --dry-run<
 
      
 
      serviceaccount
      
 
      
-
       Set Deployment nginx-deployment's ServiceAccount to serviceaccount1
      
+
       Set deployment nginx-deployment's service account to serviceaccount1
      
 
      
 
      kubectl set serviceaccount deployment nginx-deployment serviceaccount1
 
      
 
      
-
       Print the result (in yaml format) of updated nginx deployment with serviceaccount from local file, without hitting apiserver
      
+
       Print the result (in YAML format) of updated nginx deployment with the service account from local file, without hitting the API server
      
 
      
 
      kubectl set sa -f nginx-deployment.yaml serviceaccount1 --local --dry-run=client -o yaml
 
      
-
      Update ServiceAccount of pod template resources.
      
+
      Update the service account of pod template resources.
      
 
       Possible resources (case insensitive) can be:
      
 
       replicationcontroller (rc), deployment (deploy), daemonset (ds), job, replicaset (rs), statefulset
      
 
      Usage
      
@@ -5931,21 +5943,21 @@ kubectl create deployment my-dep -o yaml --dry-run<
 
      
 
      subject
      
 
      
-
       Update a ClusterRoleBinding for serviceaccount1
      
+
       Update a cluster role binding for serviceaccount1
      
 
      
 
      kubectl set subject clusterrolebinding admin --serviceaccount=namespace:serviceaccount1
 
      
 
      
-
       Update a RoleBinding for user1, user2, and group1
      
+
       Update a role binding for user1, user2, and group1
      
 
      
 
      kubectl set subject rolebinding admin --user=user1 --user=user2 --group=group1
 
      
 
      
-
       Print the result (in yaml format) of updating rolebinding subjects from a local, without hitting the server
      
+
       Print the result (in YAML format) of updating rolebinding subjects from a local, without hitting the server
      
 
      
 
      kubectl create rolebinding admin --role=admin --user=admin -o yaml --dry-run=client | kubectl set subject --local -f - --user=foo -o yaml
 
      
-
      Update User, Group or ServiceAccount in a RoleBinding/ClusterRoleBinding.
      
+
      Update the user, group, or service account in a role binding or cluster role binding.
      
 
      Usage
      
 
      $ kubectl set subject (-f FILENAME | TYPE NAME) [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none]
      
 
      Flags
      
@@ -6048,17 +6060,17 @@ kubectl create deployment my-dep -o yaml --dry-run<
 
      
 
      wait
      
 
      
-
       Wait for the pod "busybox1" to contain the status condition of type "Ready".
      
+
       Wait for the pod "busybox1" to contain the status condition of type "Ready"
      
 
      
 
      kubectl wait --for=condition=Ready pod/busybox1
 
      
 
      
-
       The default value of status condition is true, you can set false.
      
+
       The default value of status condition is true; you can set it to false
      
 
      
 
      kubectl wait --for=condition=Ready=false pod/busybox1
 
      
 
      
-
       Wait for the pod "busybox1" to be deleted, with a timeout of 60s, after having issued the "delete" command.
      
+
       Wait for the pod "busybox1" to be deleted, with a timeout of 60s, after having issued the "delete" command
      
 
      
 
      kubectl delete pod/busybox1
 kubectl wait --for=delete pod/busybox1 --timeout=60s
@@ -6066,7 +6078,7 @@ kubectl wait --for=delete pod/busybox1 Experimental: Wait for a specific condition on one or many resources.
      
 
       The command takes multiple resources and waits until the specified condition is seen in the Status field of every given resource.
      
 
       Alternatively, the command can wait for the given set of resources to be deleted by providing the "delete" keyword as the value to the --for flag.
      
-
       A successful message will be printed to stdout indicating when the specified condition has been met. One can use -o option to change to output destination.
      
+
       A successful message will be printed to stdout indicating when the specified condition has been met. You can use -o option to change to output destination.
      
 
      Usage
      
 
      $ kubectl wait ([-f FILENAME] | resource.group/resource.name | resource.group [(-l label | --all)]) [--for=delete|--for condition=available]
      
 
      Flags
      
@@ -6171,7 +6183,7 @@ applications.
      
 
      
 
      attach
      
 
      
-
       Get output from running pod mypod, use the kubectl.kubernetes.io/default-container annotation # for selecting the container to be attached or the first container in the pod will be chosen
      
+
       Get output from running pod mypod; use the 'kubectl.kubernetes.io/default-container' annotation # for selecting the container to be attached or the first container in the pod will be chosen
      
 
      
 
      kubectl attach mypod
 
      
@@ -6181,12 +6193,12 @@ applications.
      
 
      kubectl attach mypod -c ruby-container
 
      
 
      
-
       Switch to raw terminal mode, sends stdin to 'bash' in ruby-container from pod mypod # and sends stdout/stderr from 'bash' back to the client
      
+
       Switch to raw terminal mode; sends stdin to 'bash' in ruby-container from pod mypod # and sends stdout/stderr from 'bash' back to the client
      
 
      
 
      kubectl attach mypod -c ruby-container -i -t
 
      
 
      
-
       Get output from the first pod of a ReplicaSet named nginx
      
+
       Get output from the first pod of a replica set named nginx
      
 
      
 
      kubectl attach rs/nginx
 
      
@@ -6279,7 +6291,7 @@ applications.
      
 
      kubectl auth can-i --list --namespace=foo
 
      
 
      Check whether an action is allowed.
      
-
       VERB is a logical Kubernetes API verb like 'get', 'list', 'watch', 'delete', etc. TYPE is a Kubernetes resource. Shortcuts and groups will be resolved. NONRESOURCEURL is a partial URL starts with "/". NAME is the name of a particular Kubernetes resource.
      
+
       VERB is a logical Kubernetes API verb like 'get', 'list', 'watch', 'delete', etc. TYPE is a Kubernetes resource. Shortcuts and groups will be resolved. NONRESOURCEURL is a partial URL that starts with "/". NAME is the name of a particular Kubernetes resource.
      
 
      Usage
      
 
      $ kubectl auth can-i VERB [TYPE | TYPE/NAME | NONRESOURCEURL]
      
 
      Flags
      
@@ -6328,11 +6340,11 @@ applications.
      
 
      
 
      reconcile
      
 
      
-
       Reconcile rbac resources from a file
      
+
       Reconcile RBAC resources from a file
      
 
      
 
      kubectl auth reconcile -f my-rbac-rules.yaml
 
      
-
      Reconciles rules for RBAC Role, RoleBinding, ClusterRole, and ClusterRoleBinding objects.
      
+
      Reconciles rules for RBAC role, role binding, cluster role, and cluster role binding objects.
      
 
       Missing objects are created, and the containing namespace is created for namespaced objects, if required.
      
 
       Existing roles are updated to include the permissions in the input objects, and remove extra permissions if --remove-extra-permissions is specified.
      
 
       Existing bindings are updated to include the subjects in the input objects, and remove extra subjects if --remove-extra-subjects is specified.
      
@@ -6415,7 +6427,7 @@ applications.
      
 
      
 
      cp
      
 
      
-
       !!!Important Note!!! # Requires that the 'tar' binary is present in your container # image.  If 'tar' is not present, 'kubectl cp' will fail. # # For advanced use cases, such as symlinks, wildcard expansion or # file mode preservation consider using 'kubectl exec'. # Copy /tmp/foo local file to /tmp/bar in a remote pod in namespace 
      
+
       !!!Important Note!!! # Requires that the 'tar' binary is present in your container # image.  If 'tar' is not present, 'kubectl cp' will fail. # # For advanced use cases, such as symlinks, wildcard expansion or # file mode preservation, consider using 'kubectl exec'. # Copy /tmp/foo local file to /tmp/bar in a remote pod in namespace 
      
 
      
 
      tar cf - /tmp/foo | kubectl exec -i -n <some-namespace> <some-pod> -- tar xf - -C /tmp/bar
 
      
@@ -6500,11 +6512,11 @@ applications.
      
 
      kubectl describe po -l name=myLabel
 
      
 
      
-
       Describe all pods managed by the 'frontend' replication controller (rc-created pods # get the name of the rc as a prefix in the pod the name).
      
+
       Describe all pods managed by the 'frontend' replication controller (rc-created pods # get the name of the rc as a prefix in the pod the name)
      
 
      
 
      kubectl describe pods frontend
 
      
-
      Show details of a specific resource or group of resources
      
+
      Show details of a specific resource or group of resources.
      
 
       Print a detailed description of the selected resources, including related resources such as events or controllers. You may select a single object by name, all objects of that type, provide a name prefix, or label selector. For example:
      
 
        $ kubectl describe TYPE NAME_PREFIX
      
 
       will first check for an exact match on TYPE and NAME_PREFIX. If no such resource exists, it will output details for every resource that has a name prefixed with NAME_PREFIX.
      
@@ -6529,6 +6541,12 @@ applications.
      
 If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with --namespace. 
 
 
+chunk-size
+
+500
+Return large lists in chunks rather than all at once. Pass 0 to disable. This flag is beta and may change in the future. 
+
+
 filename
 f
 []
@@ -6563,22 +6581,22 @@ applications.
      
 
      
 
      exec
      
 
      
-
       Get output from running 'date' command from pod mypod, using the first container by default
      
+
       Get output from running the 'date' command from pod mypod, using the first container by default
      
 
      
 
      kubectl exec mypod -- date
 
      
 
      
-
       Get output from running 'date' command in ruby-container from pod mypod
      
+
       Get output from running the 'date' command in ruby-container from pod mypod
      
 
      
 
      kubectl exec mypod -c ruby-container -- date
 
      
 
      
-
       Switch to raw terminal mode, sends stdin to 'bash' in ruby-container from pod mypod # and sends stdout/stderr from 'bash' back to the client
      
+
       Switch to raw terminal mode; sends stdin to 'bash' in ruby-container from pod mypod # and sends stdout/stderr from 'bash' back to the client
      
 
      
 
      kubectl exec mypod -c ruby-container -i -t -- bash -il
 
      
 
      
-
       List contents of /usr from the first container of pod mypod and sort by modification time. # If the command you want to execute in the pod has any flags in common (e.g. -i), # you must use two dashes (--) to separate your command's flags/arguments. # Also note, do not surround your command and its flags/arguments with quotes # unless that is how you would execute it normally (i.e., do ls -t /usr, not "ls -t /usr").
      
+
       List contents of /usr from the first container of pod mypod and sort by modification time # If the command you want to execute in the pod has any flags in common (e.g. -i), # you must use two dashes (--) to separate your command's flags/arguments # Also note, do not surround your command and its flags/arguments with quotes # unless that is how you would execute it normally (i.e., do ls -t /usr, not "ls -t /usr")
      
 
      
 
      kubectl exec mypod -i -t -- ls -t /usr
 
      
@@ -6659,7 +6677,7 @@ applications.
      
 
      
 
       Return snapshot logs from all containers in pods defined by label app=nginx
      
 
      
-
      kubectl logs -lapp=nginx --all-containers=true
+
      kubectl logs -l app=nginx --all-containers=true
 
      
 
      
 
       Return snapshot of previous terminated ruby container logs from pod web-1
      
@@ -6674,7 +6692,7 @@ applications.
      
 
      
 
       Begin streaming the logs from all containers in pods defined by label app=nginx
      
 
      
-
      kubectl logs -f -lapp=nginx --all-containers=true
+
      kubectl logs -f -l app=nginx --all-containers=true
 
      
 
      
 
       Display only the most recent 20 lines of output in pod nginx
      
@@ -6844,9 +6862,9 @@ applications.
      
 
      
 
      kubectl port-forward pod/mypod :5000
 
      
-
      Forward one or more local ports to a pod. This command requires the node to have 'socat' installed.
      
+
      Forward one or more local ports to a pod.
      
 
       Use resource type/name such as deployment/mydeployment to select a pod. Resource type defaults to 'pod' if omitted.
      
-
       If there are multiple pods matching the criteria, a pod will be selected automatically. The forwarding session ends when the selected pod terminates, and rerun of the command is needed to resume forwarding.
      
+
       If there are multiple pods matching the criteria, a pod will be selected automatically. The forwarding session ends when the selected pod terminates, and a rerun of the command is needed to resume forwarding.
      
 
      Usage
      
 
      $ kubectl port-forward TYPE/NAME [options] [LOCAL_PORT:]REMOTE_PORT [...[LOCAL_PORT_N:]REMOTE_PORT_N]
      
 
      Flags
      
@@ -6877,36 +6895,36 @@ applications.
      
 
      
 
      proxy
      
 
      
-
       To proxy all of the kubernetes api and nothing else.
      
+
       To proxy all of the Kubernetes API and nothing else
      
 
      
 
      kubectl proxy --api-prefix=/
 
      
 
      
-
       To proxy only part of the kubernetes api and also some static files. # You can get pods info with 'curl localhost:8001/api/v1/pods'
      
+
       To proxy only part of the Kubernetes API and also some static files # You can get pods info with 'curl localhost:8001/api/v1/pods'
      
 
      
 
      kubectl proxy --www=/my/files --www-prefix=/static/ --api-prefix=/api/
 
      
 
      
-
       To proxy the entire kubernetes api at a different root. # You can get pods info with 'curl localhost:8001/custom/api/v1/pods'
      
+
       To proxy the entire Kubernetes API at a different root # You can get pods info with 'curl localhost:8001/custom/api/v1/pods'
      
 
      
 
      kubectl proxy --api-prefix=/custom/
 
      
 
      
-
       Run a proxy to kubernetes apiserver on port 8011, serving static content from ./local/www/
      
+
       Run a proxy to the Kubernetes API server on port 8011, serving static content from ./local/www/
      
 
      
 
      kubectl proxy --port=8011 --www=./local/www/
 
      
 
      
-
       Run a proxy to kubernetes apiserver on an arbitrary local port. # The chosen port for the server will be output to stdout.
      
+
       Run a proxy to the Kubernetes API server on an arbitrary local port # The chosen port for the server will be output to stdout
      
 
      
 
      kubectl proxy --port=0
 
      
 
      
-
       Run a proxy to kubernetes apiserver, changing the api prefix to k8s-api # This makes e.g. the pods api available at localhost:8001/k8s-api/v1/pods/
      
+
       Run a proxy to the Kubernetes API server, changing the API prefix to k8s-api # This makes e.g. the pods API available at localhost:8001/k8s-api/v1/pods/
      
 
      
 
      kubectl proxy --api-prefix=/k8s-api
 
      
-
      Creates a proxy server or application-level gateway between localhost and the Kubernetes API Server. It also allows serving static content over specified HTTP path. All incoming data enters through one port and gets forwarded to the remote kubernetes API Server port, except for the path matching the static content path.
      
+
      Creates a proxy server or application-level gateway between localhost and the Kubernetes API server. It also allows serving static content over specified HTTP path. All incoming data enters through one port and gets forwarded to the remote Kubernetes API server port, except for the path matching the static content path.
      
 
      Usage
      
 
      $ kubectl proxy [--port=PORT] [--www=static-dir] [--www-prefix=prefix] [--api-prefix=prefix]
      
 
      Flags
      
@@ -7013,7 +7031,7 @@ applications.
      
 
      
 
      kubectl top node NODE_NAME
 
      
-
      Display Resource (CPU/Memory) usage of nodes.
      
+
      Display resource (CPU/memory) usage of nodes.
      
 
       The top-node command allows you to see the resource consumption of nodes.
      
 
      Usage
      
 
      $ kubectl top node [NAME | -l label]
      
@@ -7049,8 +7067,8 @@ applications.
      
 
 use-protocol-buffers
 
-false
-If present, protocol-buffers will be used to request metrics. 
+true
+Enables using protocol-buffers to access Metrics API. 
 
 
 
@@ -7076,7 +7094,7 @@ applications.
      
 
 
      kubectl top pod -l name=myLabel
 
      
-
      Display Resource (CPU/Memory) usage of pods.
      
+
      Display resource (CPU/memory) usage of pods.
      
 
       The 'top pod' command allows you to see the resource consumption of pods.
      
 
       Due to the metrics pipeline delay, they may be unavailable for a few minutes since pod creation.
      
 
      Usage
      
@@ -7105,6 +7123,12 @@ applications.
      
 If present, print usage of containers within a pod. 
 
 
+field-selector
+
+
+Selector (field query) to filter on, supports '=', '==', and '!='.(e.g. --field-selector key1=value1,key2=value2). The server only supports a limited number of field queries per type. 
+
+
 no-headers
 
 false
@@ -7125,8 +7149,8 @@ applications.
      
 
 use-protocol-buffers
 
-false
-If present, protocol-buffers will be used to request metrics. 
+true
+Enables using protocol-buffers to access Metrics API. 
 
 
 
@@ -7138,7 +7162,7 @@ applications.
      
 
 
      kubectl api-versions
 
      
-
      Print the supported API versions on the server, in the form of "group/version"
      
+
      Print the supported API versions on the server, in the form of "group/version".
      
 
      Usage
      
 
      $ kubectl api-versions
      
 
      
@@ -7148,6 +7172,11 @@ applications.
      
 
      $ kubectl certificate SUBCOMMAND
      
 
      
 
      approve
      
+
      
+
       Approve CSR 'csr-sqgzp'
      
+
      
+
      kubectl certificate approve csr-sqgzp
+
      
 
      Approve a certificate signing request.
      
 
       kubectl certificate approve allows a cluster admin to approve a certificate signing request (CSR). This action tells a certificate signing controller to issue a certificate to the requestor with the attributes requested in the CSR.
      
 
       SECURITY NOTICE: Depending on the requested attributes, the issued certificate can potentially grant a requester access to cluster resources or to authenticate as a requested identity. Before approving a CSR, ensure you understand what the signed certificate can do.
      
@@ -7216,6 +7245,11 @@ applications.
      
 
 
      
 
      deny
      
+
      
+
       Deny CSR 'csr-sqgzp'
      
+
      
+
      kubectl certificate deny csr-sqgzp
+
      
 
      Deny a certificate signing request.
      
 
       kubectl certificate deny allows a cluster admin to deny a certificate signing request (CSR). This action tells a certificate signing controller to not to issue a certificate to the requestor.
      
 
      Usage
      
@@ -7288,7 +7322,7 @@ applications.
      
 
 
      kubectl cluster-info
 
      
-
      Display addresses of the control plane and services with label kubernetes.io/cluster-service=true To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
      
+
      Display addresses of the control plane and services with label kubernetes.io/cluster-service=true. To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
      
 
      Usage
      
 
      $ kubectl cluster-info
      
 
      
@@ -7313,8 +7347,8 @@ applications.
      
 
 
      kubectl cluster-info dump --namespaces default,kube-system --output-directory=/path/to/cluster-state
 
      
-
      Dumps cluster info out suitable for debugging and diagnosing cluster problems.  By default, dumps everything to stdout. You can optionally specify a directory with --output-directory.  If you specify a directory, kubernetes will build a set of files in that directory.  By default only dumps things in the 'kube-system' namespace, but you can switch to a different namespace with the --namespaces flag, or specify --all-namespaces to dump all namespaces.
      
-
       The command also dumps the logs of all of the pods in the cluster, these logs are dumped into different directories based on namespace and pod name.
      
+
      Dump cluster information out suitable for debugging and diagnosing cluster problems.  By default, dumps everything to stdout. You can optionally specify a directory with --output-directory.  If you specify a directory, Kubernetes will build a set of files in that directory.  By default, only dumps things in the current namespace and 'kube-system' namespace, but you can switch to a different namespace with the --namespaces flag, or specify --all-namespaces to dump all namespaces.
      
+
       The command also dumps the logs of all of the pods in the cluster; these logs are dumped into different directories based on namespace and pod name.
      
 
      Usage
      
 
      $ kubectl cluster-info dump
      
 
      Flags
      
@@ -7381,7 +7415,7 @@ applications.
      
 
      
 
      cordon
      
 
      
-
       Mark node "foo" as unschedulable.
      
+
       Mark node "foo" as unschedulable
      
 
      
 
      kubectl cordon foo
 
      
@@ -7416,20 +7450,20 @@ applications.
      
 
      
 
      drain
      
 
      
-
       Drain node "foo", even if there are pods not managed by a ReplicationController, ReplicaSet, Job, DaemonSet or StatefulSet on it.
      
+
       Drain node "foo", even if there are pods not managed by a replication controller, replica set, job, daemon set or stateful set on it
      
 
      
-
      $ kubectl drain foo --force
+
      kubectl drain foo --force
 
      
 
      
-
       As above, but abort if there are pods not managed by a ReplicationController, ReplicaSet, Job, DaemonSet or StatefulSet, and use a grace period of 15 minutes.
      
+
       As above, but abort if there are pods not managed by a replication controller, replica set, job, daemon set or stateful set, and use a grace period of 15 minutes
      
 
      
-
      $ kubectl drain foo --grace-period=900
+
      kubectl drain foo --grace-period=900
 
      
 
      Drain node in preparation for maintenance.
      
-
       The given node will be marked unschedulable to prevent new pods from arriving. 'drain' evicts the pods if the APIServer supports http://kubernetes.io/docs/admin/disruptions/ . Otherwise, it will use normal DELETE to delete the pods. The 'drain' evicts or deletes all pods except mirror pods (which cannot be deleted through the API server).  If there are DaemonSet-managed pods, drain will not proceed without --ignore-daemonsets, and regardless it will not delete any DaemonSet-managed pods, because those pods would be immediately replaced by the DaemonSet controller, which ignores unschedulable markings.  If there are any pods that are neither mirror pods nor managed by ReplicationController, ReplicaSet, DaemonSet, StatefulSet or Job, then drain will not delete any pods unless you use --force.  --force will also allow deletion to proceed if the managing resource of one or more pods is missing.
      
+
       The given node will be marked unschedulable to prevent new pods from arriving. 'drain' evicts the pods if the API server supports https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ . Otherwise, it will use normal DELETE to delete the pods. The 'drain' evicts or deletes all pods except mirror pods (which cannot be deleted through the API server).  If there are daemon set-managed pods, drain will not proceed without --ignore-daemonsets, and regardless it will not delete any daemon set-managed pods, because those pods would be immediately replaced by the daemon set controller, which ignores unschedulable markings.  If there are any pods that are neither mirror pods nor managed by a replication controller, replica set, daemon set, stateful set, or job, then drain will not delete any pods unless you use --force.  --force will also allow deletion to proceed if the managing resource of one or more pods is missing.
      
 
       'drain' waits for graceful termination. You should not operate on the machine until the command completes.
      
 
       When you are ready to put the node back into service, use kubectl uncordon, which will make the node schedulable again.
      
-
       http://kubernetes.io/images/docs/kubectl_drain.svg
      
+
       https://kubernetes.io/images/docs/kubectl_drain.svg
      
 
      Usage
      
 
      $ kubectl drain NODE
      
 
      Flags
      
@@ -7444,6 +7478,12 @@ applications.
      
 
 
 
+chunk-size
+
+500
+Return large lists in chunks rather than all at once. Pass 0 to disable. This flag is beta and may change in the future. 
+
+
 delete-emptydir-data
 
 false
@@ -7520,12 +7560,12 @@ applications.
      
 
      
 
      taint
      
 
      
-
       Update node 'foo' with a taint with key 'dedicated' and value 'special-user' and effect 'NoSchedule'. # If a taint with that key and effect already exists, its value is replaced as specified.
      
+
       Update node 'foo' with a taint with key 'dedicated' and value 'special-user' and effect 'NoSchedule' # If a taint with that key and effect already exists, its value is replaced as specified
      
 
      
 
      kubectl taint nodes foo dedicated=special-user:NoSchedule
 
      
 
      
-
       Remove from node 'foo' the taint with key 'dedicated' and effect 'NoSchedule' if one exists.
      
+
       Remove from node 'foo' the taint with key 'dedicated' and effect 'NoSchedule' if one exists
      
 
      
 
      kubectl taint nodes foo dedicated:NoSchedule-
 
      
@@ -7548,7 +7588,7 @@ applications.
      
 
        
 
      • A taint consists of a key, value, and effect. As an argument here, it is expressed as key=value:effect.
        • 
 
      • The key must begin with a letter or number, and may contain letters, numbers, hyphens, dots, and underscores, up to  253 characters.
        • 
-
      • Optionally, the key can begin with a DNS subdomain prefix and a single '/', like example.com/my-app
        • 
+
      • Optionally, the key can begin with a DNS subdomain prefix and a single '/', like example.com/my-app.
        • 
 
      • The value is optional. If given, it must begin with a letter or number, and may contain letters, numbers, hyphens, dots, and underscores, up to  63 characters.
        • 
 
      • The effect must be NoSchedule, PreferNoSchedule or NoExecute.
        • 
 
      • Currently taint can only apply to node.
        • 
@@ -7631,9 +7671,9 @@ applications.
        
 
        
 
        uncordon
        
 
        
-
         Mark node "foo" as schedulable.
        
+
         Mark node "foo" as schedulable
        
 
        
-
        $ kubectl uncordon foo
+
        kubectl uncordon foo
 
        
 
        Mark node as schedulable.
        
 
        Usage
        
@@ -7672,17 +7712,17 @@ applications.
        
 
        
 
        api-resources
        
 
        
-
         Print the supported API Resources
        
+
         Print the supported API resources
        
 
        
 
        kubectl api-resources
 
        
 
        
-
         Print the supported API Resources with more information
        
+
         Print the supported API resources with more information
        
 
        
 
        kubectl api-resources -o wide
 
        
 
        
-
         Print the supported API Resources sorted by a column
        
+
         Print the supported API resources sorted by a column
        
 
        
 
        kubectl api-resources --sort-by=name
 
        
@@ -7697,11 +7737,11 @@ applications.
        
 
        kubectl api-resources --namespaced=false
 
        
 
        
-
         Print the supported API Resources with specific APIGroup
        
+
         Print the supported API resources with a specific APIGroup
        
 
        
 
        kubectl api-resources --api-group=extensions
 
        
-
        Print the supported API resources on the server
        
+
        Print the supported API resources on the server.
        
 
        Usage
        
 
        $ kubectl api-resources
        
 
        Flags
        
@@ -7772,12 +7812,12 @@ applications.
        
 
        brew install bash-completion@2
 
        
 
        
-
         If kubectl is installed via homebrew, this should start working immediately. ## If you've installed via other means, you may need add the completion to your completion directory
        
+
         If kubectl is installed via homebrew, this should start working immediately ## If you've installed via other means, you may need add the completion to your completion directory
        
 
        
 
        kubectl completion bash > $(brew --prefix)/etc/bash_completion.d/kubectl
 
        
 
        
-
         Installing bash completion on Linux ## If bash-completion is not installed on Linux, please install the 'bash-completion' package ## via your distribution's package manager. ## Load the kubectl completion code for bash into the current shell
        
+
         Installing bash completion on Linux ## If bash-completion is not installed on Linux, install the 'bash-completion' package ## via your distribution's package manager. ## Load the kubectl completion code for bash into the current shell
        
 
        
 
        source <(kubectl completion bash)
 
        
@@ -7805,8 +7845,14 @@ source $HOME/.bash_profile
 
        kubectl completion zsh > "${fpath[1]}/_kubectl"
 
        
 
        Output shell completion code for the specified shell (bash or zsh). The shell code must be evaluated to provide interactive completion of kubectl commands.  This can be done by sourcing it from the .bash_profile.
        
-
         Detailed instructions on how to do this are available here: https://kubernetes.io/docs/tasks/tools/install-kubectl/#enabling-shell-autocompletion
        
-
         Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2
        
+
         Detailed instructions on how to do this are available here:
        
+
          for macOS:
+  https://kubernetes.io/docs/tasks/tools/install-kubectl-macos/#enable-shell-autocompletion
        
+
          for linux:
+  https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/#enable-shell-autocompletion
        
+
          for windows:
+  https://kubernetes.io/docs/tasks/tools/install-kubectl-windows/#enable-shell-autocompletion
        
+
         Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2.
        
 
        Usage
        
 
        $ kubectl completion SHELL
        
 
        
@@ -7827,7 +7873,7 @@ source $HOME/.bash_profile
 
 
        kubectl config current-context
 
        
-
        Displays the current-context
        
+
        Display the current-context.
        
 
        Usage
        
 
        $ kubectl config current-context
        
 
        
@@ -7837,7 +7883,7 @@ source $HOME/.bash_profile
 
 
        kubectl config delete-cluster minikube
 
        
-
        Delete the specified cluster from the kubeconfig
        
+
        Delete the specified cluster from the kubeconfig.
        
 
        Usage
        
 
        $ kubectl config delete-cluster NAME
        
 
        
@@ -7847,7 +7893,7 @@ source $HOME/.bash_profile
 
 
        kubectl config delete-context minikube
 
        
-
        Delete the specified context from the kubeconfig
        
+
        Delete the specified context from the kubeconfig.
        
 
        Usage
        
 
        $ kubectl config delete-context NAME
        
 
        
@@ -7857,13 +7903,13 @@ source $HOME/.bash_profile
 
 
        kubectl config delete-user minikube
 
        
-
        Delete the specified user from the kubeconfig
        
+
        Delete the specified user from the kubeconfig.
        
 
        Usage
        
 
        $ kubectl config delete-user NAME
        
 
        
 
        get-clusters
        
 
        
-
         List the clusters kubectl knows about
        
+
         List the clusters that kubectl knows about
        
 
        
 
        kubectl config get-clusters
 
        
@@ -7878,11 +7924,11 @@ source $HOME/.bash_profile
 
        kubectl config get-contexts
 
        
 
        
-
         Describe one context in your kubeconfig file.
        
+
         Describe one context in your kubeconfig file
        
 
        
 
        kubectl config get-contexts my-context
 
        
-
        Displays one or many contexts from the kubeconfig file.
        
+
        Display one or many contexts from the kubeconfig file.
        
 
        Usage
        
 
        $ kubectl config get-contexts [(-o|--output=)name)]
        
 
        Flags
        
@@ -7913,7 +7959,7 @@ source $HOME/.bash_profile
 
        
 
        get-users
        
 
        
-
         List the users kubectl knows about
        
+
         List the users that kubectl knows about
        
 
        
 
        kubectl config get-users
 
        
@@ -7928,37 +7974,37 @@ source $HOME/.bash_profile
 
        kubectl config rename-context old-name new-name
 
        
 
        Renames a context from the kubeconfig file.
        
-
         CONTEXT_NAME is the context name that you wish to change.
        
-
         NEW_NAME is the new name you wish to set.
        
-
         Note: In case the context being renamed is the 'current-context', this field will also be updated.
        
+
         CONTEXT_NAME is the context name that you want to change.
        
+
         NEW_NAME is the new name you want to set.
        
+
         Note: If the context being renamed is the 'current-context', this field will also be updated.
        
 
        Usage
        
 
        $ kubectl config rename-context CONTEXT_NAME NEW_NAME
        
 
        
 
        set
        
 
        
-
         Set server field on the my-cluster cluster to https://1.2.3.4
        
+
         Set the server field on the my-cluster cluster to https://1.2.3.4
        
 
        
 
        kubectl config set clusters.my-cluster.server https://1.2.3.4
 
        
 
        
-
         Set certificate-authority-data field on the my-cluster cluster.
        
+
         Set the certificate-authority-data field on the my-cluster cluster
        
 
        
 
        kubectl config set clusters.my-cluster.certificate-authority-data $(echo "cert_data_here" | base64 -i -)
 
        
 
        
-
         Set cluster field in the my-context context to my-cluster.
        
+
         Set the cluster field in the my-context context to my-cluster
        
 
        
 
        kubectl config set contexts.my-context.cluster my-cluster
 
        
 
        
-
         Set client-key-data field in the cluster-admin user using --set-raw-bytes option.
        
+
         Set the client-key-data field in the cluster-admin user using --set-raw-bytes option
        
 
        
 
        kubectl config set users.cluster-admin.client-key-data cert_data_here --set-raw-bytes=true
 
        
-
        Sets an individual value in a kubeconfig file
        
+
        Set an individual value in a kubeconfig file.
        
 
         PROPERTY_NAME is a dot delimited name where each token represents either an attribute name or a map key.  Map keys may not contain dots.
        
-
         PROPERTY_VALUE is the new value you wish to set. Binary fields such as 'certificate-authority-data' expect a base64 encoded string unless the --set-raw-bytes flag is used.
        
-
         Specifying a attribute name that already exists will merge new fields on top of existing values.
        
+
         PROPERTY_VALUE is the new value you want to set. Binary fields such as 'certificate-authority-data' expect a base64 encoded string unless the --set-raw-bytes flag is used.
        
+
         Specifying an attribute name that already exists will merge new fields on top of existing values.
        
 
        Usage
        
 
        $ kubectl config set PROPERTY_NAME PROPERTY_VALUE
        
 
        Flags
        
@@ -7983,7 +8029,7 @@ source $HOME/.bash_profile
 
        
 
        set-cluster
        
 
        
-
         Set only the server field on the e2e cluster entry without touching other values.
        
+
         Set only the server field on the e2e cluster entry without touching other values
        
 
        
 
        kubectl config set-cluster e2e --server=https://1.2.3.4
 
        
@@ -8002,7 +8048,7 @@ source $HOME/.bash_profile
 
 
        kubectl config set-cluster e2e --tls-server-name=my-cluster-name
 
        
-
        Sets a cluster entry in kubeconfig.
        
+
        Set a cluster entry in kubeconfig.
        
 
         Specifying a name that already exists will merge new fields on top of existing values for those fields.
        
 
        Usage
        
 
        $ kubectl config set-cluster NAME [--server=server] [--certificate-authority=path/to/certificate/authority] [--insecure-skip-tls-verify=true] [--tls-server-name=example.com]
        
@@ -8032,7 +8078,7 @@ source $HOME/.bash_profile
 
 
        kubectl config set-context gce --user=cluster-admin
 
        
-
        Sets a context entry in kubeconfig
        
+
        Set a context entry in kubeconfig.
        
 
         Specifying a name that already exists will merge new fields on top of existing values for those fields.
        
 
        Usage
        
 
        $ kubectl config set-context [NAME | --current] [--cluster=cluster_nickname] [--user=user_nickname] [--namespace=namespace]
        
@@ -8058,7 +8104,7 @@ source $HOME/.bash_profile
 
        
 
        set-credentials
        
 
        
-
         Set only the "client-key" field on the "cluster-admin" # entry, without touching other values:
        
+
         Set only the "client-key" field on the "cluster-admin" # entry, without touching other values
        
 
        
 
        kubectl config set-credentials cluster-admin --client-key=~/.kube/admin.key
 
        
@@ -8107,7 +8153,7 @@ source $HOME/.bash_profile
 
 
        kubectl config set-credentials cluster-admin --exec-env=var-to-remove-
 
        
-
        Sets a user entry in kubeconfig
        
+
        Set a user entry in kubeconfig.
        
 
         Specifying a name that already exists will merge new fields on top of existing values.
        
 
          Client-certificate flags:
   --client-certificate=certfile --client-key=keyfile
        
@@ -8176,16 +8222,16 @@ source $HOME/.bash_profile
 
        
 
        unset
        
 
        
-
         Unset the current-context.
        
+
         Unset the current-context
        
 
        
 
        kubectl config unset current-context
 
        
 
        
-
         Unset namespace in foo context.
        
+
         Unset namespace in foo context
        
 
        
 
        kubectl config unset contexts.foo.namespace
 
        
-
        Unsets an individual value in a kubeconfig file
        
+
        Unset an individual value in a kubeconfig file.
        
 
         PROPERTY_NAME is a dot delimited name where each token represents either an attribute name or a map key.  Map keys may not contain dots.
        
 
        Usage
        
 
        $ kubectl config unset PROPERTY_NAME
        
@@ -8196,18 +8242,18 @@ source $HOME/.bash_profile
 
 
        kubectl config use-context minikube
 
        
-
        Sets the current-context in a kubeconfig file
        
+
        Set the current-context in a kubeconfig file.
        
 
        Usage
        
 
        $ kubectl config use-context CONTEXT_NAME
        
 
        
 
        view
        
 
        
-
         Show merged kubeconfig settings.
        
+
         Show merged kubeconfig settings
        
 
        
 
        kubectl config view
 
        
 
        
-
         Show merged kubeconfig settings and raw certificate data.
        
+
         Show merged kubeconfig settings and raw certificate data
        
 
        
 
        kubectl config view --raw
 
        
@@ -8293,7 +8339,7 @@ source $HOME/.bash_profile
 
 
        kubectl explain pods.spec.containers
 
        
-
        List the fields for supported resources
        
+
        List the fields for supported resources.
        
 
         This command describes the fields associated with each supported API resource. Fields are identified via a simple JSONPath identifier:
        
 
          <type>.<fieldName>[.<fieldName>]
        
 
         Add the --recursive flag to display all of the fields at once without descriptions. Information about each field is retrieved from the server in OpenAPI format.
        
@@ -8374,7 +8420,7 @@ source $HOME/.bash_profile
 
 
        kubectl version
 
        
-
        Print the client and server version information for the current context
        
+
        Print the client and server version information for the current context.
        
 
        Usage
        
 
        $ kubectl version
        
 
        Flags
        

From ee245ff73e635cd42b4a87710a70de59e21941b8 Mon Sep 17 00:00:00 2001
From: Sayantani Saha <75435974+sayantani11@users.noreply.github.com>
Date: Sun, 8 Aug 2021 18:31:30 +0530
Subject: [PATCH 106/279] Added announcements of KubeCon NA & China (#29192)

* Added announcements of KubeCon NA & China

* svg images added & required changes made

* Requested changes made

* svg images fixed

* small correction required

* added the to the message

* small correction

* Netlify build error fixed
---
 data/announcements/scheduled.yaml             | 24 ++++++++++++++++++-
 .../kubecon-China-2021-white.svg              |  1 +
 .../announcements/kubecon-NA-2021-white.svg   |  1 +
 3 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 static/images/announcements/kubecon-China-2021-white.svg
 create mode 100644 static/images/announcements/kubecon-NA-2021-white.svg

diff --git a/data/announcements/scheduled.yaml b/data/announcements/scheduled.yaml
index eca320cc88..831ad1ebb6 100644
--- a/data/announcements/scheduled.yaml
+++ b/data/announcements/scheduled.yaml
@@ -71,4 +71,26 @@ announcements:
     KubeCon + CloudNativeCon EU 2021 virtual.
   message: |
     4 days of incredible opportunities to collaborate, learn + share with the entire community!
        
-    May 4 - May 7, 2021.
\ No newline at end of file
+    May 4 - May 7, 2021.
+
+- name: Kubecon 2021 NA
+  startTime: 2021-10-01T00:00:00
+  endTime: 2021-10-16T01:00:00
+  style: "background: linear-gradient(90deg, rgb(7, 132, 111) 0%, rgb(54, 214, 183) 100%)" 
+  title: |
+    
+     KubeCon + CloudNativeCon North America 2021 Los Angeles, California + Virtual.
+  message: |
+    5 days of incredible opportunites to collaborate, learn + share with the entire community!
        
+    October 11 - 15, 2021.
+
+- name: Kubecon 2021 China
+  startTime: 2021-11-30T00:00:00
+  endTime: 2021-12-10T14:00:00
+  style: "background: linear-gradient(90deg, rgb(253, 133, 1) 0%, rgb(128, 34, 196) 100%)"
+  title: |
+     
+     KubeCon + CloudNativeCon + Open Source Summit China 2021 Virtual.
+  message: |
+    2 days of incredible opportunities to collaborate, learn + share with the entire community!
        
+    December 9 + 10, 2021.
diff --git a/static/images/announcements/kubecon-China-2021-white.svg b/static/images/announcements/kubecon-China-2021-white.svg
new file mode 100644
index 0000000000..2d40cf9580
--- /dev/null
+++ b/static/images/announcements/kubecon-China-2021-white.svg
@@ -0,0 +1 @@
+KubeCon-China-2020-logos_white.svg
diff --git a/static/images/announcements/kubecon-NA-2021-white.svg b/static/images/announcements/kubecon-NA-2021-white.svg
new file mode 100644
index 0000000000..0e9840087d
--- /dev/null
+++ b/static/images/announcements/kubecon-NA-2021-white.svg
@@ -0,0 +1 @@
+KubeCon_NA_2021_web_web-logo-white (1).svg

From 8ed0b0fd6d2789c59936e22a8e8d5a6b3a14acba Mon Sep 17 00:00:00 2001
From: kerthcet 
Date: Sun, 8 Aug 2021 21:26:36 +0800
Subject: [PATCH 107/279] keep the document in sync with deprecation of Dynamic
 Kubelet Configuration in releasev1.22

Signed-off-by: kerthcet 
---
 .../administer-cluster/reconfigure-kubelet.md | 100 ++++++++++--------
 1 file changed, 56 insertions(+), 44 deletions(-)

diff --git a/content/zh/docs/tasks/administer-cluster/reconfigure-kubelet.md b/content/zh/docs/tasks/administer-cluster/reconfigure-kubelet.md
index 1a4867a9e7..7d34460c24 100644
--- a/content/zh/docs/tasks/administer-cluster/reconfigure-kubelet.md
+++ b/content/zh/docs/tasks/administer-cluster/reconfigure-kubelet.md
@@ -13,7 +13,15 @@ content_type: task
 
 
 
-{{< feature-state for_k8s_version="v1.11" state="beta" >}}
+{{< feature-state for_k8s_version="v1.22" state="deprecated" >}}
+
+
+{{< caution >}}
+[动态 kubelet 配置](https://github.com/kubernetes/enhancements/issues/281)
+已经废弃不建议使用。请选择其他方法将配置分发到集群中的节点。
+{{< /caution >}}
 
 
 [动态 kubelet 配置](https://github.com/kubernetes/enhancements/issues/281)
-允许你在一个运行的 Kubernetes 集群上通过部署 ConfigMap
-并配置每个节点来使用它来更改每个 kubelet 的配置，。
+允许你通过部署一个所有节点都会使用的 ConfigMap 
+达到在运行中的 Kubernetes 集群中更改 kubelet 配置的目的。
 
 
 {{< warning >}}
-所有 kubelet 配置参数都可以动态更改，但这对某些参数来说是不安全的。
-在决定动态更改参数之前，你需要深刻理解这种变化将如何影响你的集群的行为。
-在把一组变更推广到集群范围之前，需要在较小规模的节点集合上仔细地测试这些配置变化。
-与特定字段配置相关的建议可以在源码中 `KubeletConfiguration`
-[类型文档](https://github.com/kubernetes/kubernetes/blob/release-1.11/pkg/kubelet/apis/kubeletconfig/v1beta1/types.go)中找到。
+所有 kubelet 配置参数都可以被动态更改，但对某些参数来说这类更改是不安全的。
+在决定动态更改参数之前，你需要深刻理解这个改动将会如何影响集群的行为。
+在将变更扩散到整个集群之前，你需要先在小规模的节点集合上仔细地测试这些配置变动。
+特定字段相关的配置建议可以在文档
+[`KubeletConfiguration`](/docs/reference/config-api/kubelet-config.v1beta1/)中找到。
 {{< /warning >}}
 
 ## {{% heading "prerequisites" %}}
@@ -54,10 +62,10 @@ or v1.17; other combinations
 [aren't supported](/docs/setup/release/version-skew-policy/#kubectl).
 -->
 你需要一个 Kubernetes 集群。
-你需要 v1.11 或更高版本的 kubectl，并以配置好与集群通信。
+你需要 v1.11 或更高版本的 kubectl，并配置好与集群的通信。
 {{< version-check >}}
-你的集群 API 服务器版本（如 v1.12）不能比你所用的 kubectl
-的版本差不止一个小版本号。
+你的集群 API 服务器版本（如 v1.12）不能和你的 kubectl
+版本相差超过一个小版本号。
 例如，如果你的集群在运行 v1.16，那么你可以使用 v1.15、v1.16、v1.17 的 kubectl，
 所有其他的组合都是
 [不支持的](/zh/docs/setup/release/version-skew-policy/#kubectl)。
@@ -70,10 +78,10 @@ because there are manual alternatives.
 For each node that you're reconfiguring, you must set the kubelet
 `-dynamic-config-dir` flag to a writable directory.
 -->
-某些例子中使用了命令行工具 [jq](https://stedolan.github.io/jq/)。
+在某些例子中使用了命令行工具 [jq](https://stedolan.github.io/jq/)。
 你并不一定需要 `jq` 才能完成这些任务，因为总是有一些手工替代的方式。
 
-针对你所重新配置的每个节点，你必须设置 kubelet 的参数
+针对你重新配置的每个节点，你必须设置 kubelet 的标志
 `-dynamic-config-dir`，使之指向一个可写的目录。
 
 
@@ -85,21 +93,21 @@ For each node that you're reconfiguring, you must set the kubelet
 -->
 ## 重配置 集群中运行节点上的 kubelet 
 
-### 基本工作流程概述
+### 基本工作流程概览
 
 
 在运行中的集群中配置 kubelet 的基本工作流程如下：
 
-1. 编写一个 YAML 或 JSON 的配置文件包含 kubelet 的配置。
+1. 编写一个包含 kubelet 配置的 YAML 或 JSON 文件。
 2. 将此文件包装在 ConfigMap 中并将其保存到 Kubernetes 控制平面。
-3. 更新 kubelet 的相应节点对象以使用此 ConfigMap。
+3. 更新 kubelet 所在节点对象以使用此 ConfigMap。
 
 
-每个 kubelet 都会在其各自的节点对象上监测（Watch）配置引用。当引用更改时，kubelet 将下载新配置，
-更新本地引用以引用该文件，然后退出。
-要想使该功能正常地工作，你必须运行操作系统级别的服务管理器（如 systemd），
-在 kubelet 退出时将其重启。
+每个 kubelet 都会在其各自的节点对象上监测（Watch）配置引用。当引用更改时，kubelet 将下载新的配置文件，
+更新本地引用指向该文件，然后退出。
+为了使该功能正常地工作，你必须运行操作系统级别的服务管理器（如 systemd），
+它将会在 kubelet 退出后将其重启。
 kubelet 重新启动时，将开始使用新配置。
 
 
-这个新配置完全地覆盖 `--config` 所提供的配置，并被命令行标志覆盖。
+新配置将会完全地覆盖 `--config` 所提供的配置，并被命令行标志覆盖。
 新配置中未指定的值将收到适合配置版本的默认值
 (e.g. `kubelet.config.k8s.io/v1beta1`)，除非被命令行标志覆盖。
 
@@ -132,16 +140,16 @@ ConfigMap, you can observe this status to confirm that the Node is using the
 intended configuration.
 -->
 节点 kubelet 配置状态可通过 `node.spec.status.config` 获取。
-一旦你已经改变了一个节点去使用新的 ConfigMap，
-就可以观察此状态以确认该节点正在使用的预期配置。
+一旦你更新了一个节点去使用新的 ConfigMap，
+就可以通过观察此状态来确认该节点是否正在使用预期配置。
 
 
-本文用命令 `kubectl edit` 描述节点的编辑，还有一些其他的方式去修改节点的规约，
-包括更利于脚本化的工作流程的 `kubectl patch`。
+本文中使用命令 `kubectl edit` 来编辑节点，还有其他的方式可以修改节点的规约，
+比如更利于脚本化工作流程的 `kubectl patch`。
 
 
 {{< warning >}}
-通过就地更新 ConfigMap 来更改配置是 *可能的*。
-尽管如此，这样做会导致所有配置为使用该 ConfigMap 的 kubelet 被同时更新。
+尽管通过就地更新 ConfigMap 来更改配置是 *可能的*。
+但是这样做会导致所有使用该 ConfigMap 配置的 kubelet 同时更新。
 更安全的做法是按惯例将 ConfigMap 视为不可变更的，借助于
 `kubectl` 的 `--append-hash` 选项逐步把更新推广到 `node.spec.configSource`。
 {{< /warning >}}
@@ -249,22 +257,22 @@ adapt the steps if you prefer to extract the `kubeletconfig` subobject manually.
 
 
 1. 选择要重新配置的节点。在本例中，此节点的名称为 `NODE_NAME`。
 2. 使用以下命令在后台启动 kubectl 代理：
 
-   ```bash
+   ```shell
    kubectl proxy --port=8001 &
    ```
 
 3. 运行以下命令从 `configz` 端点中下载并解压配置。这个命令很长，因此在复制粘贴时要小心。
    **如果你使用 zsh**，请注意常见的 zsh 配置要添加反斜杠转义 URL 中变量名称周围的大括号。
@@ -477,12 +485,12 @@ by eye.
 
-如果发生错误，kubelet 会在 `node.status.config.error` 中显示出错误信息的结构体。
-可能的错误列在[了解节点配置错误信息](#understanding-node-config-status-errors)节。
+如果发生错误，kubelet 会在 `Node.Status.Config.Error` 中显示出错误信息的结构体。
+错误可能出现在列表[理解节点状态配置错误信息](#understanding-node-config-status-errors)中。
 你可以在 kubelet 日志中搜索相同的文本以获取更多详细信息和有关错误的上下文。
 
 
-## 了解节点配置错误信息 {#understanding-node-config-status-errors}
+## 理解 `Node.Status.Config.Error` 消息 {#understanding-node-config-status-errors}
 
 下表描述了使用动态 kubelet 配置时可能发生的错误消息。
 你可以在 kubelet 日志中搜索相同的文本来获取有关错误的其他详细信息和上下文。
@@ -646,11 +654,15 @@ internal failure, see Kubelet log for details | 在对配置进行同步的循
 ## {{% heading "whatsnext" %}}
 
 
 - 关于如何通过配置文件来配置 kubelet 的更多细节信息，可参阅
   [使用配置文件设置 kubelet 参数](/zh/docs/tasks/administer-cluster/kubelet-config-file).
 - 阅读 API 文档中 [`NodeConfigSource`](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#nodeconfigsource-v1-core) 说明
-
+- 查阅[`KubeletConfiguration`](/docs/reference/config-api/kubelet-config.v1beta1/)文献进一步了解 kubelet 
+  配置信息。
\ No newline at end of file

From 91f4f4adf7d36d1887271fc780b531e8478d1704 Mon Sep 17 00:00:00 2001
From: Dima Brusilovsky 
Date: Sun, 8 Aug 2021 18:47:19 +0300
Subject: [PATCH 108/279] Update custom-resource-definition-versioning.md

---
 .../custom-resources/custom-resource-definition-versioning.md   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definition-versioning.md b/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definition-versioning.md
index 05e60449c4..45f589e9d7 100644
--- a/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definition-versioning.md
+++ b/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definition-versioning.md
@@ -202,7 +202,7 @@ spec:
     plural: crontabs
     # singular name to be used as an alias on the CLI and for display
     singular: crontab
-    # kind is normally the CamelCased singular type. Your resource manifests use this.
+    # kind is normally the PascalCased singular type. Your resource manifests use this.
     kind: CronTab
     # shortNames allow shorter string to match your resource on the CLI
     shortNames:

From fafe6d1e9f206c29d6183d2f3efd76a6af737524 Mon Sep 17 00:00:00 2001
From: Carlos Panato 
Date: Fri, 6 Aug 2021 12:36:29 +0200
Subject: [PATCH 109/279] patch releases: add 1.22 release to the schedule

Signed-off-by: Carlos Panato 
---
 content/en/releases/patch-releases.md | 12 +++++++++++-
 data/releases/schedule.yaml           |  6 ++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/content/en/releases/patch-releases.md b/content/en/releases/patch-releases.md
index fe00ea5807..97d9449ea7 100644
--- a/content/en/releases/patch-releases.md
+++ b/content/en/releases/patch-releases.md
@@ -80,12 +80,22 @@ releases may also occur in between these.
 | --------------------- | -------------------- | ----------- |
 | August 2021           | 2021-08-07           | 2021-08-11  |
 | September 2021        | 2021-09-10           | 2021-09-15  |
-| October 2021          | 2021-10-08           | 2021-10-13  |
+| October 2021          | 2021-10-15           | 2021-10-20  |
 | November 2021         | 2021-11-12           | 2021-11-17  |
 | December 2021         | 2021-12-10           | 2021-12-15  |
 
 ## Detailed Release History for Active Branches
 
+### 1.22
+
+**1.22** enters maintenance mode on **2022-08-28**
+
+End of Life for **1.22** is **2022-10-28**
+
+| PATCH RELEASE | CHERRY PICK DEADLINE | TARGET DATE | NOTE |
+|---------------|----------------------|-------------|------|
+| 1.22.1        | 2021-08-16           | 2021-08-19  |      |
+
 ### 1.21
 
 **1.21** enters maintenance mode on **2022-04-28**
diff --git a/data/releases/schedule.yaml b/data/releases/schedule.yaml
index 003af71a3b..412ed74e2c 100644
--- a/data/releases/schedule.yaml
+++ b/data/releases/schedule.yaml
@@ -1,4 +1,10 @@
 schedules:
+- release: 1.22
+  next: 1.22.1
+  cherryPickDeadline: 2021-08-16
+  targetDate: 2021-08-19
+  endOfLifeDate: 2022-10-28
+  previousPatches:
 - release: 1.21
   next: 1.21.4
   cherryPickDeadline: 2021-08-07

From 647e9d6ca831e058b5def3ae60d62c8d7d98f4bf Mon Sep 17 00:00:00 2001
From: Maciej Filocha 
Date: Mon, 9 Aug 2021 12:08:22 +0200
Subject: [PATCH 110/279] Fix links in RBAC default bindings table

An extra line needs to be added to allow
the link to be rendered properly.
Also reformatting link line to be better readable.
---
 content/en/docs/reference/access-authn-authz/rbac.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/content/en/docs/reference/access-authn-authz/rbac.md b/content/en/docs/reference/access-authn-authz/rbac.md
index bf7e754d7c..a954b5c513 100644
--- a/content/en/docs/reference/access-authn-authz/rbac.md
+++ b/content/en/docs/reference/access-authn-authz/rbac.md
@@ -683,12 +683,13 @@ When used in a RoleBinding, it gives full control over every resource in
 admin
 None
 Allows admin access, intended to be granted within a namespace using a RoleBinding.
+
 If used in a RoleBinding, allows read/write access to most resources in a namespace,
 including the ability to create roles and role bindings within the namespace.
 This role does not allow write access to resource quota or to the namespace itself.
 This role also does not allow write access to Endpoints in clusters created
-using Kubernetes v1.22+. More information is available in the ["Write Access for
-Endpoints" section](#write-access-for-endpoints).
+using Kubernetes v1.22+. More information is available in the
+["Write Access for Endpoints" section](#write-access-for-endpoints).
 
 
 edit

From bbc82ea1f2d3d817d311ef712dfac67d2bac0518 Mon Sep 17 00:00:00 2001
From: Mengjiao Liu 
Date: Mon, 9 Aug 2021 18:07:38 +0800
Subject: [PATCH 111/279] [zh] Fix `selector` expect map not string and sync
 horizontal-pod-autoscale-walkthrough.md file

---
 .../run-application/horizontal-pod-autoscale-walkthrough.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/content/zh/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md b/content/zh/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md
index ca9931c7d1..f831b28fab 100644
--- a/content/zh/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md
+++ b/content/zh/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md
@@ -304,7 +304,7 @@ First, get the YAML of your HorizontalPodAutoscaler in the `autoscaling/v2beta2`
 首先，将 HorizontalPodAutoscaler 的 YAML 文件改为 `autoscaling/v2beta2` 格式：
 
 ```shell
-kubectl get hpa.v2beta2.autoscaling -o yaml > /tmp/hpa-v2.yaml
+kubectl get hpa php-apache -o yaml > /tmp/hpa-v2.yaml
 ```
 
 
 
-{{< feature-state for_k8s_version="v1.22" state="ga" >}}
+{{< feature-state for_k8s_version="v1.22" state="stable" >}}
 
 ## Introduction
 

From 11c7b70b416a437a2b8835f37eca2fc0bf1f94c2 Mon Sep 17 00:00:00 2001
From: Hoon Jo 
Date: Tue, 10 Aug 2021 18:51:23 +0900
Subject: [PATCH 127/279] Update web-ui-dashboard.md

I rquest to update dashboard/v2.3.1 from v2.2.0

Refer to below
https://github.com/kubernetes/dashboard
---
 .../docs/tasks/access-application-cluster/web-ui-dashboard.md   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/en/docs/tasks/access-application-cluster/web-ui-dashboard.md b/content/en/docs/tasks/access-application-cluster/web-ui-dashboard.md
index 5c402e0304..7ab4e1d135 100644
--- a/content/en/docs/tasks/access-application-cluster/web-ui-dashboard.md
+++ b/content/en/docs/tasks/access-application-cluster/web-ui-dashboard.md
@@ -34,7 +34,7 @@ Dashboard also provides information on the state of Kubernetes resources in your
 The Dashboard UI is not deployed by default. To deploy it, run the following command:
 
 ```
-kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.2.0/aio/deploy/recommended.yaml
+kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.3.1/aio/deploy/recommended.yaml
 ```
 
 ## Accessing the Dashboard UI

From f945335af6c9ee094d8c66d11c163325506a7101 Mon Sep 17 00:00:00 2001
From: Mengjiao Liu 
Date: Tue, 10 Aug 2021 11:15:28 +0800
Subject: [PATCH 128/279]  Hard-code the name of the target repo's default
 branch instead of using the githubbranch parameter value

---
 .../cluster-administration/logging.md         |  2 +-
 .../manage-deployment.md                      |  2 +-
 .../docs/concepts/configuration/overview.md   |  4 ++--
 .../containers/container-environment.md       |  2 +-
 .../connect-applications-service.md           |  6 ++---
 .../concepts/services-networking/service.md   |  2 +-
 content/en/docs/concepts/storage/volumes.md   | 22 +++++++++----------
 .../concepts/workloads/controllers/job.md     |  2 +-
 .../workloads/controllers/statefulset.md      |  2 +-
 .../docs/reference/access-authn-authz/abac.md |  2 +-
 .../access-authn-authz/bootstrap-tokens.md    |  2 +-
 .../administer-cluster/access-cluster-api.md  |  2 +-
 .../dns-custom-nameservers.md                 |  2 +-
 .../tasks/administer-cluster/namespaces.md    |  2 +-
 ...igure-liveness-readiness-startup-probes.md |  2 +-
 .../configure-projected-volume-storage.md     |  2 +-
 .../tasks/debug-application-cluster/audit.md  |  2 +-
 .../configure-multiple-schedulers.md          |  2 +-
 .../basic-stateful-set.md                     |  2 +-
 .../stateful-application/zookeeper.md         |  2 +-
 20 files changed, 33 insertions(+), 33 deletions(-)

diff --git a/content/en/docs/concepts/cluster-administration/logging.md b/content/en/docs/concepts/cluster-administration/logging.md
index 406420f5bf..1bf057f23e 100644
--- a/content/en/docs/concepts/cluster-administration/logging.md
+++ b/content/en/docs/concepts/cluster-administration/logging.md
@@ -81,7 +81,7 @@ rotate an application's logs automatically.
 
 As an example, you can find detailed information about how `kube-up.sh` sets
 up logging for COS image on GCP in the corresponding
-[`configure-helper` script](https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/cluster/gce/gci/configure-helper.sh).
+[`configure-helper` script](https://github.com/kubernetes/kubernetes/blob/master/cluster/gce/gci/configure-helper.sh).
 
 When using a **CRI container runtime**, the kubelet is responsible for rotating the logs and managing the logging directory structure.
 The kubelet sends this information to the CRI container runtime and the runtime writes the container logs to the given location.
diff --git a/content/en/docs/concepts/cluster-administration/manage-deployment.md b/content/en/docs/concepts/cluster-administration/manage-deployment.md
index 173c3f8c15..4d98cf820c 100644
--- a/content/en/docs/concepts/cluster-administration/manage-deployment.md
+++ b/content/en/docs/concepts/cluster-administration/manage-deployment.md
@@ -160,7 +160,7 @@ If you're interested in learning more about `kubectl`, go ahead and read [kubect
 
 The examples we've used so far apply at most a single label to any resource. There are many scenarios where multiple labels should be used to distinguish sets from one another.
 
-For instance, different applications would use different values for the `app` label, but a multi-tier application, such as the [guestbook example](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/guestbook/), would additionally need to distinguish each tier. The frontend could carry the following labels:
+For instance, different applications would use different values for the `app` label, but a multi-tier application, such as the [guestbook example](https://github.com/kubernetes/examples/tree/master/guestbook/), would additionally need to distinguish each tier. The frontend could carry the following labels:
 
 ```yaml
      labels:
diff --git a/content/en/docs/concepts/configuration/overview.md b/content/en/docs/concepts/configuration/overview.md
index 25cfb2e7f1..2f5302b4ff 100644
--- a/content/en/docs/concepts/configuration/overview.md
+++ b/content/en/docs/concepts/configuration/overview.md
@@ -21,7 +21,7 @@ This is a living document. If you think of something that is not on this list bu
 
 - Write your configuration files using YAML rather than JSON. Though these formats can be used interchangeably in almost all scenarios, YAML tends to be more user-friendly.
 
-- Group related objects into a single file whenever it makes sense. One file is often easier to manage than several. See the [guestbook-all-in-one.yaml](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/guestbook/all-in-one/guestbook-all-in-one.yaml) file as an example of this syntax.
+- Group related objects into a single file whenever it makes sense. One file is often easier to manage than several. See the [guestbook-all-in-one.yaml](https://github.com/kubernetes/examples/tree/master/guestbook/all-in-one/guestbook-all-in-one.yaml) file as an example of this syntax.
 
 - Note also that many `kubectl` commands can be called on a directory. For example, you can call `kubectl apply` on a directory of config files.
 
@@ -63,7 +63,7 @@ DNS server watches the Kubernetes API for new `Services` and creates a set of DN
 
 ## Using Labels
 
-- Define and use [labels](/docs/concepts/overview/working-with-objects/labels/) that identify __semantic attributes__ of your application or Deployment, such as `{ app: myapp, tier: frontend, phase: test, deployment: v3 }`. You can use these labels to select the appropriate Pods for other resources; for example, a Service that selects all `tier: frontend` Pods, or all `phase: test` components of `app: myapp`. See the [guestbook](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/guestbook/) app for examples of this approach.
+- Define and use [labels](/docs/concepts/overview/working-with-objects/labels/) that identify __semantic attributes__ of your application or Deployment, such as `{ app: myapp, tier: frontend, phase: test, deployment: v3 }`. You can use these labels to select the appropriate Pods for other resources; for example, a Service that selects all `tier: frontend` Pods, or all `phase: test` components of `app: myapp`. See the [guestbook](https://github.com/kubernetes/examples/tree/master/guestbook/) app for examples of this approach.
 
 A Service can be made to span multiple Deployments by omitting release-specific labels from its selector. When you need to update a running service without downtime, use a [Deployment](/docs/concepts/workloads/controllers/deployment/).
 
diff --git a/content/en/docs/concepts/containers/container-environment.md b/content/en/docs/concepts/containers/container-environment.md
index a1eba4d96d..3c4c153927 100644
--- a/content/en/docs/concepts/containers/container-environment.md
+++ b/content/en/docs/concepts/containers/container-environment.md
@@ -52,7 +52,7 @@ FOO_SERVICE_PORT=
 ```
 
 Services have dedicated IP addresses and are available to the Container via DNS,
-if [DNS addon](https://releases.k8s.io/{{< param "githubbranch" >}}/cluster/addons/dns/) is enabled. 
+if [DNS addon](https://releases.k8s.io/{{< param "fullversion" >}}/cluster/addons/dns/) is enabled. 
 
 
 
diff --git a/content/en/docs/concepts/services-networking/connect-applications-service.md b/content/en/docs/concepts/services-networking/connect-applications-service.md
index 14bc98101f..89d2daddb2 100644
--- a/content/en/docs/concepts/services-networking/connect-applications-service.md
+++ b/content/en/docs/concepts/services-networking/connect-applications-service.md
@@ -133,7 +133,7 @@ about the [service proxy](/docs/concepts/services-networking/service/#virtual-ip
 
 Kubernetes supports 2 primary modes of finding a Service - environment variables
 and DNS. The former works out of the box while the latter requires the
-[CoreDNS cluster addon](https://releases.k8s.io/{{< param "githubbranch" >}}/cluster/addons/dns/coredns).
+[CoreDNS cluster addon](https://releases.k8s.io/{{< param "fullversion" >}}/cluster/addons/dns/coredns).
 {{< note >}}
 If the service environment variables are not desired (because possible clashing with expected program ones,
 too many variables to process, only using DNS, etc) you can disable this mode by setting the `enableServiceLinks`
@@ -231,7 +231,7 @@ Till now we have only accessed the nginx server from within the cluster. Before
 * An nginx server configured to use the certificates
 * A [secret](/docs/concepts/configuration/secret/) that makes the certificates accessible to pods
 
-You can acquire all these from the [nginx https example](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/https-nginx/). This requires having go and make tools installed. If you don't want to install those, then follow the manual steps later. In short:
+You can acquire all these from the [nginx https example](https://github.com/kubernetes/examples/tree/master/staging/https-nginx/). This requires having go and make tools installed. If you don't want to install those, then follow the manual steps later. In short:
 
 ```shell
 make keys KEY=/tmp/nginx.key CERT=/tmp/nginx.crt
@@ -303,7 +303,7 @@ Now modify your nginx replicas to start an https server using the certificate in
 Noteworthy points about the nginx-secure-app manifest:
 
 - It contains both Deployment and Service specification in the same file.
-- The [nginx server](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/https-nginx/default.conf)
+- The [nginx server](https://github.com/kubernetes/examples/tree/master/staging/https-nginx/default.conf)
   serves HTTP traffic on port 80 and HTTPS traffic on 443, and nginx Service
   exposes both ports.
 - Each container has access to the keys through a volume mounted at `/etc/nginx/ssl`.
diff --git a/content/en/docs/concepts/services-networking/service.md b/content/en/docs/concepts/services-networking/service.md
index c3a93921b0..55a1351500 100644
--- a/content/en/docs/concepts/services-networking/service.md
+++ b/content/en/docs/concepts/services-networking/service.md
@@ -429,7 +429,7 @@ variables and DNS.
 When a Pod is run on a Node, the kubelet adds a set of environment variables
 for each active Service.  It supports both [Docker links
 compatible](https://docs.docker.com/userguide/dockerlinks/) variables (see
-[makeLinkVariables](https://releases.k8s.io/{{< param "githubbranch" >}}/pkg/kubelet/envvars/envvars.go#L49))
+[makeLinkVariables](https://releases.k8s.io/{{< param "fullversion" >}}/pkg/kubelet/envvars/envvars.go#L49))
 and simpler `{SVCNAME}_SERVICE_HOST` and `{SVCNAME}_SERVICE_PORT` variables,
 where the Service name is upper-cased and dashes are converted to underscores.
 
diff --git a/content/en/docs/concepts/storage/volumes.md b/content/en/docs/concepts/storage/volumes.md
index d1137286be..56694dee66 100644
--- a/content/en/docs/concepts/storage/volumes.md
+++ b/content/en/docs/concepts/storage/volumes.md
@@ -130,7 +130,7 @@ and the kubelet, set the `InTreePluginAWSUnregister` flag to `true`.
 
 The `azureDisk` volume type mounts a Microsoft Azure [Data Disk](https://docs.microsoft.com/en-us/azure/aks/csi-storage-drivers) into a pod.
 
-For more details, see the [`azureDisk` volume plugin](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/azure_disk/README.md).
+For more details, see the [`azureDisk` volume plugin](https://github.com/kubernetes/examples/tree/master/staging/volumes/azure_disk/README.md).
 
 #### azureDisk CSI migration
 
@@ -148,7 +148,7 @@ features must be enabled.
 The `azureFile` volume type mounts a Microsoft Azure File volume (SMB 2.1 and 3.0)
 into a pod.
 
-For more details, see the [`azureFile` volume plugin](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/azure_file/README.md).
+For more details, see the [`azureFile` volume plugin](https://github.com/kubernetes/examples/tree/master/staging/volumes/azure_file/README.md).
 
 #### azureFile CSI migration
 
@@ -176,7 +176,7 @@ writers simultaneously.
 You must have your own Ceph server running with the share exported before you can use it.
 {{< /note >}}
 
-See the [CephFS example](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/volumes/cephfs/) for more details.
+See the [CephFS example](https://github.com/kubernetes/examples/tree/master/volumes/cephfs/) for more details.
 
 ### cinder
 
@@ -347,7 +347,7 @@ You must configure FC SAN Zoning to allocate and mask those LUNs (volumes) to th
 beforehand so that Kubernetes hosts can access them.
 {{< /note >}}
 
-See the [fibre channel example](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/fibre_channel) for more details.
+See the [fibre channel example](https://github.com/kubernetes/examples/tree/master/staging/volumes/fibre_channel) for more details.
 
 ### flocker (deprecated) {#flocker}
 
@@ -365,7 +365,7 @@ can be shared between pods as required.
 You must have your own Flocker installation running before you can use it.
 {{< /note >}}
 
-See the [Flocker example](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/flocker) for more details.
+See the [Flocker example](https://github.com/kubernetes/examples/tree/master/staging/volumes/flocker) for more details.
 
 ### gcePersistentDisk
 
@@ -533,7 +533,7 @@ simultaneously.
 You must have your own GlusterFS installation running before you can use it.
 {{< /note >}}
 
-See the [GlusterFS example](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/volumes/glusterfs) for more details.
+See the [GlusterFS example](https://github.com/kubernetes/examples/tree/master/volumes/glusterfs) for more details.
 
 ### hostPath {#hostpath}
 
@@ -661,7 +661,7 @@ and then serve it in parallel from as many Pods as you need. Unfortunately,
 iSCSI volumes can only be mounted by a single consumer in read-write mode.
 Simultaneous writers are not allowed.
 
-See the [iSCSI example](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/volumes/iscsi) for more details.
+See the [iSCSI example](https://github.com/kubernetes/examples/tree/master/volumes/iscsi) for more details.
 
 ### local
 
@@ -749,7 +749,7 @@ writers simultaneously.
 You must have your own NFS server running with the share exported before you can use it.
 {{< /note >}}
 
-See the [NFS example](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/nfs) for more details.
+See the [NFS example](https://github.com/kubernetes/examples/tree/master/staging/volumes/nfs) for more details.
 
 ### persistentVolumeClaim {#persistentvolumeclaim}
 
@@ -797,7 +797,7 @@ Make sure you have an existing PortworxVolume with name `pxvol`
 before using it in the Pod.
 {{< /note >}}
 
-For more details, see the [Portworx volume](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/portworx/README.md) examples.
+For more details, see the [Portworx volume](https://github.com/kubernetes/examples/tree/master/staging/volumes/portworx/README.md) examples.
 
 ### projected
 
@@ -811,7 +811,7 @@ Currently, the following types of volume sources can be projected:
 * `serviceAccountToken`
 
 All sources are required to be in the same namespace as the Pod. For more details,
-see the [all-in-one volume design document](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/design-proposals/node/all-in-one-volume.md).
+see the [all-in-one volume design document](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node/all-in-one-volume.md).
 
 #### Example configuration with a secret, a downwardAPI, and a configMap {#example-configuration-secret-downwardapi-configmap}
 
@@ -972,7 +972,7 @@ and then serve it in parallel from as many pods as you need. Unfortunately,
 RBD volumes can only be mounted by a single consumer in read-write mode.
 Simultaneous writers are not allowed.
 
-See the [RBD example](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/volumes/rbd)
+See the [RBD example](https://github.com/kubernetes/examples/tree/master/volumes/rbd)
 for more details.
 
 ### secret
diff --git a/content/en/docs/concepts/workloads/controllers/job.md b/content/en/docs/concepts/workloads/controllers/job.md
index 6d90ce1cbb..1635caf7b3 100644
--- a/content/en/docs/concepts/workloads/controllers/job.md
+++ b/content/en/docs/concepts/workloads/controllers/job.md
@@ -632,7 +632,7 @@ of custom controller for those Pods.  This allows the most flexibility, but may
 complicated to get started with and offers less integration with Kubernetes.
 
 One example of this pattern would be a Job which starts a Pod which runs a script that in turn
-starts a Spark master controller (see [spark example](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/spark/README.md)), runs a spark
+starts a Spark master controller (see [spark example](https://github.com/kubernetes/examples/tree/master/staging/spark/README.md)), runs a spark
 driver, and then cleans up.
 
 An advantage of this approach is that the overall process gets the completion guarantee of a Job
diff --git a/content/en/docs/concepts/workloads/controllers/statefulset.md b/content/en/docs/concepts/workloads/controllers/statefulset.md
index faf244b1a5..1383d5410a 100644
--- a/content/en/docs/concepts/workloads/controllers/statefulset.md
+++ b/content/en/docs/concepts/workloads/controllers/statefulset.md
@@ -39,7 +39,7 @@ that provides a set of stateless replicas.
 
 ## Limitations
 
-* The storage for a given Pod must either be provisioned by a [PersistentVolume Provisioner](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/persistent-volume-provisioning/README.md) based on the requested `storage class`, or pre-provisioned by an admin.
+* The storage for a given Pod must either be provisioned by a [PersistentVolume Provisioner](https://github.com/kubernetes/examples/tree/master/staging/persistent-volume-provisioning/README.md) based on the requested `storage class`, or pre-provisioned by an admin.
 * Deleting and/or scaling a StatefulSet down will *not* delete the volumes associated with the StatefulSet. This is done to ensure data safety, which is generally more valuable than an automatic purge of all related StatefulSet resources.
 * StatefulSets currently require a [Headless Service](/docs/concepts/services-networking/service/#headless-services) to be responsible for the network identity of the Pods. You are responsible for creating this Service.
 * StatefulSets do not provide any guarantees on the termination of pods when a StatefulSet is deleted. To achieve ordered and graceful termination of the pods in the StatefulSet, it is possible to scale the StatefulSet down to 0 prior to deletion.
diff --git a/content/en/docs/reference/access-authn-authz/abac.md b/content/en/docs/reference/access-authn-authz/abac.md
index 3e2aea6b36..197901a170 100644
--- a/content/en/docs/reference/access-authn-authz/abac.md
+++ b/content/en/docs/reference/access-authn-authz/abac.md
@@ -127,7 +127,7 @@ up the verbosity:
     {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group": "system:unauthenticated", "readonly": true, "nonResourcePath": "*"}}
     ```
 
-[Complete file example](https://releases.k8s.io/{{< param "githubbranch" >}}/pkg/auth/authorizer/abac/example_policy_file.jsonl)
+[Complete file example](https://releases.k8s.io/{{< param "fullversion" >}}/pkg/auth/authorizer/abac/example_policy_file.jsonl)
 
 ## A quick note on service accounts
 
diff --git a/content/en/docs/reference/access-authn-authz/bootstrap-tokens.md b/content/en/docs/reference/access-authn-authz/bootstrap-tokens.md
index f128c14a7a..7e743be63d 100644
--- a/content/en/docs/reference/access-authn-authz/bootstrap-tokens.md
+++ b/content/en/docs/reference/access-authn-authz/bootstrap-tokens.md
@@ -70,7 +70,7 @@ controller on the controller manager.
 
 Each valid token is backed by a secret in the `kube-system` namespace.  You can
 find the full design doc
-[here](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/design-proposals/cluster-lifecycle/bootstrap-discovery.md).
+[here](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/cluster-lifecycle/bootstrap-discovery.md).
 
 Here is what the secret looks like.
 
diff --git a/content/en/docs/tasks/administer-cluster/access-cluster-api.md b/content/en/docs/tasks/administer-cluster/access-cluster-api.md
index 0275cadabf..827cb50f7c 100644
--- a/content/en/docs/tasks/administer-cluster/access-cluster-api.md
+++ b/content/en/docs/tasks/administer-cluster/access-cluster-api.md
@@ -30,7 +30,7 @@ Check the location and credentials that kubectl knows about with this command:
 kubectl config view
 ```
 
-Many of the [examples](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/) provide an introduction to using
+Many of the [examples](https://github.com/kubernetes/examples/tree/master/) provide an introduction to using
 kubectl. Complete documentation is found in the [kubectl manual](/docs/reference/kubectl/overview/).
 
 ### Directly accessing the REST API
diff --git a/content/en/docs/tasks/administer-cluster/dns-custom-nameservers.md b/content/en/docs/tasks/administer-cluster/dns-custom-nameservers.md
index 308b066651..bd2fb3684c 100644
--- a/content/en/docs/tasks/administer-cluster/dns-custom-nameservers.md
+++ b/content/en/docs/tasks/administer-cluster/dns-custom-nameservers.md
@@ -28,7 +28,7 @@ explains how to use `kubeadm` to migrate from `kube-dns`.
 
 DNS is a built-in Kubernetes service launched automatically
 using the _addon manager_
-[cluster add-on](http://releases.k8s.io/{{< param "githubbranch" >}}/cluster/addons/README.md).
+[cluster add-on](http://releases.k8s.io/master/cluster/addons/README.md).
 
 As of Kubernetes v1.12, CoreDNS is the recommended DNS Server, replacing kube-dns. If your cluster
 originally used kube-dns, you may still have `kube-dns` deployed rather than CoreDNS.
diff --git a/content/en/docs/tasks/administer-cluster/namespaces.md b/content/en/docs/tasks/administer-cluster/namespaces.md
index 0964033079..231de37e26 100644
--- a/content/en/docs/tasks/administer-cluster/namespaces.md
+++ b/content/en/docs/tasks/administer-cluster/namespaces.md
@@ -314,7 +314,7 @@ across namespaces, you need to use the fully qualified domain name (FQDN).
 
 * Learn more about [setting the namespace preference](/docs/concepts/overview/working-with-objects/namespaces/#setting-the-namespace-preference).
 * Learn more about [setting the namespace for a request](/docs/concepts/overview/working-with-objects/namespaces/#setting-the-namespace-for-a-request)
-* See [namespaces design](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/design-proposals/architecture/namespaces.md).
+* See [namespaces design](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/architecture/namespaces.md).
 
 
 
diff --git a/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md b/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md
index 301d81870c..d9ab2056da 100644
--- a/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md
+++ b/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md
@@ -145,7 +145,7 @@ Any code greater than or equal to 200 and less than 400 indicates success. Any
 other code indicates failure.
 
 You can see the source code for the server in
-[server.go](https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/test/images/agnhost/liveness/server.go).
+[server.go](https://github.com/kubernetes/kubernetes/blob/master/test/images/agnhost/liveness/server.go).
 
 For the first 10 seconds that the container is alive, the `/healthz` handler
 returns a status of 200. After that, the handler returns a status of 500.
diff --git a/content/en/docs/tasks/configure-pod-container/configure-projected-volume-storage.md b/content/en/docs/tasks/configure-pod-container/configure-projected-volume-storage.md
index ad99a05c27..ca71e7a721 100644
--- a/content/en/docs/tasks/configure-pod-container/configure-projected-volume-storage.md
+++ b/content/en/docs/tasks/configure-pod-container/configure-projected-volume-storage.md
@@ -83,5 +83,5 @@ kubectl delete secret user pass
 ## {{% heading "whatsnext" %}}
 
 * Learn more about [`projected`](/docs/concepts/storage/volumes/#projected) volumes.
-* Read the [all-in-one volume](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/design-proposals/node/all-in-one-volume.md) design document.
+* Read the [all-in-one volume](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node/all-in-one-volume.md) design document.
 
diff --git a/content/en/docs/tasks/debug-application-cluster/audit.md b/content/en/docs/tasks/debug-application-cluster/audit.md
index c44caf66b5..6c4b433ca2 100644
--- a/content/en/docs/tasks/debug-application-cluster/audit.md
+++ b/content/en/docs/tasks/debug-application-cluster/audit.md
@@ -94,7 +94,7 @@ rules:
 ```
 
 If you're crafting your own audit profile, you can use the audit profile for Google Container-Optimized OS as a starting point. You can check the
-[configure-helper.sh](https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/cluster/gce/gci/configure-helper.sh)
+[configure-helper.sh](https://github.com/kubernetes/kubernetes/blob/master/cluster/gce/gci/configure-helper.sh)
 script, which generates an audit policy file. You can see most of the audit policy file by looking directly at the script.
 
 You can also refer to the [`Policy` configuration reference](/docs/reference/config-api/apiserver-audit.v1/#audit-k8s-io-v1-Policy)
diff --git a/content/en/docs/tasks/extend-kubernetes/configure-multiple-schedulers.md b/content/en/docs/tasks/extend-kubernetes/configure-multiple-schedulers.md
index 7ad7072fd7..d44e6897b0 100644
--- a/content/en/docs/tasks/extend-kubernetes/configure-multiple-schedulers.md
+++ b/content/en/docs/tasks/extend-kubernetes/configure-multiple-schedulers.md
@@ -18,7 +18,7 @@ learn how to run multiple schedulers in Kubernetes with an example.
 
 A detailed description of how to implement a scheduler is outside the scope of this
 document. Please refer to the kube-scheduler implementation in
-[pkg/scheduler](https://github.com/kubernetes/kubernetes/tree/{{< param "githubbranch" >}}/pkg/scheduler)
+[pkg/scheduler](https://github.com/kubernetes/kubernetes/tree/master/pkg/scheduler)
 in the Kubernetes source directory for a canonical example.
 
 ## {{% heading "prerequisites" %}}
diff --git a/content/en/docs/tutorials/stateful-application/basic-stateful-set.md b/content/en/docs/tutorials/stateful-application/basic-stateful-set.md
index f2d02dce11..760d3df013 100644
--- a/content/en/docs/tutorials/stateful-application/basic-stateful-set.md
+++ b/content/en/docs/tutorials/stateful-application/basic-stateful-set.md
@@ -26,7 +26,7 @@ following Kubernetes concepts:
 * [Cluster DNS](/docs/concepts/services-networking/dns-pod-service/)
 * [Headless Services](/docs/concepts/services-networking/service/#headless-services)
 * [PersistentVolumes](/docs/concepts/storage/persistent-volumes/)
-* [PersistentVolume Provisioning](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/persistent-volume-provisioning/)
+* [PersistentVolume Provisioning](https://github.com/kubernetes/examples/tree/master/staging/persistent-volume-provisioning/)
 * [StatefulSets](/docs/concepts/workloads/controllers/statefulset/)
 * The [kubectl](/docs/reference/kubectl/kubectl/) command line tool
 
diff --git a/content/en/docs/tutorials/stateful-application/zookeeper.md b/content/en/docs/tutorials/stateful-application/zookeeper.md
index 2844ae6a0e..3ed1cd454b 100644
--- a/content/en/docs/tutorials/stateful-application/zookeeper.md
+++ b/content/en/docs/tutorials/stateful-application/zookeeper.md
@@ -27,7 +27,7 @@ Kubernetes concepts:
 - [Cluster DNS](/docs/concepts/services-networking/dns-pod-service/)
 - [Headless Services](/docs/concepts/services-networking/service/#headless-services)
 - [PersistentVolumes](/docs/concepts/storage/volumes/)
-- [PersistentVolume Provisioning](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/persistent-volume-provisioning/)
+- [PersistentVolume Provisioning](https://github.com/kubernetes/examples/tree/master/staging/persistent-volume-provisioning/)
 - [StatefulSets](/docs/concepts/workloads/controllers/statefulset/)
 - [PodDisruptionBudgets](/docs/concepts/workloads/pods/disruptions/#pod-disruption-budget)
 - [PodAntiAffinity](/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity)

From 08387d84346b2e0b0915bed3116326aeebf6c271 Mon Sep 17 00:00:00 2001
From: Rey Lejano 
Date: Wed, 4 Aug 2021 16:31:13 -0700
Subject: [PATCH 129/279] add kubewarden as an alternative to enforce security
 profiles

add third-party content shortcode and list
---
 content/en/docs/concepts/security/pod-security-standards.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/content/en/docs/concepts/security/pod-security-standards.md b/content/en/docs/concepts/security/pod-security-standards.md
index 1aa1907398..5636f95eb4 100644
--- a/content/en/docs/concepts/security/pod-security-standards.md
+++ b/content/en/docs/concepts/security/pod-security-standards.md
@@ -495,8 +495,12 @@ as well as other related parameters outside the Security Context. As of July 202
 [Pod Security Policies](/docs/concepts/profile/pod-security-profile/) are deprecated in favor of the
 built-in [Pod Security Admission Controller](/docs/concepts/security/pod-security-admission/). 
 
+{{% thirdparty-content %}}
+
 Other alternatives for enforcing security profiles are being developed in the Kubernetes
-ecosystem, such as [OPA Gatekeeper](https://github.com/open-profile-agent/gatekeeper).
+ecosystem, such as: 
+- [OPA Gatekeeper](https://github.com/open-profile-agent/gatekeeper) 
+- [Kubewarden](https://github.com/kubewarden).
 
 ### What profiles should I apply to my Windows Pods?
 

From 382766070a5b2bb9f5beb0c121714db8d29ec444 Mon Sep 17 00:00:00 2001
From: Edith Puclla <58795858+edithturn@users.noreply.github.com>
Date: Tue, 10 Aug 2021 12:36:28 -0500
Subject: [PATCH 130/279] Update
 content/es/docs/concepts/storage/volume-snapshot-classes.md

Co-authored-by: Victor Morales 
---
 content/es/docs/concepts/storage/volume-snapshot-classes.md | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/content/es/docs/concepts/storage/volume-snapshot-classes.md b/content/es/docs/concepts/storage/volume-snapshot-classes.md
index 3264a4d4be..35932846cd 100644
--- a/content/es/docs/concepts/storage/volume-snapshot-classes.md
+++ b/content/es/docs/concepts/storage/volume-snapshot-classes.md
@@ -14,8 +14,8 @@ weight: 30
 
 
 Este documento describe el concepto de VolumeSnapshotClass en Kubernetes. Se sugiere estar familiarizado 
-con [volume snapshots](/docs/concepts/storage/volume-snapshots/) y
-[storage classes](/docs/concepts/storage/storage-classes).
+con [Volume Snapshots](/docs/concepts/storage/volume-snapshots/) y
+[Storage Classes](/docs/concepts/storage/storage-classes).
 
 
 
@@ -71,4 +71,3 @@ Si la deletionPolicy es `Delete`, la instantánea de almacenamiento subyacente s
 
 Las clases de instantáneas de volumen tienen parámetros que describen las instantáneas de volumen que pertenecen a la clase de instantáneas de volumen. Se pueden aceptar diferentes parámetros dependiendo del `driver`.
 
-

From 90c1306da52c80dce346e37286aa7ab0cfcdad86 Mon Sep 17 00:00:00 2001
From: Edith 
Date: Tue, 10 Aug 2021 14:37:22 -0500
Subject: [PATCH 131/279] fixing grammar errors

---
 .../storage/volume-snapshot-classes.md         | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/content/es/docs/concepts/storage/volume-snapshot-classes.md b/content/es/docs/concepts/storage/volume-snapshot-classes.md
index 35932846cd..0fbb03f32b 100644
--- a/content/es/docs/concepts/storage/volume-snapshot-classes.md
+++ b/content/es/docs/concepts/storage/volume-snapshot-classes.md
@@ -13,7 +13,7 @@ weight: 30
 
 
 
-Este documento describe el concepto de VolumeSnapshotClass en Kubernetes. Se sugiere estar familiarizado 
+Este documento describe el concepto de VolumeSnapshotClass en Kubernetes. Se sugiere estar familiarizado
 con [Volume Snapshots](/docs/concepts/storage/volume-snapshots/) y
 [Storage Classes](/docs/concepts/storage/storage-classes).
 
@@ -24,14 +24,14 @@ con [Volume Snapshots](/docs/concepts/storage/volume-snapshots/) y
 
 Al igual que StorageClass proporciona a los administradores una forma de describir las “clases”
 de almacenamiento que ofrecen al aprovisionar un volumen, VolumeSnapshotClass proporciona una
-forma de describir las “clases” de almacenamiento al aprovisionar una instantánea de volumen.
+forma de describir las “clases” de almacenamiento al aprovisionar un Snapshot de volumen.
 
 ## El Recurso VolumeSnapshotClass
 
 Cada VolumeSnapshotClass contiene los campos `driver`, `deletionPolicy`, y `parameters`,
 que se utilizan cuando un VolumeSnapshot que pertenece a la clase, necesita aprovisionarse dinámicamente.
 
-El nombre de un objeto VolumeSnapshotClass es significativo y es la forma en que los usuarios  pueden solicitar una clase en particular. Los Administradores establecen el nombre y otros parámetros de una clase cuando crean por primera vez objetos VolumeSnapshotClass, y los objetos no se pueden actualizar una vez creados.
+El nombre de un objeto VolumeSnapshotClass es significativo y es la forma en que los usuarios pueden solicitar una clase en particular. Los administradores establecen el nombre y parámetros de una clase cuando crean por primera vez objetos VolumeSnapshotClass; una vez creados los objetos no pueden ser vez actualizados.
 
 ```yaml
 apiVersion: snapshot.storage.k8s.io/v1
@@ -43,7 +43,7 @@ deletionPolicy: Delete
 parameters:
 ```
 
-Los administradores pueden especificar un VolumeSnapshotClass  predeterminado para VolumeSnapshots que no solicitan ninguna clase en particular para vincularse agregando la anotación: `snapshot.storage.kubernetes.io/is-default-class: "true"`.
+Los administradores pueden especificar un VolumeSnapshotClass predeterminado para VolumeSnapshots que no solicitan ninguna clase en particular para vincularse agregando la anotación: `snapshot.storage.kubernetes.io/is-default-class: "true"`.
 
 ```yaml
 apiVersion: snapshot.storage.k8s.io/v1
@@ -59,15 +59,15 @@ parameters:
 
 ### Driver
 
-Las clases de instantáneas de volumen tienen un controlador que determina qué complemento de volumen CSI se utiliza para aprovisionar VolumeSnapshots. Este campo debe especificarse.
+Las clases de Snapshot de volumen tienen un controlador que determina que complemento de volumen CSI se utiliza para aprovisionar VolumeSnapshots. Este campo debe especificarse.
 
 ### DeletionPolicy
 
-Las clases de instantáneas de volumen tienen un  deletionPolicy. Le permite configurar lo que sucede con un VolumeSnapshotContent  cuando se va a eliminar el objeto VolumeSnapshot al que está vinculado. La deletionPolicy de una clase de instantánea de volumen  puede `Retain` o `Delete`. This field must be specified.
+Las clases de Snapshot de volumen tienen un deletionPolicy. Permite configurar lo que sucede con un VolumeSnapshotContent cuando se va a eliminar el objeto VolumeSnapshot al que está vinculado. La deletionPolicy de una clase de Snapshot de volumen puede `Retain` o `Delete`. Este campo debe ser especificado.
 
-Si la deletionPolicy es `Delete`, la instantánea de almacenamiento subyacente se eliminará junto con el objeto VolumeSnapshotContent. Si deletionPolicy es `Retain`, tanto la instantánea subyacente como VolumeSnapshotContent permanecerán.
+Si la deletionPolicy es `Delete`, el Snapshot de almacenamiento subyacente se eliminará junto con el objeto VolumeSnapshotContent. Si deletionPolicy es `Retain`, tanto el Snapshot subyacente como VolumeSnapshotContent permanecerán.
 
-## Parameters
+### Parameters
 
-Las clases de instantáneas de volumen tienen parámetros que describen las instantáneas de volumen que pertenecen a la clase de instantáneas de volumen. Se pueden aceptar diferentes parámetros dependiendo del `driver`.
+Las clases de Snapshot de volumen tienen parámetros que describen los Snapshots de volumen que pertenecen a la clase de Snapshot de volumen. Se pueden aceptar diferentes parámetros dependiendo del `driver`.
 

From c1785d2dd94901a4cc0866b4ed7ea6531fee56a2 Mon Sep 17 00:00:00 2001
From: Arhell 
Date: Wed, 11 Aug 2021 00:42:28 +0300
Subject: [PATCH 132/279] [fr] Deleted reference to removed file

---
 content/fr/docs/contribute/generate-ref-docs/kubernetes-api.md | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/content/fr/docs/contribute/generate-ref-docs/kubernetes-api.md b/content/fr/docs/contribute/generate-ref-docs/kubernetes-api.md
index 9e00fb57b0..cdb91bb27a 100644
--- a/content/fr/docs/contribute/generate-ref-docs/kubernetes-api.md
+++ b/content/fr/docs/contribute/generate-ref-docs/kubernetes-api.md
@@ -135,7 +135,6 @@ hack/update-generated-swagger-docs.sh
 hack/update-swagger-spec.sh
 hack/update-openapi-spec.sh
 hack/update-generated-protobuf.sh
-hack/update-api-reference-docs.sh
 ```
 
 Exécutez `git status` pour voir ce qui a été généré.
@@ -144,8 +143,6 @@ Exécutez `git status` pour voir ce qui a été généré.
 On branch master
 ...
     modified:   api/openapi-spec/swagger.json
-    modified:   api/swagger-spec/apps_v1.json
-    modified:   docs/api-reference/apps/v1/definitions.html
     modified:   staging/src/k8s.io/api/apps/v1/generated.proto
     modified:   staging/src/k8s.io/api/apps/v1/types.go
     modified:   staging/src/k8s.io/api/apps/v1/types_swagger_doc_generated.go

From b6dc198148e97ad897cf5a1f132a5a1078e33b34 Mon Sep 17 00:00:00 2001
From: Edith 
Date: Tue, 10 Aug 2021 17:16:29 -0500
Subject: [PATCH 133/279] grammar error second update

---
 content/es/docs/concepts/storage/volume-snapshot-classes.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/es/docs/concepts/storage/volume-snapshot-classes.md b/content/es/docs/concepts/storage/volume-snapshot-classes.md
index 0fbb03f32b..cf18340869 100644
--- a/content/es/docs/concepts/storage/volume-snapshot-classes.md
+++ b/content/es/docs/concepts/storage/volume-snapshot-classes.md
@@ -31,7 +31,7 @@ forma de describir las “clases” de almacenamiento al aprovisionar un Snapsho
 Cada VolumeSnapshotClass contiene los campos `driver`, `deletionPolicy`, y `parameters`,
 que se utilizan cuando un VolumeSnapshot que pertenece a la clase, necesita aprovisionarse dinámicamente.
 
-El nombre de un objeto VolumeSnapshotClass es significativo y es la forma en que los usuarios pueden solicitar una clase en particular. Los administradores establecen el nombre y parámetros de una clase cuando crean por primera vez objetos VolumeSnapshotClass; una vez creados los objetos no pueden ser vez actualizados.
+El nombre de un objeto VolumeSnapshotClass es significativo y es la forma en que los usuarios pueden solicitar una clase en particular. Los administradores establecen el nombre y parámetros de una clase cuando crean por primera vez objetos VolumeSnapshotClass; una vez creados los objetos no pueden ser actualizados.
 
 ```yaml
 apiVersion: snapshot.storage.k8s.io/v1
@@ -43,7 +43,7 @@ deletionPolicy: Delete
 parameters:
 ```
 
-Los administradores pueden especificar un VolumeSnapshotClass predeterminado para VolumeSnapshots que no solicitan ninguna clase en particular para vincularse agregando la anotación: `snapshot.storage.kubernetes.io/is-default-class: "true"`.
+Los administradores pueden especificar un VolumeSnapshotClass predeterminado para VolumeSnapshots que no solicitan ninguna clase en particular. Para definir la clase predeterminada  agregue la anotación: `snapshot.storage.kubernetes.io/is-default-class: "true"`.
 
 ```yaml
 apiVersion: snapshot.storage.k8s.io/v1

From 9ca04a101496aeb24be81e15533fdce020d7f8c3 Mon Sep 17 00:00:00 2001
From: Alexey Kopytko 
Date: Thu, 5 Aug 2021 03:38:40 +0900
Subject: [PATCH 134/279] Update Managing Resources to mention the measure of
 CPU time

---
 .../concepts/configuration/manage-resources-containers.md    | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/content/en/docs/concepts/configuration/manage-resources-containers.md b/content/en/docs/concepts/configuration/manage-resources-containers.md
index db29621809..5c30840f66 100644
--- a/content/en/docs/concepts/configuration/manage-resources-containers.md
+++ b/content/en/docs/concepts/configuration/manage-resources-containers.md
@@ -181,8 +181,9 @@ When using Docker:
   flag in the `docker run` command.
 
 - The `spec.containers[].resources.limits.cpu` is converted to its millicore value and
-  multiplied by 100. The resulting value is the total amount of CPU time that a container can use
-  every 100ms. A container cannot use more than its share of CPU time during this interval.
+  multiplied by 100. The resulting value is the total amount of CPU time in microseconds
+  that a container can use every 100ms. A container cannot use more than its share of
+  CPU time during this interval.
 
   {{< note >}}
   The default quota period is 100ms. The minimum resolution of CPU quota is 1ms.

From 1b8eeb500add215fa0e3540dd34a9fb97d95e7e5 Mon Sep 17 00:00:00 2001
From: Tim Bannister 
Date: Wed, 4 Aug 2021 21:59:57 +0100
Subject: [PATCH 135/279] Update the node concept

Modernise the page by:
- rewording to follow the style guide
- adding some glossary tooltips
- linking to new-style API reference
- linking to Safely Drain a Node

plus general tweaks.
---
 .../en/docs/concepts/architecture/nodes.md    | 122 +++++++++++-------
 1 file changed, 76 insertions(+), 46 deletions(-)

diff --git a/content/en/docs/concepts/architecture/nodes.md b/content/en/docs/concepts/architecture/nodes.md
index 0e954e0743..b1f7a35dc8 100644
--- a/content/en/docs/concepts/architecture/nodes.md
+++ b/content/en/docs/concepts/architecture/nodes.md
@@ -122,6 +122,9 @@ To mark a Node unschedulable, run:
 kubectl cordon $NODENAME
 ```
 
+See [Safely Drain a Node](/docs/tasks/administer-cluster/safely-drain-node/)
+for more details.
+
 {{< note >}}
 Pods that are part of a {{< glossary_tooltip term_id="daemonset" >}} tolerate
 being run on an unschedulable Node. DaemonSets typically provide node-local services
@@ -162,8 +165,8 @@ The `conditions` field describes the status of all `Running` nodes. Examples of
 | Node Condition       | Description |
 |----------------------|-------------|
 | `Ready`              | `True` if the node is healthy and ready to accept pods, `False` if the node is not healthy and is not accepting pods, and `Unknown` if the node controller has not heard from the node in the last `node-monitor-grace-period` (default is 40 seconds) |
-| `DiskPressure`       | `True` if pressure exists on the disk size--that is, if the disk capacity is low; otherwise `False` |
-| `MemoryPressure`     | `True` if pressure exists on the node memory--that is, if the node memory is low; otherwise `False` |
+| `DiskPressure`       | `True` if pressure exists on the disk size—that is, if the disk capacity is low; otherwise `False` |
+| `MemoryPressure`     | `True` if pressure exists on the node memory—that is, if the node memory is low; otherwise `False` |
 | `PIDPressure`        | `True` if pressure exists on the processes—that is, if there are too many processes on the node; otherwise `False` |
 | `NetworkUnavailable` | `True` if the network for the node is not correctly configured, otherwise `False` |
 {{< /table >}}
@@ -174,7 +177,8 @@ If you use command-line tools to print details of a cordoned Node, the Condition
 cordoned nodes are marked Unschedulable in their spec.
 {{< /note >}}
 
-The node condition is represented as a JSON object. For example, the following structure describes a healthy node:
+In the Kubernetes API, a node's condition is represented as part of the `.status`
+of the Node resource. For example, the following JSON structure describes a healthy node:
 
 ```json
 "conditions": [
@@ -189,7 +193,17 @@ The node condition is represented as a JSON object. For example, the following s
 ]
 ```
 
-If the Status of the Ready condition remains `Unknown` or `False` for longer than the `pod-eviction-timeout` (an argument passed to the {{< glossary_tooltip text="kube-controller-manager" term_id="kube-controller-manager" >}}), then all the Pods on the node are scheduled for deletion by the node controller. The default eviction timeout duration is **five minutes**. In some cases when the node is unreachable, the API server is unable to communicate with the kubelet on the node. The decision to delete the pods cannot be communicated to the kubelet until communication with the API server is re-established. In the meantime, the pods that are scheduled for deletion may continue to run on the partitioned node.
+If the `status` of the Ready condition remains `Unknown` or `False` for longer
+than the `pod-eviction-timeout` (an argument passed to the
+{{< glossary_tooltip text="kube-controller-manager" term_id="kube-controller-manager"
+>}}), then the [node controller](#node-controller) triggers
+{{< glossary_tooltip text="API-initiated eviction" term_id="api-eviction" >}}
+for all Pods assigned to that node. The default eviction timeout duration is
+**five minutes**.
+In some cases when the node is unreachable, the API server is unable to communicate
+with the kubelet on the node. The decision to delete the pods cannot be communicated to
+the kubelet until communication with the API server is re-established. In the meantime,
+the pods that are scheduled for deletion may continue to run on the partitioned node.
 
 The node controller does not force delete pods until it is confirmed that they have stopped
 running in the cluster. You can see the pods that might be running on an unreachable node as
@@ -199,10 +213,12 @@ may need to delete the node object by hand. Deleting the node object from Kubern
 all the Pod objects running on the node to be deleted from the API server and frees up their
 names.
 
-The node lifecycle controller automatically creates
-[taints](/docs/concepts/scheduling-eviction/taint-and-toleration/) that represent conditions.
+When problems occur on nodes, the Kubernetes control plane automatically creates
+[taints](/docs/concepts/scheduling-eviction/taint-and-toleration/) that match the conditions
+affecting the node.
 The scheduler takes the Node's taints into consideration when assigning a Pod to a Node.
-Pods can also have tolerations which let them tolerate a Node's taints.
+Pods can also have {{< glossary_tooltip text="tolerations" term_id="toleration" >}} that let
+them run on a Node even though it has a specific taint.
 
 See [Taint Nodes by Condition](/docs/concepts/scheduling-eviction/taint-and-toleration/#taint-nodes-by-condition)
 for more details.
@@ -222,10 +238,43 @@ on a Node.
 
 ### Info
 
-Describes general information about the node, such as kernel version, Kubernetes version (kubelet and kube-proxy version), Docker version (if used), and OS name.
-This information is gathered by Kubelet from the node.
+Describes general information about the node, such as kernel version, Kubernetes
+version (kubelet and kube-proxy version), container runtime details, and which
+operating system the node uses.
+The kubelet gathers this information from the node and publishes it into
+the Kubernetes API.
 
-### Node controller
+## Heartbeats
+
+Heartbeats, sent by Kubernetes nodes, help your cluster determine the
+availability of each node, and to take action when failures are detected.
+
+For nodes there are two forms of heartbeats:
+
+* updates to the `.status` of a Node
+* [Lease](/docs/reference/kubernetes-api/cluster-resources/lease-v1/) objects
+  within the `kube-node-lease`
+  {{< glossary_tooltip term_id="namespace" text="namespace">}}.
+  Each Node has an associated Lease object.
+
+Compared to updates to `.status` of a Node, a Lease is a lightweight resource.
+Using Leases for heartbeats reduces the performance impact of these updates
+for large clusters.
+
+The kubelet is responsible for creating and updating the `.status` of Nodes,
+and for updating their related Leases.
+
+- The kubelet updates the node's `.status` either when there is change in status
+  or if there has been no update for a configured interval. The default interval
+  for `.status` updates to Nodes is 5 minutes, which is much longer than the 40
+  second default timeout for unreachable nodes.
+- The kubelet creates and then updates its Lease object every 10 seconds
+  (the default update interval). Lease updates occur independently from
+  updates to the Node's `.status`. If the Lease update fails, the kubelet retries,
+  using exponential backoff that starts at 200 milliseconds and capped at 7 seconds.
+
+
+## Node controller
 
 The node {{< glossary_tooltip text="controller" term_id="controller" >}} is a
 Kubernetes control plane component that manages various aspects of nodes.
@@ -241,39 +290,18 @@ controller deletes the node from its list of nodes.
 
 The third is monitoring the nodes' health. The node controller is
 responsible for:
-- Updating the NodeReady condition of NodeStatus to ConditionUnknown when a node
-  becomes unreachable, as the node controller stops receiving heartbeats for some
-  reason such as the node being down.
-- Evicting all the pods from the node using graceful termination if
-  the node continues to be unreachable. The default timeouts are 40s to start
-  reporting ConditionUnknown and 5m after that to start evicting pods.
+- In the case that a node becomes unreachable, updating the NodeReady condition
+  of within the Node's `.status`. In this case the node controller sets the
+  NodeReady condition to `ConditionUnknown`.
+- If a node remains unreachable: triggering
+  [API-initiated eviction](/docs/concepts/scheduling-eviction/api-eviction/)
+  for all of the Pods on the unreachable node. By default, the node controller
+  waits 5 minutes between marking the node as `ConditionUnknown` and submitting
+  the first eviction request.
 
 The node controller checks the state of each node every `--node-monitor-period` seconds.
 
-#### Heartbeats
-
-Heartbeats, sent by Kubernetes nodes, help determine the availability of a node.
-
-There are two forms of heartbeats: updates of `NodeStatus` and the
-[Lease object](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#lease-v1-coordination-k8s-io).
-Each Node has an associated Lease object in the `kube-node-lease`
-{{< glossary_tooltip term_id="namespace" text="namespace">}}.
-Lease is a lightweight resource, which improves the performance
-of the node heartbeats as the cluster scales.
-
-The kubelet is responsible for creating and updating the `NodeStatus` and
-a Lease object.
-
-- The kubelet updates the `NodeStatus` either when there is change in status
-  or if there has been no update for a configured interval. The default interval
-  for `NodeStatus` updates is 5 minutes, which is much longer than the 40 second default
-  timeout for unreachable nodes.
-- The kubelet creates and then updates its Lease object every 10 seconds
-  (the default update interval). Lease updates occur independently from the
-  `NodeStatus` updates. If the Lease update fails, the kubelet retries with
-  exponential backoff starting at 200 milliseconds and capped at 7 seconds.
-
-#### Reliability
+### Rate limits on eviction
 
  In most cases, the node controller limits the eviction rate to
 `--node-eviction-rate` (default 0.1) per second, meaning it won't evict pods
@@ -281,7 +309,7 @@ from more than 1 node per 10 seconds.
 
 The node eviction behavior changes when a node in a given availability zone
 becomes unhealthy. The node controller checks what percentage of nodes in the zone
-are unhealthy (NodeReady condition is ConditionUnknown or ConditionFalse) at
+are unhealthy (NodeReady condition is `ConditionUnknown` or `ConditionFalse`) at
 the same time:
 - If the fraction of unhealthy nodes is at least `--unhealthy-zone-threshold`
   (default 0.55), then the eviction rate is reduced.
@@ -293,15 +321,17 @@ the same time:
 The reason these policies are implemented per availability zone is because one
 availability zone might become partitioned from the master while the others remain
 connected. If your cluster does not span multiple cloud provider availability zones,
-then there is only one availability zone (i.e. the whole cluster).
+then the eviction mechanism does not take per-zone unavailability into account.
 
 A key reason for spreading your nodes across availability zones is so that the
 workload can be shifted to healthy zones when one entire zone goes down.
 Therefore, if all nodes in a zone are unhealthy, then the node controller evicts at
 the normal rate of `--node-eviction-rate`.  The corner case is when all zones are
-completely unhealthy (i.e. there are no healthy nodes in the cluster). In such a
-case, the node controller assumes that there is some problem with master
-connectivity and stops all evictions until some connectivity is restored.
+completely unhealthy (none of the nodes in the cluster are healthy). In such a
+case, the node controller assumes that there is some problem with connectivity
+between the control plane and the nodes, and doesn't perform any evictions.
+(If there has been an outage and some nodes reappear, the node controller does
+evict pods from the remaining nodes that are unhealthy or unreachable).
 
 The node controller is also responsible for evicting pods running on nodes with
 `NoExecute` taints, unless those pods tolerate that taint.
@@ -309,7 +339,7 @@ The node controller also adds {{< glossary_tooltip text="taints" term_id="taint"
 corresponding to node problems like node unreachable or not ready. This means
 that the scheduler won't place Pods onto unhealthy nodes.
 
-### Node capacity
+## Resource capacity tracking {#node-capacity}
 
 Node objects track information about the Node's resource capacity: for example, the amount
 of memory available and the number of CPUs.

From 8773d024e7683e834e741cf781a9f465e7c696e0 Mon Sep 17 00:00:00 2001
From: Damien Grisonnet 
Date: Wed, 11 Aug 2021 12:59:57 +0200
Subject: [PATCH 136/279] api-ref-generator: update to include Event changes

Update api-ref-generator submodule to 55bce68 to include changes
updating the recommended Events API from core to events.k8s.io in the
kubernetes-api doc.

Signed-off-by: Damien Grisonnet 
---
 api-ref-generator | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api-ref-generator b/api-ref-generator
index 78e64febda..55bce68622 160000
--- a/api-ref-generator
+++ b/api-ref-generator
@@ -1 +1 @@
-Subproject commit 78e64febda1b53cafc79979c5978b42162cea276
+Subproject commit 55bce686224caba37f93e1e1eb53c0c9fc104ed4

From 923b2e25f2fb9d0c1e769d15c2a534a70f221cf7 Mon Sep 17 00:00:00 2001
From: Damien Grisonnet 
Date: Wed, 11 Aug 2021 11:00:27 +0200
Subject: [PATCH 137/279] kubernetes-api: update recommended events API

In Kubernetes v1.19, the new Events API events.k8s.io was promoted to
v1. As such it now supersedes the original core Events API.

Signed-off-by: Damien Grisonnet 
---
 .../generated/kubernetes-api/v1.20/index.html | 326 +++++++++---------
 .../kubernetes-api/v1.20/js/navData.js        |   2 +-
 .../generated/kubernetes-api/v1.21/index.html | 322 ++++++++---------
 .../kubernetes-api/v1.21/js/navData.js        |   2 +-
 .../generated/kubernetes-api/v1.22/index.html | 324 ++++++++---------
 .../kubernetes-api/v1.22/js/navData.js        |   2 +-
 6 files changed, 489 insertions(+), 489 deletions(-)

diff --git a/static/docs/reference/generated/kubernetes-api/v1.20/index.html b/static/docs/reference/generated/kubernetes-api/v1.20/index.html
index 618eefa545..7476971f21 100644
--- a/static/docs/reference/generated/kubernetes-api/v1.20/index.html
+++ b/static/docs/reference/generated/kubernetes-api/v1.20/index.html
@@ -771,27 +771,27 @@
  
      
 
 
        
- 
      • Event v1 core
        • 
-

    • API OVERVIEW

    @@ -17972,11 +17972,11 @@ $ curl -X GET 'http://127.0.0.1:8001/api/v1/watch/namespaces/default/services/de 201
    CustomResourceDefinitionCreated -

    Event v1 core

    +

    Event v1 events.k8s.io

    - +
    GroupVersionKind
    corev1Event
    events.k8s.iov1Event
    Other API versions of this object exist: @@ -17984,46 +17984,46 @@ $ curl -X GET 'http://127.0.0.1:8001/api/v1/watch/namespaces/default/services/de
    Appears In:
    - + - - - - + + + + + - - - - - - - - - + + + + + + + +
    FieldDescription
    action
    string    		What action was taken/failed regarding to the Regarding object.
    action
    string    		action is what action was taken/failed regarding to the regarding object. It is machine-readable. This field cannot be empty for new Events and it can have at most 128 characters.
    apiVersion
    string    		APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    count
    integer    		The number of times this event has occurred.
    eventTime
    MicroTime    		Time when this Event was first observed.
    firstTimestamp
    Time    		The time at which the event was first recorded. (Time of server receipt is in TypeMeta.)
    involvedObject
    ObjectReference    		The object that this event is about.
    deprecatedCount
    integer    		deprecatedCount is the deprecated field assuring backward compatibility with core.v1 Event type.
    deprecatedFirstTimestamp
    Time    		deprecatedFirstTimestamp is the deprecated field assuring backward compatibility with core.v1 Event type.
    deprecatedLastTimestamp
    Time    		deprecatedLastTimestamp is the deprecated field assuring backward compatibility with core.v1 Event type.
    deprecatedSource
    EventSource    		deprecatedSource is the deprecated field assuring backward compatibility with core.v1 Event type.
    eventTime
    MicroTime    		eventTime is the time when this Event was first observed. It is required.
    kind
    string    		Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    lastTimestamp
    Time    		The time at which the most recent occurrence of this event was recorded.
    message
    string    		A human-readable description of the status of this operation.
    metadata
    ObjectMeta    		Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    reason
    string    		This should be a short, machine understandable string that gives the reason for the transition into the object's current status.
    related
    ObjectReference    		Optional secondary object for more complex actions.
    reportingComponent
    string    		Name of the controller that emitted this Event, e.g. `kubernetes.io/kubelet`.
    reportingInstance
    string    		ID of the controller instance, e.g. `kubelet-xyzf`.
    series
    EventSeries    		Data about the Event series this event represents or nil if it's a singleton Event.
    source
    EventSource    		The component reporting this event. Should be a short machine understandable string.
    type
    string    		Type of this event (Normal, Warning), new types could be added in the future
    note
    string    		note is a human-readable description of the status of this operation. Maximal length of the note is 1kB, but libraries should be prepared to handle values up to 64kB.
    reason
    string    		reason is why the action was taken. It is human-readable. This field cannot be empty for new Events and it can have at most 128 characters.
    regarding
    ObjectReference    		regarding contains the object this Event is about. In most cases it's an Object reporting controller implements, e.g. ReplicaSetController implements ReplicaSets and this event is emitted because it acts on some changes in a ReplicaSet object.
    related
    ObjectReference    		related is the optional secondary object for more complex actions. E.g. when regarding object triggers a creation or deletion of related object.
    reportingController
    string    		reportingController is the name of the controller that emitted this Event, e.g. `kubernetes.io/kubelet`. This field cannot be empty for new Events.
    reportingInstance
    string    		reportingInstance is the ID of the controller instance, e.g. `kubelet-xyzf`. This field cannot be empty for new Events and it can have at most 128 characters.
    series
    EventSeries    		series is data about the Event series this event represents or nil if it's a singleton Event.
    type
    string    		type is the type of this event (Normal, Warning), new types could be added in the future. It is machine-readable. This field cannot be empty for new Events.
    -

    EventList v1 core

    +

    EventList v1 events

    - + - +
    FieldDescription
    apiVersion
    string    		APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    Event array    		List of events
    items
    Event array    		items is a list of schema objects.
    kind
    string    		Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta    		Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta    		Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    -

    Write Operations

    -

    Create

    +

    Write Operations

    +

    Create

    create an Event

    HTTP Request

    -POST /api/v1/namespaces/{namespace}/events +POST /apis/events.k8s.io/v1/namespaces/{namespace}/events

    Path Parameters

    @@ -18044,22 +18044,22 @@ $ curl -X GET 'http://127.0.0.1:8001/api/v1/watch/namespaces/default/services/de
    ParameterDescription
    - +
    ParameterDescription
    body
    Event
    body
    Event

    Response

    - - - + + +
    CodeDescription
    200
    Event    		OK
    201
    Event    		Created
    202
    Event    		Accepted
    200
    Event    		OK
    201
    Event    		Created
    202
    Event    		Accepted
    -

    Patch

    +

    Patch

    partially update the specified Event

    HTTP Request

    -PATCH /api/v1/namespaces/{namespace}/events/{name} +PATCH /apis/events.k8s.io/v1/namespaces/{namespace}/events/{name}

    Path Parameters

    @@ -18089,14 +18089,14 @@ $ curl -X GET 'http://127.0.0.1:8001/api/v1/watch/namespaces/default/services/de
    ParameterDescription
    - - + +
    CodeDescription
    200
    Event    		OK
    201
    Event    		Created
    200
    Event    		OK
    201
    Event    		Created
    -

    Replace

    +

    Replace

    replace the specified Event

    HTTP Request

    -PUT /api/v1/namespaces/{namespace}/events/{name} +PUT /apis/events.k8s.io/v1/namespaces/{namespace}/events/{name}

    Path Parameters

    @@ -18118,21 +18118,21 @@ $ curl -X GET 'http://127.0.0.1:8001/api/v1/watch/namespaces/default/services/de
    ParameterDescription
    - +
    ParameterDescription
    body
    Event
    body
    Event

    Response

    - - + +
    CodeDescription
    200
    Event    		OK
    201
    Event    		Created
    200
    Event    		OK
    201
    Event    		Created
    -

    Delete

    +

    Delete

    delete an Event

    HTTP Request

    -DELETE /api/v1/namespaces/{namespace}/events/{name} +DELETE /apis/events.k8s.io/v1/namespaces/{namespace}/events/{name}

    Path Parameters

    @@ -18167,10 +18167,10 @@ $ curl -X GET 'http://127.0.0.1:8001/api/v1/watch/namespaces/default/services/de
    ParameterDescription
    202
    Status    		Accepted
    -

    Delete Collection

    +

    Delete Collection

    delete collection of Event

    HTTP Request

    -DELETE /api/v1/namespaces/{namespace}/events +DELETE /apis/events.k8s.io/v1/namespaces/{namespace}/events

    Path Parameters

    @@ -18210,11 +18210,11 @@ $ curl -X GET 'http://127.0.0.1:8001/api/v1/watch/namespaces/default/services/de
    ParameterDescription
    200
    Status    		OK
    -

    Read Operations

    -

    Read

    +

    Read Operations

    +

    Read

    read the specified Event

    HTTP Request

    -GET /api/v1/namespaces/{namespace}/events/{name} +GET /apis/events.k8s.io/v1/namespaces/{namespace}/events/{name}

    Path Parameters

    @@ -18234,13 +18234,13 @@ $ curl -X GET 'http://127.0.0.1:8001/api/v1/watch/namespaces/default/services/de
    ParameterDescription
    - +
    CodeDescription
    200
    Event    		OK
    200
    Event    		OK
    -

    List

    +

    List

    list or watch objects of kind Event

    HTTP Request

    -GET /api/v1/namespaces/{namespace}/events +GET /apis/events.k8s.io/v1/namespaces/{namespace}/events

    Path Parameters

    @@ -18268,13 +18268,13 @@ $ curl -X GET 'http://127.0.0.1:8001/api/v1/watch/namespaces/default/services/de
    ParameterDescription
    - +
    CodeDescription
    200
    EventList    		OK
    200
    EventList    		OK
    -

    List All Namespaces

    +

    List All Namespaces

    list or watch objects of kind Event

    HTTP Request

    -GET /api/v1/events +GET /apis/events.k8s.io/v1/events

    Query Parameters

    @@ -18295,13 +18295,13 @@ $ curl -X GET 'http://127.0.0.1:8001/api/v1/watch/namespaces/default/services/de
    ParameterDescription
    - +
    CodeDescription
    200
    EventList    		OK
    200
    EventList    		OK
    -

    Watch

    +

    Watch

    watch changes to an object of kind Event. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    HTTP Request

    -GET /api/v1/watch/namespaces/{namespace}/events/{name} +GET /apis/events.k8s.io/v1/watch/namespaces/{namespace}/events/{name}

    Path Parameters

    @@ -18333,10 +18333,10 @@ $ curl -X GET 'http://127.0.0.1:8001/api/v1/watch/namespaces/default/services/de
    ParameterDescription
    200
    WatchEvent    		OK
    -

    Watch List

    +

    Watch List

    watch individual changes to a list of Event. deprecated: use the 'watch' parameter with a list operation instead.

    HTTP Request

    -GET /api/v1/watch/namespaces/{namespace}/events +GET /apis/events.k8s.io/v1/watch/namespaces/{namespace}/events

    Path Parameters

    @@ -18367,10 +18367,10 @@ $ curl -X GET 'http://127.0.0.1:8001/api/v1/watch/namespaces/default/services/de
    ParameterDescription
    200
    WatchEvent    		OK
    -

    Watch List All Namespaces

    +

    Watch List All Namespaces

    watch individual changes to a list of Event. deprecated: use the 'watch' parameter with a list operation instead.

    HTTP Request

    -GET /api/v1/watch/events +GET /apis/events.k8s.io/v1/watch/events

    Query Parameters

    @@ -31133,27 +31133,27 @@ The resulting set of endpoints can be viewed as:
    ParameterDescription
    volumeClaimTemplate
    PersistentVolumeClaimTemplate    		Will be used to create a stand-alone PVC to provision the volume. The pod in which this EphemeralVolumeSource is embedded will be the owner of the PVC, i.e. the PVC will be deleted together with the pod. The name of the PVC will be `<pod name>-<volume name>` where `<volume name>` is the name from the `PodSpec.Volumes` array entry. Pod validation will reject the pod if the concatenated name is not valid for a PVC (for example, too long). An existing PVC with that name that is not owned by the pod will *not* be used for the pod to avoid using an unrelated volume by mistake. Starting the pod is then blocked until the unrelated PVC is removed. If such a pre-created PVC is meant to be used by the pod, the PVC has to updated with an owner reference to the pod once the pod exists. Normally this should not be necessary, but it may be useful when manually reconstructing a broken cluster. This field is read-only and no changes will be made by Kubernetes to the PVC after it has been created. Required, must not be nil.
    -

    EventSeries v1 core

    +

    EventSeries v1 events.k8s.io

    - +
    GroupVersionKind
    corev1EventSeries
    events.k8s.iov1EventSeries
    -

    EventSeries contain information on series of events, i.e. thing that was/is happening continuously for some time.

    +

    EventSeries contain information on series of events, i.e. thing that was/is happening continuously for some time. How often to update the EventSeries is up to the event reporters. The default event reporter in "k8s.io/client-go/tools/events/event_broadcaster.go" shows how this struct is updated on heartbeats and can guide customized reporter implementations.

    Other API versions of this object exist: v1beta1
    Appears In:
    - - + +
    FieldDescription
    count
    integer    		Number of occurrences in this series up to the last heartbeat time
    lastObservedTime
    MicroTime    		Time of the last occurrence observed
    count
    integer    		count is the number of occurrences in this series up to the last heartbeat time.
    lastObservedTime
    MicroTime    		lastObservedTime is the time when last Event from the series was seen before last heartbeat.

    EventSource v1 core

    @@ -38127,11 +38127,11 @@ The contents of the target Secret's Data field will be presented in a volume 200
    WatchEventOK -

    Event v1 events.k8s.io

    +

    Event v1 core

    - +
    GroupVersionKind
    events.k8s.iov1Event
    corev1Event
    Other API versions of this object exist: @@ -38139,46 +38139,46 @@ The contents of the target Secret's Data field will be presented in a volume
    Appears In:
    - + - - - - - + + + + + + - - - - - - - - + + + + + + +
    FieldDescription
    action
    string    		action is what action was taken/failed regarding to the regarding object. It is machine-readable. This field cannot be empty for new Events and it can have at most 128 characters.
    action
    string    		What action was taken/failed regarding to the Regarding object.
    apiVersion
    string    		APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    deprecatedCount
    integer    		deprecatedCount is the deprecated field assuring backward compatibility with core.v1 Event type.
    deprecatedFirstTimestamp
    Time    		deprecatedFirstTimestamp is the deprecated field assuring backward compatibility with core.v1 Event type.
    deprecatedLastTimestamp
    Time    		deprecatedLastTimestamp is the deprecated field assuring backward compatibility with core.v1 Event type.
    deprecatedSource
    EventSource    		deprecatedSource is the deprecated field assuring backward compatibility with core.v1 Event type.
    eventTime
    MicroTime    		eventTime is the time when this Event was first observed. It is required.
    count
    integer    		The number of times this event has occurred.
    eventTime
    MicroTime    		Time when this Event was first observed.
    firstTimestamp
    Time    		The time at which the event was first recorded. (Time of server receipt is in TypeMeta.)
    involvedObject
    ObjectReference    		The object that this event is about.
    kind
    string    		Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    lastTimestamp
    Time    		The time at which the most recent occurrence of this event was recorded.
    message
    string    		A human-readable description of the status of this operation.
    metadata
    ObjectMeta    		Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    note
    string    		note is a human-readable description of the status of this operation. Maximal length of the note is 1kB, but libraries should be prepared to handle values up to 64kB.
    reason
    string    		reason is why the action was taken. It is human-readable. This field cannot be empty for new Events and it can have at most 128 characters.
    regarding
    ObjectReference    		regarding contains the object this Event is about. In most cases it's an Object reporting controller implements, e.g. ReplicaSetController implements ReplicaSets and this event is emitted because it acts on some changes in a ReplicaSet object.
    related
    ObjectReference    		related is the optional secondary object for more complex actions. E.g. when regarding object triggers a creation or deletion of related object.
    reportingController
    string    		reportingController is the name of the controller that emitted this Event, e.g. `kubernetes.io/kubelet`. This field cannot be empty for new Events.
    reportingInstance
    string    		reportingInstance is the ID of the controller instance, e.g. `kubelet-xyzf`. This field cannot be empty for new Events and it can have at most 128 characters.
    series
    EventSeries    		series is data about the Event series this event represents or nil if it's a singleton Event.
    type
    string    		type is the type of this event (Normal, Warning), new types could be added in the future. It is machine-readable. This field cannot be empty for new Events.
    reason
    string    		This should be a short, machine understandable string that gives the reason for the transition into the object's current status.
    related
    ObjectReference    		Optional secondary object for more complex actions.
    reportingComponent
    string    		Name of the controller that emitted this Event, e.g. `kubernetes.io/kubelet`.
    reportingInstance
    string    		ID of the controller instance, e.g. `kubelet-xyzf`.
    series
    EventSeries    		Data about the Event series this event represents or nil if it's a singleton Event.
    source
    EventSource    		The component reporting this event. Should be a short machine understandable string.
    type
    string    		Type of this event (Normal, Warning), new types could be added in the future
    -

    EventList v1 events

    +

    EventList v1 core

    - + - +
    FieldDescription
    apiVersion
    string    		APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    Event array    		items is a list of schema objects.
    items
    Event array    		List of events
    kind
    string    		Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta    		Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    metadata
    ListMeta    		Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    -

    Write Operations

    -

    Create

    +

    Write Operations

    +

    Create

    create an Event

    HTTP Request

    -POST /apis/events.k8s.io/v1/namespaces/{namespace}/events +POST /api/v1/namespaces/{namespace}/events

    Path Parameters

    @@ -38199,22 +38199,22 @@ The contents of the target Secret's Data field will be presented in a volume
    ParameterDescription
    - +
    ParameterDescription
    body
    Event
    body
    Event

    Response

    - - - + + +
    CodeDescription
    200
    Event    		OK
    201
    Event    		Created
    202
    Event    		Accepted
    200
    Event    		OK
    201
    Event    		Created
    202
    Event    		Accepted
    -

    Patch

    +

    Patch

    partially update the specified Event

    HTTP Request

    -PATCH /apis/events.k8s.io/v1/namespaces/{namespace}/events/{name} +PATCH /api/v1/namespaces/{namespace}/events/{name}

    Path Parameters

    @@ -38244,14 +38244,14 @@ The contents of the target Secret's Data field will be presented in a volume
    ParameterDescription
    - - + +
    CodeDescription
    200
    Event    		OK
    201
    Event    		Created
    200
    Event    		OK
    201
    Event    		Created
    -

    Replace

    +

    Replace

    replace the specified Event

    HTTP Request

    -PUT /apis/events.k8s.io/v1/namespaces/{namespace}/events/{name} +PUT /api/v1/namespaces/{namespace}/events/{name}

    Path Parameters

    @@ -38273,21 +38273,21 @@ The contents of the target Secret's Data field will be presented in a volume
    ParameterDescription
    - +
    ParameterDescription
    body
    Event
    body
    Event

    Response

    - - + +
    CodeDescription
    200
    Event    		OK
    201
    Event    		Created
    200
    Event    		OK
    201
    Event    		Created
    -

    Delete

    +

    Delete

    delete an Event

    HTTP Request

    -DELETE /apis/events.k8s.io/v1/namespaces/{namespace}/events/{name} +DELETE /api/v1/namespaces/{namespace}/events/{name}

    Path Parameters

    @@ -38322,10 +38322,10 @@ The contents of the target Secret's Data field will be presented in a volume
    ParameterDescription
    202
    Status    		Accepted
    -

    Delete Collection

    +

    Delete Collection

    delete collection of Event

    HTTP Request

    -DELETE /apis/events.k8s.io/v1/namespaces/{namespace}/events +DELETE /api/v1/namespaces/{namespace}/events

    Path Parameters

    @@ -38365,11 +38365,11 @@ The contents of the target Secret's Data field will be presented in a volume
    ParameterDescription
    200
    Status    		OK
    -

    Read Operations

    -

    Read

    +

    Read Operations

    +

    Read

    read the specified Event

    HTTP Request

    -GET /apis/events.k8s.io/v1/namespaces/{namespace}/events/{name} +GET /api/v1/namespaces/{namespace}/events/{name}

    Path Parameters

    @@ -38389,13 +38389,13 @@ The contents of the target Secret's Data field will be presented in a volume
    ParameterDescription
    - +
    CodeDescription
    200
    Event    		OK
    200
    Event    		OK
    -

    List

    +

    List

    list or watch objects of kind Event

    HTTP Request

    -GET /apis/events.k8s.io/v1/namespaces/{namespace}/events +GET /api/v1/namespaces/{namespace}/events

    Path Parameters

    @@ -38423,13 +38423,13 @@ The contents of the target Secret's Data field will be presented in a volume
    ParameterDescription
    - +
    CodeDescription
    200
    EventList    		OK
    200
    EventList    		OK
    -

    List All Namespaces

    +

    List All Namespaces

    list or watch objects of kind Event

    HTTP Request

    -GET /apis/events.k8s.io/v1/events +GET /api/v1/events

    Query Parameters

    @@ -38450,13 +38450,13 @@ The contents of the target Secret's Data field will be presented in a volume
    ParameterDescription
    - +
    CodeDescription
    200
    EventList    		OK
    200
    EventList    		OK
    -

    Watch

    +

    Watch

    watch changes to an object of kind Event. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    HTTP Request

    -GET /apis/events.k8s.io/v1/watch/namespaces/{namespace}/events/{name} +GET /api/v1/watch/namespaces/{namespace}/events/{name}

    Path Parameters

    @@ -38488,10 +38488,10 @@ The contents of the target Secret's Data field will be presented in a volume
    ParameterDescription
    200
    WatchEvent    		OK
    -

    Watch List

    +

    Watch List

    watch individual changes to a list of Event. deprecated: use the 'watch' parameter with a list operation instead.

    HTTP Request

    -GET /apis/events.k8s.io/v1/watch/namespaces/{namespace}/events +GET /api/v1/watch/namespaces/{namespace}/events

    Path Parameters

    @@ -38522,10 +38522,10 @@ The contents of the target Secret's Data field will be presented in a volume
    ParameterDescription
    200
    WatchEvent    		OK
    -

    Watch List All Namespaces

    +

    Watch List All Namespaces

    watch individual changes to a list of Event. deprecated: use the 'watch' parameter with a list operation instead.

    HTTP Request

    -GET /apis/events.k8s.io/v1/watch/events +GET /api/v1/watch/events

    Query Parameters

    @@ -38557,8 +38557,8 @@ The contents of the target Secret's Data field will be presented in a volume
    ParameterDescription
    Other API versions of this object exist: -v1 v1 +v1
    Appears In:
      @@ -38972,11 +38972,11 @@ The contents of the target Secret's Data field will be presented in a volume 200
      WatchEventOK -

      EventSeries v1 events.k8s.io

      +

      EventSeries v1 core

      - +
      GroupVersionKind
      events.k8s.iov1EventSeries
      corev1EventSeries
      Other API versions of this object exist: @@ -38984,14 +38984,14 @@ The contents of the target Secret's Data field will be presented in a volume
      Appears In:
      - - + +
      FieldDescription
      count
      integer      		count is the number of occurrences in this series up to the last heartbeat time.
      lastObservedTime
      MicroTime      		lastObservedTime is the time when last Event from the series was seen before last heartbeat.
      count
      integer      		Number of occurrences in this series up to the last heartbeat time
      lastObservedTime
      MicroTime      		Time of the last occurrence observed

      EventSeries v1beta1 events.k8s.io

      @@ -39002,8 +39002,8 @@ The contents of the target Secret's Data field will be presented in a volume
      Other API versions of this object exist: -v1 v1 +v1
      Appears In:
        diff --git a/static/docs/reference/generated/kubernetes-api/v1.22/js/navData.js b/static/docs/reference/generated/kubernetes-api/v1.22/js/navData.js index b6130e04f3..cd194cf369 100644 --- a/static/docs/reference/generated/kubernetes-api/v1.22/js/navData.js +++ b/static/docs/reference/generated/kubernetes-api/v1.22/js/navData.js @@ -1 +1 @@ -(function(){navData={"toc":[{"section":"webhookclientconfig-v1-apiextensions-k8s-io","subsections":[]},{"section":"volumeerror-v1alpha1-storage-k8s-io","subsections":[]},{"section":"volumeattachmentsource-v1alpha1-storage-k8s-io","subsections":[]},{"section":"volumeattachment-v1alpha1-storage-k8s-io","subsections":[{"section":"-strong-read-operations-volumeattachment-v1alpha1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-volumeattachment-v1alpha1-storage-k8s-io","subsections":[]},{"section":"watch-volumeattachment-v1alpha1-storage-k8s-io","subsections":[]},{"section":"list-volumeattachment-v1alpha1-storage-k8s-io","subsections":[]},{"section":"read-volumeattachment-v1alpha1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-volumeattachment-v1alpha1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-volumeattachment-v1alpha1-storage-k8s-io","subsections":[]},{"section":"delete-volumeattachment-v1alpha1-storage-k8s-io","subsections":[]},{"section":"replace-volumeattachment-v1alpha1-storage-k8s-io","subsections":[]},{"section":"patch-volumeattachment-v1alpha1-storage-k8s-io","subsections":[]},{"section":"create-volumeattachment-v1alpha1-storage-k8s-io","subsections":[]}]}]},{"section":"tokenrequest-v1-storage-k8s-io","subsections":[]},{"section":"subject-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"subject-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"servicereference-v1-apiregistration-k8s-io","subsections":[]},{"section":"servicereference-v1-apiextensions-k8s-io","subsections":[]},{"section":"scheduling-v1alpha1-node-k8s-io","subsections":[]},{"section":"scheduling-v1beta1-node-k8s-io","subsections":[]},{"section":"runtimeclass-v1alpha1-node-k8s-io","subsections":[{"section":"-strong-read-operations-runtimeclass-v1alpha1-node-k8s-io-strong-","subsections":[{"section":"watch-list-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"watch-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"list-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"read-runtimeclass-v1alpha1-node-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-runtimeclass-v1alpha1-node-k8s-io-strong-","subsections":[{"section":"delete-collection-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"delete-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"replace-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"patch-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"create-runtimeclass-v1alpha1-node-k8s-io","subsections":[]}]}]},{"section":"runtimeclass-v1beta1-node-k8s-io","subsections":[{"section":"-strong-read-operations-runtimeclass-v1beta1-node-k8s-io-strong-","subsections":[{"section":"watch-list-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"watch-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"list-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"read-runtimeclass-v1beta1-node-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-runtimeclass-v1beta1-node-k8s-io-strong-","subsections":[{"section":"delete-collection-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"delete-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"replace-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"patch-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"create-runtimeclass-v1beta1-node-k8s-io","subsections":[]}]}]},{"section":"roleref-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-rolebinding-v1alpha1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-list-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-all-namespaces-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-rolebinding-v1alpha1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"role-v1alpha1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-role-v1alpha1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-list-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-all-namespaces-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-role-v1alpha1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"resourcemetricstatus-v2beta1-autoscaling","subsections":[]},{"section":"resourcemetricsource-v2beta1-autoscaling","subsections":[]},{"section":"priorityclass-v1alpha1-scheduling-k8s-io","subsections":[{"section":"-strong-read-operations-priorityclass-v1alpha1-scheduling-k8s-io-strong-","subsections":[{"section":"watch-list-priorityclass-v1alpha1-scheduling-k8s-io","subsections":[]},{"section":"watch-priorityclass-v1alpha1-scheduling-k8s-io","subsections":[]},{"section":"list-priorityclass-v1alpha1-scheduling-k8s-io","subsections":[]},{"section":"read-priorityclass-v1alpha1-scheduling-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-priorityclass-v1alpha1-scheduling-k8s-io-strong-","subsections":[{"section":"delete-collection-priorityclass-v1alpha1-scheduling-k8s-io","subsections":[]},{"section":"delete-priorityclass-v1alpha1-scheduling-k8s-io","subsections":[]},{"section":"replace-priorityclass-v1alpha1-scheduling-k8s-io","subsections":[]},{"section":"patch-priorityclass-v1alpha1-scheduling-k8s-io","subsections":[]},{"section":"create-priorityclass-v1alpha1-scheduling-k8s-io","subsections":[]}]}]},{"section":"policyrule-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"podsmetricstatus-v2beta1-autoscaling","subsections":[]},{"section":"podsmetricsource-v2beta1-autoscaling","subsections":[]},{"section":"poddisruptionbudget-v1beta1-policy","subsections":[{"section":"-strong-status-operations-poddisruptionbudget-v1beta1-policy-strong-","subsections":[{"section":"replace-status-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"read-status-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"patch-status-poddisruptionbudget-v1beta1-policy","subsections":[]}]},{"section":"-strong-read-operations-poddisruptionbudget-v1beta1-policy-strong-","subsections":[{"section":"watch-list-all-namespaces-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"watch-list-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"watch-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"list-all-namespaces-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"list-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"read-poddisruptionbudget-v1beta1-policy","subsections":[]}]},{"section":"-strong-write-operations-poddisruptionbudget-v1beta1-policy-strong-","subsections":[{"section":"delete-collection-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"delete-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"replace-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"patch-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"create-poddisruptionbudget-v1beta1-policy","subsections":[]}]}]},{"section":"overhead-v1alpha1-node-k8s-io","subsections":[]},{"section":"overhead-v1beta1-node-k8s-io","subsections":[]},{"section":"objectmetricstatus-v2beta1-autoscaling","subsections":[]},{"section":"objectmetricsource-v2beta1-autoscaling","subsections":[]},{"section":"metricstatus-v2beta1-autoscaling","subsections":[]},{"section":"metricspec-v2beta1-autoscaling","subsections":[]},{"section":"jobtemplatespec-v1beta1-batch","subsections":[]},{"section":"horizontalpodautoscalercondition-v2beta1-autoscaling","subsections":[]},{"section":"horizontalpodautoscaler-v2beta1-autoscaling","subsections":[{"section":"-strong-status-operations-horizontalpodautoscaler-v2beta1-autoscaling-strong-","subsections":[{"section":"replace-status-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"read-status-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"patch-status-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]}]},{"section":"-strong-read-operations-horizontalpodautoscaler-v2beta1-autoscaling-strong-","subsections":[{"section":"watch-list-all-namespaces-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"watch-list-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"watch-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"list-all-namespaces-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"list-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"read-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]}]},{"section":"-strong-write-operations-horizontalpodautoscaler-v2beta1-autoscaling-strong-","subsections":[{"section":"delete-collection-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"delete-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"replace-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"patch-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"create-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]}]}]},{"section":"horizontalpodautoscaler-v2beta2-autoscaling","subsections":[{"section":"-strong-status-operations-horizontalpodautoscaler-v2beta2-autoscaling-strong-","subsections":[{"section":"replace-status-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"read-status-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"patch-status-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]}]},{"section":"-strong-read-operations-horizontalpodautoscaler-v2beta2-autoscaling-strong-","subsections":[{"section":"watch-list-all-namespaces-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"watch-list-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"watch-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"list-all-namespaces-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"list-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"read-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]}]},{"section":"-strong-write-operations-horizontalpodautoscaler-v2beta2-autoscaling-strong-","subsections":[{"section":"delete-collection-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"delete-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"replace-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"patch-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"create-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]}]}]},{"section":"forzone-v1beta1-discovery-k8s-io","subsections":[]},{"section":"externalmetricstatus-v2beta1-autoscaling","subsections":[]},{"section":"externalmetricsource-v2beta1-autoscaling","subsections":[]},{"section":"eventseries-v1beta1-events-k8s-io","subsections":[]},{"section":"eventseries-v1-events-k8s-io","subsections":[]},{"section":"event-v1beta1-events-k8s-io","subsections":[{"section":"-strong-read-operations-event-v1beta1-events-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-event-v1beta1-events-k8s-io","subsections":[]},{"section":"watch-list-event-v1beta1-events-k8s-io","subsections":[]},{"section":"watch-event-v1beta1-events-k8s-io","subsections":[]},{"section":"list-all-namespaces-event-v1beta1-events-k8s-io","subsections":[]},{"section":"list-event-v1beta1-events-k8s-io","subsections":[]},{"section":"read-event-v1beta1-events-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-event-v1beta1-events-k8s-io-strong-","subsections":[{"section":"delete-collection-event-v1beta1-events-k8s-io","subsections":[]},{"section":"delete-event-v1beta1-events-k8s-io","subsections":[]},{"section":"replace-event-v1beta1-events-k8s-io","subsections":[]},{"section":"patch-event-v1beta1-events-k8s-io","subsections":[]},{"section":"create-event-v1beta1-events-k8s-io","subsections":[]}]}]},{"section":"event-v1-events-k8s-io","subsections":[{"section":"-strong-read-operations-event-v1-events-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-event-v1-events-k8s-io","subsections":[]},{"section":"watch-list-event-v1-events-k8s-io","subsections":[]},{"section":"watch-event-v1-events-k8s-io","subsections":[]},{"section":"list-all-namespaces-event-v1-events-k8s-io","subsections":[]},{"section":"list-event-v1-events-k8s-io","subsections":[]},{"section":"read-event-v1-events-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-event-v1-events-k8s-io-strong-","subsections":[{"section":"delete-collection-event-v1-events-k8s-io","subsections":[]},{"section":"delete-event-v1-events-k8s-io","subsections":[]},{"section":"replace-event-v1-events-k8s-io","subsections":[]},{"section":"patch-event-v1-events-k8s-io","subsections":[]},{"section":"create-event-v1-events-k8s-io","subsections":[]}]}]},{"section":"endpointslice-v1beta1-discovery-k8s-io","subsections":[{"section":"-strong-read-operations-endpointslice-v1beta1-discovery-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"watch-list-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"watch-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"list-all-namespaces-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"list-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"read-endpointslice-v1beta1-discovery-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-endpointslice-v1beta1-discovery-k8s-io-strong-","subsections":[{"section":"delete-collection-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"delete-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"replace-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"patch-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"create-endpointslice-v1beta1-discovery-k8s-io","subsections":[]}]}]},{"section":"endpointport-v1beta1-discovery-k8s-io","subsections":[]},{"section":"endpointport-v1-discovery-k8s-io","subsections":[]},{"section":"endpointhints-v1beta1-discovery-k8s-io","subsections":[]},{"section":"endpointconditions-v1beta1-discovery-k8s-io","subsections":[]},{"section":"endpoint-v1beta1-discovery-k8s-io","subsections":[]},{"section":"crossversionobjectreference-v2beta1-autoscaling","subsections":[]},{"section":"crossversionobjectreference-v2beta2-autoscaling","subsections":[]},{"section":"cronjob-v1beta1-batch","subsections":[{"section":"-strong-status-operations-cronjob-v1beta1-batch-strong-","subsections":[{"section":"replace-status-cronjob-v1beta1-batch","subsections":[]},{"section":"read-status-cronjob-v1beta1-batch","subsections":[]},{"section":"patch-status-cronjob-v1beta1-batch","subsections":[]}]},{"section":"-strong-read-operations-cronjob-v1beta1-batch-strong-","subsections":[{"section":"watch-list-all-namespaces-cronjob-v1beta1-batch","subsections":[]},{"section":"watch-list-cronjob-v1beta1-batch","subsections":[]},{"section":"watch-cronjob-v1beta1-batch","subsections":[]},{"section":"list-all-namespaces-cronjob-v1beta1-batch","subsections":[]},{"section":"list-cronjob-v1beta1-batch","subsections":[]},{"section":"read-cronjob-v1beta1-batch","subsections":[]}]},{"section":"-strong-write-operations-cronjob-v1beta1-batch-strong-","subsections":[{"section":"delete-collection-cronjob-v1beta1-batch","subsections":[]},{"section":"delete-cronjob-v1beta1-batch","subsections":[]},{"section":"replace-cronjob-v1beta1-batch","subsections":[]},{"section":"patch-cronjob-v1beta1-batch","subsections":[]},{"section":"create-cronjob-v1beta1-batch","subsections":[]}]}]},{"section":"containerresourcemetricstatus-v2beta1-autoscaling","subsections":[]},{"section":"containerresourcemetricsource-v2beta1-autoscaling","subsections":[]},{"section":"clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-clusterrole-v1alpha1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-clusterrole-v1alpha1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[{"section":"-strong-read-operations-csistoragecapacity-v1alpha1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"watch-list-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"watch-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"list-all-namespaces-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"list-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"read-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-csistoragecapacity-v1alpha1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"delete-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"replace-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"patch-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"create-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]}]}]},{"section":"aggregationrule-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"-strong-old-api-versions-strong-","subsections":[]},{"section":"windowssecuritycontextoptions-v1-core","subsections":[]},{"section":"weightedpodaffinityterm-v1-core","subsections":[]},{"section":"webhookconversion-v1-apiextensions-k8s-io","subsections":[]},{"section":"webhookclientconfig-v1-admissionregistration-k8s-io","subsections":[]},{"section":"watchevent-v1-meta","subsections":[]},{"section":"vspherevirtualdiskvolumesource-v1-core","subsections":[]},{"section":"volumeprojection-v1-core","subsections":[]},{"section":"volumenoderesources-v1-storage-k8s-io","subsections":[]},{"section":"volumenodeaffinity-v1-core","subsections":[]},{"section":"volumemount-v1-core","subsections":[]},{"section":"volumeerror-v1-storage-k8s-io","subsections":[]},{"section":"volumedevice-v1-core","subsections":[]},{"section":"volumeattachmentsource-v1-storage-k8s-io","subsections":[]},{"section":"validatingwebhook-v1-admissionregistration-k8s-io","subsections":[]},{"section":"usersubject-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"userinfo-v1-authentication-k8s-io","subsections":[]},{"section":"uncountedterminatedpods-v1-batch","subsections":[]},{"section":"typedlocalobjectreference-v1-core","subsections":[]},{"section":"topologyspreadconstraint-v1-core","subsections":[]},{"section":"topologyselectorterm-v1-core","subsections":[]},{"section":"topologyselectorlabelrequirement-v1-core","subsections":[]},{"section":"toleration-v1-core","subsections":[]},{"section":"time-v1-meta","subsections":[]},{"section":"taint-v1-core","subsections":[]},{"section":"tcpsocketaction-v1-core","subsections":[]},{"section":"sysctl-v1-core","subsections":[]},{"section":"supplementalgroupsstrategyoptions-v1beta1-policy","subsections":[]},{"section":"subjectrulesreviewstatus-v1-authorization-k8s-io","subsections":[]},{"section":"subject-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"storageversioncondition-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"storageosvolumesource-v1-core","subsections":[]},{"section":"storageospersistentvolumesource-v1-core","subsections":[]},{"section":"statusdetails-v1-meta","subsections":[]},{"section":"statuscause-v1-meta","subsections":[]},{"section":"status-v1-meta","subsections":[]},{"section":"statefulsetupdatestrategy-v1-apps","subsections":[]},{"section":"statefulsetcondition-v1-apps","subsections":[]},{"section":"sessionaffinityconfig-v1-core","subsections":[]},{"section":"servicereference-v1-admissionregistration-k8s-io","subsections":[]},{"section":"serviceport-v1-core","subsections":[]},{"section":"servicebackendport-v1-networking-k8s-io","subsections":[]},{"section":"serviceaccounttokenprojection-v1-core","subsections":[]},{"section":"serviceaccountsubject-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"serverstorageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"serveraddressbyclientcidr-v1-meta","subsections":[]},{"section":"securitycontext-v1-core","subsections":[]},{"section":"secretvolumesource-v1-core","subsections":[]},{"section":"secretreference-v1-core","subsections":[]},{"section":"secretprojection-v1-core","subsections":[]},{"section":"secretkeyselector-v1-core","subsections":[]},{"section":"secretenvsource-v1-core","subsections":[]},{"section":"seccompprofile-v1-core","subsections":[]},{"section":"scopedresourceselectorrequirement-v1-core","subsections":[]},{"section":"scopeselector-v1-core","subsections":[]},{"section":"scheduling-v1-node-k8s-io","subsections":[]},{"section":"scaleiovolumesource-v1-core","subsections":[]},{"section":"scaleiopersistentvolumesource-v1-core","subsections":[]},{"section":"scale-v1-autoscaling","subsections":[]},{"section":"selinuxstrategyoptions-v1beta1-policy","subsections":[]},{"section":"selinuxoptions-v1-core","subsections":[]},{"section":"runtimeclassstrategyoptions-v1beta1-policy","subsections":[]},{"section":"runasuserstrategyoptions-v1beta1-policy","subsections":[]},{"section":"runasgroupstrategyoptions-v1beta1-policy","subsections":[]},{"section":"rulewithoperations-v1-admissionregistration-k8s-io","subsections":[]},{"section":"rollingupdatestatefulsetstrategy-v1-apps","subsections":[]},{"section":"roleref-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"resourcerule-v1-authorization-k8s-io","subsections":[]},{"section":"resourcerequirements-v1-core","subsections":[]},{"section":"resourcepolicyrule-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"resourcemetricstatus-v2beta2-autoscaling","subsections":[]},{"section":"resourcemetricsource-v2beta2-autoscaling","subsections":[]},{"section":"resourcefieldselector-v1-core","subsections":[]},{"section":"resourceattributes-v1-authorization-k8s-io","subsections":[]},{"section":"replicationcontrollercondition-v1-core","subsections":[]},{"section":"replicasetcondition-v1-apps","subsections":[]},{"section":"rbdvolumesource-v1-core","subsections":[]},{"section":"rbdpersistentvolumesource-v1-core","subsections":[]},{"section":"quobytevolumesource-v1-core","subsections":[]},{"section":"queuingconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"quantity-resource-core","subsections":[]},{"section":"projectedvolumesource-v1-core","subsections":[]},{"section":"probe-v1-core","subsections":[]},{"section":"prioritylevelconfigurationreference-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"prioritylevelconfigurationcondition-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"preferredschedulingterm-v1-core","subsections":[]},{"section":"preconditions-v1-meta","subsections":[]},{"section":"portworxvolumesource-v1-core","subsections":[]},{"section":"portstatus-v1-core","subsections":[]},{"section":"policyruleswithsubjects-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"policyrule-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"podsmetricstatus-v2beta2-autoscaling","subsections":[]},{"section":"podsmetricsource-v2beta2-autoscaling","subsections":[]},{"section":"podsecuritycontext-v1-core","subsections":[]},{"section":"podreadinessgate-v1-core","subsections":[]},{"section":"podip-v1-core","subsections":[]},{"section":"poddnsconfigoption-v1-core","subsections":[]},{"section":"poddnsconfig-v1-core","subsections":[]},{"section":"podcondition-v1-core","subsections":[]},{"section":"podantiaffinity-v1-core","subsections":[]},{"section":"podaffinityterm-v1-core","subsections":[]},{"section":"podaffinity-v1-core","subsections":[]},{"section":"photonpersistentdiskvolumesource-v1-core","subsections":[]},{"section":"persistentvolumeclaimvolumesource-v1-core","subsections":[]},{"section":"persistentvolumeclaimtemplate-v1-core","subsections":[]},{"section":"persistentvolumeclaimcondition-v1-core","subsections":[]},{"section":"patch-v1-meta","subsections":[]},{"section":"ownerreference-v1-meta","subsections":[]},{"section":"overhead-v1-node-k8s-io","subsections":[]},{"section":"objectreference-v1-core","subsections":[]},{"section":"objectmetricstatus-v2beta2-autoscaling","subsections":[]},{"section":"objectmetricsource-v2beta2-autoscaling","subsections":[]},{"section":"objectmeta-v1-meta","subsections":[]},{"section":"objectfieldselector-v1-core","subsections":[]},{"section":"nonresourcerule-v1-authorization-k8s-io","subsections":[]},{"section":"nonresourcepolicyrule-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"nonresourceattributes-v1-authorization-k8s-io","subsections":[]},{"section":"nodesysteminfo-v1-core","subsections":[]},{"section":"nodeselectorterm-v1-core","subsections":[]},{"section":"nodeselectorrequirement-v1-core","subsections":[]},{"section":"nodeselector-v1-core","subsections":[]},{"section":"nodedaemonendpoints-v1-core","subsections":[]},{"section":"nodeconfigstatus-v1-core","subsections":[]},{"section":"nodeconfigsource-v1-core","subsections":[]},{"section":"nodecondition-v1-core","subsections":[]},{"section":"nodeaffinity-v1-core","subsections":[]},{"section":"nodeaddress-v1-core","subsections":[]},{"section":"networkpolicyport-v1-networking-k8s-io","subsections":[]},{"section":"networkpolicypeer-v1-networking-k8s-io","subsections":[]},{"section":"networkpolicyingressrule-v1-networking-k8s-io","subsections":[]},{"section":"networkpolicyegressrule-v1-networking-k8s-io","subsections":[]},{"section":"namespacecondition-v1-core","subsections":[]},{"section":"nfsvolumesource-v1-core","subsections":[]},{"section":"mutatingwebhook-v1-admissionregistration-k8s-io","subsections":[]},{"section":"microtime-v1-meta","subsections":[]},{"section":"metricvaluestatus-v2beta2-autoscaling","subsections":[]},{"section":"metrictarget-v2beta2-autoscaling","subsections":[]},{"section":"metricstatus-v2beta2-autoscaling","subsections":[]},{"section":"metricspec-v2beta2-autoscaling","subsections":[]},{"section":"metricidentifier-v2beta2-autoscaling","subsections":[]},{"section":"managedfieldsentry-v1-meta","subsections":[]},{"section":"localvolumesource-v1-core","subsections":[]},{"section":"localobjectreference-v1-core","subsections":[]},{"section":"loadbalancerstatus-v1-core","subsections":[]},{"section":"loadbalanceringress-v1-core","subsections":[]},{"section":"listmeta-v1-meta","subsections":[]},{"section":"limitedprioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"limitresponse-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"limitrangeitem-v1-core","subsections":[]},{"section":"lifecycle-v1-core","subsections":[]},{"section":"labelselectorrequirement-v1-meta","subsections":[]},{"section":"labelselector-v1-meta","subsections":[]},{"section":"keytopath-v1-core","subsections":[]},{"section":"jobtemplatespec-v1-batch","subsections":[]},{"section":"jobcondition-v1-batch","subsections":[]},{"section":"jsonschemapropsorbool-v1-apiextensions-k8s-io","subsections":[]},{"section":"jsonschemapropsorarray-v1-apiextensions-k8s-io","subsections":[]},{"section":"jsonschemaprops-v1-apiextensions-k8s-io","subsections":[]},{"section":"json-v1-apiextensions-k8s-io","subsections":[]},{"section":"ingresstls-v1-networking-k8s-io","subsections":[]},{"section":"ingressservicebackend-v1-networking-k8s-io","subsections":[]},{"section":"ingressrule-v1-networking-k8s-io","subsections":[]},{"section":"ingressclassparametersreference-v1-networking-k8s-io","subsections":[]},{"section":"ingressbackend-v1-networking-k8s-io","subsections":[]},{"section":"iscsivolumesource-v1-core","subsections":[]},{"section":"iscsipersistentvolumesource-v1-core","subsections":[]},{"section":"ipblock-v1-networking-k8s-io","subsections":[]},{"section":"idrange-v1beta1-policy","subsections":[]},{"section":"hostportrange-v1beta1-policy","subsections":[]},{"section":"hostpathvolumesource-v1-core","subsections":[]},{"section":"hostalias-v1-core","subsections":[]},{"section":"horizontalpodautoscalercondition-v2beta2-autoscaling","subsections":[]},{"section":"horizontalpodautoscalerbehavior-v2beta2-autoscaling","subsections":[]},{"section":"handler-v1-core","subsections":[]},{"section":"httpingressrulevalue-v1-networking-k8s-io","subsections":[]},{"section":"httpingresspath-v1-networking-k8s-io","subsections":[]},{"section":"httpheader-v1-core","subsections":[]},{"section":"httpgetaction-v1-core","subsections":[]},{"section":"hpascalingrules-v2beta2-autoscaling","subsections":[]},{"section":"hpascalingpolicy-v2beta2-autoscaling","subsections":[]},{"section":"groupversionfordiscovery-v1-meta","subsections":[]},{"section":"groupsubject-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"glusterfsvolumesource-v1-core","subsections":[]},{"section":"glusterfspersistentvolumesource-v1-core","subsections":[]},{"section":"gitrepovolumesource-v1-core","subsections":[]},{"section":"gcepersistentdiskvolumesource-v1-core","subsections":[]},{"section":"forzone-v1-discovery-k8s-io","subsections":[]},{"section":"flowschemacondition-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"flowdistinguishermethod-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"flockervolumesource-v1-core","subsections":[]},{"section":"flexvolumesource-v1-core","subsections":[]},{"section":"flexpersistentvolumesource-v1-core","subsections":[]},{"section":"fieldsv1-v1-meta","subsections":[]},{"section":"fsgroupstrategyoptions-v1beta1-policy","subsections":[]},{"section":"fcvolumesource-v1-core","subsections":[]},{"section":"externalmetricstatus-v2beta2-autoscaling","subsections":[]},{"section":"externalmetricsource-v2beta2-autoscaling","subsections":[]},{"section":"externaldocumentation-v1-apiextensions-k8s-io","subsections":[]},{"section":"execaction-v1-core","subsections":[]},{"section":"eviction-v1-policy","subsections":[]},{"section":"eventsource-v1-core","subsections":[]},{"section":"eventseries-v1-core","subsections":[]},{"section":"ephemeralvolumesource-v1-core","subsections":[]},{"section":"ephemeralcontainer-v1-core","subsections":[]},{"section":"envvarsource-v1-core","subsections":[]},{"section":"envvar-v1-core","subsections":[]},{"section":"envfromsource-v1-core","subsections":[]},{"section":"endpointsubset-v1-core","subsections":[]},{"section":"endpointport-v1-core","subsections":[]},{"section":"endpointhints-v1-discovery-k8s-io","subsections":[]},{"section":"endpointconditions-v1-discovery-k8s-io","subsections":[]},{"section":"endpointaddress-v1-core","subsections":[]},{"section":"endpoint-v1-discovery-k8s-io","subsections":[]},{"section":"emptydirvolumesource-v1-core","subsections":[]},{"section":"downwardapivolumesource-v1-core","subsections":[]},{"section":"downwardapivolumefile-v1-core","subsections":[]},{"section":"downwardapiprojection-v1-core","subsections":[]},{"section":"deploymentcondition-v1-apps","subsections":[]},{"section":"deleteoptions-v1-meta","subsections":[]},{"section":"daemonsetupdatestrategy-v1-apps","subsections":[]},{"section":"daemonsetcondition-v1-apps","subsections":[]},{"section":"daemonendpoint-v1-core","subsections":[]},{"section":"customresourcevalidation-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcesubresources-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcesubresourcestatus-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcesubresourcescale-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcedefinitionversion-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcedefinitionnames-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcedefinitioncondition-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourceconversion-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcecolumndefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"crossversionobjectreference-v1-autoscaling","subsections":[]},{"section":"containerstatewaiting-v1-core","subsections":[]},{"section":"containerstateterminated-v1-core","subsections":[]},{"section":"containerstaterunning-v1-core","subsections":[]},{"section":"containerstate-v1-core","subsections":[]},{"section":"containerresourcemetricstatus-v2beta2-autoscaling","subsections":[]},{"section":"containerresourcemetricsource-v2beta2-autoscaling","subsections":[]},{"section":"containerport-v1-core","subsections":[]},{"section":"containerimage-v1-core","subsections":[]},{"section":"configmapvolumesource-v1-core","subsections":[]},{"section":"configmapprojection-v1-core","subsections":[]},{"section":"configmapnodeconfigsource-v1-core","subsections":[]},{"section":"configmapkeyselector-v1-core","subsections":[]},{"section":"configmapenvsource-v1-core","subsections":[]},{"section":"condition-v1-meta","subsections":[]},{"section":"componentcondition-v1-core","subsections":[]},{"section":"clientipconfig-v1-core","subsections":[]},{"section":"cindervolumesource-v1-core","subsections":[]},{"section":"cinderpersistentvolumesource-v1-core","subsections":[]},{"section":"certificatesigningrequestcondition-v1-certificates-k8s-io","subsections":[]},{"section":"cephfsvolumesource-v1-core","subsections":[]},{"section":"cephfspersistentvolumesource-v1-core","subsections":[]},{"section":"capabilities-v1-core","subsections":[]},{"section":"csivolumesource-v1-core","subsections":[]},{"section":"csipersistentvolumesource-v1-core","subsections":[]},{"section":"csinodedriver-v1-storage-k8s-io","subsections":[]},{"section":"boundobjectreference-v1-authentication-k8s-io","subsections":[]},{"section":"azurefilevolumesource-v1-core","subsections":[]},{"section":"azurefilepersistentvolumesource-v1-core","subsections":[]},{"section":"azurediskvolumesource-v1-core","subsections":[]},{"section":"attachedvolume-v1-core","subsections":[]},{"section":"allowedhostpath-v1beta1-policy","subsections":[]},{"section":"allowedflexvolume-v1beta1-policy","subsections":[]},{"section":"allowedcsidriver-v1beta1-policy","subsections":[]},{"section":"aggregationrule-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"affinity-v1-core","subsections":[]},{"section":"awselasticblockstorevolumesource-v1-core","subsections":[]},{"section":"apiversions-v1-meta","subsections":[]},{"section":"apiservicecondition-v1-apiregistration-k8s-io","subsections":[]},{"section":"apiresource-v1-meta","subsections":[]},{"section":"apigroup-v1-meta","subsections":[]},{"section":"-strong-definitions-strong-","subsections":[]},{"section":"networkpolicy-v1-networking-k8s-io","subsections":[{"section":"-strong-read-operations-networkpolicy-v1-networking-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"watch-list-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"watch-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"list-all-namespaces-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"list-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"read-networkpolicy-v1-networking-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-networkpolicy-v1-networking-k8s-io-strong-","subsections":[{"section":"delete-collection-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"delete-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"replace-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"patch-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"create-networkpolicy-v1-networking-k8s-io","subsections":[]}]}]},{"section":"tokenreview-v1-authentication-k8s-io","subsections":[{"section":"-strong-write-operations-tokenreview-v1-authentication-k8s-io-strong-","subsections":[{"section":"create-tokenreview-v1-authentication-k8s-io","subsections":[]}]}]},{"section":"tokenrequest-v1-authentication-k8s-io","subsections":[]},{"section":"subjectaccessreview-v1-authorization-k8s-io","subsections":[{"section":"-strong-write-operations-subjectaccessreview-v1-authorization-k8s-io-strong-","subsections":[{"section":"create-subjectaccessreview-v1-authorization-k8s-io","subsections":[]}]}]},{"section":"storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[{"section":"-strong-status-operations-storageversion-v1alpha1-internal-apiserver-k8s-io-strong-","subsections":[{"section":"replace-status-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"read-status-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"patch-status-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-storageversion-v1alpha1-internal-apiserver-k8s-io-strong-","subsections":[{"section":"watch-list-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"watch-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"list-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"read-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-storageversion-v1alpha1-internal-apiserver-k8s-io-strong-","subsections":[{"section":"delete-collection-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"delete-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"replace-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"patch-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"create-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]}]}]},{"section":"serviceaccount-v1-core","subsections":[{"section":"-strong-read-operations-serviceaccount-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-serviceaccount-v1-core","subsections":[]},{"section":"watch-list-serviceaccount-v1-core","subsections":[]},{"section":"watch-serviceaccount-v1-core","subsections":[]},{"section":"list-all-namespaces-serviceaccount-v1-core","subsections":[]},{"section":"list-serviceaccount-v1-core","subsections":[]},{"section":"read-serviceaccount-v1-core","subsections":[]}]},{"section":"-strong-write-operations-serviceaccount-v1-core-strong-","subsections":[{"section":"delete-collection-serviceaccount-v1-core","subsections":[]},{"section":"delete-serviceaccount-v1-core","subsections":[]},{"section":"replace-serviceaccount-v1-core","subsections":[]},{"section":"patch-serviceaccount-v1-core","subsections":[]},{"section":"create-serviceaccount-v1-core","subsections":[]}]}]},{"section":"selfsubjectrulesreview-v1-authorization-k8s-io","subsections":[{"section":"-strong-write-operations-selfsubjectrulesreview-v1-authorization-k8s-io-strong-","subsections":[{"section":"create-selfsubjectrulesreview-v1-authorization-k8s-io","subsections":[]}]}]},{"section":"selfsubjectaccessreview-v1-authorization-k8s-io","subsections":[{"section":"-strong-write-operations-selfsubjectaccessreview-v1-authorization-k8s-io-strong-","subsections":[{"section":"create-selfsubjectaccessreview-v1-authorization-k8s-io","subsections":[]}]}]},{"section":"runtimeclass-v1-node-k8s-io","subsections":[{"section":"-strong-read-operations-runtimeclass-v1-node-k8s-io-strong-","subsections":[{"section":"watch-list-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"watch-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"list-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"read-runtimeclass-v1-node-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-runtimeclass-v1-node-k8s-io-strong-","subsections":[{"section":"delete-collection-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"delete-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"replace-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"patch-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"create-runtimeclass-v1-node-k8s-io","subsections":[]}]}]},{"section":"rolebinding-v1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-rolebinding-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-list-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-all-namespaces-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-rolebinding-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"role-v1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-role-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-list-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-all-namespaces-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-role-v1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-role-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-role-v1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"resourcequota-v1-core","subsections":[{"section":"-strong-status-operations-resourcequota-v1-core-strong-","subsections":[{"section":"replace-status-resourcequota-v1-core","subsections":[]},{"section":"read-status-resourcequota-v1-core","subsections":[]},{"section":"patch-status-resourcequota-v1-core","subsections":[]}]},{"section":"-strong-read-operations-resourcequota-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-resourcequota-v1-core","subsections":[]},{"section":"watch-list-resourcequota-v1-core","subsections":[]},{"section":"watch-resourcequota-v1-core","subsections":[]},{"section":"list-all-namespaces-resourcequota-v1-core","subsections":[]},{"section":"list-resourcequota-v1-core","subsections":[]},{"section":"read-resourcequota-v1-core","subsections":[]}]},{"section":"-strong-write-operations-resourcequota-v1-core-strong-","subsections":[{"section":"delete-collection-resourcequota-v1-core","subsections":[]},{"section":"delete-resourcequota-v1-core","subsections":[]},{"section":"replace-resourcequota-v1-core","subsections":[]},{"section":"patch-resourcequota-v1-core","subsections":[]},{"section":"create-resourcequota-v1-core","subsections":[]}]}]},{"section":"prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[{"section":"-strong-status-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"replace-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"read-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"patch-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"watch-list-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"watch-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"list-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"read-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"delete-collection-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"delete-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"replace-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"patch-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"create-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]}]},{"section":"persistentvolume-v1-core","subsections":[{"section":"-strong-status-operations-persistentvolume-v1-core-strong-","subsections":[{"section":"replace-status-persistentvolume-v1-core","subsections":[]},{"section":"read-status-persistentvolume-v1-core","subsections":[]},{"section":"patch-status-persistentvolume-v1-core","subsections":[]}]},{"section":"-strong-read-operations-persistentvolume-v1-core-strong-","subsections":[{"section":"watch-list-persistentvolume-v1-core","subsections":[]},{"section":"watch-persistentvolume-v1-core","subsections":[]},{"section":"list-persistentvolume-v1-core","subsections":[]},{"section":"read-persistentvolume-v1-core","subsections":[]}]},{"section":"-strong-write-operations-persistentvolume-v1-core-strong-","subsections":[{"section":"delete-collection-persistentvolume-v1-core","subsections":[]},{"section":"delete-persistentvolume-v1-core","subsections":[]},{"section":"replace-persistentvolume-v1-core","subsections":[]},{"section":"patch-persistentvolume-v1-core","subsections":[]},{"section":"create-persistentvolume-v1-core","subsections":[]}]}]},{"section":"node-v1-core","subsections":[{"section":"-strong-proxy-operations-node-v1-core-strong-","subsections":[{"section":"replace-connect-proxy-path-node-v1-core","subsections":[]},{"section":"replace-connect-proxy-node-v1-core","subsections":[]},{"section":"head-connect-proxy-path-node-v1-core","subsections":[]},{"section":"head-connect-proxy-node-v1-core","subsections":[]},{"section":"get-connect-proxy-path-node-v1-core","subsections":[]},{"section":"get-connect-proxy-node-v1-core","subsections":[]},{"section":"delete-connect-proxy-path-node-v1-core","subsections":[]},{"section":"delete-connect-proxy-node-v1-core","subsections":[]},{"section":"create-connect-proxy-path-node-v1-core","subsections":[]},{"section":"create-connect-proxy-node-v1-core","subsections":[]}]},{"section":"-strong-status-operations-node-v1-core-strong-","subsections":[{"section":"replace-status-node-v1-core","subsections":[]},{"section":"read-status-node-v1-core","subsections":[]},{"section":"patch-status-node-v1-core","subsections":[]}]},{"section":"-strong-read-operations-node-v1-core-strong-","subsections":[{"section":"watch-list-node-v1-core","subsections":[]},{"section":"watch-node-v1-core","subsections":[]},{"section":"list-node-v1-core","subsections":[]},{"section":"read-node-v1-core","subsections":[]}]},{"section":"-strong-write-operations-node-v1-core-strong-","subsections":[{"section":"delete-collection-node-v1-core","subsections":[]},{"section":"delete-node-v1-core","subsections":[]},{"section":"replace-node-v1-core","subsections":[]},{"section":"patch-node-v1-core","subsections":[]},{"section":"create-node-v1-core","subsections":[]}]}]},{"section":"namespace-v1-core","subsections":[{"section":"-strong-status-operations-namespace-v1-core-strong-","subsections":[{"section":"replace-status-namespace-v1-core","subsections":[]},{"section":"read-status-namespace-v1-core","subsections":[]},{"section":"patch-status-namespace-v1-core","subsections":[]}]},{"section":"-strong-read-operations-namespace-v1-core-strong-","subsections":[{"section":"watch-list-namespace-v1-core","subsections":[]},{"section":"watch-namespace-v1-core","subsections":[]},{"section":"list-namespace-v1-core","subsections":[]},{"section":"read-namespace-v1-core","subsections":[]}]},{"section":"-strong-write-operations-namespace-v1-core-strong-","subsections":[{"section":"delete-namespace-v1-core","subsections":[]},{"section":"replace-namespace-v1-core","subsections":[]},{"section":"patch-namespace-v1-core","subsections":[]},{"section":"create-namespace-v1-core","subsections":[]}]}]},{"section":"localsubjectaccessreview-v1-authorization-k8s-io","subsections":[{"section":"-strong-write-operations-localsubjectaccessreview-v1-authorization-k8s-io-strong-","subsections":[{"section":"create-localsubjectaccessreview-v1-authorization-k8s-io","subsections":[]}]}]},{"section":"lease-v1-coordination-k8s-io","subsections":[{"section":"-strong-read-operations-lease-v1-coordination-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-lease-v1-coordination-k8s-io","subsections":[]},{"section":"watch-list-lease-v1-coordination-k8s-io","subsections":[]},{"section":"watch-lease-v1-coordination-k8s-io","subsections":[]},{"section":"list-all-namespaces-lease-v1-coordination-k8s-io","subsections":[]},{"section":"list-lease-v1-coordination-k8s-io","subsections":[]},{"section":"read-lease-v1-coordination-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-lease-v1-coordination-k8s-io-strong-","subsections":[{"section":"delete-collection-lease-v1-coordination-k8s-io","subsections":[]},{"section":"delete-lease-v1-coordination-k8s-io","subsections":[]},{"section":"replace-lease-v1-coordination-k8s-io","subsections":[]},{"section":"patch-lease-v1-coordination-k8s-io","subsections":[]},{"section":"create-lease-v1-coordination-k8s-io","subsections":[]}]}]},{"section":"flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[{"section":"-strong-status-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"replace-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"read-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"patch-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"watch-list-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"watch-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"list-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"read-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"delete-collection-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"delete-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"replace-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"patch-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"create-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]}]},{"section":"componentstatus-v1-core","subsections":[{"section":"-strong-read-operations-componentstatus-v1-core-strong-","subsections":[{"section":"list-componentstatus-v1-core","subsections":[]},{"section":"read-componentstatus-v1-core","subsections":[]}]}]},{"section":"clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-clusterrolebinding-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-clusterrolebinding-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"clusterrole-v1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-clusterrole-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-clusterrole-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"certificatesigningrequest-v1-certificates-k8s-io","subsections":[{"section":"-strong-status-operations-certificatesigningrequest-v1-certificates-k8s-io-strong-","subsections":[{"section":"replace-status-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"read-status-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"patch-status-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-certificatesigningrequest-v1-certificates-k8s-io-strong-","subsections":[{"section":"watch-list-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"watch-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"list-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"read-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-certificatesigningrequest-v1-certificates-k8s-io-strong-","subsections":[{"section":"delete-collection-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"delete-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"replace-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"patch-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"create-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]}]}]},{"section":"binding-v1-core","subsections":[{"section":"-strong-write-operations-binding-v1-core-strong-","subsections":[{"section":"create-binding-v1-core","subsections":[]}]}]},{"section":"apiservice-v1-apiregistration-k8s-io","subsections":[{"section":"-strong-status-operations-apiservice-v1-apiregistration-k8s-io-strong-","subsections":[{"section":"replace-status-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"read-status-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"patch-status-apiservice-v1-apiregistration-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-apiservice-v1-apiregistration-k8s-io-strong-","subsections":[{"section":"watch-list-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"watch-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"list-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"read-apiservice-v1-apiregistration-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-apiservice-v1-apiregistration-k8s-io-strong-","subsections":[{"section":"delete-collection-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"delete-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"replace-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"patch-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"create-apiservice-v1-apiregistration-k8s-io","subsections":[]}]}]},{"section":"-strong-cluster-apis-strong-","subsections":[]},{"section":"podsecuritypolicy-v1beta1-policy","subsections":[{"section":"-strong-read-operations-podsecuritypolicy-v1beta1-policy-strong-","subsections":[{"section":"watch-list-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"watch-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"list-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"read-podsecuritypolicy-v1beta1-policy","subsections":[]}]},{"section":"-strong-write-operations-podsecuritypolicy-v1beta1-policy-strong-","subsections":[{"section":"delete-collection-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"delete-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"replace-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"patch-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"create-podsecuritypolicy-v1beta1-policy","subsections":[]}]}]},{"section":"priorityclass-v1-scheduling-k8s-io","subsections":[{"section":"-strong-read-operations-priorityclass-v1-scheduling-k8s-io-strong-","subsections":[{"section":"watch-list-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"watch-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"list-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"read-priorityclass-v1-scheduling-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-priorityclass-v1-scheduling-k8s-io-strong-","subsections":[{"section":"delete-collection-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"delete-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"replace-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"patch-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"create-priorityclass-v1-scheduling-k8s-io","subsections":[]}]}]},{"section":"poddisruptionbudget-v1-policy","subsections":[{"section":"-strong-status-operations-poddisruptionbudget-v1-policy-strong-","subsections":[{"section":"replace-status-poddisruptionbudget-v1-policy","subsections":[]},{"section":"read-status-poddisruptionbudget-v1-policy","subsections":[]},{"section":"patch-status-poddisruptionbudget-v1-policy","subsections":[]}]},{"section":"-strong-read-operations-poddisruptionbudget-v1-policy-strong-","subsections":[{"section":"watch-list-all-namespaces-poddisruptionbudget-v1-policy","subsections":[]},{"section":"watch-list-poddisruptionbudget-v1-policy","subsections":[]},{"section":"watch-poddisruptionbudget-v1-policy","subsections":[]},{"section":"list-all-namespaces-poddisruptionbudget-v1-policy","subsections":[]},{"section":"list-poddisruptionbudget-v1-policy","subsections":[]},{"section":"read-poddisruptionbudget-v1-policy","subsections":[]}]},{"section":"-strong-write-operations-poddisruptionbudget-v1-policy-strong-","subsections":[{"section":"delete-collection-poddisruptionbudget-v1-policy","subsections":[]},{"section":"delete-poddisruptionbudget-v1-policy","subsections":[]},{"section":"replace-poddisruptionbudget-v1-policy","subsections":[]},{"section":"patch-poddisruptionbudget-v1-policy","subsections":[]},{"section":"create-poddisruptionbudget-v1-policy","subsections":[]}]}]},{"section":"podtemplate-v1-core","subsections":[{"section":"-strong-read-operations-podtemplate-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-podtemplate-v1-core","subsections":[]},{"section":"watch-list-podtemplate-v1-core","subsections":[]},{"section":"watch-podtemplate-v1-core","subsections":[]},{"section":"list-all-namespaces-podtemplate-v1-core","subsections":[]},{"section":"list-podtemplate-v1-core","subsections":[]},{"section":"read-podtemplate-v1-core","subsections":[]}]},{"section":"-strong-write-operations-podtemplate-v1-core-strong-","subsections":[{"section":"delete-collection-podtemplate-v1-core","subsections":[]},{"section":"delete-podtemplate-v1-core","subsections":[]},{"section":"replace-podtemplate-v1-core","subsections":[]},{"section":"patch-podtemplate-v1-core","subsections":[]},{"section":"create-podtemplate-v1-core","subsections":[]}]}]},{"section":"validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[{"section":"-strong-read-operations-validatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","subsections":[{"section":"watch-list-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"watch-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"list-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"read-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-validatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","subsections":[{"section":"delete-collection-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"delete-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"replace-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"patch-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"create-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]}]}]},{"section":"mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[{"section":"-strong-read-operations-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","subsections":[{"section":"watch-list-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"watch-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"list-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"read-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","subsections":[{"section":"delete-collection-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"delete-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"replace-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"patch-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"create-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]}]}]},{"section":"horizontalpodautoscaler-v1-autoscaling","subsections":[{"section":"-strong-status-operations-horizontalpodautoscaler-v1-autoscaling-strong-","subsections":[{"section":"replace-status-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"read-status-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"patch-status-horizontalpodautoscaler-v1-autoscaling","subsections":[]}]},{"section":"-strong-read-operations-horizontalpodautoscaler-v1-autoscaling-strong-","subsections":[{"section":"watch-list-all-namespaces-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"watch-list-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"watch-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"list-all-namespaces-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"list-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"read-horizontalpodautoscaler-v1-autoscaling","subsections":[]}]},{"section":"-strong-write-operations-horizontalpodautoscaler-v1-autoscaling-strong-","subsections":[{"section":"delete-collection-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"delete-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"replace-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"patch-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"create-horizontalpodautoscaler-v1-autoscaling","subsections":[]}]}]},{"section":"limitrange-v1-core","subsections":[{"section":"-strong-read-operations-limitrange-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-limitrange-v1-core","subsections":[]},{"section":"watch-list-limitrange-v1-core","subsections":[]},{"section":"watch-limitrange-v1-core","subsections":[]},{"section":"list-all-namespaces-limitrange-v1-core","subsections":[]},{"section":"list-limitrange-v1-core","subsections":[]},{"section":"read-limitrange-v1-core","subsections":[]}]},{"section":"-strong-write-operations-limitrange-v1-core-strong-","subsections":[{"section":"delete-collection-limitrange-v1-core","subsections":[]},{"section":"delete-limitrange-v1-core","subsections":[]},{"section":"replace-limitrange-v1-core","subsections":[]},{"section":"patch-limitrange-v1-core","subsections":[]},{"section":"create-limitrange-v1-core","subsections":[]}]}]},{"section":"event-v1-core","subsections":[{"section":"-strong-read-operations-event-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-event-v1-core","subsections":[]},{"section":"watch-list-event-v1-core","subsections":[]},{"section":"watch-event-v1-core","subsections":[]},{"section":"list-all-namespaces-event-v1-core","subsections":[]},{"section":"list-event-v1-core","subsections":[]},{"section":"read-event-v1-core","subsections":[]}]},{"section":"-strong-write-operations-event-v1-core-strong-","subsections":[{"section":"delete-collection-event-v1-core","subsections":[]},{"section":"delete-event-v1-core","subsections":[]},{"section":"replace-event-v1-core","subsections":[]},{"section":"patch-event-v1-core","subsections":[]},{"section":"create-event-v1-core","subsections":[]}]}]},{"section":"customresourcedefinition-v1-apiextensions-k8s-io","subsections":[{"section":"-strong-status-operations-customresourcedefinition-v1-apiextensions-k8s-io-strong-","subsections":[{"section":"replace-status-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"read-status-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"patch-status-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-customresourcedefinition-v1-apiextensions-k8s-io-strong-","subsections":[{"section":"watch-list-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"watch-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"list-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"read-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-customresourcedefinition-v1-apiextensions-k8s-io-strong-","subsections":[{"section":"delete-collection-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"delete-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"replace-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"patch-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"create-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]}]}]},{"section":"controllerrevision-v1-apps","subsections":[{"section":"-strong-read-operations-controllerrevision-v1-apps-strong-","subsections":[{"section":"watch-list-all-namespaces-controllerrevision-v1-apps","subsections":[]},{"section":"watch-list-controllerrevision-v1-apps","subsections":[]},{"section":"watch-controllerrevision-v1-apps","subsections":[]},{"section":"list-all-namespaces-controllerrevision-v1-apps","subsections":[]},{"section":"list-controllerrevision-v1-apps","subsections":[]},{"section":"read-controllerrevision-v1-apps","subsections":[]}]},{"section":"-strong-write-operations-controllerrevision-v1-apps-strong-","subsections":[{"section":"delete-collection-controllerrevision-v1-apps","subsections":[]},{"section":"delete-controllerrevision-v1-apps","subsections":[]},{"section":"replace-controllerrevision-v1-apps","subsections":[]},{"section":"patch-controllerrevision-v1-apps","subsections":[]},{"section":"create-controllerrevision-v1-apps","subsections":[]}]}]},{"section":"-strong-metadata-apis-strong-","subsections":[]},{"section":"volumeattachment-v1-storage-k8s-io","subsections":[{"section":"-strong-status-operations-volumeattachment-v1-storage-k8s-io-strong-","subsections":[{"section":"replace-status-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"read-status-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"patch-status-volumeattachment-v1-storage-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-volumeattachment-v1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"watch-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"list-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"read-volumeattachment-v1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-volumeattachment-v1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"delete-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"replace-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"patch-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"create-volumeattachment-v1-storage-k8s-io","subsections":[]}]}]},{"section":"volume-v1-core","subsections":[]},{"section":"csistoragecapacity-v1beta1-storage-k8s-io","subsections":[{"section":"-strong-read-operations-csistoragecapacity-v1beta1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"watch-list-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"watch-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"list-all-namespaces-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"list-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"read-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-csistoragecapacity-v1beta1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"delete-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"replace-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"patch-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"create-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]}]}]},{"section":"storageclass-v1-storage-k8s-io","subsections":[{"section":"-strong-read-operations-storageclass-v1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"watch-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"list-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"read-storageclass-v1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-storageclass-v1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"delete-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"replace-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"patch-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"create-storageclass-v1-storage-k8s-io","subsections":[]}]}]},{"section":"persistentvolumeclaim-v1-core","subsections":[{"section":"-strong-status-operations-persistentvolumeclaim-v1-core-strong-","subsections":[{"section":"replace-status-persistentvolumeclaim-v1-core","subsections":[]},{"section":"read-status-persistentvolumeclaim-v1-core","subsections":[]},{"section":"patch-status-persistentvolumeclaim-v1-core","subsections":[]}]},{"section":"-strong-read-operations-persistentvolumeclaim-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-persistentvolumeclaim-v1-core","subsections":[]},{"section":"watch-list-persistentvolumeclaim-v1-core","subsections":[]},{"section":"watch-persistentvolumeclaim-v1-core","subsections":[]},{"section":"list-all-namespaces-persistentvolumeclaim-v1-core","subsections":[]},{"section":"list-persistentvolumeclaim-v1-core","subsections":[]},{"section":"read-persistentvolumeclaim-v1-core","subsections":[]}]},{"section":"-strong-write-operations-persistentvolumeclaim-v1-core-strong-","subsections":[{"section":"delete-collection-persistentvolumeclaim-v1-core","subsections":[]},{"section":"delete-persistentvolumeclaim-v1-core","subsections":[]},{"section":"replace-persistentvolumeclaim-v1-core","subsections":[]},{"section":"patch-persistentvolumeclaim-v1-core","subsections":[]},{"section":"create-persistentvolumeclaim-v1-core","subsections":[]}]}]},{"section":"secret-v1-core","subsections":[{"section":"-strong-read-operations-secret-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-secret-v1-core","subsections":[]},{"section":"watch-list-secret-v1-core","subsections":[]},{"section":"watch-secret-v1-core","subsections":[]},{"section":"list-all-namespaces-secret-v1-core","subsections":[]},{"section":"list-secret-v1-core","subsections":[]},{"section":"read-secret-v1-core","subsections":[]}]},{"section":"-strong-write-operations-secret-v1-core-strong-","subsections":[{"section":"delete-collection-secret-v1-core","subsections":[]},{"section":"delete-secret-v1-core","subsections":[]},{"section":"replace-secret-v1-core","subsections":[]},{"section":"patch-secret-v1-core","subsections":[]},{"section":"create-secret-v1-core","subsections":[]}]}]},{"section":"csinode-v1-storage-k8s-io","subsections":[{"section":"-strong-read-operations-csinode-v1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-csinode-v1-storage-k8s-io","subsections":[]},{"section":"watch-csinode-v1-storage-k8s-io","subsections":[]},{"section":"list-csinode-v1-storage-k8s-io","subsections":[]},{"section":"read-csinode-v1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-csinode-v1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-csinode-v1-storage-k8s-io","subsections":[]},{"section":"delete-csinode-v1-storage-k8s-io","subsections":[]},{"section":"replace-csinode-v1-storage-k8s-io","subsections":[]},{"section":"patch-csinode-v1-storage-k8s-io","subsections":[]},{"section":"create-csinode-v1-storage-k8s-io","subsections":[]}]}]},{"section":"csidriver-v1-storage-k8s-io","subsections":[{"section":"-strong-read-operations-csidriver-v1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"watch-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"list-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"read-csidriver-v1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-csidriver-v1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"delete-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"replace-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"patch-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"create-csidriver-v1-storage-k8s-io","subsections":[]}]}]},{"section":"configmap-v1-core","subsections":[{"section":"-strong-read-operations-configmap-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-configmap-v1-core","subsections":[]},{"section":"watch-list-configmap-v1-core","subsections":[]},{"section":"watch-configmap-v1-core","subsections":[]},{"section":"list-all-namespaces-configmap-v1-core","subsections":[]},{"section":"list-configmap-v1-core","subsections":[]},{"section":"read-configmap-v1-core","subsections":[]}]},{"section":"-strong-write-operations-configmap-v1-core-strong-","subsections":[{"section":"delete-collection-configmap-v1-core","subsections":[]},{"section":"delete-configmap-v1-core","subsections":[]},{"section":"replace-configmap-v1-core","subsections":[]},{"section":"patch-configmap-v1-core","subsections":[]},{"section":"create-configmap-v1-core","subsections":[]}]}]},{"section":"-strong-config-and-storage-apis-strong-","subsections":[]},{"section":"service-v1-core","subsections":[{"section":"-strong-proxy-operations-service-v1-core-strong-","subsections":[{"section":"replace-connect-proxy-path-service-v1-core","subsections":[]},{"section":"replace-connect-proxy-service-v1-core","subsections":[]},{"section":"head-connect-proxy-path-service-v1-core","subsections":[]},{"section":"head-connect-proxy-service-v1-core","subsections":[]},{"section":"get-connect-proxy-path-service-v1-core","subsections":[]},{"section":"get-connect-proxy-service-v1-core","subsections":[]},{"section":"delete-connect-proxy-path-service-v1-core","subsections":[]},{"section":"delete-connect-proxy-service-v1-core","subsections":[]},{"section":"create-connect-proxy-path-service-v1-core","subsections":[]},{"section":"create-connect-proxy-service-v1-core","subsections":[]}]},{"section":"-strong-status-operations-service-v1-core-strong-","subsections":[{"section":"replace-status-service-v1-core","subsections":[]},{"section":"read-status-service-v1-core","subsections":[]},{"section":"patch-status-service-v1-core","subsections":[]}]},{"section":"-strong-read-operations-service-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-service-v1-core","subsections":[]},{"section":"watch-list-service-v1-core","subsections":[]},{"section":"watch-service-v1-core","subsections":[]},{"section":"list-all-namespaces-service-v1-core","subsections":[]},{"section":"list-service-v1-core","subsections":[]},{"section":"read-service-v1-core","subsections":[]}]},{"section":"-strong-write-operations-service-v1-core-strong-","subsections":[{"section":"delete-service-v1-core","subsections":[]},{"section":"replace-service-v1-core","subsections":[]},{"section":"patch-service-v1-core","subsections":[]},{"section":"create-service-v1-core","subsections":[]}]}]},{"section":"ingressclass-v1-networking-k8s-io","subsections":[{"section":"-strong-read-operations-ingressclass-v1-networking-k8s-io-strong-","subsections":[{"section":"watch-list-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"watch-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"list-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"read-ingressclass-v1-networking-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-ingressclass-v1-networking-k8s-io-strong-","subsections":[{"section":"delete-collection-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"delete-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"replace-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"patch-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"create-ingressclass-v1-networking-k8s-io","subsections":[]}]}]},{"section":"ingress-v1-networking-k8s-io","subsections":[{"section":"-strong-status-operations-ingress-v1-networking-k8s-io-strong-","subsections":[{"section":"replace-status-ingress-v1-networking-k8s-io","subsections":[]},{"section":"read-status-ingress-v1-networking-k8s-io","subsections":[]},{"section":"patch-status-ingress-v1-networking-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-ingress-v1-networking-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-ingress-v1-networking-k8s-io","subsections":[]},{"section":"watch-list-ingress-v1-networking-k8s-io","subsections":[]},{"section":"watch-ingress-v1-networking-k8s-io","subsections":[]},{"section":"list-all-namespaces-ingress-v1-networking-k8s-io","subsections":[]},{"section":"list-ingress-v1-networking-k8s-io","subsections":[]},{"section":"read-ingress-v1-networking-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-ingress-v1-networking-k8s-io-strong-","subsections":[{"section":"delete-collection-ingress-v1-networking-k8s-io","subsections":[]},{"section":"delete-ingress-v1-networking-k8s-io","subsections":[]},{"section":"replace-ingress-v1-networking-k8s-io","subsections":[]},{"section":"patch-ingress-v1-networking-k8s-io","subsections":[]},{"section":"create-ingress-v1-networking-k8s-io","subsections":[]}]}]},{"section":"endpointslice-v1-discovery-k8s-io","subsections":[{"section":"-strong-read-operations-endpointslice-v1-discovery-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"watch-list-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"watch-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"list-all-namespaces-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"list-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"read-endpointslice-v1-discovery-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-endpointslice-v1-discovery-k8s-io-strong-","subsections":[{"section":"delete-collection-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"delete-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"replace-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"patch-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"create-endpointslice-v1-discovery-k8s-io","subsections":[]}]}]},{"section":"endpoints-v1-core","subsections":[{"section":"-strong-read-operations-endpoints-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-endpoints-v1-core","subsections":[]},{"section":"watch-list-endpoints-v1-core","subsections":[]},{"section":"watch-endpoints-v1-core","subsections":[]},{"section":"list-all-namespaces-endpoints-v1-core","subsections":[]},{"section":"list-endpoints-v1-core","subsections":[]},{"section":"read-endpoints-v1-core","subsections":[]}]},{"section":"-strong-write-operations-endpoints-v1-core-strong-","subsections":[{"section":"delete-collection-endpoints-v1-core","subsections":[]},{"section":"delete-endpoints-v1-core","subsections":[]},{"section":"replace-endpoints-v1-core","subsections":[]},{"section":"patch-endpoints-v1-core","subsections":[]},{"section":"create-endpoints-v1-core","subsections":[]}]}]},{"section":"-strong-service-apis-strong-","subsections":[]},{"section":"statefulset-v1-apps","subsections":[{"section":"-strong-misc-operations-statefulset-v1-apps-strong-","subsections":[{"section":"patch-scale-statefulset-v1-apps","subsections":[]},{"section":"replace-scale-statefulset-v1-apps","subsections":[]},{"section":"read-scale-statefulset-v1-apps","subsections":[]}]},{"section":"-strong-status-operations-statefulset-v1-apps-strong-","subsections":[{"section":"replace-status-statefulset-v1-apps","subsections":[]},{"section":"read-status-statefulset-v1-apps","subsections":[]},{"section":"patch-status-statefulset-v1-apps","subsections":[]}]},{"section":"-strong-read-operations-statefulset-v1-apps-strong-","subsections":[{"section":"watch-list-all-namespaces-statefulset-v1-apps","subsections":[]},{"section":"watch-list-statefulset-v1-apps","subsections":[]},{"section":"watch-statefulset-v1-apps","subsections":[]},{"section":"list-all-namespaces-statefulset-v1-apps","subsections":[]},{"section":"list-statefulset-v1-apps","subsections":[]},{"section":"read-statefulset-v1-apps","subsections":[]}]},{"section":"-strong-write-operations-statefulset-v1-apps-strong-","subsections":[{"section":"delete-collection-statefulset-v1-apps","subsections":[]},{"section":"delete-statefulset-v1-apps","subsections":[]},{"section":"replace-statefulset-v1-apps","subsections":[]},{"section":"patch-statefulset-v1-apps","subsections":[]},{"section":"create-statefulset-v1-apps","subsections":[]}]}]},{"section":"replicationcontroller-v1-core","subsections":[{"section":"-strong-misc-operations-replicationcontroller-v1-core-strong-","subsections":[{"section":"patch-scale-replicationcontroller-v1-core","subsections":[]},{"section":"replace-scale-replicationcontroller-v1-core","subsections":[]},{"section":"read-scale-replicationcontroller-v1-core","subsections":[]}]},{"section":"-strong-status-operations-replicationcontroller-v1-core-strong-","subsections":[{"section":"replace-status-replicationcontroller-v1-core","subsections":[]},{"section":"read-status-replicationcontroller-v1-core","subsections":[]},{"section":"patch-status-replicationcontroller-v1-core","subsections":[]}]},{"section":"-strong-read-operations-replicationcontroller-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-replicationcontroller-v1-core","subsections":[]},{"section":"watch-list-replicationcontroller-v1-core","subsections":[]},{"section":"watch-replicationcontroller-v1-core","subsections":[]},{"section":"list-all-namespaces-replicationcontroller-v1-core","subsections":[]},{"section":"list-replicationcontroller-v1-core","subsections":[]},{"section":"read-replicationcontroller-v1-core","subsections":[]}]},{"section":"-strong-write-operations-replicationcontroller-v1-core-strong-","subsections":[{"section":"delete-collection-replicationcontroller-v1-core","subsections":[]},{"section":"delete-replicationcontroller-v1-core","subsections":[]},{"section":"replace-replicationcontroller-v1-core","subsections":[]},{"section":"patch-replicationcontroller-v1-core","subsections":[]},{"section":"create-replicationcontroller-v1-core","subsections":[]}]}]},{"section":"replicaset-v1-apps","subsections":[{"section":"-strong-misc-operations-replicaset-v1-apps-strong-","subsections":[{"section":"patch-scale-replicaset-v1-apps","subsections":[]},{"section":"replace-scale-replicaset-v1-apps","subsections":[]},{"section":"read-scale-replicaset-v1-apps","subsections":[]}]},{"section":"-strong-status-operations-replicaset-v1-apps-strong-","subsections":[{"section":"replace-status-replicaset-v1-apps","subsections":[]},{"section":"read-status-replicaset-v1-apps","subsections":[]},{"section":"patch-status-replicaset-v1-apps","subsections":[]}]},{"section":"-strong-read-operations-replicaset-v1-apps-strong-","subsections":[{"section":"watch-list-all-namespaces-replicaset-v1-apps","subsections":[]},{"section":"watch-list-replicaset-v1-apps","subsections":[]},{"section":"watch-replicaset-v1-apps","subsections":[]},{"section":"list-all-namespaces-replicaset-v1-apps","subsections":[]},{"section":"list-replicaset-v1-apps","subsections":[]},{"section":"read-replicaset-v1-apps","subsections":[]}]},{"section":"-strong-write-operations-replicaset-v1-apps-strong-","subsections":[{"section":"delete-collection-replicaset-v1-apps","subsections":[]},{"section":"delete-replicaset-v1-apps","subsections":[]},{"section":"replace-replicaset-v1-apps","subsections":[]},{"section":"patch-replicaset-v1-apps","subsections":[]},{"section":"create-replicaset-v1-apps","subsections":[]}]}]},{"section":"pod-v1-core","subsections":[{"section":"-strong-misc-operations-pod-v1-core-strong-","subsections":[{"section":"read-log-pod-v1-core","subsections":[]}]},{"section":"-strong-proxy-operations-pod-v1-core-strong-","subsections":[{"section":"replace-connect-proxy-path-pod-v1-core","subsections":[]},{"section":"replace-connect-proxy-pod-v1-core","subsections":[]},{"section":"head-connect-proxy-path-pod-v1-core","subsections":[]},{"section":"head-connect-proxy-pod-v1-core","subsections":[]},{"section":"get-connect-proxy-path-pod-v1-core","subsections":[]},{"section":"get-connect-proxy-pod-v1-core","subsections":[]},{"section":"get-connect-portforward-pod-v1-core","subsections":[]},{"section":"delete-connect-proxy-path-pod-v1-core","subsections":[]},{"section":"delete-connect-proxy-pod-v1-core","subsections":[]},{"section":"create-connect-proxy-path-pod-v1-core","subsections":[]},{"section":"create-connect-proxy-pod-v1-core","subsections":[]},{"section":"create-connect-portforward-pod-v1-core","subsections":[]}]},{"section":"-strong-ephemeralcontainers-operations-pod-v1-core-strong-","subsections":[{"section":"replace-ephemeralcontainers-pod-v1-core","subsections":[]},{"section":"read-ephemeralcontainers-pod-v1-core","subsections":[]},{"section":"patch-ephemeralcontainers-pod-v1-core","subsections":[]}]},{"section":"-strong-status-operations-pod-v1-core-strong-","subsections":[{"section":"replace-status-pod-v1-core","subsections":[]},{"section":"read-status-pod-v1-core","subsections":[]},{"section":"patch-status-pod-v1-core","subsections":[]}]},{"section":"-strong-read-operations-pod-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-pod-v1-core","subsections":[]},{"section":"watch-list-pod-v1-core","subsections":[]},{"section":"watch-pod-v1-core","subsections":[]},{"section":"list-all-namespaces-pod-v1-core","subsections":[]},{"section":"list-pod-v1-core","subsections":[]},{"section":"read-pod-v1-core","subsections":[]}]},{"section":"-strong-write-operations-pod-v1-core-strong-","subsections":[{"section":"delete-collection-pod-v1-core","subsections":[]},{"section":"delete-pod-v1-core","subsections":[]},{"section":"replace-pod-v1-core","subsections":[]},{"section":"patch-pod-v1-core","subsections":[]},{"section":"create-eviction-pod-v1-core","subsections":[]},{"section":"create-pod-v1-core","subsections":[]}]}]},{"section":"job-v1-batch","subsections":[{"section":"-strong-status-operations-job-v1-batch-strong-","subsections":[{"section":"replace-status-job-v1-batch","subsections":[]},{"section":"read-status-job-v1-batch","subsections":[]},{"section":"patch-status-job-v1-batch","subsections":[]}]},{"section":"-strong-read-operations-job-v1-batch-strong-","subsections":[{"section":"watch-list-all-namespaces-job-v1-batch","subsections":[]},{"section":"watch-list-job-v1-batch","subsections":[]},{"section":"watch-job-v1-batch","subsections":[]},{"section":"list-all-namespaces-job-v1-batch","subsections":[]},{"section":"list-job-v1-batch","subsections":[]},{"section":"read-job-v1-batch","subsections":[]}]},{"section":"-strong-write-operations-job-v1-batch-strong-","subsections":[{"section":"delete-collection-job-v1-batch","subsections":[]},{"section":"delete-job-v1-batch","subsections":[]},{"section":"replace-job-v1-batch","subsections":[]},{"section":"patch-job-v1-batch","subsections":[]},{"section":"create-job-v1-batch","subsections":[]}]}]},{"section":"deployment-v1-apps","subsections":[{"section":"-strong-misc-operations-deployment-v1-apps-strong-","subsections":[{"section":"patch-scale-deployment-v1-apps","subsections":[]},{"section":"replace-scale-deployment-v1-apps","subsections":[]},{"section":"read-scale-deployment-v1-apps","subsections":[]}]},{"section":"-strong-status-operations-deployment-v1-apps-strong-","subsections":[{"section":"replace-status-deployment-v1-apps","subsections":[]},{"section":"read-status-deployment-v1-apps","subsections":[]},{"section":"patch-status-deployment-v1-apps","subsections":[]}]},{"section":"-strong-read-operations-deployment-v1-apps-strong-","subsections":[{"section":"watch-list-all-namespaces-deployment-v1-apps","subsections":[]},{"section":"watch-list-deployment-v1-apps","subsections":[]},{"section":"watch-deployment-v1-apps","subsections":[]},{"section":"list-all-namespaces-deployment-v1-apps","subsections":[]},{"section":"list-deployment-v1-apps","subsections":[]},{"section":"read-deployment-v1-apps","subsections":[]}]},{"section":"-strong-write-operations-deployment-v1-apps-strong-","subsections":[{"section":"delete-collection-deployment-v1-apps","subsections":[]},{"section":"delete-deployment-v1-apps","subsections":[]},{"section":"replace-deployment-v1-apps","subsections":[]},{"section":"patch-deployment-v1-apps","subsections":[]},{"section":"create-deployment-v1-apps","subsections":[]}]}]},{"section":"daemonset-v1-apps","subsections":[{"section":"-strong-status-operations-daemonset-v1-apps-strong-","subsections":[{"section":"replace-status-daemonset-v1-apps","subsections":[]},{"section":"read-status-daemonset-v1-apps","subsections":[]},{"section":"patch-status-daemonset-v1-apps","subsections":[]}]},{"section":"-strong-read-operations-daemonset-v1-apps-strong-","subsections":[{"section":"watch-list-all-namespaces-daemonset-v1-apps","subsections":[]},{"section":"watch-list-daemonset-v1-apps","subsections":[]},{"section":"watch-daemonset-v1-apps","subsections":[]},{"section":"list-all-namespaces-daemonset-v1-apps","subsections":[]},{"section":"list-daemonset-v1-apps","subsections":[]},{"section":"read-daemonset-v1-apps","subsections":[]}]},{"section":"-strong-write-operations-daemonset-v1-apps-strong-","subsections":[{"section":"delete-collection-daemonset-v1-apps","subsections":[]},{"section":"delete-daemonset-v1-apps","subsections":[]},{"section":"replace-daemonset-v1-apps","subsections":[]},{"section":"patch-daemonset-v1-apps","subsections":[]},{"section":"create-daemonset-v1-apps","subsections":[]}]}]},{"section":"cronjob-v1-batch","subsections":[{"section":"-strong-status-operations-cronjob-v1-batch-strong-","subsections":[{"section":"replace-status-cronjob-v1-batch","subsections":[]},{"section":"read-status-cronjob-v1-batch","subsections":[]},{"section":"patch-status-cronjob-v1-batch","subsections":[]}]},{"section":"-strong-read-operations-cronjob-v1-batch-strong-","subsections":[{"section":"watch-list-all-namespaces-cronjob-v1-batch","subsections":[]},{"section":"watch-list-cronjob-v1-batch","subsections":[]},{"section":"watch-cronjob-v1-batch","subsections":[]},{"section":"list-all-namespaces-cronjob-v1-batch","subsections":[]},{"section":"list-cronjob-v1-batch","subsections":[]},{"section":"read-cronjob-v1-batch","subsections":[]}]},{"section":"-strong-write-operations-cronjob-v1-batch-strong-","subsections":[{"section":"delete-collection-cronjob-v1-batch","subsections":[]},{"section":"delete-cronjob-v1-batch","subsections":[]},{"section":"replace-cronjob-v1-batch","subsections":[]},{"section":"patch-cronjob-v1-batch","subsections":[]},{"section":"create-cronjob-v1-batch","subsections":[]}]}]},{"section":"container-v1-core","subsections":[]},{"section":"-strong-workloads-apis-strong-","subsections":[]},{"section":"-strong-api-groups-strong-","subsections":[]},{"section":"-strong-api-overview-strong-","subsections":[]}],"flatToc":["webhookclientconfig-v1-apiextensions-k8s-io","volumeerror-v1alpha1-storage-k8s-io","volumeattachmentsource-v1alpha1-storage-k8s-io","watch-list-volumeattachment-v1alpha1-storage-k8s-io","watch-volumeattachment-v1alpha1-storage-k8s-io","list-volumeattachment-v1alpha1-storage-k8s-io","read-volumeattachment-v1alpha1-storage-k8s-io","-strong-read-operations-volumeattachment-v1alpha1-storage-k8s-io-strong-","delete-collection-volumeattachment-v1alpha1-storage-k8s-io","delete-volumeattachment-v1alpha1-storage-k8s-io","replace-volumeattachment-v1alpha1-storage-k8s-io","patch-volumeattachment-v1alpha1-storage-k8s-io","create-volumeattachment-v1alpha1-storage-k8s-io","-strong-write-operations-volumeattachment-v1alpha1-storage-k8s-io-strong-","volumeattachment-v1alpha1-storage-k8s-io","tokenrequest-v1-storage-k8s-io","subject-v1alpha1-rbac-authorization-k8s-io","subject-v1-rbac-authorization-k8s-io","servicereference-v1-apiregistration-k8s-io","servicereference-v1-apiextensions-k8s-io","scheduling-v1alpha1-node-k8s-io","scheduling-v1beta1-node-k8s-io","watch-list-runtimeclass-v1alpha1-node-k8s-io","watch-runtimeclass-v1alpha1-node-k8s-io","list-runtimeclass-v1alpha1-node-k8s-io","read-runtimeclass-v1alpha1-node-k8s-io","-strong-read-operations-runtimeclass-v1alpha1-node-k8s-io-strong-","delete-collection-runtimeclass-v1alpha1-node-k8s-io","delete-runtimeclass-v1alpha1-node-k8s-io","replace-runtimeclass-v1alpha1-node-k8s-io","patch-runtimeclass-v1alpha1-node-k8s-io","create-runtimeclass-v1alpha1-node-k8s-io","-strong-write-operations-runtimeclass-v1alpha1-node-k8s-io-strong-","runtimeclass-v1alpha1-node-k8s-io","watch-list-runtimeclass-v1beta1-node-k8s-io","watch-runtimeclass-v1beta1-node-k8s-io","list-runtimeclass-v1beta1-node-k8s-io","read-runtimeclass-v1beta1-node-k8s-io","-strong-read-operations-runtimeclass-v1beta1-node-k8s-io-strong-","delete-collection-runtimeclass-v1beta1-node-k8s-io","delete-runtimeclass-v1beta1-node-k8s-io","replace-runtimeclass-v1beta1-node-k8s-io","patch-runtimeclass-v1beta1-node-k8s-io","create-runtimeclass-v1beta1-node-k8s-io","-strong-write-operations-runtimeclass-v1beta1-node-k8s-io-strong-","runtimeclass-v1beta1-node-k8s-io","roleref-v1alpha1-rbac-authorization-k8s-io","watch-list-all-namespaces-rolebinding-v1alpha1-rbac-authorization-k8s-io","watch-list-rolebinding-v1alpha1-rbac-authorization-k8s-io","watch-rolebinding-v1alpha1-rbac-authorization-k8s-io","list-all-namespaces-rolebinding-v1alpha1-rbac-authorization-k8s-io","list-rolebinding-v1alpha1-rbac-authorization-k8s-io","read-rolebinding-v1alpha1-rbac-authorization-k8s-io","-strong-read-operations-rolebinding-v1alpha1-rbac-authorization-k8s-io-strong-","delete-collection-rolebinding-v1alpha1-rbac-authorization-k8s-io","delete-rolebinding-v1alpha1-rbac-authorization-k8s-io","replace-rolebinding-v1alpha1-rbac-authorization-k8s-io","patch-rolebinding-v1alpha1-rbac-authorization-k8s-io","create-rolebinding-v1alpha1-rbac-authorization-k8s-io","-strong-write-operations-rolebinding-v1alpha1-rbac-authorization-k8s-io-strong-","rolebinding-v1alpha1-rbac-authorization-k8s-io","watch-list-all-namespaces-role-v1alpha1-rbac-authorization-k8s-io","watch-list-role-v1alpha1-rbac-authorization-k8s-io","watch-role-v1alpha1-rbac-authorization-k8s-io","list-all-namespaces-role-v1alpha1-rbac-authorization-k8s-io","list-role-v1alpha1-rbac-authorization-k8s-io","read-role-v1alpha1-rbac-authorization-k8s-io","-strong-read-operations-role-v1alpha1-rbac-authorization-k8s-io-strong-","delete-collection-role-v1alpha1-rbac-authorization-k8s-io","delete-role-v1alpha1-rbac-authorization-k8s-io","replace-role-v1alpha1-rbac-authorization-k8s-io","patch-role-v1alpha1-rbac-authorization-k8s-io","create-role-v1alpha1-rbac-authorization-k8s-io","-strong-write-operations-role-v1alpha1-rbac-authorization-k8s-io-strong-","role-v1alpha1-rbac-authorization-k8s-io","resourcemetricstatus-v2beta1-autoscaling","resourcemetricsource-v2beta1-autoscaling","watch-list-priorityclass-v1alpha1-scheduling-k8s-io","watch-priorityclass-v1alpha1-scheduling-k8s-io","list-priorityclass-v1alpha1-scheduling-k8s-io","read-priorityclass-v1alpha1-scheduling-k8s-io","-strong-read-operations-priorityclass-v1alpha1-scheduling-k8s-io-strong-","delete-collection-priorityclass-v1alpha1-scheduling-k8s-io","delete-priorityclass-v1alpha1-scheduling-k8s-io","replace-priorityclass-v1alpha1-scheduling-k8s-io","patch-priorityclass-v1alpha1-scheduling-k8s-io","create-priorityclass-v1alpha1-scheduling-k8s-io","-strong-write-operations-priorityclass-v1alpha1-scheduling-k8s-io-strong-","priorityclass-v1alpha1-scheduling-k8s-io","policyrule-v1alpha1-rbac-authorization-k8s-io","podsmetricstatus-v2beta1-autoscaling","podsmetricsource-v2beta1-autoscaling","replace-status-poddisruptionbudget-v1beta1-policy","read-status-poddisruptionbudget-v1beta1-policy","patch-status-poddisruptionbudget-v1beta1-policy","-strong-status-operations-poddisruptionbudget-v1beta1-policy-strong-","watch-list-all-namespaces-poddisruptionbudget-v1beta1-policy","watch-list-poddisruptionbudget-v1beta1-policy","watch-poddisruptionbudget-v1beta1-policy","list-all-namespaces-poddisruptionbudget-v1beta1-policy","list-poddisruptionbudget-v1beta1-policy","read-poddisruptionbudget-v1beta1-policy","-strong-read-operations-poddisruptionbudget-v1beta1-policy-strong-","delete-collection-poddisruptionbudget-v1beta1-policy","delete-poddisruptionbudget-v1beta1-policy","replace-poddisruptionbudget-v1beta1-policy","patch-poddisruptionbudget-v1beta1-policy","create-poddisruptionbudget-v1beta1-policy","-strong-write-operations-poddisruptionbudget-v1beta1-policy-strong-","poddisruptionbudget-v1beta1-policy","overhead-v1alpha1-node-k8s-io","overhead-v1beta1-node-k8s-io","objectmetricstatus-v2beta1-autoscaling","objectmetricsource-v2beta1-autoscaling","metricstatus-v2beta1-autoscaling","metricspec-v2beta1-autoscaling","jobtemplatespec-v1beta1-batch","horizontalpodautoscalercondition-v2beta1-autoscaling","replace-status-horizontalpodautoscaler-v2beta1-autoscaling","read-status-horizontalpodautoscaler-v2beta1-autoscaling","patch-status-horizontalpodautoscaler-v2beta1-autoscaling","-strong-status-operations-horizontalpodautoscaler-v2beta1-autoscaling-strong-","watch-list-all-namespaces-horizontalpodautoscaler-v2beta1-autoscaling","watch-list-horizontalpodautoscaler-v2beta1-autoscaling","watch-horizontalpodautoscaler-v2beta1-autoscaling","list-all-namespaces-horizontalpodautoscaler-v2beta1-autoscaling","list-horizontalpodautoscaler-v2beta1-autoscaling","read-horizontalpodautoscaler-v2beta1-autoscaling","-strong-read-operations-horizontalpodautoscaler-v2beta1-autoscaling-strong-","delete-collection-horizontalpodautoscaler-v2beta1-autoscaling","delete-horizontalpodautoscaler-v2beta1-autoscaling","replace-horizontalpodautoscaler-v2beta1-autoscaling","patch-horizontalpodautoscaler-v2beta1-autoscaling","create-horizontalpodautoscaler-v2beta1-autoscaling","-strong-write-operations-horizontalpodautoscaler-v2beta1-autoscaling-strong-","horizontalpodautoscaler-v2beta1-autoscaling","replace-status-horizontalpodautoscaler-v2beta2-autoscaling","read-status-horizontalpodautoscaler-v2beta2-autoscaling","patch-status-horizontalpodautoscaler-v2beta2-autoscaling","-strong-status-operations-horizontalpodautoscaler-v2beta2-autoscaling-strong-","watch-list-all-namespaces-horizontalpodautoscaler-v2beta2-autoscaling","watch-list-horizontalpodautoscaler-v2beta2-autoscaling","watch-horizontalpodautoscaler-v2beta2-autoscaling","list-all-namespaces-horizontalpodautoscaler-v2beta2-autoscaling","list-horizontalpodautoscaler-v2beta2-autoscaling","read-horizontalpodautoscaler-v2beta2-autoscaling","-strong-read-operations-horizontalpodautoscaler-v2beta2-autoscaling-strong-","delete-collection-horizontalpodautoscaler-v2beta2-autoscaling","delete-horizontalpodautoscaler-v2beta2-autoscaling","replace-horizontalpodautoscaler-v2beta2-autoscaling","patch-horizontalpodautoscaler-v2beta2-autoscaling","create-horizontalpodautoscaler-v2beta2-autoscaling","-strong-write-operations-horizontalpodautoscaler-v2beta2-autoscaling-strong-","horizontalpodautoscaler-v2beta2-autoscaling","forzone-v1beta1-discovery-k8s-io","externalmetricstatus-v2beta1-autoscaling","externalmetricsource-v2beta1-autoscaling","eventseries-v1beta1-events-k8s-io","eventseries-v1-events-k8s-io","watch-list-all-namespaces-event-v1beta1-events-k8s-io","watch-list-event-v1beta1-events-k8s-io","watch-event-v1beta1-events-k8s-io","list-all-namespaces-event-v1beta1-events-k8s-io","list-event-v1beta1-events-k8s-io","read-event-v1beta1-events-k8s-io","-strong-read-operations-event-v1beta1-events-k8s-io-strong-","delete-collection-event-v1beta1-events-k8s-io","delete-event-v1beta1-events-k8s-io","replace-event-v1beta1-events-k8s-io","patch-event-v1beta1-events-k8s-io","create-event-v1beta1-events-k8s-io","-strong-write-operations-event-v1beta1-events-k8s-io-strong-","event-v1beta1-events-k8s-io","watch-list-all-namespaces-event-v1-events-k8s-io","watch-list-event-v1-events-k8s-io","watch-event-v1-events-k8s-io","list-all-namespaces-event-v1-events-k8s-io","list-event-v1-events-k8s-io","read-event-v1-events-k8s-io","-strong-read-operations-event-v1-events-k8s-io-strong-","delete-collection-event-v1-events-k8s-io","delete-event-v1-events-k8s-io","replace-event-v1-events-k8s-io","patch-event-v1-events-k8s-io","create-event-v1-events-k8s-io","-strong-write-operations-event-v1-events-k8s-io-strong-","event-v1-events-k8s-io","watch-list-all-namespaces-endpointslice-v1beta1-discovery-k8s-io","watch-list-endpointslice-v1beta1-discovery-k8s-io","watch-endpointslice-v1beta1-discovery-k8s-io","list-all-namespaces-endpointslice-v1beta1-discovery-k8s-io","list-endpointslice-v1beta1-discovery-k8s-io","read-endpointslice-v1beta1-discovery-k8s-io","-strong-read-operations-endpointslice-v1beta1-discovery-k8s-io-strong-","delete-collection-endpointslice-v1beta1-discovery-k8s-io","delete-endpointslice-v1beta1-discovery-k8s-io","replace-endpointslice-v1beta1-discovery-k8s-io","patch-endpointslice-v1beta1-discovery-k8s-io","create-endpointslice-v1beta1-discovery-k8s-io","-strong-write-operations-endpointslice-v1beta1-discovery-k8s-io-strong-","endpointslice-v1beta1-discovery-k8s-io","endpointport-v1beta1-discovery-k8s-io","endpointport-v1-discovery-k8s-io","endpointhints-v1beta1-discovery-k8s-io","endpointconditions-v1beta1-discovery-k8s-io","endpoint-v1beta1-discovery-k8s-io","crossversionobjectreference-v2beta1-autoscaling","crossversionobjectreference-v2beta2-autoscaling","replace-status-cronjob-v1beta1-batch","read-status-cronjob-v1beta1-batch","patch-status-cronjob-v1beta1-batch","-strong-status-operations-cronjob-v1beta1-batch-strong-","watch-list-all-namespaces-cronjob-v1beta1-batch","watch-list-cronjob-v1beta1-batch","watch-cronjob-v1beta1-batch","list-all-namespaces-cronjob-v1beta1-batch","list-cronjob-v1beta1-batch","read-cronjob-v1beta1-batch","-strong-read-operations-cronjob-v1beta1-batch-strong-","delete-collection-cronjob-v1beta1-batch","delete-cronjob-v1beta1-batch","replace-cronjob-v1beta1-batch","patch-cronjob-v1beta1-batch","create-cronjob-v1beta1-batch","-strong-write-operations-cronjob-v1beta1-batch-strong-","cronjob-v1beta1-batch","containerresourcemetricstatus-v2beta1-autoscaling","containerresourcemetricsource-v2beta1-autoscaling","watch-list-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","watch-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","list-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","read-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","-strong-read-operations-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io-strong-","delete-collection-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","delete-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","replace-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","patch-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","create-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","-strong-write-operations-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io-strong-","clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","watch-list-clusterrole-v1alpha1-rbac-authorization-k8s-io","watch-clusterrole-v1alpha1-rbac-authorization-k8s-io","list-clusterrole-v1alpha1-rbac-authorization-k8s-io","read-clusterrole-v1alpha1-rbac-authorization-k8s-io","-strong-read-operations-clusterrole-v1alpha1-rbac-authorization-k8s-io-strong-","delete-collection-clusterrole-v1alpha1-rbac-authorization-k8s-io","delete-clusterrole-v1alpha1-rbac-authorization-k8s-io","replace-clusterrole-v1alpha1-rbac-authorization-k8s-io","patch-clusterrole-v1alpha1-rbac-authorization-k8s-io","create-clusterrole-v1alpha1-rbac-authorization-k8s-io","-strong-write-operations-clusterrole-v1alpha1-rbac-authorization-k8s-io-strong-","clusterrole-v1alpha1-rbac-authorization-k8s-io","watch-list-all-namespaces-csistoragecapacity-v1alpha1-storage-k8s-io","watch-list-csistoragecapacity-v1alpha1-storage-k8s-io","watch-csistoragecapacity-v1alpha1-storage-k8s-io","list-all-namespaces-csistoragecapacity-v1alpha1-storage-k8s-io","list-csistoragecapacity-v1alpha1-storage-k8s-io","read-csistoragecapacity-v1alpha1-storage-k8s-io","-strong-read-operations-csistoragecapacity-v1alpha1-storage-k8s-io-strong-","delete-collection-csistoragecapacity-v1alpha1-storage-k8s-io","delete-csistoragecapacity-v1alpha1-storage-k8s-io","replace-csistoragecapacity-v1alpha1-storage-k8s-io","patch-csistoragecapacity-v1alpha1-storage-k8s-io","create-csistoragecapacity-v1alpha1-storage-k8s-io","-strong-write-operations-csistoragecapacity-v1alpha1-storage-k8s-io-strong-","csistoragecapacity-v1alpha1-storage-k8s-io","aggregationrule-v1alpha1-rbac-authorization-k8s-io","-strong-old-api-versions-strong-","windowssecuritycontextoptions-v1-core","weightedpodaffinityterm-v1-core","webhookconversion-v1-apiextensions-k8s-io","webhookclientconfig-v1-admissionregistration-k8s-io","watchevent-v1-meta","vspherevirtualdiskvolumesource-v1-core","volumeprojection-v1-core","volumenoderesources-v1-storage-k8s-io","volumenodeaffinity-v1-core","volumemount-v1-core","volumeerror-v1-storage-k8s-io","volumedevice-v1-core","volumeattachmentsource-v1-storage-k8s-io","validatingwebhook-v1-admissionregistration-k8s-io","usersubject-v1beta1-flowcontrol-apiserver-k8s-io","userinfo-v1-authentication-k8s-io","uncountedterminatedpods-v1-batch","typedlocalobjectreference-v1-core","topologyspreadconstraint-v1-core","topologyselectorterm-v1-core","topologyselectorlabelrequirement-v1-core","toleration-v1-core","time-v1-meta","taint-v1-core","tcpsocketaction-v1-core","sysctl-v1-core","supplementalgroupsstrategyoptions-v1beta1-policy","subjectrulesreviewstatus-v1-authorization-k8s-io","subject-v1beta1-flowcontrol-apiserver-k8s-io","storageversioncondition-v1alpha1-internal-apiserver-k8s-io","storageosvolumesource-v1-core","storageospersistentvolumesource-v1-core","statusdetails-v1-meta","statuscause-v1-meta","status-v1-meta","statefulsetupdatestrategy-v1-apps","statefulsetcondition-v1-apps","sessionaffinityconfig-v1-core","servicereference-v1-admissionregistration-k8s-io","serviceport-v1-core","servicebackendport-v1-networking-k8s-io","serviceaccounttokenprojection-v1-core","serviceaccountsubject-v1beta1-flowcontrol-apiserver-k8s-io","serverstorageversion-v1alpha1-internal-apiserver-k8s-io","serveraddressbyclientcidr-v1-meta","securitycontext-v1-core","secretvolumesource-v1-core","secretreference-v1-core","secretprojection-v1-core","secretkeyselector-v1-core","secretenvsource-v1-core","seccompprofile-v1-core","scopedresourceselectorrequirement-v1-core","scopeselector-v1-core","scheduling-v1-node-k8s-io","scaleiovolumesource-v1-core","scaleiopersistentvolumesource-v1-core","scale-v1-autoscaling","selinuxstrategyoptions-v1beta1-policy","selinuxoptions-v1-core","runtimeclassstrategyoptions-v1beta1-policy","runasuserstrategyoptions-v1beta1-policy","runasgroupstrategyoptions-v1beta1-policy","rulewithoperations-v1-admissionregistration-k8s-io","rollingupdatestatefulsetstrategy-v1-apps","roleref-v1-rbac-authorization-k8s-io","resourcerule-v1-authorization-k8s-io","resourcerequirements-v1-core","resourcepolicyrule-v1beta1-flowcontrol-apiserver-k8s-io","resourcemetricstatus-v2beta2-autoscaling","resourcemetricsource-v2beta2-autoscaling","resourcefieldselector-v1-core","resourceattributes-v1-authorization-k8s-io","replicationcontrollercondition-v1-core","replicasetcondition-v1-apps","rbdvolumesource-v1-core","rbdpersistentvolumesource-v1-core","quobytevolumesource-v1-core","queuingconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","quantity-resource-core","projectedvolumesource-v1-core","probe-v1-core","prioritylevelconfigurationreference-v1beta1-flowcontrol-apiserver-k8s-io","prioritylevelconfigurationcondition-v1beta1-flowcontrol-apiserver-k8s-io","preferredschedulingterm-v1-core","preconditions-v1-meta","portworxvolumesource-v1-core","portstatus-v1-core","policyruleswithsubjects-v1beta1-flowcontrol-apiserver-k8s-io","policyrule-v1-rbac-authorization-k8s-io","podsmetricstatus-v2beta2-autoscaling","podsmetricsource-v2beta2-autoscaling","podsecuritycontext-v1-core","podreadinessgate-v1-core","podip-v1-core","poddnsconfigoption-v1-core","poddnsconfig-v1-core","podcondition-v1-core","podantiaffinity-v1-core","podaffinityterm-v1-core","podaffinity-v1-core","photonpersistentdiskvolumesource-v1-core","persistentvolumeclaimvolumesource-v1-core","persistentvolumeclaimtemplate-v1-core","persistentvolumeclaimcondition-v1-core","patch-v1-meta","ownerreference-v1-meta","overhead-v1-node-k8s-io","objectreference-v1-core","objectmetricstatus-v2beta2-autoscaling","objectmetricsource-v2beta2-autoscaling","objectmeta-v1-meta","objectfieldselector-v1-core","nonresourcerule-v1-authorization-k8s-io","nonresourcepolicyrule-v1beta1-flowcontrol-apiserver-k8s-io","nonresourceattributes-v1-authorization-k8s-io","nodesysteminfo-v1-core","nodeselectorterm-v1-core","nodeselectorrequirement-v1-core","nodeselector-v1-core","nodedaemonendpoints-v1-core","nodeconfigstatus-v1-core","nodeconfigsource-v1-core","nodecondition-v1-core","nodeaffinity-v1-core","nodeaddress-v1-core","networkpolicyport-v1-networking-k8s-io","networkpolicypeer-v1-networking-k8s-io","networkpolicyingressrule-v1-networking-k8s-io","networkpolicyegressrule-v1-networking-k8s-io","namespacecondition-v1-core","nfsvolumesource-v1-core","mutatingwebhook-v1-admissionregistration-k8s-io","microtime-v1-meta","metricvaluestatus-v2beta2-autoscaling","metrictarget-v2beta2-autoscaling","metricstatus-v2beta2-autoscaling","metricspec-v2beta2-autoscaling","metricidentifier-v2beta2-autoscaling","managedfieldsentry-v1-meta","localvolumesource-v1-core","localobjectreference-v1-core","loadbalancerstatus-v1-core","loadbalanceringress-v1-core","listmeta-v1-meta","limitedprioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","limitresponse-v1beta1-flowcontrol-apiserver-k8s-io","limitrangeitem-v1-core","lifecycle-v1-core","labelselectorrequirement-v1-meta","labelselector-v1-meta","keytopath-v1-core","jobtemplatespec-v1-batch","jobcondition-v1-batch","jsonschemapropsorbool-v1-apiextensions-k8s-io","jsonschemapropsorarray-v1-apiextensions-k8s-io","jsonschemaprops-v1-apiextensions-k8s-io","json-v1-apiextensions-k8s-io","ingresstls-v1-networking-k8s-io","ingressservicebackend-v1-networking-k8s-io","ingressrule-v1-networking-k8s-io","ingressclassparametersreference-v1-networking-k8s-io","ingressbackend-v1-networking-k8s-io","iscsivolumesource-v1-core","iscsipersistentvolumesource-v1-core","ipblock-v1-networking-k8s-io","idrange-v1beta1-policy","hostportrange-v1beta1-policy","hostpathvolumesource-v1-core","hostalias-v1-core","horizontalpodautoscalercondition-v2beta2-autoscaling","horizontalpodautoscalerbehavior-v2beta2-autoscaling","handler-v1-core","httpingressrulevalue-v1-networking-k8s-io","httpingresspath-v1-networking-k8s-io","httpheader-v1-core","httpgetaction-v1-core","hpascalingrules-v2beta2-autoscaling","hpascalingpolicy-v2beta2-autoscaling","groupversionfordiscovery-v1-meta","groupsubject-v1beta1-flowcontrol-apiserver-k8s-io","glusterfsvolumesource-v1-core","glusterfspersistentvolumesource-v1-core","gitrepovolumesource-v1-core","gcepersistentdiskvolumesource-v1-core","forzone-v1-discovery-k8s-io","flowschemacondition-v1beta1-flowcontrol-apiserver-k8s-io","flowdistinguishermethod-v1beta1-flowcontrol-apiserver-k8s-io","flockervolumesource-v1-core","flexvolumesource-v1-core","flexpersistentvolumesource-v1-core","fieldsv1-v1-meta","fsgroupstrategyoptions-v1beta1-policy","fcvolumesource-v1-core","externalmetricstatus-v2beta2-autoscaling","externalmetricsource-v2beta2-autoscaling","externaldocumentation-v1-apiextensions-k8s-io","execaction-v1-core","eviction-v1-policy","eventsource-v1-core","eventseries-v1-core","ephemeralvolumesource-v1-core","ephemeralcontainer-v1-core","envvarsource-v1-core","envvar-v1-core","envfromsource-v1-core","endpointsubset-v1-core","endpointport-v1-core","endpointhints-v1-discovery-k8s-io","endpointconditions-v1-discovery-k8s-io","endpointaddress-v1-core","endpoint-v1-discovery-k8s-io","emptydirvolumesource-v1-core","downwardapivolumesource-v1-core","downwardapivolumefile-v1-core","downwardapiprojection-v1-core","deploymentcondition-v1-apps","deleteoptions-v1-meta","daemonsetupdatestrategy-v1-apps","daemonsetcondition-v1-apps","daemonendpoint-v1-core","customresourcevalidation-v1-apiextensions-k8s-io","customresourcesubresources-v1-apiextensions-k8s-io","customresourcesubresourcestatus-v1-apiextensions-k8s-io","customresourcesubresourcescale-v1-apiextensions-k8s-io","customresourcedefinitionversion-v1-apiextensions-k8s-io","customresourcedefinitionnames-v1-apiextensions-k8s-io","customresourcedefinitioncondition-v1-apiextensions-k8s-io","customresourceconversion-v1-apiextensions-k8s-io","customresourcecolumndefinition-v1-apiextensions-k8s-io","crossversionobjectreference-v1-autoscaling","containerstatewaiting-v1-core","containerstateterminated-v1-core","containerstaterunning-v1-core","containerstate-v1-core","containerresourcemetricstatus-v2beta2-autoscaling","containerresourcemetricsource-v2beta2-autoscaling","containerport-v1-core","containerimage-v1-core","configmapvolumesource-v1-core","configmapprojection-v1-core","configmapnodeconfigsource-v1-core","configmapkeyselector-v1-core","configmapenvsource-v1-core","condition-v1-meta","componentcondition-v1-core","clientipconfig-v1-core","cindervolumesource-v1-core","cinderpersistentvolumesource-v1-core","certificatesigningrequestcondition-v1-certificates-k8s-io","cephfsvolumesource-v1-core","cephfspersistentvolumesource-v1-core","capabilities-v1-core","csivolumesource-v1-core","csipersistentvolumesource-v1-core","csinodedriver-v1-storage-k8s-io","boundobjectreference-v1-authentication-k8s-io","azurefilevolumesource-v1-core","azurefilepersistentvolumesource-v1-core","azurediskvolumesource-v1-core","attachedvolume-v1-core","allowedhostpath-v1beta1-policy","allowedflexvolume-v1beta1-policy","allowedcsidriver-v1beta1-policy","aggregationrule-v1-rbac-authorization-k8s-io","affinity-v1-core","awselasticblockstorevolumesource-v1-core","apiversions-v1-meta","apiservicecondition-v1-apiregistration-k8s-io","apiresource-v1-meta","apigroup-v1-meta","-strong-definitions-strong-","watch-list-all-namespaces-networkpolicy-v1-networking-k8s-io","watch-list-networkpolicy-v1-networking-k8s-io","watch-networkpolicy-v1-networking-k8s-io","list-all-namespaces-networkpolicy-v1-networking-k8s-io","list-networkpolicy-v1-networking-k8s-io","read-networkpolicy-v1-networking-k8s-io","-strong-read-operations-networkpolicy-v1-networking-k8s-io-strong-","delete-collection-networkpolicy-v1-networking-k8s-io","delete-networkpolicy-v1-networking-k8s-io","replace-networkpolicy-v1-networking-k8s-io","patch-networkpolicy-v1-networking-k8s-io","create-networkpolicy-v1-networking-k8s-io","-strong-write-operations-networkpolicy-v1-networking-k8s-io-strong-","networkpolicy-v1-networking-k8s-io","create-tokenreview-v1-authentication-k8s-io","-strong-write-operations-tokenreview-v1-authentication-k8s-io-strong-","tokenreview-v1-authentication-k8s-io","tokenrequest-v1-authentication-k8s-io","create-subjectaccessreview-v1-authorization-k8s-io","-strong-write-operations-subjectaccessreview-v1-authorization-k8s-io-strong-","subjectaccessreview-v1-authorization-k8s-io","replace-status-storageversion-v1alpha1-internal-apiserver-k8s-io","read-status-storageversion-v1alpha1-internal-apiserver-k8s-io","patch-status-storageversion-v1alpha1-internal-apiserver-k8s-io","-strong-status-operations-storageversion-v1alpha1-internal-apiserver-k8s-io-strong-","watch-list-storageversion-v1alpha1-internal-apiserver-k8s-io","watch-storageversion-v1alpha1-internal-apiserver-k8s-io","list-storageversion-v1alpha1-internal-apiserver-k8s-io","read-storageversion-v1alpha1-internal-apiserver-k8s-io","-strong-read-operations-storageversion-v1alpha1-internal-apiserver-k8s-io-strong-","delete-collection-storageversion-v1alpha1-internal-apiserver-k8s-io","delete-storageversion-v1alpha1-internal-apiserver-k8s-io","replace-storageversion-v1alpha1-internal-apiserver-k8s-io","patch-storageversion-v1alpha1-internal-apiserver-k8s-io","create-storageversion-v1alpha1-internal-apiserver-k8s-io","-strong-write-operations-storageversion-v1alpha1-internal-apiserver-k8s-io-strong-","storageversion-v1alpha1-internal-apiserver-k8s-io","watch-list-all-namespaces-serviceaccount-v1-core","watch-list-serviceaccount-v1-core","watch-serviceaccount-v1-core","list-all-namespaces-serviceaccount-v1-core","list-serviceaccount-v1-core","read-serviceaccount-v1-core","-strong-read-operations-serviceaccount-v1-core-strong-","delete-collection-serviceaccount-v1-core","delete-serviceaccount-v1-core","replace-serviceaccount-v1-core","patch-serviceaccount-v1-core","create-serviceaccount-v1-core","-strong-write-operations-serviceaccount-v1-core-strong-","serviceaccount-v1-core","create-selfsubjectrulesreview-v1-authorization-k8s-io","-strong-write-operations-selfsubjectrulesreview-v1-authorization-k8s-io-strong-","selfsubjectrulesreview-v1-authorization-k8s-io","create-selfsubjectaccessreview-v1-authorization-k8s-io","-strong-write-operations-selfsubjectaccessreview-v1-authorization-k8s-io-strong-","selfsubjectaccessreview-v1-authorization-k8s-io","watch-list-runtimeclass-v1-node-k8s-io","watch-runtimeclass-v1-node-k8s-io","list-runtimeclass-v1-node-k8s-io","read-runtimeclass-v1-node-k8s-io","-strong-read-operations-runtimeclass-v1-node-k8s-io-strong-","delete-collection-runtimeclass-v1-node-k8s-io","delete-runtimeclass-v1-node-k8s-io","replace-runtimeclass-v1-node-k8s-io","patch-runtimeclass-v1-node-k8s-io","create-runtimeclass-v1-node-k8s-io","-strong-write-operations-runtimeclass-v1-node-k8s-io-strong-","runtimeclass-v1-node-k8s-io","watch-list-all-namespaces-rolebinding-v1-rbac-authorization-k8s-io","watch-list-rolebinding-v1-rbac-authorization-k8s-io","watch-rolebinding-v1-rbac-authorization-k8s-io","list-all-namespaces-rolebinding-v1-rbac-authorization-k8s-io","list-rolebinding-v1-rbac-authorization-k8s-io","read-rolebinding-v1-rbac-authorization-k8s-io","-strong-read-operations-rolebinding-v1-rbac-authorization-k8s-io-strong-","delete-collection-rolebinding-v1-rbac-authorization-k8s-io","delete-rolebinding-v1-rbac-authorization-k8s-io","replace-rolebinding-v1-rbac-authorization-k8s-io","patch-rolebinding-v1-rbac-authorization-k8s-io","create-rolebinding-v1-rbac-authorization-k8s-io","-strong-write-operations-rolebinding-v1-rbac-authorization-k8s-io-strong-","rolebinding-v1-rbac-authorization-k8s-io","watch-list-all-namespaces-role-v1-rbac-authorization-k8s-io","watch-list-role-v1-rbac-authorization-k8s-io","watch-role-v1-rbac-authorization-k8s-io","list-all-namespaces-role-v1-rbac-authorization-k8s-io","list-role-v1-rbac-authorization-k8s-io","read-role-v1-rbac-authorization-k8s-io","-strong-read-operations-role-v1-rbac-authorization-k8s-io-strong-","delete-collection-role-v1-rbac-authorization-k8s-io","delete-role-v1-rbac-authorization-k8s-io","replace-role-v1-rbac-authorization-k8s-io","patch-role-v1-rbac-authorization-k8s-io","create-role-v1-rbac-authorization-k8s-io","-strong-write-operations-role-v1-rbac-authorization-k8s-io-strong-","role-v1-rbac-authorization-k8s-io","replace-status-resourcequota-v1-core","read-status-resourcequota-v1-core","patch-status-resourcequota-v1-core","-strong-status-operations-resourcequota-v1-core-strong-","watch-list-all-namespaces-resourcequota-v1-core","watch-list-resourcequota-v1-core","watch-resourcequota-v1-core","list-all-namespaces-resourcequota-v1-core","list-resourcequota-v1-core","read-resourcequota-v1-core","-strong-read-operations-resourcequota-v1-core-strong-","delete-collection-resourcequota-v1-core","delete-resourcequota-v1-core","replace-resourcequota-v1-core","patch-resourcequota-v1-core","create-resourcequota-v1-core","-strong-write-operations-resourcequota-v1-core-strong-","resourcequota-v1-core","replace-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","read-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","patch-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","-strong-status-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","watch-list-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","watch-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","list-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","read-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","-strong-read-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","delete-collection-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","delete-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","replace-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","patch-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","create-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","-strong-write-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","replace-status-persistentvolume-v1-core","read-status-persistentvolume-v1-core","patch-status-persistentvolume-v1-core","-strong-status-operations-persistentvolume-v1-core-strong-","watch-list-persistentvolume-v1-core","watch-persistentvolume-v1-core","list-persistentvolume-v1-core","read-persistentvolume-v1-core","-strong-read-operations-persistentvolume-v1-core-strong-","delete-collection-persistentvolume-v1-core","delete-persistentvolume-v1-core","replace-persistentvolume-v1-core","patch-persistentvolume-v1-core","create-persistentvolume-v1-core","-strong-write-operations-persistentvolume-v1-core-strong-","persistentvolume-v1-core","replace-connect-proxy-path-node-v1-core","replace-connect-proxy-node-v1-core","head-connect-proxy-path-node-v1-core","head-connect-proxy-node-v1-core","get-connect-proxy-path-node-v1-core","get-connect-proxy-node-v1-core","delete-connect-proxy-path-node-v1-core","delete-connect-proxy-node-v1-core","create-connect-proxy-path-node-v1-core","create-connect-proxy-node-v1-core","-strong-proxy-operations-node-v1-core-strong-","replace-status-node-v1-core","read-status-node-v1-core","patch-status-node-v1-core","-strong-status-operations-node-v1-core-strong-","watch-list-node-v1-core","watch-node-v1-core","list-node-v1-core","read-node-v1-core","-strong-read-operations-node-v1-core-strong-","delete-collection-node-v1-core","delete-node-v1-core","replace-node-v1-core","patch-node-v1-core","create-node-v1-core","-strong-write-operations-node-v1-core-strong-","node-v1-core","replace-status-namespace-v1-core","read-status-namespace-v1-core","patch-status-namespace-v1-core","-strong-status-operations-namespace-v1-core-strong-","watch-list-namespace-v1-core","watch-namespace-v1-core","list-namespace-v1-core","read-namespace-v1-core","-strong-read-operations-namespace-v1-core-strong-","delete-namespace-v1-core","replace-namespace-v1-core","patch-namespace-v1-core","create-namespace-v1-core","-strong-write-operations-namespace-v1-core-strong-","namespace-v1-core","create-localsubjectaccessreview-v1-authorization-k8s-io","-strong-write-operations-localsubjectaccessreview-v1-authorization-k8s-io-strong-","localsubjectaccessreview-v1-authorization-k8s-io","watch-list-all-namespaces-lease-v1-coordination-k8s-io","watch-list-lease-v1-coordination-k8s-io","watch-lease-v1-coordination-k8s-io","list-all-namespaces-lease-v1-coordination-k8s-io","list-lease-v1-coordination-k8s-io","read-lease-v1-coordination-k8s-io","-strong-read-operations-lease-v1-coordination-k8s-io-strong-","delete-collection-lease-v1-coordination-k8s-io","delete-lease-v1-coordination-k8s-io","replace-lease-v1-coordination-k8s-io","patch-lease-v1-coordination-k8s-io","create-lease-v1-coordination-k8s-io","-strong-write-operations-lease-v1-coordination-k8s-io-strong-","lease-v1-coordination-k8s-io","replace-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","read-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","patch-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","-strong-status-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","watch-list-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","watch-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","list-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","read-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","-strong-read-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","delete-collection-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","delete-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","replace-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","patch-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","create-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","-strong-write-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","flowschema-v1beta1-flowcontrol-apiserver-k8s-io","list-componentstatus-v1-core","read-componentstatus-v1-core","-strong-read-operations-componentstatus-v1-core-strong-","componentstatus-v1-core","watch-list-clusterrolebinding-v1-rbac-authorization-k8s-io","watch-clusterrolebinding-v1-rbac-authorization-k8s-io","list-clusterrolebinding-v1-rbac-authorization-k8s-io","read-clusterrolebinding-v1-rbac-authorization-k8s-io","-strong-read-operations-clusterrolebinding-v1-rbac-authorization-k8s-io-strong-","delete-collection-clusterrolebinding-v1-rbac-authorization-k8s-io","delete-clusterrolebinding-v1-rbac-authorization-k8s-io","replace-clusterrolebinding-v1-rbac-authorization-k8s-io","patch-clusterrolebinding-v1-rbac-authorization-k8s-io","create-clusterrolebinding-v1-rbac-authorization-k8s-io","-strong-write-operations-clusterrolebinding-v1-rbac-authorization-k8s-io-strong-","clusterrolebinding-v1-rbac-authorization-k8s-io","watch-list-clusterrole-v1-rbac-authorization-k8s-io","watch-clusterrole-v1-rbac-authorization-k8s-io","list-clusterrole-v1-rbac-authorization-k8s-io","read-clusterrole-v1-rbac-authorization-k8s-io","-strong-read-operations-clusterrole-v1-rbac-authorization-k8s-io-strong-","delete-collection-clusterrole-v1-rbac-authorization-k8s-io","delete-clusterrole-v1-rbac-authorization-k8s-io","replace-clusterrole-v1-rbac-authorization-k8s-io","patch-clusterrole-v1-rbac-authorization-k8s-io","create-clusterrole-v1-rbac-authorization-k8s-io","-strong-write-operations-clusterrole-v1-rbac-authorization-k8s-io-strong-","clusterrole-v1-rbac-authorization-k8s-io","replace-status-certificatesigningrequest-v1-certificates-k8s-io","read-status-certificatesigningrequest-v1-certificates-k8s-io","patch-status-certificatesigningrequest-v1-certificates-k8s-io","-strong-status-operations-certificatesigningrequest-v1-certificates-k8s-io-strong-","watch-list-certificatesigningrequest-v1-certificates-k8s-io","watch-certificatesigningrequest-v1-certificates-k8s-io","list-certificatesigningrequest-v1-certificates-k8s-io","read-certificatesigningrequest-v1-certificates-k8s-io","-strong-read-operations-certificatesigningrequest-v1-certificates-k8s-io-strong-","delete-collection-certificatesigningrequest-v1-certificates-k8s-io","delete-certificatesigningrequest-v1-certificates-k8s-io","replace-certificatesigningrequest-v1-certificates-k8s-io","patch-certificatesigningrequest-v1-certificates-k8s-io","create-certificatesigningrequest-v1-certificates-k8s-io","-strong-write-operations-certificatesigningrequest-v1-certificates-k8s-io-strong-","certificatesigningrequest-v1-certificates-k8s-io","create-binding-v1-core","-strong-write-operations-binding-v1-core-strong-","binding-v1-core","replace-status-apiservice-v1-apiregistration-k8s-io","read-status-apiservice-v1-apiregistration-k8s-io","patch-status-apiservice-v1-apiregistration-k8s-io","-strong-status-operations-apiservice-v1-apiregistration-k8s-io-strong-","watch-list-apiservice-v1-apiregistration-k8s-io","watch-apiservice-v1-apiregistration-k8s-io","list-apiservice-v1-apiregistration-k8s-io","read-apiservice-v1-apiregistration-k8s-io","-strong-read-operations-apiservice-v1-apiregistration-k8s-io-strong-","delete-collection-apiservice-v1-apiregistration-k8s-io","delete-apiservice-v1-apiregistration-k8s-io","replace-apiservice-v1-apiregistration-k8s-io","patch-apiservice-v1-apiregistration-k8s-io","create-apiservice-v1-apiregistration-k8s-io","-strong-write-operations-apiservice-v1-apiregistration-k8s-io-strong-","apiservice-v1-apiregistration-k8s-io","-strong-cluster-apis-strong-","watch-list-podsecuritypolicy-v1beta1-policy","watch-podsecuritypolicy-v1beta1-policy","list-podsecuritypolicy-v1beta1-policy","read-podsecuritypolicy-v1beta1-policy","-strong-read-operations-podsecuritypolicy-v1beta1-policy-strong-","delete-collection-podsecuritypolicy-v1beta1-policy","delete-podsecuritypolicy-v1beta1-policy","replace-podsecuritypolicy-v1beta1-policy","patch-podsecuritypolicy-v1beta1-policy","create-podsecuritypolicy-v1beta1-policy","-strong-write-operations-podsecuritypolicy-v1beta1-policy-strong-","podsecuritypolicy-v1beta1-policy","watch-list-priorityclass-v1-scheduling-k8s-io","watch-priorityclass-v1-scheduling-k8s-io","list-priorityclass-v1-scheduling-k8s-io","read-priorityclass-v1-scheduling-k8s-io","-strong-read-operations-priorityclass-v1-scheduling-k8s-io-strong-","delete-collection-priorityclass-v1-scheduling-k8s-io","delete-priorityclass-v1-scheduling-k8s-io","replace-priorityclass-v1-scheduling-k8s-io","patch-priorityclass-v1-scheduling-k8s-io","create-priorityclass-v1-scheduling-k8s-io","-strong-write-operations-priorityclass-v1-scheduling-k8s-io-strong-","priorityclass-v1-scheduling-k8s-io","replace-status-poddisruptionbudget-v1-policy","read-status-poddisruptionbudget-v1-policy","patch-status-poddisruptionbudget-v1-policy","-strong-status-operations-poddisruptionbudget-v1-policy-strong-","watch-list-all-namespaces-poddisruptionbudget-v1-policy","watch-list-poddisruptionbudget-v1-policy","watch-poddisruptionbudget-v1-policy","list-all-namespaces-poddisruptionbudget-v1-policy","list-poddisruptionbudget-v1-policy","read-poddisruptionbudget-v1-policy","-strong-read-operations-poddisruptionbudget-v1-policy-strong-","delete-collection-poddisruptionbudget-v1-policy","delete-poddisruptionbudget-v1-policy","replace-poddisruptionbudget-v1-policy","patch-poddisruptionbudget-v1-policy","create-poddisruptionbudget-v1-policy","-strong-write-operations-poddisruptionbudget-v1-policy-strong-","poddisruptionbudget-v1-policy","watch-list-all-namespaces-podtemplate-v1-core","watch-list-podtemplate-v1-core","watch-podtemplate-v1-core","list-all-namespaces-podtemplate-v1-core","list-podtemplate-v1-core","read-podtemplate-v1-core","-strong-read-operations-podtemplate-v1-core-strong-","delete-collection-podtemplate-v1-core","delete-podtemplate-v1-core","replace-podtemplate-v1-core","patch-podtemplate-v1-core","create-podtemplate-v1-core","-strong-write-operations-podtemplate-v1-core-strong-","podtemplate-v1-core","watch-list-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","watch-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","list-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","read-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","-strong-read-operations-validatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","delete-collection-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","delete-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","replace-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","patch-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","create-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","-strong-write-operations-validatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","validatingwebhookconfiguration-v1-admissionregistration-k8s-io","watch-list-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","watch-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","list-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","read-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","-strong-read-operations-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","delete-collection-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","delete-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","replace-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","patch-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","create-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","-strong-write-operations-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","replace-status-horizontalpodautoscaler-v1-autoscaling","read-status-horizontalpodautoscaler-v1-autoscaling","patch-status-horizontalpodautoscaler-v1-autoscaling","-strong-status-operations-horizontalpodautoscaler-v1-autoscaling-strong-","watch-list-all-namespaces-horizontalpodautoscaler-v1-autoscaling","watch-list-horizontalpodautoscaler-v1-autoscaling","watch-horizontalpodautoscaler-v1-autoscaling","list-all-namespaces-horizontalpodautoscaler-v1-autoscaling","list-horizontalpodautoscaler-v1-autoscaling","read-horizontalpodautoscaler-v1-autoscaling","-strong-read-operations-horizontalpodautoscaler-v1-autoscaling-strong-","delete-collection-horizontalpodautoscaler-v1-autoscaling","delete-horizontalpodautoscaler-v1-autoscaling","replace-horizontalpodautoscaler-v1-autoscaling","patch-horizontalpodautoscaler-v1-autoscaling","create-horizontalpodautoscaler-v1-autoscaling","-strong-write-operations-horizontalpodautoscaler-v1-autoscaling-strong-","horizontalpodautoscaler-v1-autoscaling","watch-list-all-namespaces-limitrange-v1-core","watch-list-limitrange-v1-core","watch-limitrange-v1-core","list-all-namespaces-limitrange-v1-core","list-limitrange-v1-core","read-limitrange-v1-core","-strong-read-operations-limitrange-v1-core-strong-","delete-collection-limitrange-v1-core","delete-limitrange-v1-core","replace-limitrange-v1-core","patch-limitrange-v1-core","create-limitrange-v1-core","-strong-write-operations-limitrange-v1-core-strong-","limitrange-v1-core","watch-list-all-namespaces-event-v1-core","watch-list-event-v1-core","watch-event-v1-core","list-all-namespaces-event-v1-core","list-event-v1-core","read-event-v1-core","-strong-read-operations-event-v1-core-strong-","delete-collection-event-v1-core","delete-event-v1-core","replace-event-v1-core","patch-event-v1-core","create-event-v1-core","-strong-write-operations-event-v1-core-strong-","event-v1-core","replace-status-customresourcedefinition-v1-apiextensions-k8s-io","read-status-customresourcedefinition-v1-apiextensions-k8s-io","patch-status-customresourcedefinition-v1-apiextensions-k8s-io","-strong-status-operations-customresourcedefinition-v1-apiextensions-k8s-io-strong-","watch-list-customresourcedefinition-v1-apiextensions-k8s-io","watch-customresourcedefinition-v1-apiextensions-k8s-io","list-customresourcedefinition-v1-apiextensions-k8s-io","read-customresourcedefinition-v1-apiextensions-k8s-io","-strong-read-operations-customresourcedefinition-v1-apiextensions-k8s-io-strong-","delete-collection-customresourcedefinition-v1-apiextensions-k8s-io","delete-customresourcedefinition-v1-apiextensions-k8s-io","replace-customresourcedefinition-v1-apiextensions-k8s-io","patch-customresourcedefinition-v1-apiextensions-k8s-io","create-customresourcedefinition-v1-apiextensions-k8s-io","-strong-write-operations-customresourcedefinition-v1-apiextensions-k8s-io-strong-","customresourcedefinition-v1-apiextensions-k8s-io","watch-list-all-namespaces-controllerrevision-v1-apps","watch-list-controllerrevision-v1-apps","watch-controllerrevision-v1-apps","list-all-namespaces-controllerrevision-v1-apps","list-controllerrevision-v1-apps","read-controllerrevision-v1-apps","-strong-read-operations-controllerrevision-v1-apps-strong-","delete-collection-controllerrevision-v1-apps","delete-controllerrevision-v1-apps","replace-controllerrevision-v1-apps","patch-controllerrevision-v1-apps","create-controllerrevision-v1-apps","-strong-write-operations-controllerrevision-v1-apps-strong-","controllerrevision-v1-apps","-strong-metadata-apis-strong-","replace-status-volumeattachment-v1-storage-k8s-io","read-status-volumeattachment-v1-storage-k8s-io","patch-status-volumeattachment-v1-storage-k8s-io","-strong-status-operations-volumeattachment-v1-storage-k8s-io-strong-","watch-list-volumeattachment-v1-storage-k8s-io","watch-volumeattachment-v1-storage-k8s-io","list-volumeattachment-v1-storage-k8s-io","read-volumeattachment-v1-storage-k8s-io","-strong-read-operations-volumeattachment-v1-storage-k8s-io-strong-","delete-collection-volumeattachment-v1-storage-k8s-io","delete-volumeattachment-v1-storage-k8s-io","replace-volumeattachment-v1-storage-k8s-io","patch-volumeattachment-v1-storage-k8s-io","create-volumeattachment-v1-storage-k8s-io","-strong-write-operations-volumeattachment-v1-storage-k8s-io-strong-","volumeattachment-v1-storage-k8s-io","volume-v1-core","watch-list-all-namespaces-csistoragecapacity-v1beta1-storage-k8s-io","watch-list-csistoragecapacity-v1beta1-storage-k8s-io","watch-csistoragecapacity-v1beta1-storage-k8s-io","list-all-namespaces-csistoragecapacity-v1beta1-storage-k8s-io","list-csistoragecapacity-v1beta1-storage-k8s-io","read-csistoragecapacity-v1beta1-storage-k8s-io","-strong-read-operations-csistoragecapacity-v1beta1-storage-k8s-io-strong-","delete-collection-csistoragecapacity-v1beta1-storage-k8s-io","delete-csistoragecapacity-v1beta1-storage-k8s-io","replace-csistoragecapacity-v1beta1-storage-k8s-io","patch-csistoragecapacity-v1beta1-storage-k8s-io","create-csistoragecapacity-v1beta1-storage-k8s-io","-strong-write-operations-csistoragecapacity-v1beta1-storage-k8s-io-strong-","csistoragecapacity-v1beta1-storage-k8s-io","watch-list-storageclass-v1-storage-k8s-io","watch-storageclass-v1-storage-k8s-io","list-storageclass-v1-storage-k8s-io","read-storageclass-v1-storage-k8s-io","-strong-read-operations-storageclass-v1-storage-k8s-io-strong-","delete-collection-storageclass-v1-storage-k8s-io","delete-storageclass-v1-storage-k8s-io","replace-storageclass-v1-storage-k8s-io","patch-storageclass-v1-storage-k8s-io","create-storageclass-v1-storage-k8s-io","-strong-write-operations-storageclass-v1-storage-k8s-io-strong-","storageclass-v1-storage-k8s-io","replace-status-persistentvolumeclaim-v1-core","read-status-persistentvolumeclaim-v1-core","patch-status-persistentvolumeclaim-v1-core","-strong-status-operations-persistentvolumeclaim-v1-core-strong-","watch-list-all-namespaces-persistentvolumeclaim-v1-core","watch-list-persistentvolumeclaim-v1-core","watch-persistentvolumeclaim-v1-core","list-all-namespaces-persistentvolumeclaim-v1-core","list-persistentvolumeclaim-v1-core","read-persistentvolumeclaim-v1-core","-strong-read-operations-persistentvolumeclaim-v1-core-strong-","delete-collection-persistentvolumeclaim-v1-core","delete-persistentvolumeclaim-v1-core","replace-persistentvolumeclaim-v1-core","patch-persistentvolumeclaim-v1-core","create-persistentvolumeclaim-v1-core","-strong-write-operations-persistentvolumeclaim-v1-core-strong-","persistentvolumeclaim-v1-core","watch-list-all-namespaces-secret-v1-core","watch-list-secret-v1-core","watch-secret-v1-core","list-all-namespaces-secret-v1-core","list-secret-v1-core","read-secret-v1-core","-strong-read-operations-secret-v1-core-strong-","delete-collection-secret-v1-core","delete-secret-v1-core","replace-secret-v1-core","patch-secret-v1-core","create-secret-v1-core","-strong-write-operations-secret-v1-core-strong-","secret-v1-core","watch-list-csinode-v1-storage-k8s-io","watch-csinode-v1-storage-k8s-io","list-csinode-v1-storage-k8s-io","read-csinode-v1-storage-k8s-io","-strong-read-operations-csinode-v1-storage-k8s-io-strong-","delete-collection-csinode-v1-storage-k8s-io","delete-csinode-v1-storage-k8s-io","replace-csinode-v1-storage-k8s-io","patch-csinode-v1-storage-k8s-io","create-csinode-v1-storage-k8s-io","-strong-write-operations-csinode-v1-storage-k8s-io-strong-","csinode-v1-storage-k8s-io","watch-list-csidriver-v1-storage-k8s-io","watch-csidriver-v1-storage-k8s-io","list-csidriver-v1-storage-k8s-io","read-csidriver-v1-storage-k8s-io","-strong-read-operations-csidriver-v1-storage-k8s-io-strong-","delete-collection-csidriver-v1-storage-k8s-io","delete-csidriver-v1-storage-k8s-io","replace-csidriver-v1-storage-k8s-io","patch-csidriver-v1-storage-k8s-io","create-csidriver-v1-storage-k8s-io","-strong-write-operations-csidriver-v1-storage-k8s-io-strong-","csidriver-v1-storage-k8s-io","watch-list-all-namespaces-configmap-v1-core","watch-list-configmap-v1-core","watch-configmap-v1-core","list-all-namespaces-configmap-v1-core","list-configmap-v1-core","read-configmap-v1-core","-strong-read-operations-configmap-v1-core-strong-","delete-collection-configmap-v1-core","delete-configmap-v1-core","replace-configmap-v1-core","patch-configmap-v1-core","create-configmap-v1-core","-strong-write-operations-configmap-v1-core-strong-","configmap-v1-core","-strong-config-and-storage-apis-strong-","replace-connect-proxy-path-service-v1-core","replace-connect-proxy-service-v1-core","head-connect-proxy-path-service-v1-core","head-connect-proxy-service-v1-core","get-connect-proxy-path-service-v1-core","get-connect-proxy-service-v1-core","delete-connect-proxy-path-service-v1-core","delete-connect-proxy-service-v1-core","create-connect-proxy-path-service-v1-core","create-connect-proxy-service-v1-core","-strong-proxy-operations-service-v1-core-strong-","replace-status-service-v1-core","read-status-service-v1-core","patch-status-service-v1-core","-strong-status-operations-service-v1-core-strong-","watch-list-all-namespaces-service-v1-core","watch-list-service-v1-core","watch-service-v1-core","list-all-namespaces-service-v1-core","list-service-v1-core","read-service-v1-core","-strong-read-operations-service-v1-core-strong-","delete-service-v1-core","replace-service-v1-core","patch-service-v1-core","create-service-v1-core","-strong-write-operations-service-v1-core-strong-","service-v1-core","watch-list-ingressclass-v1-networking-k8s-io","watch-ingressclass-v1-networking-k8s-io","list-ingressclass-v1-networking-k8s-io","read-ingressclass-v1-networking-k8s-io","-strong-read-operations-ingressclass-v1-networking-k8s-io-strong-","delete-collection-ingressclass-v1-networking-k8s-io","delete-ingressclass-v1-networking-k8s-io","replace-ingressclass-v1-networking-k8s-io","patch-ingressclass-v1-networking-k8s-io","create-ingressclass-v1-networking-k8s-io","-strong-write-operations-ingressclass-v1-networking-k8s-io-strong-","ingressclass-v1-networking-k8s-io","replace-status-ingress-v1-networking-k8s-io","read-status-ingress-v1-networking-k8s-io","patch-status-ingress-v1-networking-k8s-io","-strong-status-operations-ingress-v1-networking-k8s-io-strong-","watch-list-all-namespaces-ingress-v1-networking-k8s-io","watch-list-ingress-v1-networking-k8s-io","watch-ingress-v1-networking-k8s-io","list-all-namespaces-ingress-v1-networking-k8s-io","list-ingress-v1-networking-k8s-io","read-ingress-v1-networking-k8s-io","-strong-read-operations-ingress-v1-networking-k8s-io-strong-","delete-collection-ingress-v1-networking-k8s-io","delete-ingress-v1-networking-k8s-io","replace-ingress-v1-networking-k8s-io","patch-ingress-v1-networking-k8s-io","create-ingress-v1-networking-k8s-io","-strong-write-operations-ingress-v1-networking-k8s-io-strong-","ingress-v1-networking-k8s-io","watch-list-all-namespaces-endpointslice-v1-discovery-k8s-io","watch-list-endpointslice-v1-discovery-k8s-io","watch-endpointslice-v1-discovery-k8s-io","list-all-namespaces-endpointslice-v1-discovery-k8s-io","list-endpointslice-v1-discovery-k8s-io","read-endpointslice-v1-discovery-k8s-io","-strong-read-operations-endpointslice-v1-discovery-k8s-io-strong-","delete-collection-endpointslice-v1-discovery-k8s-io","delete-endpointslice-v1-discovery-k8s-io","replace-endpointslice-v1-discovery-k8s-io","patch-endpointslice-v1-discovery-k8s-io","create-endpointslice-v1-discovery-k8s-io","-strong-write-operations-endpointslice-v1-discovery-k8s-io-strong-","endpointslice-v1-discovery-k8s-io","watch-list-all-namespaces-endpoints-v1-core","watch-list-endpoints-v1-core","watch-endpoints-v1-core","list-all-namespaces-endpoints-v1-core","list-endpoints-v1-core","read-endpoints-v1-core","-strong-read-operations-endpoints-v1-core-strong-","delete-collection-endpoints-v1-core","delete-endpoints-v1-core","replace-endpoints-v1-core","patch-endpoints-v1-core","create-endpoints-v1-core","-strong-write-operations-endpoints-v1-core-strong-","endpoints-v1-core","-strong-service-apis-strong-","patch-scale-statefulset-v1-apps","replace-scale-statefulset-v1-apps","read-scale-statefulset-v1-apps","-strong-misc-operations-statefulset-v1-apps-strong-","replace-status-statefulset-v1-apps","read-status-statefulset-v1-apps","patch-status-statefulset-v1-apps","-strong-status-operations-statefulset-v1-apps-strong-","watch-list-all-namespaces-statefulset-v1-apps","watch-list-statefulset-v1-apps","watch-statefulset-v1-apps","list-all-namespaces-statefulset-v1-apps","list-statefulset-v1-apps","read-statefulset-v1-apps","-strong-read-operations-statefulset-v1-apps-strong-","delete-collection-statefulset-v1-apps","delete-statefulset-v1-apps","replace-statefulset-v1-apps","patch-statefulset-v1-apps","create-statefulset-v1-apps","-strong-write-operations-statefulset-v1-apps-strong-","statefulset-v1-apps","patch-scale-replicationcontroller-v1-core","replace-scale-replicationcontroller-v1-core","read-scale-replicationcontroller-v1-core","-strong-misc-operations-replicationcontroller-v1-core-strong-","replace-status-replicationcontroller-v1-core","read-status-replicationcontroller-v1-core","patch-status-replicationcontroller-v1-core","-strong-status-operations-replicationcontroller-v1-core-strong-","watch-list-all-namespaces-replicationcontroller-v1-core","watch-list-replicationcontroller-v1-core","watch-replicationcontroller-v1-core","list-all-namespaces-replicationcontroller-v1-core","list-replicationcontroller-v1-core","read-replicationcontroller-v1-core","-strong-read-operations-replicationcontroller-v1-core-strong-","delete-collection-replicationcontroller-v1-core","delete-replicationcontroller-v1-core","replace-replicationcontroller-v1-core","patch-replicationcontroller-v1-core","create-replicationcontroller-v1-core","-strong-write-operations-replicationcontroller-v1-core-strong-","replicationcontroller-v1-core","patch-scale-replicaset-v1-apps","replace-scale-replicaset-v1-apps","read-scale-replicaset-v1-apps","-strong-misc-operations-replicaset-v1-apps-strong-","replace-status-replicaset-v1-apps","read-status-replicaset-v1-apps","patch-status-replicaset-v1-apps","-strong-status-operations-replicaset-v1-apps-strong-","watch-list-all-namespaces-replicaset-v1-apps","watch-list-replicaset-v1-apps","watch-replicaset-v1-apps","list-all-namespaces-replicaset-v1-apps","list-replicaset-v1-apps","read-replicaset-v1-apps","-strong-read-operations-replicaset-v1-apps-strong-","delete-collection-replicaset-v1-apps","delete-replicaset-v1-apps","replace-replicaset-v1-apps","patch-replicaset-v1-apps","create-replicaset-v1-apps","-strong-write-operations-replicaset-v1-apps-strong-","replicaset-v1-apps","read-log-pod-v1-core","-strong-misc-operations-pod-v1-core-strong-","replace-connect-proxy-path-pod-v1-core","replace-connect-proxy-pod-v1-core","head-connect-proxy-path-pod-v1-core","head-connect-proxy-pod-v1-core","get-connect-proxy-path-pod-v1-core","get-connect-proxy-pod-v1-core","get-connect-portforward-pod-v1-core","delete-connect-proxy-path-pod-v1-core","delete-connect-proxy-pod-v1-core","create-connect-proxy-path-pod-v1-core","create-connect-proxy-pod-v1-core","create-connect-portforward-pod-v1-core","-strong-proxy-operations-pod-v1-core-strong-","replace-ephemeralcontainers-pod-v1-core","read-ephemeralcontainers-pod-v1-core","patch-ephemeralcontainers-pod-v1-core","-strong-ephemeralcontainers-operations-pod-v1-core-strong-","replace-status-pod-v1-core","read-status-pod-v1-core","patch-status-pod-v1-core","-strong-status-operations-pod-v1-core-strong-","watch-list-all-namespaces-pod-v1-core","watch-list-pod-v1-core","watch-pod-v1-core","list-all-namespaces-pod-v1-core","list-pod-v1-core","read-pod-v1-core","-strong-read-operations-pod-v1-core-strong-","delete-collection-pod-v1-core","delete-pod-v1-core","replace-pod-v1-core","patch-pod-v1-core","create-eviction-pod-v1-core","create-pod-v1-core","-strong-write-operations-pod-v1-core-strong-","pod-v1-core","replace-status-job-v1-batch","read-status-job-v1-batch","patch-status-job-v1-batch","-strong-status-operations-job-v1-batch-strong-","watch-list-all-namespaces-job-v1-batch","watch-list-job-v1-batch","watch-job-v1-batch","list-all-namespaces-job-v1-batch","list-job-v1-batch","read-job-v1-batch","-strong-read-operations-job-v1-batch-strong-","delete-collection-job-v1-batch","delete-job-v1-batch","replace-job-v1-batch","patch-job-v1-batch","create-job-v1-batch","-strong-write-operations-job-v1-batch-strong-","job-v1-batch","patch-scale-deployment-v1-apps","replace-scale-deployment-v1-apps","read-scale-deployment-v1-apps","-strong-misc-operations-deployment-v1-apps-strong-","replace-status-deployment-v1-apps","read-status-deployment-v1-apps","patch-status-deployment-v1-apps","-strong-status-operations-deployment-v1-apps-strong-","watch-list-all-namespaces-deployment-v1-apps","watch-list-deployment-v1-apps","watch-deployment-v1-apps","list-all-namespaces-deployment-v1-apps","list-deployment-v1-apps","read-deployment-v1-apps","-strong-read-operations-deployment-v1-apps-strong-","delete-collection-deployment-v1-apps","delete-deployment-v1-apps","replace-deployment-v1-apps","patch-deployment-v1-apps","create-deployment-v1-apps","-strong-write-operations-deployment-v1-apps-strong-","deployment-v1-apps","replace-status-daemonset-v1-apps","read-status-daemonset-v1-apps","patch-status-daemonset-v1-apps","-strong-status-operations-daemonset-v1-apps-strong-","watch-list-all-namespaces-daemonset-v1-apps","watch-list-daemonset-v1-apps","watch-daemonset-v1-apps","list-all-namespaces-daemonset-v1-apps","list-daemonset-v1-apps","read-daemonset-v1-apps","-strong-read-operations-daemonset-v1-apps-strong-","delete-collection-daemonset-v1-apps","delete-daemonset-v1-apps","replace-daemonset-v1-apps","patch-daemonset-v1-apps","create-daemonset-v1-apps","-strong-write-operations-daemonset-v1-apps-strong-","daemonset-v1-apps","replace-status-cronjob-v1-batch","read-status-cronjob-v1-batch","patch-status-cronjob-v1-batch","-strong-status-operations-cronjob-v1-batch-strong-","watch-list-all-namespaces-cronjob-v1-batch","watch-list-cronjob-v1-batch","watch-cronjob-v1-batch","list-all-namespaces-cronjob-v1-batch","list-cronjob-v1-batch","read-cronjob-v1-batch","-strong-read-operations-cronjob-v1-batch-strong-","delete-collection-cronjob-v1-batch","delete-cronjob-v1-batch","replace-cronjob-v1-batch","patch-cronjob-v1-batch","create-cronjob-v1-batch","-strong-write-operations-cronjob-v1-batch-strong-","cronjob-v1-batch","container-v1-core","-strong-workloads-apis-strong-","-strong-api-groups-strong-","-strong-api-overview-strong-"]};})(); \ No newline at end of file +(function(){navData={"toc":[{"section":"webhookclientconfig-v1-apiextensions-k8s-io","subsections":[]},{"section":"volumeerror-v1alpha1-storage-k8s-io","subsections":[]},{"section":"volumeattachmentsource-v1alpha1-storage-k8s-io","subsections":[]},{"section":"volumeattachment-v1alpha1-storage-k8s-io","subsections":[{"section":"-strong-read-operations-volumeattachment-v1alpha1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-volumeattachment-v1alpha1-storage-k8s-io","subsections":[]},{"section":"watch-volumeattachment-v1alpha1-storage-k8s-io","subsections":[]},{"section":"list-volumeattachment-v1alpha1-storage-k8s-io","subsections":[]},{"section":"read-volumeattachment-v1alpha1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-volumeattachment-v1alpha1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-volumeattachment-v1alpha1-storage-k8s-io","subsections":[]},{"section":"delete-volumeattachment-v1alpha1-storage-k8s-io","subsections":[]},{"section":"replace-volumeattachment-v1alpha1-storage-k8s-io","subsections":[]},{"section":"patch-volumeattachment-v1alpha1-storage-k8s-io","subsections":[]},{"section":"create-volumeattachment-v1alpha1-storage-k8s-io","subsections":[]}]}]},{"section":"tokenrequest-v1-storage-k8s-io","subsections":[]},{"section":"subject-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"subject-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"servicereference-v1-apiregistration-k8s-io","subsections":[]},{"section":"servicereference-v1-apiextensions-k8s-io","subsections":[]},{"section":"scheduling-v1alpha1-node-k8s-io","subsections":[]},{"section":"scheduling-v1beta1-node-k8s-io","subsections":[]},{"section":"runtimeclass-v1alpha1-node-k8s-io","subsections":[{"section":"-strong-read-operations-runtimeclass-v1alpha1-node-k8s-io-strong-","subsections":[{"section":"watch-list-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"watch-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"list-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"read-runtimeclass-v1alpha1-node-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-runtimeclass-v1alpha1-node-k8s-io-strong-","subsections":[{"section":"delete-collection-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"delete-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"replace-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"patch-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"create-runtimeclass-v1alpha1-node-k8s-io","subsections":[]}]}]},{"section":"runtimeclass-v1beta1-node-k8s-io","subsections":[{"section":"-strong-read-operations-runtimeclass-v1beta1-node-k8s-io-strong-","subsections":[{"section":"watch-list-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"watch-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"list-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"read-runtimeclass-v1beta1-node-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-runtimeclass-v1beta1-node-k8s-io-strong-","subsections":[{"section":"delete-collection-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"delete-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"replace-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"patch-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"create-runtimeclass-v1beta1-node-k8s-io","subsections":[]}]}]},{"section":"roleref-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-rolebinding-v1alpha1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-list-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-all-namespaces-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-rolebinding-v1alpha1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-rolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"role-v1alpha1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-role-v1alpha1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-list-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-all-namespaces-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-role-v1alpha1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-role-v1alpha1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"resourcemetricstatus-v2beta1-autoscaling","subsections":[]},{"section":"resourcemetricsource-v2beta1-autoscaling","subsections":[]},{"section":"priorityclass-v1alpha1-scheduling-k8s-io","subsections":[{"section":"-strong-read-operations-priorityclass-v1alpha1-scheduling-k8s-io-strong-","subsections":[{"section":"watch-list-priorityclass-v1alpha1-scheduling-k8s-io","subsections":[]},{"section":"watch-priorityclass-v1alpha1-scheduling-k8s-io","subsections":[]},{"section":"list-priorityclass-v1alpha1-scheduling-k8s-io","subsections":[]},{"section":"read-priorityclass-v1alpha1-scheduling-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-priorityclass-v1alpha1-scheduling-k8s-io-strong-","subsections":[{"section":"delete-collection-priorityclass-v1alpha1-scheduling-k8s-io","subsections":[]},{"section":"delete-priorityclass-v1alpha1-scheduling-k8s-io","subsections":[]},{"section":"replace-priorityclass-v1alpha1-scheduling-k8s-io","subsections":[]},{"section":"patch-priorityclass-v1alpha1-scheduling-k8s-io","subsections":[]},{"section":"create-priorityclass-v1alpha1-scheduling-k8s-io","subsections":[]}]}]},{"section":"policyrule-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"podsmetricstatus-v2beta1-autoscaling","subsections":[]},{"section":"podsmetricsource-v2beta1-autoscaling","subsections":[]},{"section":"poddisruptionbudget-v1beta1-policy","subsections":[{"section":"-strong-status-operations-poddisruptionbudget-v1beta1-policy-strong-","subsections":[{"section":"replace-status-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"read-status-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"patch-status-poddisruptionbudget-v1beta1-policy","subsections":[]}]},{"section":"-strong-read-operations-poddisruptionbudget-v1beta1-policy-strong-","subsections":[{"section":"watch-list-all-namespaces-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"watch-list-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"watch-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"list-all-namespaces-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"list-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"read-poddisruptionbudget-v1beta1-policy","subsections":[]}]},{"section":"-strong-write-operations-poddisruptionbudget-v1beta1-policy-strong-","subsections":[{"section":"delete-collection-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"delete-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"replace-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"patch-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"create-poddisruptionbudget-v1beta1-policy","subsections":[]}]}]},{"section":"overhead-v1alpha1-node-k8s-io","subsections":[]},{"section":"overhead-v1beta1-node-k8s-io","subsections":[]},{"section":"objectmetricstatus-v2beta1-autoscaling","subsections":[]},{"section":"objectmetricsource-v2beta1-autoscaling","subsections":[]},{"section":"metricstatus-v2beta1-autoscaling","subsections":[]},{"section":"metricspec-v2beta1-autoscaling","subsections":[]},{"section":"jobtemplatespec-v1beta1-batch","subsections":[]},{"section":"horizontalpodautoscalercondition-v2beta1-autoscaling","subsections":[]},{"section":"horizontalpodautoscaler-v2beta1-autoscaling","subsections":[{"section":"-strong-status-operations-horizontalpodautoscaler-v2beta1-autoscaling-strong-","subsections":[{"section":"replace-status-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"read-status-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"patch-status-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]}]},{"section":"-strong-read-operations-horizontalpodautoscaler-v2beta1-autoscaling-strong-","subsections":[{"section":"watch-list-all-namespaces-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"watch-list-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"watch-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"list-all-namespaces-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"list-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"read-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]}]},{"section":"-strong-write-operations-horizontalpodautoscaler-v2beta1-autoscaling-strong-","subsections":[{"section":"delete-collection-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"delete-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"replace-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"patch-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"create-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]}]}]},{"section":"horizontalpodautoscaler-v2beta2-autoscaling","subsections":[{"section":"-strong-status-operations-horizontalpodautoscaler-v2beta2-autoscaling-strong-","subsections":[{"section":"replace-status-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"read-status-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"patch-status-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]}]},{"section":"-strong-read-operations-horizontalpodautoscaler-v2beta2-autoscaling-strong-","subsections":[{"section":"watch-list-all-namespaces-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"watch-list-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"watch-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"list-all-namespaces-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"list-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"read-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]}]},{"section":"-strong-write-operations-horizontalpodautoscaler-v2beta2-autoscaling-strong-","subsections":[{"section":"delete-collection-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"delete-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"replace-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"patch-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"create-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]}]}]},{"section":"forzone-v1beta1-discovery-k8s-io","subsections":[]},{"section":"externalmetricstatus-v2beta1-autoscaling","subsections":[]},{"section":"externalmetricsource-v2beta1-autoscaling","subsections":[]},{"section":"eventseries-v1beta1-events-k8s-io","subsections":[]},{"section":"eventseries-v1-core","subsections":[]},{"section":"event-v1beta1-events-k8s-io","subsections":[{"section":"-strong-read-operations-event-v1beta1-events-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-event-v1beta1-events-k8s-io","subsections":[]},{"section":"watch-list-event-v1beta1-events-k8s-io","subsections":[]},{"section":"watch-event-v1beta1-events-k8s-io","subsections":[]},{"section":"list-all-namespaces-event-v1beta1-events-k8s-io","subsections":[]},{"section":"list-event-v1beta1-events-k8s-io","subsections":[]},{"section":"read-event-v1beta1-events-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-event-v1beta1-events-k8s-io-strong-","subsections":[{"section":"delete-collection-event-v1beta1-events-k8s-io","subsections":[]},{"section":"delete-event-v1beta1-events-k8s-io","subsections":[]},{"section":"replace-event-v1beta1-events-k8s-io","subsections":[]},{"section":"patch-event-v1beta1-events-k8s-io","subsections":[]},{"section":"create-event-v1beta1-events-k8s-io","subsections":[]}]}]},{"section":"event-v1-core","subsections":[{"section":"-strong-read-operations-event-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-event-v1-core","subsections":[]},{"section":"watch-list-event-v1-core","subsections":[]},{"section":"watch-event-v1-core","subsections":[]},{"section":"list-all-namespaces-event-v1-core","subsections":[]},{"section":"list-event-v1-core","subsections":[]},{"section":"read-event-v1-core","subsections":[]}]},{"section":"-strong-write-operations-event-v1-core-strong-","subsections":[{"section":"delete-collection-event-v1-core","subsections":[]},{"section":"delete-event-v1-core","subsections":[]},{"section":"replace-event-v1-core","subsections":[]},{"section":"patch-event-v1-core","subsections":[]},{"section":"create-event-v1-core","subsections":[]}]}]},{"section":"endpointslice-v1beta1-discovery-k8s-io","subsections":[{"section":"-strong-read-operations-endpointslice-v1beta1-discovery-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"watch-list-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"watch-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"list-all-namespaces-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"list-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"read-endpointslice-v1beta1-discovery-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-endpointslice-v1beta1-discovery-k8s-io-strong-","subsections":[{"section":"delete-collection-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"delete-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"replace-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"patch-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"create-endpointslice-v1beta1-discovery-k8s-io","subsections":[]}]}]},{"section":"endpointport-v1beta1-discovery-k8s-io","subsections":[]},{"section":"endpointport-v1-discovery-k8s-io","subsections":[]},{"section":"endpointhints-v1beta1-discovery-k8s-io","subsections":[]},{"section":"endpointconditions-v1beta1-discovery-k8s-io","subsections":[]},{"section":"endpoint-v1beta1-discovery-k8s-io","subsections":[]},{"section":"crossversionobjectreference-v2beta1-autoscaling","subsections":[]},{"section":"crossversionobjectreference-v2beta2-autoscaling","subsections":[]},{"section":"cronjob-v1beta1-batch","subsections":[{"section":"-strong-status-operations-cronjob-v1beta1-batch-strong-","subsections":[{"section":"replace-status-cronjob-v1beta1-batch","subsections":[]},{"section":"read-status-cronjob-v1beta1-batch","subsections":[]},{"section":"patch-status-cronjob-v1beta1-batch","subsections":[]}]},{"section":"-strong-read-operations-cronjob-v1beta1-batch-strong-","subsections":[{"section":"watch-list-all-namespaces-cronjob-v1beta1-batch","subsections":[]},{"section":"watch-list-cronjob-v1beta1-batch","subsections":[]},{"section":"watch-cronjob-v1beta1-batch","subsections":[]},{"section":"list-all-namespaces-cronjob-v1beta1-batch","subsections":[]},{"section":"list-cronjob-v1beta1-batch","subsections":[]},{"section":"read-cronjob-v1beta1-batch","subsections":[]}]},{"section":"-strong-write-operations-cronjob-v1beta1-batch-strong-","subsections":[{"section":"delete-collection-cronjob-v1beta1-batch","subsections":[]},{"section":"delete-cronjob-v1beta1-batch","subsections":[]},{"section":"replace-cronjob-v1beta1-batch","subsections":[]},{"section":"patch-cronjob-v1beta1-batch","subsections":[]},{"section":"create-cronjob-v1beta1-batch","subsections":[]}]}]},{"section":"containerresourcemetricstatus-v2beta1-autoscaling","subsections":[]},{"section":"containerresourcemetricsource-v2beta1-autoscaling","subsections":[]},{"section":"clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-clusterrole-v1alpha1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-clusterrole-v1alpha1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-clusterrole-v1alpha1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[{"section":"-strong-read-operations-csistoragecapacity-v1alpha1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"watch-list-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"watch-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"list-all-namespaces-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"list-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"read-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-csistoragecapacity-v1alpha1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"delete-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"replace-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"patch-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"create-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]}]}]},{"section":"aggregationrule-v1alpha1-rbac-authorization-k8s-io","subsections":[]},{"section":"-strong-old-api-versions-strong-","subsections":[]},{"section":"windowssecuritycontextoptions-v1-core","subsections":[]},{"section":"weightedpodaffinityterm-v1-core","subsections":[]},{"section":"webhookconversion-v1-apiextensions-k8s-io","subsections":[]},{"section":"webhookclientconfig-v1-admissionregistration-k8s-io","subsections":[]},{"section":"watchevent-v1-meta","subsections":[]},{"section":"vspherevirtualdiskvolumesource-v1-core","subsections":[]},{"section":"volumeprojection-v1-core","subsections":[]},{"section":"volumenoderesources-v1-storage-k8s-io","subsections":[]},{"section":"volumenodeaffinity-v1-core","subsections":[]},{"section":"volumemount-v1-core","subsections":[]},{"section":"volumeerror-v1-storage-k8s-io","subsections":[]},{"section":"volumedevice-v1-core","subsections":[]},{"section":"volumeattachmentsource-v1-storage-k8s-io","subsections":[]},{"section":"validatingwebhook-v1-admissionregistration-k8s-io","subsections":[]},{"section":"usersubject-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"userinfo-v1-authentication-k8s-io","subsections":[]},{"section":"uncountedterminatedpods-v1-batch","subsections":[]},{"section":"typedlocalobjectreference-v1-core","subsections":[]},{"section":"topologyspreadconstraint-v1-core","subsections":[]},{"section":"topologyselectorterm-v1-core","subsections":[]},{"section":"topologyselectorlabelrequirement-v1-core","subsections":[]},{"section":"toleration-v1-core","subsections":[]},{"section":"time-v1-meta","subsections":[]},{"section":"taint-v1-core","subsections":[]},{"section":"tcpsocketaction-v1-core","subsections":[]},{"section":"sysctl-v1-core","subsections":[]},{"section":"supplementalgroupsstrategyoptions-v1beta1-policy","subsections":[]},{"section":"subjectrulesreviewstatus-v1-authorization-k8s-io","subsections":[]},{"section":"subject-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"storageversioncondition-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"storageosvolumesource-v1-core","subsections":[]},{"section":"storageospersistentvolumesource-v1-core","subsections":[]},{"section":"statusdetails-v1-meta","subsections":[]},{"section":"statuscause-v1-meta","subsections":[]},{"section":"status-v1-meta","subsections":[]},{"section":"statefulsetupdatestrategy-v1-apps","subsections":[]},{"section":"statefulsetcondition-v1-apps","subsections":[]},{"section":"sessionaffinityconfig-v1-core","subsections":[]},{"section":"servicereference-v1-admissionregistration-k8s-io","subsections":[]},{"section":"serviceport-v1-core","subsections":[]},{"section":"servicebackendport-v1-networking-k8s-io","subsections":[]},{"section":"serviceaccounttokenprojection-v1-core","subsections":[]},{"section":"serviceaccountsubject-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"serverstorageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"serveraddressbyclientcidr-v1-meta","subsections":[]},{"section":"securitycontext-v1-core","subsections":[]},{"section":"secretvolumesource-v1-core","subsections":[]},{"section":"secretreference-v1-core","subsections":[]},{"section":"secretprojection-v1-core","subsections":[]},{"section":"secretkeyselector-v1-core","subsections":[]},{"section":"secretenvsource-v1-core","subsections":[]},{"section":"seccompprofile-v1-core","subsections":[]},{"section":"scopedresourceselectorrequirement-v1-core","subsections":[]},{"section":"scopeselector-v1-core","subsections":[]},{"section":"scheduling-v1-node-k8s-io","subsections":[]},{"section":"scaleiovolumesource-v1-core","subsections":[]},{"section":"scaleiopersistentvolumesource-v1-core","subsections":[]},{"section":"scale-v1-autoscaling","subsections":[]},{"section":"selinuxstrategyoptions-v1beta1-policy","subsections":[]},{"section":"selinuxoptions-v1-core","subsections":[]},{"section":"runtimeclassstrategyoptions-v1beta1-policy","subsections":[]},{"section":"runasuserstrategyoptions-v1beta1-policy","subsections":[]},{"section":"runasgroupstrategyoptions-v1beta1-policy","subsections":[]},{"section":"rulewithoperations-v1-admissionregistration-k8s-io","subsections":[]},{"section":"rollingupdatestatefulsetstrategy-v1-apps","subsections":[]},{"section":"roleref-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"resourcerule-v1-authorization-k8s-io","subsections":[]},{"section":"resourcerequirements-v1-core","subsections":[]},{"section":"resourcepolicyrule-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"resourcemetricstatus-v2beta2-autoscaling","subsections":[]},{"section":"resourcemetricsource-v2beta2-autoscaling","subsections":[]},{"section":"resourcefieldselector-v1-core","subsections":[]},{"section":"resourceattributes-v1-authorization-k8s-io","subsections":[]},{"section":"replicationcontrollercondition-v1-core","subsections":[]},{"section":"replicasetcondition-v1-apps","subsections":[]},{"section":"rbdvolumesource-v1-core","subsections":[]},{"section":"rbdpersistentvolumesource-v1-core","subsections":[]},{"section":"quobytevolumesource-v1-core","subsections":[]},{"section":"queuingconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"quantity-resource-core","subsections":[]},{"section":"projectedvolumesource-v1-core","subsections":[]},{"section":"probe-v1-core","subsections":[]},{"section":"prioritylevelconfigurationreference-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"prioritylevelconfigurationcondition-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"preferredschedulingterm-v1-core","subsections":[]},{"section":"preconditions-v1-meta","subsections":[]},{"section":"portworxvolumesource-v1-core","subsections":[]},{"section":"portstatus-v1-core","subsections":[]},{"section":"policyruleswithsubjects-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"policyrule-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"podsmetricstatus-v2beta2-autoscaling","subsections":[]},{"section":"podsmetricsource-v2beta2-autoscaling","subsections":[]},{"section":"podsecuritycontext-v1-core","subsections":[]},{"section":"podreadinessgate-v1-core","subsections":[]},{"section":"podip-v1-core","subsections":[]},{"section":"poddnsconfigoption-v1-core","subsections":[]},{"section":"poddnsconfig-v1-core","subsections":[]},{"section":"podcondition-v1-core","subsections":[]},{"section":"podantiaffinity-v1-core","subsections":[]},{"section":"podaffinityterm-v1-core","subsections":[]},{"section":"podaffinity-v1-core","subsections":[]},{"section":"photonpersistentdiskvolumesource-v1-core","subsections":[]},{"section":"persistentvolumeclaimvolumesource-v1-core","subsections":[]},{"section":"persistentvolumeclaimtemplate-v1-core","subsections":[]},{"section":"persistentvolumeclaimcondition-v1-core","subsections":[]},{"section":"patch-v1-meta","subsections":[]},{"section":"ownerreference-v1-meta","subsections":[]},{"section":"overhead-v1-node-k8s-io","subsections":[]},{"section":"objectreference-v1-core","subsections":[]},{"section":"objectmetricstatus-v2beta2-autoscaling","subsections":[]},{"section":"objectmetricsource-v2beta2-autoscaling","subsections":[]},{"section":"objectmeta-v1-meta","subsections":[]},{"section":"objectfieldselector-v1-core","subsections":[]},{"section":"nonresourcerule-v1-authorization-k8s-io","subsections":[]},{"section":"nonresourcepolicyrule-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"nonresourceattributes-v1-authorization-k8s-io","subsections":[]},{"section":"nodesysteminfo-v1-core","subsections":[]},{"section":"nodeselectorterm-v1-core","subsections":[]},{"section":"nodeselectorrequirement-v1-core","subsections":[]},{"section":"nodeselector-v1-core","subsections":[]},{"section":"nodedaemonendpoints-v1-core","subsections":[]},{"section":"nodeconfigstatus-v1-core","subsections":[]},{"section":"nodeconfigsource-v1-core","subsections":[]},{"section":"nodecondition-v1-core","subsections":[]},{"section":"nodeaffinity-v1-core","subsections":[]},{"section":"nodeaddress-v1-core","subsections":[]},{"section":"networkpolicyport-v1-networking-k8s-io","subsections":[]},{"section":"networkpolicypeer-v1-networking-k8s-io","subsections":[]},{"section":"networkpolicyingressrule-v1-networking-k8s-io","subsections":[]},{"section":"networkpolicyegressrule-v1-networking-k8s-io","subsections":[]},{"section":"namespacecondition-v1-core","subsections":[]},{"section":"nfsvolumesource-v1-core","subsections":[]},{"section":"mutatingwebhook-v1-admissionregistration-k8s-io","subsections":[]},{"section":"microtime-v1-meta","subsections":[]},{"section":"metricvaluestatus-v2beta2-autoscaling","subsections":[]},{"section":"metrictarget-v2beta2-autoscaling","subsections":[]},{"section":"metricstatus-v2beta2-autoscaling","subsections":[]},{"section":"metricspec-v2beta2-autoscaling","subsections":[]},{"section":"metricidentifier-v2beta2-autoscaling","subsections":[]},{"section":"managedfieldsentry-v1-meta","subsections":[]},{"section":"localvolumesource-v1-core","subsections":[]},{"section":"localobjectreference-v1-core","subsections":[]},{"section":"loadbalancerstatus-v1-core","subsections":[]},{"section":"loadbalanceringress-v1-core","subsections":[]},{"section":"listmeta-v1-meta","subsections":[]},{"section":"limitedprioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"limitresponse-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"limitrangeitem-v1-core","subsections":[]},{"section":"lifecycle-v1-core","subsections":[]},{"section":"labelselectorrequirement-v1-meta","subsections":[]},{"section":"labelselector-v1-meta","subsections":[]},{"section":"keytopath-v1-core","subsections":[]},{"section":"jobtemplatespec-v1-batch","subsections":[]},{"section":"jobcondition-v1-batch","subsections":[]},{"section":"jsonschemapropsorbool-v1-apiextensions-k8s-io","subsections":[]},{"section":"jsonschemapropsorarray-v1-apiextensions-k8s-io","subsections":[]},{"section":"jsonschemaprops-v1-apiextensions-k8s-io","subsections":[]},{"section":"json-v1-apiextensions-k8s-io","subsections":[]},{"section":"ingresstls-v1-networking-k8s-io","subsections":[]},{"section":"ingressservicebackend-v1-networking-k8s-io","subsections":[]},{"section":"ingressrule-v1-networking-k8s-io","subsections":[]},{"section":"ingressclassparametersreference-v1-networking-k8s-io","subsections":[]},{"section":"ingressbackend-v1-networking-k8s-io","subsections":[]},{"section":"iscsivolumesource-v1-core","subsections":[]},{"section":"iscsipersistentvolumesource-v1-core","subsections":[]},{"section":"ipblock-v1-networking-k8s-io","subsections":[]},{"section":"idrange-v1beta1-policy","subsections":[]},{"section":"hostportrange-v1beta1-policy","subsections":[]},{"section":"hostpathvolumesource-v1-core","subsections":[]},{"section":"hostalias-v1-core","subsections":[]},{"section":"horizontalpodautoscalercondition-v2beta2-autoscaling","subsections":[]},{"section":"horizontalpodautoscalerbehavior-v2beta2-autoscaling","subsections":[]},{"section":"handler-v1-core","subsections":[]},{"section":"httpingressrulevalue-v1-networking-k8s-io","subsections":[]},{"section":"httpingresspath-v1-networking-k8s-io","subsections":[]},{"section":"httpheader-v1-core","subsections":[]},{"section":"httpgetaction-v1-core","subsections":[]},{"section":"hpascalingrules-v2beta2-autoscaling","subsections":[]},{"section":"hpascalingpolicy-v2beta2-autoscaling","subsections":[]},{"section":"groupversionfordiscovery-v1-meta","subsections":[]},{"section":"groupsubject-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"glusterfsvolumesource-v1-core","subsections":[]},{"section":"glusterfspersistentvolumesource-v1-core","subsections":[]},{"section":"gitrepovolumesource-v1-core","subsections":[]},{"section":"gcepersistentdiskvolumesource-v1-core","subsections":[]},{"section":"forzone-v1-discovery-k8s-io","subsections":[]},{"section":"flowschemacondition-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"flowdistinguishermethod-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"flockervolumesource-v1-core","subsections":[]},{"section":"flexvolumesource-v1-core","subsections":[]},{"section":"flexpersistentvolumesource-v1-core","subsections":[]},{"section":"fieldsv1-v1-meta","subsections":[]},{"section":"fsgroupstrategyoptions-v1beta1-policy","subsections":[]},{"section":"fcvolumesource-v1-core","subsections":[]},{"section":"externalmetricstatus-v2beta2-autoscaling","subsections":[]},{"section":"externalmetricsource-v2beta2-autoscaling","subsections":[]},{"section":"externaldocumentation-v1-apiextensions-k8s-io","subsections":[]},{"section":"execaction-v1-core","subsections":[]},{"section":"eviction-v1-policy","subsections":[]},{"section":"eventsource-v1-core","subsections":[]},{"section":"eventseries-v1-events-k8s-io","subsections":[]},{"section":"ephemeralvolumesource-v1-core","subsections":[]},{"section":"ephemeralcontainer-v1-core","subsections":[]},{"section":"envvarsource-v1-core","subsections":[]},{"section":"envvar-v1-core","subsections":[]},{"section":"envfromsource-v1-core","subsections":[]},{"section":"endpointsubset-v1-core","subsections":[]},{"section":"endpointport-v1-core","subsections":[]},{"section":"endpointhints-v1-discovery-k8s-io","subsections":[]},{"section":"endpointconditions-v1-discovery-k8s-io","subsections":[]},{"section":"endpointaddress-v1-core","subsections":[]},{"section":"endpoint-v1-discovery-k8s-io","subsections":[]},{"section":"emptydirvolumesource-v1-core","subsections":[]},{"section":"downwardapivolumesource-v1-core","subsections":[]},{"section":"downwardapivolumefile-v1-core","subsections":[]},{"section":"downwardapiprojection-v1-core","subsections":[]},{"section":"deploymentcondition-v1-apps","subsections":[]},{"section":"deleteoptions-v1-meta","subsections":[]},{"section":"daemonsetupdatestrategy-v1-apps","subsections":[]},{"section":"daemonsetcondition-v1-apps","subsections":[]},{"section":"daemonendpoint-v1-core","subsections":[]},{"section":"customresourcevalidation-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcesubresources-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcesubresourcestatus-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcesubresourcescale-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcedefinitionversion-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcedefinitionnames-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcedefinitioncondition-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourceconversion-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcecolumndefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"crossversionobjectreference-v1-autoscaling","subsections":[]},{"section":"containerstatewaiting-v1-core","subsections":[]},{"section":"containerstateterminated-v1-core","subsections":[]},{"section":"containerstaterunning-v1-core","subsections":[]},{"section":"containerstate-v1-core","subsections":[]},{"section":"containerresourcemetricstatus-v2beta2-autoscaling","subsections":[]},{"section":"containerresourcemetricsource-v2beta2-autoscaling","subsections":[]},{"section":"containerport-v1-core","subsections":[]},{"section":"containerimage-v1-core","subsections":[]},{"section":"configmapvolumesource-v1-core","subsections":[]},{"section":"configmapprojection-v1-core","subsections":[]},{"section":"configmapnodeconfigsource-v1-core","subsections":[]},{"section":"configmapkeyselector-v1-core","subsections":[]},{"section":"configmapenvsource-v1-core","subsections":[]},{"section":"condition-v1-meta","subsections":[]},{"section":"componentcondition-v1-core","subsections":[]},{"section":"clientipconfig-v1-core","subsections":[]},{"section":"cindervolumesource-v1-core","subsections":[]},{"section":"cinderpersistentvolumesource-v1-core","subsections":[]},{"section":"certificatesigningrequestcondition-v1-certificates-k8s-io","subsections":[]},{"section":"cephfsvolumesource-v1-core","subsections":[]},{"section":"cephfspersistentvolumesource-v1-core","subsections":[]},{"section":"capabilities-v1-core","subsections":[]},{"section":"csivolumesource-v1-core","subsections":[]},{"section":"csipersistentvolumesource-v1-core","subsections":[]},{"section":"csinodedriver-v1-storage-k8s-io","subsections":[]},{"section":"boundobjectreference-v1-authentication-k8s-io","subsections":[]},{"section":"azurefilevolumesource-v1-core","subsections":[]},{"section":"azurefilepersistentvolumesource-v1-core","subsections":[]},{"section":"azurediskvolumesource-v1-core","subsections":[]},{"section":"attachedvolume-v1-core","subsections":[]},{"section":"allowedhostpath-v1beta1-policy","subsections":[]},{"section":"allowedflexvolume-v1beta1-policy","subsections":[]},{"section":"allowedcsidriver-v1beta1-policy","subsections":[]},{"section":"aggregationrule-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"affinity-v1-core","subsections":[]},{"section":"awselasticblockstorevolumesource-v1-core","subsections":[]},{"section":"apiversions-v1-meta","subsections":[]},{"section":"apiservicecondition-v1-apiregistration-k8s-io","subsections":[]},{"section":"apiresource-v1-meta","subsections":[]},{"section":"apigroup-v1-meta","subsections":[]},{"section":"-strong-definitions-strong-","subsections":[]},{"section":"networkpolicy-v1-networking-k8s-io","subsections":[{"section":"-strong-read-operations-networkpolicy-v1-networking-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"watch-list-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"watch-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"list-all-namespaces-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"list-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"read-networkpolicy-v1-networking-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-networkpolicy-v1-networking-k8s-io-strong-","subsections":[{"section":"delete-collection-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"delete-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"replace-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"patch-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"create-networkpolicy-v1-networking-k8s-io","subsections":[]}]}]},{"section":"tokenreview-v1-authentication-k8s-io","subsections":[{"section":"-strong-write-operations-tokenreview-v1-authentication-k8s-io-strong-","subsections":[{"section":"create-tokenreview-v1-authentication-k8s-io","subsections":[]}]}]},{"section":"tokenrequest-v1-authentication-k8s-io","subsections":[]},{"section":"subjectaccessreview-v1-authorization-k8s-io","subsections":[{"section":"-strong-write-operations-subjectaccessreview-v1-authorization-k8s-io-strong-","subsections":[{"section":"create-subjectaccessreview-v1-authorization-k8s-io","subsections":[]}]}]},{"section":"storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[{"section":"-strong-status-operations-storageversion-v1alpha1-internal-apiserver-k8s-io-strong-","subsections":[{"section":"replace-status-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"read-status-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"patch-status-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-storageversion-v1alpha1-internal-apiserver-k8s-io-strong-","subsections":[{"section":"watch-list-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"watch-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"list-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"read-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-storageversion-v1alpha1-internal-apiserver-k8s-io-strong-","subsections":[{"section":"delete-collection-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"delete-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"replace-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"patch-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"create-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]}]}]},{"section":"serviceaccount-v1-core","subsections":[{"section":"-strong-read-operations-serviceaccount-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-serviceaccount-v1-core","subsections":[]},{"section":"watch-list-serviceaccount-v1-core","subsections":[]},{"section":"watch-serviceaccount-v1-core","subsections":[]},{"section":"list-all-namespaces-serviceaccount-v1-core","subsections":[]},{"section":"list-serviceaccount-v1-core","subsections":[]},{"section":"read-serviceaccount-v1-core","subsections":[]}]},{"section":"-strong-write-operations-serviceaccount-v1-core-strong-","subsections":[{"section":"delete-collection-serviceaccount-v1-core","subsections":[]},{"section":"delete-serviceaccount-v1-core","subsections":[]},{"section":"replace-serviceaccount-v1-core","subsections":[]},{"section":"patch-serviceaccount-v1-core","subsections":[]},{"section":"create-serviceaccount-v1-core","subsections":[]}]}]},{"section":"selfsubjectrulesreview-v1-authorization-k8s-io","subsections":[{"section":"-strong-write-operations-selfsubjectrulesreview-v1-authorization-k8s-io-strong-","subsections":[{"section":"create-selfsubjectrulesreview-v1-authorization-k8s-io","subsections":[]}]}]},{"section":"selfsubjectaccessreview-v1-authorization-k8s-io","subsections":[{"section":"-strong-write-operations-selfsubjectaccessreview-v1-authorization-k8s-io-strong-","subsections":[{"section":"create-selfsubjectaccessreview-v1-authorization-k8s-io","subsections":[]}]}]},{"section":"runtimeclass-v1-node-k8s-io","subsections":[{"section":"-strong-read-operations-runtimeclass-v1-node-k8s-io-strong-","subsections":[{"section":"watch-list-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"watch-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"list-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"read-runtimeclass-v1-node-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-runtimeclass-v1-node-k8s-io-strong-","subsections":[{"section":"delete-collection-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"delete-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"replace-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"patch-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"create-runtimeclass-v1-node-k8s-io","subsections":[]}]}]},{"section":"rolebinding-v1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-rolebinding-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-list-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-all-namespaces-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-rolebinding-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"role-v1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-role-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-list-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-all-namespaces-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-role-v1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-role-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-role-v1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"resourcequota-v1-core","subsections":[{"section":"-strong-status-operations-resourcequota-v1-core-strong-","subsections":[{"section":"replace-status-resourcequota-v1-core","subsections":[]},{"section":"read-status-resourcequota-v1-core","subsections":[]},{"section":"patch-status-resourcequota-v1-core","subsections":[]}]},{"section":"-strong-read-operations-resourcequota-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-resourcequota-v1-core","subsections":[]},{"section":"watch-list-resourcequota-v1-core","subsections":[]},{"section":"watch-resourcequota-v1-core","subsections":[]},{"section":"list-all-namespaces-resourcequota-v1-core","subsections":[]},{"section":"list-resourcequota-v1-core","subsections":[]},{"section":"read-resourcequota-v1-core","subsections":[]}]},{"section":"-strong-write-operations-resourcequota-v1-core-strong-","subsections":[{"section":"delete-collection-resourcequota-v1-core","subsections":[]},{"section":"delete-resourcequota-v1-core","subsections":[]},{"section":"replace-resourcequota-v1-core","subsections":[]},{"section":"patch-resourcequota-v1-core","subsections":[]},{"section":"create-resourcequota-v1-core","subsections":[]}]}]},{"section":"prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[{"section":"-strong-status-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"replace-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"read-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"patch-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"watch-list-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"watch-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"list-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"read-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"delete-collection-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"delete-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"replace-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"patch-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"create-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]}]},{"section":"persistentvolume-v1-core","subsections":[{"section":"-strong-status-operations-persistentvolume-v1-core-strong-","subsections":[{"section":"replace-status-persistentvolume-v1-core","subsections":[]},{"section":"read-status-persistentvolume-v1-core","subsections":[]},{"section":"patch-status-persistentvolume-v1-core","subsections":[]}]},{"section":"-strong-read-operations-persistentvolume-v1-core-strong-","subsections":[{"section":"watch-list-persistentvolume-v1-core","subsections":[]},{"section":"watch-persistentvolume-v1-core","subsections":[]},{"section":"list-persistentvolume-v1-core","subsections":[]},{"section":"read-persistentvolume-v1-core","subsections":[]}]},{"section":"-strong-write-operations-persistentvolume-v1-core-strong-","subsections":[{"section":"delete-collection-persistentvolume-v1-core","subsections":[]},{"section":"delete-persistentvolume-v1-core","subsections":[]},{"section":"replace-persistentvolume-v1-core","subsections":[]},{"section":"patch-persistentvolume-v1-core","subsections":[]},{"section":"create-persistentvolume-v1-core","subsections":[]}]}]},{"section":"node-v1-core","subsections":[{"section":"-strong-proxy-operations-node-v1-core-strong-","subsections":[{"section":"replace-connect-proxy-path-node-v1-core","subsections":[]},{"section":"replace-connect-proxy-node-v1-core","subsections":[]},{"section":"head-connect-proxy-path-node-v1-core","subsections":[]},{"section":"head-connect-proxy-node-v1-core","subsections":[]},{"section":"get-connect-proxy-path-node-v1-core","subsections":[]},{"section":"get-connect-proxy-node-v1-core","subsections":[]},{"section":"delete-connect-proxy-path-node-v1-core","subsections":[]},{"section":"delete-connect-proxy-node-v1-core","subsections":[]},{"section":"create-connect-proxy-path-node-v1-core","subsections":[]},{"section":"create-connect-proxy-node-v1-core","subsections":[]}]},{"section":"-strong-status-operations-node-v1-core-strong-","subsections":[{"section":"replace-status-node-v1-core","subsections":[]},{"section":"read-status-node-v1-core","subsections":[]},{"section":"patch-status-node-v1-core","subsections":[]}]},{"section":"-strong-read-operations-node-v1-core-strong-","subsections":[{"section":"watch-list-node-v1-core","subsections":[]},{"section":"watch-node-v1-core","subsections":[]},{"section":"list-node-v1-core","subsections":[]},{"section":"read-node-v1-core","subsections":[]}]},{"section":"-strong-write-operations-node-v1-core-strong-","subsections":[{"section":"delete-collection-node-v1-core","subsections":[]},{"section":"delete-node-v1-core","subsections":[]},{"section":"replace-node-v1-core","subsections":[]},{"section":"patch-node-v1-core","subsections":[]},{"section":"create-node-v1-core","subsections":[]}]}]},{"section":"namespace-v1-core","subsections":[{"section":"-strong-status-operations-namespace-v1-core-strong-","subsections":[{"section":"replace-status-namespace-v1-core","subsections":[]},{"section":"read-status-namespace-v1-core","subsections":[]},{"section":"patch-status-namespace-v1-core","subsections":[]}]},{"section":"-strong-read-operations-namespace-v1-core-strong-","subsections":[{"section":"watch-list-namespace-v1-core","subsections":[]},{"section":"watch-namespace-v1-core","subsections":[]},{"section":"list-namespace-v1-core","subsections":[]},{"section":"read-namespace-v1-core","subsections":[]}]},{"section":"-strong-write-operations-namespace-v1-core-strong-","subsections":[{"section":"delete-namespace-v1-core","subsections":[]},{"section":"replace-namespace-v1-core","subsections":[]},{"section":"patch-namespace-v1-core","subsections":[]},{"section":"create-namespace-v1-core","subsections":[]}]}]},{"section":"localsubjectaccessreview-v1-authorization-k8s-io","subsections":[{"section":"-strong-write-operations-localsubjectaccessreview-v1-authorization-k8s-io-strong-","subsections":[{"section":"create-localsubjectaccessreview-v1-authorization-k8s-io","subsections":[]}]}]},{"section":"lease-v1-coordination-k8s-io","subsections":[{"section":"-strong-read-operations-lease-v1-coordination-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-lease-v1-coordination-k8s-io","subsections":[]},{"section":"watch-list-lease-v1-coordination-k8s-io","subsections":[]},{"section":"watch-lease-v1-coordination-k8s-io","subsections":[]},{"section":"list-all-namespaces-lease-v1-coordination-k8s-io","subsections":[]},{"section":"list-lease-v1-coordination-k8s-io","subsections":[]},{"section":"read-lease-v1-coordination-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-lease-v1-coordination-k8s-io-strong-","subsections":[{"section":"delete-collection-lease-v1-coordination-k8s-io","subsections":[]},{"section":"delete-lease-v1-coordination-k8s-io","subsections":[]},{"section":"replace-lease-v1-coordination-k8s-io","subsections":[]},{"section":"patch-lease-v1-coordination-k8s-io","subsections":[]},{"section":"create-lease-v1-coordination-k8s-io","subsections":[]}]}]},{"section":"flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[{"section":"-strong-status-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"replace-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"read-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"patch-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"watch-list-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"watch-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"list-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"read-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"delete-collection-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"delete-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"replace-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"patch-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"create-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]}]},{"section":"componentstatus-v1-core","subsections":[{"section":"-strong-read-operations-componentstatus-v1-core-strong-","subsections":[{"section":"list-componentstatus-v1-core","subsections":[]},{"section":"read-componentstatus-v1-core","subsections":[]}]}]},{"section":"clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-clusterrolebinding-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-clusterrolebinding-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"clusterrole-v1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-clusterrole-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-clusterrole-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"certificatesigningrequest-v1-certificates-k8s-io","subsections":[{"section":"-strong-status-operations-certificatesigningrequest-v1-certificates-k8s-io-strong-","subsections":[{"section":"replace-status-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"read-status-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"patch-status-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-certificatesigningrequest-v1-certificates-k8s-io-strong-","subsections":[{"section":"watch-list-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"watch-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"list-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"read-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-certificatesigningrequest-v1-certificates-k8s-io-strong-","subsections":[{"section":"delete-collection-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"delete-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"replace-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"patch-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"create-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]}]}]},{"section":"binding-v1-core","subsections":[{"section":"-strong-write-operations-binding-v1-core-strong-","subsections":[{"section":"create-binding-v1-core","subsections":[]}]}]},{"section":"apiservice-v1-apiregistration-k8s-io","subsections":[{"section":"-strong-status-operations-apiservice-v1-apiregistration-k8s-io-strong-","subsections":[{"section":"replace-status-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"read-status-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"patch-status-apiservice-v1-apiregistration-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-apiservice-v1-apiregistration-k8s-io-strong-","subsections":[{"section":"watch-list-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"watch-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"list-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"read-apiservice-v1-apiregistration-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-apiservice-v1-apiregistration-k8s-io-strong-","subsections":[{"section":"delete-collection-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"delete-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"replace-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"patch-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"create-apiservice-v1-apiregistration-k8s-io","subsections":[]}]}]},{"section":"-strong-cluster-apis-strong-","subsections":[]},{"section":"podsecuritypolicy-v1beta1-policy","subsections":[{"section":"-strong-read-operations-podsecuritypolicy-v1beta1-policy-strong-","subsections":[{"section":"watch-list-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"watch-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"list-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"read-podsecuritypolicy-v1beta1-policy","subsections":[]}]},{"section":"-strong-write-operations-podsecuritypolicy-v1beta1-policy-strong-","subsections":[{"section":"delete-collection-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"delete-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"replace-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"patch-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"create-podsecuritypolicy-v1beta1-policy","subsections":[]}]}]},{"section":"priorityclass-v1-scheduling-k8s-io","subsections":[{"section":"-strong-read-operations-priorityclass-v1-scheduling-k8s-io-strong-","subsections":[{"section":"watch-list-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"watch-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"list-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"read-priorityclass-v1-scheduling-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-priorityclass-v1-scheduling-k8s-io-strong-","subsections":[{"section":"delete-collection-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"delete-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"replace-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"patch-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"create-priorityclass-v1-scheduling-k8s-io","subsections":[]}]}]},{"section":"poddisruptionbudget-v1-policy","subsections":[{"section":"-strong-status-operations-poddisruptionbudget-v1-policy-strong-","subsections":[{"section":"replace-status-poddisruptionbudget-v1-policy","subsections":[]},{"section":"read-status-poddisruptionbudget-v1-policy","subsections":[]},{"section":"patch-status-poddisruptionbudget-v1-policy","subsections":[]}]},{"section":"-strong-read-operations-poddisruptionbudget-v1-policy-strong-","subsections":[{"section":"watch-list-all-namespaces-poddisruptionbudget-v1-policy","subsections":[]},{"section":"watch-list-poddisruptionbudget-v1-policy","subsections":[]},{"section":"watch-poddisruptionbudget-v1-policy","subsections":[]},{"section":"list-all-namespaces-poddisruptionbudget-v1-policy","subsections":[]},{"section":"list-poddisruptionbudget-v1-policy","subsections":[]},{"section":"read-poddisruptionbudget-v1-policy","subsections":[]}]},{"section":"-strong-write-operations-poddisruptionbudget-v1-policy-strong-","subsections":[{"section":"delete-collection-poddisruptionbudget-v1-policy","subsections":[]},{"section":"delete-poddisruptionbudget-v1-policy","subsections":[]},{"section":"replace-poddisruptionbudget-v1-policy","subsections":[]},{"section":"patch-poddisruptionbudget-v1-policy","subsections":[]},{"section":"create-poddisruptionbudget-v1-policy","subsections":[]}]}]},{"section":"podtemplate-v1-core","subsections":[{"section":"-strong-read-operations-podtemplate-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-podtemplate-v1-core","subsections":[]},{"section":"watch-list-podtemplate-v1-core","subsections":[]},{"section":"watch-podtemplate-v1-core","subsections":[]},{"section":"list-all-namespaces-podtemplate-v1-core","subsections":[]},{"section":"list-podtemplate-v1-core","subsections":[]},{"section":"read-podtemplate-v1-core","subsections":[]}]},{"section":"-strong-write-operations-podtemplate-v1-core-strong-","subsections":[{"section":"delete-collection-podtemplate-v1-core","subsections":[]},{"section":"delete-podtemplate-v1-core","subsections":[]},{"section":"replace-podtemplate-v1-core","subsections":[]},{"section":"patch-podtemplate-v1-core","subsections":[]},{"section":"create-podtemplate-v1-core","subsections":[]}]}]},{"section":"validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[{"section":"-strong-read-operations-validatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","subsections":[{"section":"watch-list-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"watch-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"list-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"read-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-validatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","subsections":[{"section":"delete-collection-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"delete-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"replace-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"patch-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"create-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]}]}]},{"section":"mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[{"section":"-strong-read-operations-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","subsections":[{"section":"watch-list-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"watch-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"list-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"read-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","subsections":[{"section":"delete-collection-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"delete-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"replace-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"patch-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"create-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]}]}]},{"section":"horizontalpodautoscaler-v1-autoscaling","subsections":[{"section":"-strong-status-operations-horizontalpodautoscaler-v1-autoscaling-strong-","subsections":[{"section":"replace-status-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"read-status-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"patch-status-horizontalpodautoscaler-v1-autoscaling","subsections":[]}]},{"section":"-strong-read-operations-horizontalpodautoscaler-v1-autoscaling-strong-","subsections":[{"section":"watch-list-all-namespaces-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"watch-list-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"watch-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"list-all-namespaces-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"list-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"read-horizontalpodautoscaler-v1-autoscaling","subsections":[]}]},{"section":"-strong-write-operations-horizontalpodautoscaler-v1-autoscaling-strong-","subsections":[{"section":"delete-collection-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"delete-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"replace-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"patch-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"create-horizontalpodautoscaler-v1-autoscaling","subsections":[]}]}]},{"section":"limitrange-v1-core","subsections":[{"section":"-strong-read-operations-limitrange-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-limitrange-v1-core","subsections":[]},{"section":"watch-list-limitrange-v1-core","subsections":[]},{"section":"watch-limitrange-v1-core","subsections":[]},{"section":"list-all-namespaces-limitrange-v1-core","subsections":[]},{"section":"list-limitrange-v1-core","subsections":[]},{"section":"read-limitrange-v1-core","subsections":[]}]},{"section":"-strong-write-operations-limitrange-v1-core-strong-","subsections":[{"section":"delete-collection-limitrange-v1-core","subsections":[]},{"section":"delete-limitrange-v1-core","subsections":[]},{"section":"replace-limitrange-v1-core","subsections":[]},{"section":"patch-limitrange-v1-core","subsections":[]},{"section":"create-limitrange-v1-core","subsections":[]}]}]},{"section":"event-v1-events-k8s-io","subsections":[{"section":"-strong-read-operations-event-v1-events-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-event-v1-events-k8s-io","subsections":[]},{"section":"watch-list-event-v1-events-k8s-io","subsections":[]},{"section":"watch-event-v1-events-k8s-io","subsections":[]},{"section":"list-all-namespaces-event-v1-events-k8s-io","subsections":[]},{"section":"list-event-v1-events-k8s-io","subsections":[]},{"section":"read-event-v1-events-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-event-v1-events-k8s-io-strong-","subsections":[{"section":"delete-collection-event-v1-events-k8s-io","subsections":[]},{"section":"delete-event-v1-events-k8s-io","subsections":[]},{"section":"replace-event-v1-events-k8s-io","subsections":[]},{"section":"patch-event-v1-events-k8s-io","subsections":[]},{"section":"create-event-v1-events-k8s-io","subsections":[]}]}]},{"section":"customresourcedefinition-v1-apiextensions-k8s-io","subsections":[{"section":"-strong-status-operations-customresourcedefinition-v1-apiextensions-k8s-io-strong-","subsections":[{"section":"replace-status-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"read-status-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"patch-status-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-customresourcedefinition-v1-apiextensions-k8s-io-strong-","subsections":[{"section":"watch-list-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"watch-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"list-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"read-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-customresourcedefinition-v1-apiextensions-k8s-io-strong-","subsections":[{"section":"delete-collection-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"delete-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"replace-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"patch-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"create-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]}]}]},{"section":"controllerrevision-v1-apps","subsections":[{"section":"-strong-read-operations-controllerrevision-v1-apps-strong-","subsections":[{"section":"watch-list-all-namespaces-controllerrevision-v1-apps","subsections":[]},{"section":"watch-list-controllerrevision-v1-apps","subsections":[]},{"section":"watch-controllerrevision-v1-apps","subsections":[]},{"section":"list-all-namespaces-controllerrevision-v1-apps","subsections":[]},{"section":"list-controllerrevision-v1-apps","subsections":[]},{"section":"read-controllerrevision-v1-apps","subsections":[]}]},{"section":"-strong-write-operations-controllerrevision-v1-apps-strong-","subsections":[{"section":"delete-collection-controllerrevision-v1-apps","subsections":[]},{"section":"delete-controllerrevision-v1-apps","subsections":[]},{"section":"replace-controllerrevision-v1-apps","subsections":[]},{"section":"patch-controllerrevision-v1-apps","subsections":[]},{"section":"create-controllerrevision-v1-apps","subsections":[]}]}]},{"section":"-strong-metadata-apis-strong-","subsections":[]},{"section":"volumeattachment-v1-storage-k8s-io","subsections":[{"section":"-strong-status-operations-volumeattachment-v1-storage-k8s-io-strong-","subsections":[{"section":"replace-status-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"read-status-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"patch-status-volumeattachment-v1-storage-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-volumeattachment-v1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"watch-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"list-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"read-volumeattachment-v1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-volumeattachment-v1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"delete-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"replace-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"patch-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"create-volumeattachment-v1-storage-k8s-io","subsections":[]}]}]},{"section":"volume-v1-core","subsections":[]},{"section":"csistoragecapacity-v1beta1-storage-k8s-io","subsections":[{"section":"-strong-read-operations-csistoragecapacity-v1beta1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"watch-list-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"watch-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"list-all-namespaces-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"list-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"read-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-csistoragecapacity-v1beta1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"delete-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"replace-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"patch-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"create-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]}]}]},{"section":"storageclass-v1-storage-k8s-io","subsections":[{"section":"-strong-read-operations-storageclass-v1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"watch-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"list-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"read-storageclass-v1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-storageclass-v1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"delete-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"replace-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"patch-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"create-storageclass-v1-storage-k8s-io","subsections":[]}]}]},{"section":"persistentvolumeclaim-v1-core","subsections":[{"section":"-strong-status-operations-persistentvolumeclaim-v1-core-strong-","subsections":[{"section":"replace-status-persistentvolumeclaim-v1-core","subsections":[]},{"section":"read-status-persistentvolumeclaim-v1-core","subsections":[]},{"section":"patch-status-persistentvolumeclaim-v1-core","subsections":[]}]},{"section":"-strong-read-operations-persistentvolumeclaim-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-persistentvolumeclaim-v1-core","subsections":[]},{"section":"watch-list-persistentvolumeclaim-v1-core","subsections":[]},{"section":"watch-persistentvolumeclaim-v1-core","subsections":[]},{"section":"list-all-namespaces-persistentvolumeclaim-v1-core","subsections":[]},{"section":"list-persistentvolumeclaim-v1-core","subsections":[]},{"section":"read-persistentvolumeclaim-v1-core","subsections":[]}]},{"section":"-strong-write-operations-persistentvolumeclaim-v1-core-strong-","subsections":[{"section":"delete-collection-persistentvolumeclaim-v1-core","subsections":[]},{"section":"delete-persistentvolumeclaim-v1-core","subsections":[]},{"section":"replace-persistentvolumeclaim-v1-core","subsections":[]},{"section":"patch-persistentvolumeclaim-v1-core","subsections":[]},{"section":"create-persistentvolumeclaim-v1-core","subsections":[]}]}]},{"section":"secret-v1-core","subsections":[{"section":"-strong-read-operations-secret-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-secret-v1-core","subsections":[]},{"section":"watch-list-secret-v1-core","subsections":[]},{"section":"watch-secret-v1-core","subsections":[]},{"section":"list-all-namespaces-secret-v1-core","subsections":[]},{"section":"list-secret-v1-core","subsections":[]},{"section":"read-secret-v1-core","subsections":[]}]},{"section":"-strong-write-operations-secret-v1-core-strong-","subsections":[{"section":"delete-collection-secret-v1-core","subsections":[]},{"section":"delete-secret-v1-core","subsections":[]},{"section":"replace-secret-v1-core","subsections":[]},{"section":"patch-secret-v1-core","subsections":[]},{"section":"create-secret-v1-core","subsections":[]}]}]},{"section":"csinode-v1-storage-k8s-io","subsections":[{"section":"-strong-read-operations-csinode-v1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-csinode-v1-storage-k8s-io","subsections":[]},{"section":"watch-csinode-v1-storage-k8s-io","subsections":[]},{"section":"list-csinode-v1-storage-k8s-io","subsections":[]},{"section":"read-csinode-v1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-csinode-v1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-csinode-v1-storage-k8s-io","subsections":[]},{"section":"delete-csinode-v1-storage-k8s-io","subsections":[]},{"section":"replace-csinode-v1-storage-k8s-io","subsections":[]},{"section":"patch-csinode-v1-storage-k8s-io","subsections":[]},{"section":"create-csinode-v1-storage-k8s-io","subsections":[]}]}]},{"section":"csidriver-v1-storage-k8s-io","subsections":[{"section":"-strong-read-operations-csidriver-v1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"watch-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"list-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"read-csidriver-v1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-csidriver-v1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"delete-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"replace-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"patch-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"create-csidriver-v1-storage-k8s-io","subsections":[]}]}]},{"section":"configmap-v1-core","subsections":[{"section":"-strong-read-operations-configmap-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-configmap-v1-core","subsections":[]},{"section":"watch-list-configmap-v1-core","subsections":[]},{"section":"watch-configmap-v1-core","subsections":[]},{"section":"list-all-namespaces-configmap-v1-core","subsections":[]},{"section":"list-configmap-v1-core","subsections":[]},{"section":"read-configmap-v1-core","subsections":[]}]},{"section":"-strong-write-operations-configmap-v1-core-strong-","subsections":[{"section":"delete-collection-configmap-v1-core","subsections":[]},{"section":"delete-configmap-v1-core","subsections":[]},{"section":"replace-configmap-v1-core","subsections":[]},{"section":"patch-configmap-v1-core","subsections":[]},{"section":"create-configmap-v1-core","subsections":[]}]}]},{"section":"-strong-config-and-storage-apis-strong-","subsections":[]},{"section":"service-v1-core","subsections":[{"section":"-strong-proxy-operations-service-v1-core-strong-","subsections":[{"section":"replace-connect-proxy-path-service-v1-core","subsections":[]},{"section":"replace-connect-proxy-service-v1-core","subsections":[]},{"section":"head-connect-proxy-path-service-v1-core","subsections":[]},{"section":"head-connect-proxy-service-v1-core","subsections":[]},{"section":"get-connect-proxy-path-service-v1-core","subsections":[]},{"section":"get-connect-proxy-service-v1-core","subsections":[]},{"section":"delete-connect-proxy-path-service-v1-core","subsections":[]},{"section":"delete-connect-proxy-service-v1-core","subsections":[]},{"section":"create-connect-proxy-path-service-v1-core","subsections":[]},{"section":"create-connect-proxy-service-v1-core","subsections":[]}]},{"section":"-strong-status-operations-service-v1-core-strong-","subsections":[{"section":"replace-status-service-v1-core","subsections":[]},{"section":"read-status-service-v1-core","subsections":[]},{"section":"patch-status-service-v1-core","subsections":[]}]},{"section":"-strong-read-operations-service-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-service-v1-core","subsections":[]},{"section":"watch-list-service-v1-core","subsections":[]},{"section":"watch-service-v1-core","subsections":[]},{"section":"list-all-namespaces-service-v1-core","subsections":[]},{"section":"list-service-v1-core","subsections":[]},{"section":"read-service-v1-core","subsections":[]}]},{"section":"-strong-write-operations-service-v1-core-strong-","subsections":[{"section":"delete-service-v1-core","subsections":[]},{"section":"replace-service-v1-core","subsections":[]},{"section":"patch-service-v1-core","subsections":[]},{"section":"create-service-v1-core","subsections":[]}]}]},{"section":"ingressclass-v1-networking-k8s-io","subsections":[{"section":"-strong-read-operations-ingressclass-v1-networking-k8s-io-strong-","subsections":[{"section":"watch-list-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"watch-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"list-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"read-ingressclass-v1-networking-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-ingressclass-v1-networking-k8s-io-strong-","subsections":[{"section":"delete-collection-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"delete-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"replace-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"patch-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"create-ingressclass-v1-networking-k8s-io","subsections":[]}]}]},{"section":"ingress-v1-networking-k8s-io","subsections":[{"section":"-strong-status-operations-ingress-v1-networking-k8s-io-strong-","subsections":[{"section":"replace-status-ingress-v1-networking-k8s-io","subsections":[]},{"section":"read-status-ingress-v1-networking-k8s-io","subsections":[]},{"section":"patch-status-ingress-v1-networking-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-ingress-v1-networking-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-ingress-v1-networking-k8s-io","subsections":[]},{"section":"watch-list-ingress-v1-networking-k8s-io","subsections":[]},{"section":"watch-ingress-v1-networking-k8s-io","subsections":[]},{"section":"list-all-namespaces-ingress-v1-networking-k8s-io","subsections":[]},{"section":"list-ingress-v1-networking-k8s-io","subsections":[]},{"section":"read-ingress-v1-networking-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-ingress-v1-networking-k8s-io-strong-","subsections":[{"section":"delete-collection-ingress-v1-networking-k8s-io","subsections":[]},{"section":"delete-ingress-v1-networking-k8s-io","subsections":[]},{"section":"replace-ingress-v1-networking-k8s-io","subsections":[]},{"section":"patch-ingress-v1-networking-k8s-io","subsections":[]},{"section":"create-ingress-v1-networking-k8s-io","subsections":[]}]}]},{"section":"endpointslice-v1-discovery-k8s-io","subsections":[{"section":"-strong-read-operations-endpointslice-v1-discovery-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"watch-list-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"watch-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"list-all-namespaces-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"list-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"read-endpointslice-v1-discovery-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-endpointslice-v1-discovery-k8s-io-strong-","subsections":[{"section":"delete-collection-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"delete-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"replace-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"patch-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"create-endpointslice-v1-discovery-k8s-io","subsections":[]}]}]},{"section":"endpoints-v1-core","subsections":[{"section":"-strong-read-operations-endpoints-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-endpoints-v1-core","subsections":[]},{"section":"watch-list-endpoints-v1-core","subsections":[]},{"section":"watch-endpoints-v1-core","subsections":[]},{"section":"list-all-namespaces-endpoints-v1-core","subsections":[]},{"section":"list-endpoints-v1-core","subsections":[]},{"section":"read-endpoints-v1-core","subsections":[]}]},{"section":"-strong-write-operations-endpoints-v1-core-strong-","subsections":[{"section":"delete-collection-endpoints-v1-core","subsections":[]},{"section":"delete-endpoints-v1-core","subsections":[]},{"section":"replace-endpoints-v1-core","subsections":[]},{"section":"patch-endpoints-v1-core","subsections":[]},{"section":"create-endpoints-v1-core","subsections":[]}]}]},{"section":"-strong-service-apis-strong-","subsections":[]},{"section":"statefulset-v1-apps","subsections":[{"section":"-strong-misc-operations-statefulset-v1-apps-strong-","subsections":[{"section":"patch-scale-statefulset-v1-apps","subsections":[]},{"section":"replace-scale-statefulset-v1-apps","subsections":[]},{"section":"read-scale-statefulset-v1-apps","subsections":[]}]},{"section":"-strong-status-operations-statefulset-v1-apps-strong-","subsections":[{"section":"replace-status-statefulset-v1-apps","subsections":[]},{"section":"read-status-statefulset-v1-apps","subsections":[]},{"section":"patch-status-statefulset-v1-apps","subsections":[]}]},{"section":"-strong-read-operations-statefulset-v1-apps-strong-","subsections":[{"section":"watch-list-all-namespaces-statefulset-v1-apps","subsections":[]},{"section":"watch-list-statefulset-v1-apps","subsections":[]},{"section":"watch-statefulset-v1-apps","subsections":[]},{"section":"list-all-namespaces-statefulset-v1-apps","subsections":[]},{"section":"list-statefulset-v1-apps","subsections":[]},{"section":"read-statefulset-v1-apps","subsections":[]}]},{"section":"-strong-write-operations-statefulset-v1-apps-strong-","subsections":[{"section":"delete-collection-statefulset-v1-apps","subsections":[]},{"section":"delete-statefulset-v1-apps","subsections":[]},{"section":"replace-statefulset-v1-apps","subsections":[]},{"section":"patch-statefulset-v1-apps","subsections":[]},{"section":"create-statefulset-v1-apps","subsections":[]}]}]},{"section":"replicationcontroller-v1-core","subsections":[{"section":"-strong-misc-operations-replicationcontroller-v1-core-strong-","subsections":[{"section":"patch-scale-replicationcontroller-v1-core","subsections":[]},{"section":"replace-scale-replicationcontroller-v1-core","subsections":[]},{"section":"read-scale-replicationcontroller-v1-core","subsections":[]}]},{"section":"-strong-status-operations-replicationcontroller-v1-core-strong-","subsections":[{"section":"replace-status-replicationcontroller-v1-core","subsections":[]},{"section":"read-status-replicationcontroller-v1-core","subsections":[]},{"section":"patch-status-replicationcontroller-v1-core","subsections":[]}]},{"section":"-strong-read-operations-replicationcontroller-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-replicationcontroller-v1-core","subsections":[]},{"section":"watch-list-replicationcontroller-v1-core","subsections":[]},{"section":"watch-replicationcontroller-v1-core","subsections":[]},{"section":"list-all-namespaces-replicationcontroller-v1-core","subsections":[]},{"section":"list-replicationcontroller-v1-core","subsections":[]},{"section":"read-replicationcontroller-v1-core","subsections":[]}]},{"section":"-strong-write-operations-replicationcontroller-v1-core-strong-","subsections":[{"section":"delete-collection-replicationcontroller-v1-core","subsections":[]},{"section":"delete-replicationcontroller-v1-core","subsections":[]},{"section":"replace-replicationcontroller-v1-core","subsections":[]},{"section":"patch-replicationcontroller-v1-core","subsections":[]},{"section":"create-replicationcontroller-v1-core","subsections":[]}]}]},{"section":"replicaset-v1-apps","subsections":[{"section":"-strong-misc-operations-replicaset-v1-apps-strong-","subsections":[{"section":"patch-scale-replicaset-v1-apps","subsections":[]},{"section":"replace-scale-replicaset-v1-apps","subsections":[]},{"section":"read-scale-replicaset-v1-apps","subsections":[]}]},{"section":"-strong-status-operations-replicaset-v1-apps-strong-","subsections":[{"section":"replace-status-replicaset-v1-apps","subsections":[]},{"section":"read-status-replicaset-v1-apps","subsections":[]},{"section":"patch-status-replicaset-v1-apps","subsections":[]}]},{"section":"-strong-read-operations-replicaset-v1-apps-strong-","subsections":[{"section":"watch-list-all-namespaces-replicaset-v1-apps","subsections":[]},{"section":"watch-list-replicaset-v1-apps","subsections":[]},{"section":"watch-replicaset-v1-apps","subsections":[]},{"section":"list-all-namespaces-replicaset-v1-apps","subsections":[]},{"section":"list-replicaset-v1-apps","subsections":[]},{"section":"read-replicaset-v1-apps","subsections":[]}]},{"section":"-strong-write-operations-replicaset-v1-apps-strong-","subsections":[{"section":"delete-collection-replicaset-v1-apps","subsections":[]},{"section":"delete-replicaset-v1-apps","subsections":[]},{"section":"replace-replicaset-v1-apps","subsections":[]},{"section":"patch-replicaset-v1-apps","subsections":[]},{"section":"create-replicaset-v1-apps","subsections":[]}]}]},{"section":"pod-v1-core","subsections":[{"section":"-strong-misc-operations-pod-v1-core-strong-","subsections":[{"section":"read-log-pod-v1-core","subsections":[]}]},{"section":"-strong-proxy-operations-pod-v1-core-strong-","subsections":[{"section":"replace-connect-proxy-path-pod-v1-core","subsections":[]},{"section":"replace-connect-proxy-pod-v1-core","subsections":[]},{"section":"head-connect-proxy-path-pod-v1-core","subsections":[]},{"section":"head-connect-proxy-pod-v1-core","subsections":[]},{"section":"get-connect-proxy-path-pod-v1-core","subsections":[]},{"section":"get-connect-proxy-pod-v1-core","subsections":[]},{"section":"get-connect-portforward-pod-v1-core","subsections":[]},{"section":"delete-connect-proxy-path-pod-v1-core","subsections":[]},{"section":"delete-connect-proxy-pod-v1-core","subsections":[]},{"section":"create-connect-proxy-path-pod-v1-core","subsections":[]},{"section":"create-connect-proxy-pod-v1-core","subsections":[]},{"section":"create-connect-portforward-pod-v1-core","subsections":[]}]},{"section":"-strong-ephemeralcontainers-operations-pod-v1-core-strong-","subsections":[{"section":"replace-ephemeralcontainers-pod-v1-core","subsections":[]},{"section":"read-ephemeralcontainers-pod-v1-core","subsections":[]},{"section":"patch-ephemeralcontainers-pod-v1-core","subsections":[]}]},{"section":"-strong-status-operations-pod-v1-core-strong-","subsections":[{"section":"replace-status-pod-v1-core","subsections":[]},{"section":"read-status-pod-v1-core","subsections":[]},{"section":"patch-status-pod-v1-core","subsections":[]}]},{"section":"-strong-read-operations-pod-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-pod-v1-core","subsections":[]},{"section":"watch-list-pod-v1-core","subsections":[]},{"section":"watch-pod-v1-core","subsections":[]},{"section":"list-all-namespaces-pod-v1-core","subsections":[]},{"section":"list-pod-v1-core","subsections":[]},{"section":"read-pod-v1-core","subsections":[]}]},{"section":"-strong-write-operations-pod-v1-core-strong-","subsections":[{"section":"delete-collection-pod-v1-core","subsections":[]},{"section":"delete-pod-v1-core","subsections":[]},{"section":"replace-pod-v1-core","subsections":[]},{"section":"patch-pod-v1-core","subsections":[]},{"section":"create-eviction-pod-v1-core","subsections":[]},{"section":"create-pod-v1-core","subsections":[]}]}]},{"section":"job-v1-batch","subsections":[{"section":"-strong-status-operations-job-v1-batch-strong-","subsections":[{"section":"replace-status-job-v1-batch","subsections":[]},{"section":"read-status-job-v1-batch","subsections":[]},{"section":"patch-status-job-v1-batch","subsections":[]}]},{"section":"-strong-read-operations-job-v1-batch-strong-","subsections":[{"section":"watch-list-all-namespaces-job-v1-batch","subsections":[]},{"section":"watch-list-job-v1-batch","subsections":[]},{"section":"watch-job-v1-batch","subsections":[]},{"section":"list-all-namespaces-job-v1-batch","subsections":[]},{"section":"list-job-v1-batch","subsections":[]},{"section":"read-job-v1-batch","subsections":[]}]},{"section":"-strong-write-operations-job-v1-batch-strong-","subsections":[{"section":"delete-collection-job-v1-batch","subsections":[]},{"section":"delete-job-v1-batch","subsections":[]},{"section":"replace-job-v1-batch","subsections":[]},{"section":"patch-job-v1-batch","subsections":[]},{"section":"create-job-v1-batch","subsections":[]}]}]},{"section":"deployment-v1-apps","subsections":[{"section":"-strong-misc-operations-deployment-v1-apps-strong-","subsections":[{"section":"patch-scale-deployment-v1-apps","subsections":[]},{"section":"replace-scale-deployment-v1-apps","subsections":[]},{"section":"read-scale-deployment-v1-apps","subsections":[]}]},{"section":"-strong-status-operations-deployment-v1-apps-strong-","subsections":[{"section":"replace-status-deployment-v1-apps","subsections":[]},{"section":"read-status-deployment-v1-apps","subsections":[]},{"section":"patch-status-deployment-v1-apps","subsections":[]}]},{"section":"-strong-read-operations-deployment-v1-apps-strong-","subsections":[{"section":"watch-list-all-namespaces-deployment-v1-apps","subsections":[]},{"section":"watch-list-deployment-v1-apps","subsections":[]},{"section":"watch-deployment-v1-apps","subsections":[]},{"section":"list-all-namespaces-deployment-v1-apps","subsections":[]},{"section":"list-deployment-v1-apps","subsections":[]},{"section":"read-deployment-v1-apps","subsections":[]}]},{"section":"-strong-write-operations-deployment-v1-apps-strong-","subsections":[{"section":"delete-collection-deployment-v1-apps","subsections":[]},{"section":"delete-deployment-v1-apps","subsections":[]},{"section":"replace-deployment-v1-apps","subsections":[]},{"section":"patch-deployment-v1-apps","subsections":[]},{"section":"create-deployment-v1-apps","subsections":[]}]}]},{"section":"daemonset-v1-apps","subsections":[{"section":"-strong-status-operations-daemonset-v1-apps-strong-","subsections":[{"section":"replace-status-daemonset-v1-apps","subsections":[]},{"section":"read-status-daemonset-v1-apps","subsections":[]},{"section":"patch-status-daemonset-v1-apps","subsections":[]}]},{"section":"-strong-read-operations-daemonset-v1-apps-strong-","subsections":[{"section":"watch-list-all-namespaces-daemonset-v1-apps","subsections":[]},{"section":"watch-list-daemonset-v1-apps","subsections":[]},{"section":"watch-daemonset-v1-apps","subsections":[]},{"section":"list-all-namespaces-daemonset-v1-apps","subsections":[]},{"section":"list-daemonset-v1-apps","subsections":[]},{"section":"read-daemonset-v1-apps","subsections":[]}]},{"section":"-strong-write-operations-daemonset-v1-apps-strong-","subsections":[{"section":"delete-collection-daemonset-v1-apps","subsections":[]},{"section":"delete-daemonset-v1-apps","subsections":[]},{"section":"replace-daemonset-v1-apps","subsections":[]},{"section":"patch-daemonset-v1-apps","subsections":[]},{"section":"create-daemonset-v1-apps","subsections":[]}]}]},{"section":"cronjob-v1-batch","subsections":[{"section":"-strong-status-operations-cronjob-v1-batch-strong-","subsections":[{"section":"replace-status-cronjob-v1-batch","subsections":[]},{"section":"read-status-cronjob-v1-batch","subsections":[]},{"section":"patch-status-cronjob-v1-batch","subsections":[]}]},{"section":"-strong-read-operations-cronjob-v1-batch-strong-","subsections":[{"section":"watch-list-all-namespaces-cronjob-v1-batch","subsections":[]},{"section":"watch-list-cronjob-v1-batch","subsections":[]},{"section":"watch-cronjob-v1-batch","subsections":[]},{"section":"list-all-namespaces-cronjob-v1-batch","subsections":[]},{"section":"list-cronjob-v1-batch","subsections":[]},{"section":"read-cronjob-v1-batch","subsections":[]}]},{"section":"-strong-write-operations-cronjob-v1-batch-strong-","subsections":[{"section":"delete-collection-cronjob-v1-batch","subsections":[]},{"section":"delete-cronjob-v1-batch","subsections":[]},{"section":"replace-cronjob-v1-batch","subsections":[]},{"section":"patch-cronjob-v1-batch","subsections":[]},{"section":"create-cronjob-v1-batch","subsections":[]}]}]},{"section":"container-v1-core","subsections":[]},{"section":"-strong-workloads-apis-strong-","subsections":[]},{"section":"-strong-api-groups-strong-","subsections":[]},{"section":"-strong-api-overview-strong-","subsections":[]}],"flatToc":["webhookclientconfig-v1-apiextensions-k8s-io","volumeerror-v1alpha1-storage-k8s-io","volumeattachmentsource-v1alpha1-storage-k8s-io","watch-list-volumeattachment-v1alpha1-storage-k8s-io","watch-volumeattachment-v1alpha1-storage-k8s-io","list-volumeattachment-v1alpha1-storage-k8s-io","read-volumeattachment-v1alpha1-storage-k8s-io","-strong-read-operations-volumeattachment-v1alpha1-storage-k8s-io-strong-","delete-collection-volumeattachment-v1alpha1-storage-k8s-io","delete-volumeattachment-v1alpha1-storage-k8s-io","replace-volumeattachment-v1alpha1-storage-k8s-io","patch-volumeattachment-v1alpha1-storage-k8s-io","create-volumeattachment-v1alpha1-storage-k8s-io","-strong-write-operations-volumeattachment-v1alpha1-storage-k8s-io-strong-","volumeattachment-v1alpha1-storage-k8s-io","tokenrequest-v1-storage-k8s-io","subject-v1alpha1-rbac-authorization-k8s-io","subject-v1-rbac-authorization-k8s-io","servicereference-v1-apiregistration-k8s-io","servicereference-v1-apiextensions-k8s-io","scheduling-v1alpha1-node-k8s-io","scheduling-v1beta1-node-k8s-io","watch-list-runtimeclass-v1alpha1-node-k8s-io","watch-runtimeclass-v1alpha1-node-k8s-io","list-runtimeclass-v1alpha1-node-k8s-io","read-runtimeclass-v1alpha1-node-k8s-io","-strong-read-operations-runtimeclass-v1alpha1-node-k8s-io-strong-","delete-collection-runtimeclass-v1alpha1-node-k8s-io","delete-runtimeclass-v1alpha1-node-k8s-io","replace-runtimeclass-v1alpha1-node-k8s-io","patch-runtimeclass-v1alpha1-node-k8s-io","create-runtimeclass-v1alpha1-node-k8s-io","-strong-write-operations-runtimeclass-v1alpha1-node-k8s-io-strong-","runtimeclass-v1alpha1-node-k8s-io","watch-list-runtimeclass-v1beta1-node-k8s-io","watch-runtimeclass-v1beta1-node-k8s-io","list-runtimeclass-v1beta1-node-k8s-io","read-runtimeclass-v1beta1-node-k8s-io","-strong-read-operations-runtimeclass-v1beta1-node-k8s-io-strong-","delete-collection-runtimeclass-v1beta1-node-k8s-io","delete-runtimeclass-v1beta1-node-k8s-io","replace-runtimeclass-v1beta1-node-k8s-io","patch-runtimeclass-v1beta1-node-k8s-io","create-runtimeclass-v1beta1-node-k8s-io","-strong-write-operations-runtimeclass-v1beta1-node-k8s-io-strong-","runtimeclass-v1beta1-node-k8s-io","roleref-v1alpha1-rbac-authorization-k8s-io","watch-list-all-namespaces-rolebinding-v1alpha1-rbac-authorization-k8s-io","watch-list-rolebinding-v1alpha1-rbac-authorization-k8s-io","watch-rolebinding-v1alpha1-rbac-authorization-k8s-io","list-all-namespaces-rolebinding-v1alpha1-rbac-authorization-k8s-io","list-rolebinding-v1alpha1-rbac-authorization-k8s-io","read-rolebinding-v1alpha1-rbac-authorization-k8s-io","-strong-read-operations-rolebinding-v1alpha1-rbac-authorization-k8s-io-strong-","delete-collection-rolebinding-v1alpha1-rbac-authorization-k8s-io","delete-rolebinding-v1alpha1-rbac-authorization-k8s-io","replace-rolebinding-v1alpha1-rbac-authorization-k8s-io","patch-rolebinding-v1alpha1-rbac-authorization-k8s-io","create-rolebinding-v1alpha1-rbac-authorization-k8s-io","-strong-write-operations-rolebinding-v1alpha1-rbac-authorization-k8s-io-strong-","rolebinding-v1alpha1-rbac-authorization-k8s-io","watch-list-all-namespaces-role-v1alpha1-rbac-authorization-k8s-io","watch-list-role-v1alpha1-rbac-authorization-k8s-io","watch-role-v1alpha1-rbac-authorization-k8s-io","list-all-namespaces-role-v1alpha1-rbac-authorization-k8s-io","list-role-v1alpha1-rbac-authorization-k8s-io","read-role-v1alpha1-rbac-authorization-k8s-io","-strong-read-operations-role-v1alpha1-rbac-authorization-k8s-io-strong-","delete-collection-role-v1alpha1-rbac-authorization-k8s-io","delete-role-v1alpha1-rbac-authorization-k8s-io","replace-role-v1alpha1-rbac-authorization-k8s-io","patch-role-v1alpha1-rbac-authorization-k8s-io","create-role-v1alpha1-rbac-authorization-k8s-io","-strong-write-operations-role-v1alpha1-rbac-authorization-k8s-io-strong-","role-v1alpha1-rbac-authorization-k8s-io","resourcemetricstatus-v2beta1-autoscaling","resourcemetricsource-v2beta1-autoscaling","watch-list-priorityclass-v1alpha1-scheduling-k8s-io","watch-priorityclass-v1alpha1-scheduling-k8s-io","list-priorityclass-v1alpha1-scheduling-k8s-io","read-priorityclass-v1alpha1-scheduling-k8s-io","-strong-read-operations-priorityclass-v1alpha1-scheduling-k8s-io-strong-","delete-collection-priorityclass-v1alpha1-scheduling-k8s-io","delete-priorityclass-v1alpha1-scheduling-k8s-io","replace-priorityclass-v1alpha1-scheduling-k8s-io","patch-priorityclass-v1alpha1-scheduling-k8s-io","create-priorityclass-v1alpha1-scheduling-k8s-io","-strong-write-operations-priorityclass-v1alpha1-scheduling-k8s-io-strong-","priorityclass-v1alpha1-scheduling-k8s-io","policyrule-v1alpha1-rbac-authorization-k8s-io","podsmetricstatus-v2beta1-autoscaling","podsmetricsource-v2beta1-autoscaling","replace-status-poddisruptionbudget-v1beta1-policy","read-status-poddisruptionbudget-v1beta1-policy","patch-status-poddisruptionbudget-v1beta1-policy","-strong-status-operations-poddisruptionbudget-v1beta1-policy-strong-","watch-list-all-namespaces-poddisruptionbudget-v1beta1-policy","watch-list-poddisruptionbudget-v1beta1-policy","watch-poddisruptionbudget-v1beta1-policy","list-all-namespaces-poddisruptionbudget-v1beta1-policy","list-poddisruptionbudget-v1beta1-policy","read-poddisruptionbudget-v1beta1-policy","-strong-read-operations-poddisruptionbudget-v1beta1-policy-strong-","delete-collection-poddisruptionbudget-v1beta1-policy","delete-poddisruptionbudget-v1beta1-policy","replace-poddisruptionbudget-v1beta1-policy","patch-poddisruptionbudget-v1beta1-policy","create-poddisruptionbudget-v1beta1-policy","-strong-write-operations-poddisruptionbudget-v1beta1-policy-strong-","poddisruptionbudget-v1beta1-policy","overhead-v1alpha1-node-k8s-io","overhead-v1beta1-node-k8s-io","objectmetricstatus-v2beta1-autoscaling","objectmetricsource-v2beta1-autoscaling","metricstatus-v2beta1-autoscaling","metricspec-v2beta1-autoscaling","jobtemplatespec-v1beta1-batch","horizontalpodautoscalercondition-v2beta1-autoscaling","replace-status-horizontalpodautoscaler-v2beta1-autoscaling","read-status-horizontalpodautoscaler-v2beta1-autoscaling","patch-status-horizontalpodautoscaler-v2beta1-autoscaling","-strong-status-operations-horizontalpodautoscaler-v2beta1-autoscaling-strong-","watch-list-all-namespaces-horizontalpodautoscaler-v2beta1-autoscaling","watch-list-horizontalpodautoscaler-v2beta1-autoscaling","watch-horizontalpodautoscaler-v2beta1-autoscaling","list-all-namespaces-horizontalpodautoscaler-v2beta1-autoscaling","list-horizontalpodautoscaler-v2beta1-autoscaling","read-horizontalpodautoscaler-v2beta1-autoscaling","-strong-read-operations-horizontalpodautoscaler-v2beta1-autoscaling-strong-","delete-collection-horizontalpodautoscaler-v2beta1-autoscaling","delete-horizontalpodautoscaler-v2beta1-autoscaling","replace-horizontalpodautoscaler-v2beta1-autoscaling","patch-horizontalpodautoscaler-v2beta1-autoscaling","create-horizontalpodautoscaler-v2beta1-autoscaling","-strong-write-operations-horizontalpodautoscaler-v2beta1-autoscaling-strong-","horizontalpodautoscaler-v2beta1-autoscaling","replace-status-horizontalpodautoscaler-v2beta2-autoscaling","read-status-horizontalpodautoscaler-v2beta2-autoscaling","patch-status-horizontalpodautoscaler-v2beta2-autoscaling","-strong-status-operations-horizontalpodautoscaler-v2beta2-autoscaling-strong-","watch-list-all-namespaces-horizontalpodautoscaler-v2beta2-autoscaling","watch-list-horizontalpodautoscaler-v2beta2-autoscaling","watch-horizontalpodautoscaler-v2beta2-autoscaling","list-all-namespaces-horizontalpodautoscaler-v2beta2-autoscaling","list-horizontalpodautoscaler-v2beta2-autoscaling","read-horizontalpodautoscaler-v2beta2-autoscaling","-strong-read-operations-horizontalpodautoscaler-v2beta2-autoscaling-strong-","delete-collection-horizontalpodautoscaler-v2beta2-autoscaling","delete-horizontalpodautoscaler-v2beta2-autoscaling","replace-horizontalpodautoscaler-v2beta2-autoscaling","patch-horizontalpodautoscaler-v2beta2-autoscaling","create-horizontalpodautoscaler-v2beta2-autoscaling","-strong-write-operations-horizontalpodautoscaler-v2beta2-autoscaling-strong-","horizontalpodautoscaler-v2beta2-autoscaling","forzone-v1beta1-discovery-k8s-io","externalmetricstatus-v2beta1-autoscaling","externalmetricsource-v2beta1-autoscaling","eventseries-v1beta1-events-k8s-io","eventseries-v1-core","watch-list-all-namespaces-event-v1beta1-events-k8s-io","watch-list-event-v1beta1-events-k8s-io","watch-event-v1beta1-events-k8s-io","list-all-namespaces-event-v1beta1-events-k8s-io","list-event-v1beta1-events-k8s-io","read-event-v1beta1-events-k8s-io","-strong-read-operations-event-v1beta1-events-k8s-io-strong-","delete-collection-event-v1beta1-events-k8s-io","delete-event-v1beta1-events-k8s-io","replace-event-v1beta1-events-k8s-io","patch-event-v1beta1-events-k8s-io","create-event-v1beta1-events-k8s-io","-strong-write-operations-event-v1beta1-events-k8s-io-strong-","event-v1beta1-events-k8s-io","watch-list-all-namespaces-event-v1-core","watch-list-event-v1-core","watch-event-v1-core","list-all-namespaces-event-v1-core","list-event-v1-core","read-event-v1-core","-strong-read-operations-event-v1-core-strong-","delete-collection-event-v1-core","delete-event-v1-core","replace-event-v1-core","patch-event-v1-core","create-event-v1-core","-strong-write-operations-event-v1-core-strong-","event-v1-core","watch-list-all-namespaces-endpointslice-v1beta1-discovery-k8s-io","watch-list-endpointslice-v1beta1-discovery-k8s-io","watch-endpointslice-v1beta1-discovery-k8s-io","list-all-namespaces-endpointslice-v1beta1-discovery-k8s-io","list-endpointslice-v1beta1-discovery-k8s-io","read-endpointslice-v1beta1-discovery-k8s-io","-strong-read-operations-endpointslice-v1beta1-discovery-k8s-io-strong-","delete-collection-endpointslice-v1beta1-discovery-k8s-io","delete-endpointslice-v1beta1-discovery-k8s-io","replace-endpointslice-v1beta1-discovery-k8s-io","patch-endpointslice-v1beta1-discovery-k8s-io","create-endpointslice-v1beta1-discovery-k8s-io","-strong-write-operations-endpointslice-v1beta1-discovery-k8s-io-strong-","endpointslice-v1beta1-discovery-k8s-io","endpointport-v1beta1-discovery-k8s-io","endpointport-v1-discovery-k8s-io","endpointhints-v1beta1-discovery-k8s-io","endpointconditions-v1beta1-discovery-k8s-io","endpoint-v1beta1-discovery-k8s-io","crossversionobjectreference-v2beta1-autoscaling","crossversionobjectreference-v2beta2-autoscaling","replace-status-cronjob-v1beta1-batch","read-status-cronjob-v1beta1-batch","patch-status-cronjob-v1beta1-batch","-strong-status-operations-cronjob-v1beta1-batch-strong-","watch-list-all-namespaces-cronjob-v1beta1-batch","watch-list-cronjob-v1beta1-batch","watch-cronjob-v1beta1-batch","list-all-namespaces-cronjob-v1beta1-batch","list-cronjob-v1beta1-batch","read-cronjob-v1beta1-batch","-strong-read-operations-cronjob-v1beta1-batch-strong-","delete-collection-cronjob-v1beta1-batch","delete-cronjob-v1beta1-batch","replace-cronjob-v1beta1-batch","patch-cronjob-v1beta1-batch","create-cronjob-v1beta1-batch","-strong-write-operations-cronjob-v1beta1-batch-strong-","cronjob-v1beta1-batch","containerresourcemetricstatus-v2beta1-autoscaling","containerresourcemetricsource-v2beta1-autoscaling","watch-list-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","watch-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","list-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","read-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","-strong-read-operations-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io-strong-","delete-collection-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","delete-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","replace-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","patch-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","create-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","-strong-write-operations-clusterrolebinding-v1alpha1-rbac-authorization-k8s-io-strong-","clusterrolebinding-v1alpha1-rbac-authorization-k8s-io","watch-list-clusterrole-v1alpha1-rbac-authorization-k8s-io","watch-clusterrole-v1alpha1-rbac-authorization-k8s-io","list-clusterrole-v1alpha1-rbac-authorization-k8s-io","read-clusterrole-v1alpha1-rbac-authorization-k8s-io","-strong-read-operations-clusterrole-v1alpha1-rbac-authorization-k8s-io-strong-","delete-collection-clusterrole-v1alpha1-rbac-authorization-k8s-io","delete-clusterrole-v1alpha1-rbac-authorization-k8s-io","replace-clusterrole-v1alpha1-rbac-authorization-k8s-io","patch-clusterrole-v1alpha1-rbac-authorization-k8s-io","create-clusterrole-v1alpha1-rbac-authorization-k8s-io","-strong-write-operations-clusterrole-v1alpha1-rbac-authorization-k8s-io-strong-","clusterrole-v1alpha1-rbac-authorization-k8s-io","watch-list-all-namespaces-csistoragecapacity-v1alpha1-storage-k8s-io","watch-list-csistoragecapacity-v1alpha1-storage-k8s-io","watch-csistoragecapacity-v1alpha1-storage-k8s-io","list-all-namespaces-csistoragecapacity-v1alpha1-storage-k8s-io","list-csistoragecapacity-v1alpha1-storage-k8s-io","read-csistoragecapacity-v1alpha1-storage-k8s-io","-strong-read-operations-csistoragecapacity-v1alpha1-storage-k8s-io-strong-","delete-collection-csistoragecapacity-v1alpha1-storage-k8s-io","delete-csistoragecapacity-v1alpha1-storage-k8s-io","replace-csistoragecapacity-v1alpha1-storage-k8s-io","patch-csistoragecapacity-v1alpha1-storage-k8s-io","create-csistoragecapacity-v1alpha1-storage-k8s-io","-strong-write-operations-csistoragecapacity-v1alpha1-storage-k8s-io-strong-","csistoragecapacity-v1alpha1-storage-k8s-io","aggregationrule-v1alpha1-rbac-authorization-k8s-io","-strong-old-api-versions-strong-","windowssecuritycontextoptions-v1-core","weightedpodaffinityterm-v1-core","webhookconversion-v1-apiextensions-k8s-io","webhookclientconfig-v1-admissionregistration-k8s-io","watchevent-v1-meta","vspherevirtualdiskvolumesource-v1-core","volumeprojection-v1-core","volumenoderesources-v1-storage-k8s-io","volumenodeaffinity-v1-core","volumemount-v1-core","volumeerror-v1-storage-k8s-io","volumedevice-v1-core","volumeattachmentsource-v1-storage-k8s-io","validatingwebhook-v1-admissionregistration-k8s-io","usersubject-v1beta1-flowcontrol-apiserver-k8s-io","userinfo-v1-authentication-k8s-io","uncountedterminatedpods-v1-batch","typedlocalobjectreference-v1-core","topologyspreadconstraint-v1-core","topologyselectorterm-v1-core","topologyselectorlabelrequirement-v1-core","toleration-v1-core","time-v1-meta","taint-v1-core","tcpsocketaction-v1-core","sysctl-v1-core","supplementalgroupsstrategyoptions-v1beta1-policy","subjectrulesreviewstatus-v1-authorization-k8s-io","subject-v1beta1-flowcontrol-apiserver-k8s-io","storageversioncondition-v1alpha1-internal-apiserver-k8s-io","storageosvolumesource-v1-core","storageospersistentvolumesource-v1-core","statusdetails-v1-meta","statuscause-v1-meta","status-v1-meta","statefulsetupdatestrategy-v1-apps","statefulsetcondition-v1-apps","sessionaffinityconfig-v1-core","servicereference-v1-admissionregistration-k8s-io","serviceport-v1-core","servicebackendport-v1-networking-k8s-io","serviceaccounttokenprojection-v1-core","serviceaccountsubject-v1beta1-flowcontrol-apiserver-k8s-io","serverstorageversion-v1alpha1-internal-apiserver-k8s-io","serveraddressbyclientcidr-v1-meta","securitycontext-v1-core","secretvolumesource-v1-core","secretreference-v1-core","secretprojection-v1-core","secretkeyselector-v1-core","secretenvsource-v1-core","seccompprofile-v1-core","scopedresourceselectorrequirement-v1-core","scopeselector-v1-core","scheduling-v1-node-k8s-io","scaleiovolumesource-v1-core","scaleiopersistentvolumesource-v1-core","scale-v1-autoscaling","selinuxstrategyoptions-v1beta1-policy","selinuxoptions-v1-core","runtimeclassstrategyoptions-v1beta1-policy","runasuserstrategyoptions-v1beta1-policy","runasgroupstrategyoptions-v1beta1-policy","rulewithoperations-v1-admissionregistration-k8s-io","rollingupdatestatefulsetstrategy-v1-apps","roleref-v1-rbac-authorization-k8s-io","resourcerule-v1-authorization-k8s-io","resourcerequirements-v1-core","resourcepolicyrule-v1beta1-flowcontrol-apiserver-k8s-io","resourcemetricstatus-v2beta2-autoscaling","resourcemetricsource-v2beta2-autoscaling","resourcefieldselector-v1-core","resourceattributes-v1-authorization-k8s-io","replicationcontrollercondition-v1-core","replicasetcondition-v1-apps","rbdvolumesource-v1-core","rbdpersistentvolumesource-v1-core","quobytevolumesource-v1-core","queuingconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","quantity-resource-core","projectedvolumesource-v1-core","probe-v1-core","prioritylevelconfigurationreference-v1beta1-flowcontrol-apiserver-k8s-io","prioritylevelconfigurationcondition-v1beta1-flowcontrol-apiserver-k8s-io","preferredschedulingterm-v1-core","preconditions-v1-meta","portworxvolumesource-v1-core","portstatus-v1-core","policyruleswithsubjects-v1beta1-flowcontrol-apiserver-k8s-io","policyrule-v1-rbac-authorization-k8s-io","podsmetricstatus-v2beta2-autoscaling","podsmetricsource-v2beta2-autoscaling","podsecuritycontext-v1-core","podreadinessgate-v1-core","podip-v1-core","poddnsconfigoption-v1-core","poddnsconfig-v1-core","podcondition-v1-core","podantiaffinity-v1-core","podaffinityterm-v1-core","podaffinity-v1-core","photonpersistentdiskvolumesource-v1-core","persistentvolumeclaimvolumesource-v1-core","persistentvolumeclaimtemplate-v1-core","persistentvolumeclaimcondition-v1-core","patch-v1-meta","ownerreference-v1-meta","overhead-v1-node-k8s-io","objectreference-v1-core","objectmetricstatus-v2beta2-autoscaling","objectmetricsource-v2beta2-autoscaling","objectmeta-v1-meta","objectfieldselector-v1-core","nonresourcerule-v1-authorization-k8s-io","nonresourcepolicyrule-v1beta1-flowcontrol-apiserver-k8s-io","nonresourceattributes-v1-authorization-k8s-io","nodesysteminfo-v1-core","nodeselectorterm-v1-core","nodeselectorrequirement-v1-core","nodeselector-v1-core","nodedaemonendpoints-v1-core","nodeconfigstatus-v1-core","nodeconfigsource-v1-core","nodecondition-v1-core","nodeaffinity-v1-core","nodeaddress-v1-core","networkpolicyport-v1-networking-k8s-io","networkpolicypeer-v1-networking-k8s-io","networkpolicyingressrule-v1-networking-k8s-io","networkpolicyegressrule-v1-networking-k8s-io","namespacecondition-v1-core","nfsvolumesource-v1-core","mutatingwebhook-v1-admissionregistration-k8s-io","microtime-v1-meta","metricvaluestatus-v2beta2-autoscaling","metrictarget-v2beta2-autoscaling","metricstatus-v2beta2-autoscaling","metricspec-v2beta2-autoscaling","metricidentifier-v2beta2-autoscaling","managedfieldsentry-v1-meta","localvolumesource-v1-core","localobjectreference-v1-core","loadbalancerstatus-v1-core","loadbalanceringress-v1-core","listmeta-v1-meta","limitedprioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","limitresponse-v1beta1-flowcontrol-apiserver-k8s-io","limitrangeitem-v1-core","lifecycle-v1-core","labelselectorrequirement-v1-meta","labelselector-v1-meta","keytopath-v1-core","jobtemplatespec-v1-batch","jobcondition-v1-batch","jsonschemapropsorbool-v1-apiextensions-k8s-io","jsonschemapropsorarray-v1-apiextensions-k8s-io","jsonschemaprops-v1-apiextensions-k8s-io","json-v1-apiextensions-k8s-io","ingresstls-v1-networking-k8s-io","ingressservicebackend-v1-networking-k8s-io","ingressrule-v1-networking-k8s-io","ingressclassparametersreference-v1-networking-k8s-io","ingressbackend-v1-networking-k8s-io","iscsivolumesource-v1-core","iscsipersistentvolumesource-v1-core","ipblock-v1-networking-k8s-io","idrange-v1beta1-policy","hostportrange-v1beta1-policy","hostpathvolumesource-v1-core","hostalias-v1-core","horizontalpodautoscalercondition-v2beta2-autoscaling","horizontalpodautoscalerbehavior-v2beta2-autoscaling","handler-v1-core","httpingressrulevalue-v1-networking-k8s-io","httpingresspath-v1-networking-k8s-io","httpheader-v1-core","httpgetaction-v1-core","hpascalingrules-v2beta2-autoscaling","hpascalingpolicy-v2beta2-autoscaling","groupversionfordiscovery-v1-meta","groupsubject-v1beta1-flowcontrol-apiserver-k8s-io","glusterfsvolumesource-v1-core","glusterfspersistentvolumesource-v1-core","gitrepovolumesource-v1-core","gcepersistentdiskvolumesource-v1-core","forzone-v1-discovery-k8s-io","flowschemacondition-v1beta1-flowcontrol-apiserver-k8s-io","flowdistinguishermethod-v1beta1-flowcontrol-apiserver-k8s-io","flockervolumesource-v1-core","flexvolumesource-v1-core","flexpersistentvolumesource-v1-core","fieldsv1-v1-meta","fsgroupstrategyoptions-v1beta1-policy","fcvolumesource-v1-core","externalmetricstatus-v2beta2-autoscaling","externalmetricsource-v2beta2-autoscaling","externaldocumentation-v1-apiextensions-k8s-io","execaction-v1-core","eviction-v1-policy","eventsource-v1-core","eventseries-v1-events-k8s-io","ephemeralvolumesource-v1-core","ephemeralcontainer-v1-core","envvarsource-v1-core","envvar-v1-core","envfromsource-v1-core","endpointsubset-v1-core","endpointport-v1-core","endpointhints-v1-discovery-k8s-io","endpointconditions-v1-discovery-k8s-io","endpointaddress-v1-core","endpoint-v1-discovery-k8s-io","emptydirvolumesource-v1-core","downwardapivolumesource-v1-core","downwardapivolumefile-v1-core","downwardapiprojection-v1-core","deploymentcondition-v1-apps","deleteoptions-v1-meta","daemonsetupdatestrategy-v1-apps","daemonsetcondition-v1-apps","daemonendpoint-v1-core","customresourcevalidation-v1-apiextensions-k8s-io","customresourcesubresources-v1-apiextensions-k8s-io","customresourcesubresourcestatus-v1-apiextensions-k8s-io","customresourcesubresourcescale-v1-apiextensions-k8s-io","customresourcedefinitionversion-v1-apiextensions-k8s-io","customresourcedefinitionnames-v1-apiextensions-k8s-io","customresourcedefinitioncondition-v1-apiextensions-k8s-io","customresourceconversion-v1-apiextensions-k8s-io","customresourcecolumndefinition-v1-apiextensions-k8s-io","crossversionobjectreference-v1-autoscaling","containerstatewaiting-v1-core","containerstateterminated-v1-core","containerstaterunning-v1-core","containerstate-v1-core","containerresourcemetricstatus-v2beta2-autoscaling","containerresourcemetricsource-v2beta2-autoscaling","containerport-v1-core","containerimage-v1-core","configmapvolumesource-v1-core","configmapprojection-v1-core","configmapnodeconfigsource-v1-core","configmapkeyselector-v1-core","configmapenvsource-v1-core","condition-v1-meta","componentcondition-v1-core","clientipconfig-v1-core","cindervolumesource-v1-core","cinderpersistentvolumesource-v1-core","certificatesigningrequestcondition-v1-certificates-k8s-io","cephfsvolumesource-v1-core","cephfspersistentvolumesource-v1-core","capabilities-v1-core","csivolumesource-v1-core","csipersistentvolumesource-v1-core","csinodedriver-v1-storage-k8s-io","boundobjectreference-v1-authentication-k8s-io","azurefilevolumesource-v1-core","azurefilepersistentvolumesource-v1-core","azurediskvolumesource-v1-core","attachedvolume-v1-core","allowedhostpath-v1beta1-policy","allowedflexvolume-v1beta1-policy","allowedcsidriver-v1beta1-policy","aggregationrule-v1-rbac-authorization-k8s-io","affinity-v1-core","awselasticblockstorevolumesource-v1-core","apiversions-v1-meta","apiservicecondition-v1-apiregistration-k8s-io","apiresource-v1-meta","apigroup-v1-meta","-strong-definitions-strong-","watch-list-all-namespaces-networkpolicy-v1-networking-k8s-io","watch-list-networkpolicy-v1-networking-k8s-io","watch-networkpolicy-v1-networking-k8s-io","list-all-namespaces-networkpolicy-v1-networking-k8s-io","list-networkpolicy-v1-networking-k8s-io","read-networkpolicy-v1-networking-k8s-io","-strong-read-operations-networkpolicy-v1-networking-k8s-io-strong-","delete-collection-networkpolicy-v1-networking-k8s-io","delete-networkpolicy-v1-networking-k8s-io","replace-networkpolicy-v1-networking-k8s-io","patch-networkpolicy-v1-networking-k8s-io","create-networkpolicy-v1-networking-k8s-io","-strong-write-operations-networkpolicy-v1-networking-k8s-io-strong-","networkpolicy-v1-networking-k8s-io","create-tokenreview-v1-authentication-k8s-io","-strong-write-operations-tokenreview-v1-authentication-k8s-io-strong-","tokenreview-v1-authentication-k8s-io","tokenrequest-v1-authentication-k8s-io","create-subjectaccessreview-v1-authorization-k8s-io","-strong-write-operations-subjectaccessreview-v1-authorization-k8s-io-strong-","subjectaccessreview-v1-authorization-k8s-io","replace-status-storageversion-v1alpha1-internal-apiserver-k8s-io","read-status-storageversion-v1alpha1-internal-apiserver-k8s-io","patch-status-storageversion-v1alpha1-internal-apiserver-k8s-io","-strong-status-operations-storageversion-v1alpha1-internal-apiserver-k8s-io-strong-","watch-list-storageversion-v1alpha1-internal-apiserver-k8s-io","watch-storageversion-v1alpha1-internal-apiserver-k8s-io","list-storageversion-v1alpha1-internal-apiserver-k8s-io","read-storageversion-v1alpha1-internal-apiserver-k8s-io","-strong-read-operations-storageversion-v1alpha1-internal-apiserver-k8s-io-strong-","delete-collection-storageversion-v1alpha1-internal-apiserver-k8s-io","delete-storageversion-v1alpha1-internal-apiserver-k8s-io","replace-storageversion-v1alpha1-internal-apiserver-k8s-io","patch-storageversion-v1alpha1-internal-apiserver-k8s-io","create-storageversion-v1alpha1-internal-apiserver-k8s-io","-strong-write-operations-storageversion-v1alpha1-internal-apiserver-k8s-io-strong-","storageversion-v1alpha1-internal-apiserver-k8s-io","watch-list-all-namespaces-serviceaccount-v1-core","watch-list-serviceaccount-v1-core","watch-serviceaccount-v1-core","list-all-namespaces-serviceaccount-v1-core","list-serviceaccount-v1-core","read-serviceaccount-v1-core","-strong-read-operations-serviceaccount-v1-core-strong-","delete-collection-serviceaccount-v1-core","delete-serviceaccount-v1-core","replace-serviceaccount-v1-core","patch-serviceaccount-v1-core","create-serviceaccount-v1-core","-strong-write-operations-serviceaccount-v1-core-strong-","serviceaccount-v1-core","create-selfsubjectrulesreview-v1-authorization-k8s-io","-strong-write-operations-selfsubjectrulesreview-v1-authorization-k8s-io-strong-","selfsubjectrulesreview-v1-authorization-k8s-io","create-selfsubjectaccessreview-v1-authorization-k8s-io","-strong-write-operations-selfsubjectaccessreview-v1-authorization-k8s-io-strong-","selfsubjectaccessreview-v1-authorization-k8s-io","watch-list-runtimeclass-v1-node-k8s-io","watch-runtimeclass-v1-node-k8s-io","list-runtimeclass-v1-node-k8s-io","read-runtimeclass-v1-node-k8s-io","-strong-read-operations-runtimeclass-v1-node-k8s-io-strong-","delete-collection-runtimeclass-v1-node-k8s-io","delete-runtimeclass-v1-node-k8s-io","replace-runtimeclass-v1-node-k8s-io","patch-runtimeclass-v1-node-k8s-io","create-runtimeclass-v1-node-k8s-io","-strong-write-operations-runtimeclass-v1-node-k8s-io-strong-","runtimeclass-v1-node-k8s-io","watch-list-all-namespaces-rolebinding-v1-rbac-authorization-k8s-io","watch-list-rolebinding-v1-rbac-authorization-k8s-io","watch-rolebinding-v1-rbac-authorization-k8s-io","list-all-namespaces-rolebinding-v1-rbac-authorization-k8s-io","list-rolebinding-v1-rbac-authorization-k8s-io","read-rolebinding-v1-rbac-authorization-k8s-io","-strong-read-operations-rolebinding-v1-rbac-authorization-k8s-io-strong-","delete-collection-rolebinding-v1-rbac-authorization-k8s-io","delete-rolebinding-v1-rbac-authorization-k8s-io","replace-rolebinding-v1-rbac-authorization-k8s-io","patch-rolebinding-v1-rbac-authorization-k8s-io","create-rolebinding-v1-rbac-authorization-k8s-io","-strong-write-operations-rolebinding-v1-rbac-authorization-k8s-io-strong-","rolebinding-v1-rbac-authorization-k8s-io","watch-list-all-namespaces-role-v1-rbac-authorization-k8s-io","watch-list-role-v1-rbac-authorization-k8s-io","watch-role-v1-rbac-authorization-k8s-io","list-all-namespaces-role-v1-rbac-authorization-k8s-io","list-role-v1-rbac-authorization-k8s-io","read-role-v1-rbac-authorization-k8s-io","-strong-read-operations-role-v1-rbac-authorization-k8s-io-strong-","delete-collection-role-v1-rbac-authorization-k8s-io","delete-role-v1-rbac-authorization-k8s-io","replace-role-v1-rbac-authorization-k8s-io","patch-role-v1-rbac-authorization-k8s-io","create-role-v1-rbac-authorization-k8s-io","-strong-write-operations-role-v1-rbac-authorization-k8s-io-strong-","role-v1-rbac-authorization-k8s-io","replace-status-resourcequota-v1-core","read-status-resourcequota-v1-core","patch-status-resourcequota-v1-core","-strong-status-operations-resourcequota-v1-core-strong-","watch-list-all-namespaces-resourcequota-v1-core","watch-list-resourcequota-v1-core","watch-resourcequota-v1-core","list-all-namespaces-resourcequota-v1-core","list-resourcequota-v1-core","read-resourcequota-v1-core","-strong-read-operations-resourcequota-v1-core-strong-","delete-collection-resourcequota-v1-core","delete-resourcequota-v1-core","replace-resourcequota-v1-core","patch-resourcequota-v1-core","create-resourcequota-v1-core","-strong-write-operations-resourcequota-v1-core-strong-","resourcequota-v1-core","replace-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","read-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","patch-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","-strong-status-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","watch-list-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","watch-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","list-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","read-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","-strong-read-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","delete-collection-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","delete-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","replace-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","patch-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","create-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","-strong-write-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","replace-status-persistentvolume-v1-core","read-status-persistentvolume-v1-core","patch-status-persistentvolume-v1-core","-strong-status-operations-persistentvolume-v1-core-strong-","watch-list-persistentvolume-v1-core","watch-persistentvolume-v1-core","list-persistentvolume-v1-core","read-persistentvolume-v1-core","-strong-read-operations-persistentvolume-v1-core-strong-","delete-collection-persistentvolume-v1-core","delete-persistentvolume-v1-core","replace-persistentvolume-v1-core","patch-persistentvolume-v1-core","create-persistentvolume-v1-core","-strong-write-operations-persistentvolume-v1-core-strong-","persistentvolume-v1-core","replace-connect-proxy-path-node-v1-core","replace-connect-proxy-node-v1-core","head-connect-proxy-path-node-v1-core","head-connect-proxy-node-v1-core","get-connect-proxy-path-node-v1-core","get-connect-proxy-node-v1-core","delete-connect-proxy-path-node-v1-core","delete-connect-proxy-node-v1-core","create-connect-proxy-path-node-v1-core","create-connect-proxy-node-v1-core","-strong-proxy-operations-node-v1-core-strong-","replace-status-node-v1-core","read-status-node-v1-core","patch-status-node-v1-core","-strong-status-operations-node-v1-core-strong-","watch-list-node-v1-core","watch-node-v1-core","list-node-v1-core","read-node-v1-core","-strong-read-operations-node-v1-core-strong-","delete-collection-node-v1-core","delete-node-v1-core","replace-node-v1-core","patch-node-v1-core","create-node-v1-core","-strong-write-operations-node-v1-core-strong-","node-v1-core","replace-status-namespace-v1-core","read-status-namespace-v1-core","patch-status-namespace-v1-core","-strong-status-operations-namespace-v1-core-strong-","watch-list-namespace-v1-core","watch-namespace-v1-core","list-namespace-v1-core","read-namespace-v1-core","-strong-read-operations-namespace-v1-core-strong-","delete-namespace-v1-core","replace-namespace-v1-core","patch-namespace-v1-core","create-namespace-v1-core","-strong-write-operations-namespace-v1-core-strong-","namespace-v1-core","create-localsubjectaccessreview-v1-authorization-k8s-io","-strong-write-operations-localsubjectaccessreview-v1-authorization-k8s-io-strong-","localsubjectaccessreview-v1-authorization-k8s-io","watch-list-all-namespaces-lease-v1-coordination-k8s-io","watch-list-lease-v1-coordination-k8s-io","watch-lease-v1-coordination-k8s-io","list-all-namespaces-lease-v1-coordination-k8s-io","list-lease-v1-coordination-k8s-io","read-lease-v1-coordination-k8s-io","-strong-read-operations-lease-v1-coordination-k8s-io-strong-","delete-collection-lease-v1-coordination-k8s-io","delete-lease-v1-coordination-k8s-io","replace-lease-v1-coordination-k8s-io","patch-lease-v1-coordination-k8s-io","create-lease-v1-coordination-k8s-io","-strong-write-operations-lease-v1-coordination-k8s-io-strong-","lease-v1-coordination-k8s-io","replace-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","read-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","patch-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","-strong-status-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","watch-list-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","watch-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","list-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","read-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","-strong-read-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","delete-collection-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","delete-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","replace-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","patch-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","create-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","-strong-write-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","flowschema-v1beta1-flowcontrol-apiserver-k8s-io","list-componentstatus-v1-core","read-componentstatus-v1-core","-strong-read-operations-componentstatus-v1-core-strong-","componentstatus-v1-core","watch-list-clusterrolebinding-v1-rbac-authorization-k8s-io","watch-clusterrolebinding-v1-rbac-authorization-k8s-io","list-clusterrolebinding-v1-rbac-authorization-k8s-io","read-clusterrolebinding-v1-rbac-authorization-k8s-io","-strong-read-operations-clusterrolebinding-v1-rbac-authorization-k8s-io-strong-","delete-collection-clusterrolebinding-v1-rbac-authorization-k8s-io","delete-clusterrolebinding-v1-rbac-authorization-k8s-io","replace-clusterrolebinding-v1-rbac-authorization-k8s-io","patch-clusterrolebinding-v1-rbac-authorization-k8s-io","create-clusterrolebinding-v1-rbac-authorization-k8s-io","-strong-write-operations-clusterrolebinding-v1-rbac-authorization-k8s-io-strong-","clusterrolebinding-v1-rbac-authorization-k8s-io","watch-list-clusterrole-v1-rbac-authorization-k8s-io","watch-clusterrole-v1-rbac-authorization-k8s-io","list-clusterrole-v1-rbac-authorization-k8s-io","read-clusterrole-v1-rbac-authorization-k8s-io","-strong-read-operations-clusterrole-v1-rbac-authorization-k8s-io-strong-","delete-collection-clusterrole-v1-rbac-authorization-k8s-io","delete-clusterrole-v1-rbac-authorization-k8s-io","replace-clusterrole-v1-rbac-authorization-k8s-io","patch-clusterrole-v1-rbac-authorization-k8s-io","create-clusterrole-v1-rbac-authorization-k8s-io","-strong-write-operations-clusterrole-v1-rbac-authorization-k8s-io-strong-","clusterrole-v1-rbac-authorization-k8s-io","replace-status-certificatesigningrequest-v1-certificates-k8s-io","read-status-certificatesigningrequest-v1-certificates-k8s-io","patch-status-certificatesigningrequest-v1-certificates-k8s-io","-strong-status-operations-certificatesigningrequest-v1-certificates-k8s-io-strong-","watch-list-certificatesigningrequest-v1-certificates-k8s-io","watch-certificatesigningrequest-v1-certificates-k8s-io","list-certificatesigningrequest-v1-certificates-k8s-io","read-certificatesigningrequest-v1-certificates-k8s-io","-strong-read-operations-certificatesigningrequest-v1-certificates-k8s-io-strong-","delete-collection-certificatesigningrequest-v1-certificates-k8s-io","delete-certificatesigningrequest-v1-certificates-k8s-io","replace-certificatesigningrequest-v1-certificates-k8s-io","patch-certificatesigningrequest-v1-certificates-k8s-io","create-certificatesigningrequest-v1-certificates-k8s-io","-strong-write-operations-certificatesigningrequest-v1-certificates-k8s-io-strong-","certificatesigningrequest-v1-certificates-k8s-io","create-binding-v1-core","-strong-write-operations-binding-v1-core-strong-","binding-v1-core","replace-status-apiservice-v1-apiregistration-k8s-io","read-status-apiservice-v1-apiregistration-k8s-io","patch-status-apiservice-v1-apiregistration-k8s-io","-strong-status-operations-apiservice-v1-apiregistration-k8s-io-strong-","watch-list-apiservice-v1-apiregistration-k8s-io","watch-apiservice-v1-apiregistration-k8s-io","list-apiservice-v1-apiregistration-k8s-io","read-apiservice-v1-apiregistration-k8s-io","-strong-read-operations-apiservice-v1-apiregistration-k8s-io-strong-","delete-collection-apiservice-v1-apiregistration-k8s-io","delete-apiservice-v1-apiregistration-k8s-io","replace-apiservice-v1-apiregistration-k8s-io","patch-apiservice-v1-apiregistration-k8s-io","create-apiservice-v1-apiregistration-k8s-io","-strong-write-operations-apiservice-v1-apiregistration-k8s-io-strong-","apiservice-v1-apiregistration-k8s-io","-strong-cluster-apis-strong-","watch-list-podsecuritypolicy-v1beta1-policy","watch-podsecuritypolicy-v1beta1-policy","list-podsecuritypolicy-v1beta1-policy","read-podsecuritypolicy-v1beta1-policy","-strong-read-operations-podsecuritypolicy-v1beta1-policy-strong-","delete-collection-podsecuritypolicy-v1beta1-policy","delete-podsecuritypolicy-v1beta1-policy","replace-podsecuritypolicy-v1beta1-policy","patch-podsecuritypolicy-v1beta1-policy","create-podsecuritypolicy-v1beta1-policy","-strong-write-operations-podsecuritypolicy-v1beta1-policy-strong-","podsecuritypolicy-v1beta1-policy","watch-list-priorityclass-v1-scheduling-k8s-io","watch-priorityclass-v1-scheduling-k8s-io","list-priorityclass-v1-scheduling-k8s-io","read-priorityclass-v1-scheduling-k8s-io","-strong-read-operations-priorityclass-v1-scheduling-k8s-io-strong-","delete-collection-priorityclass-v1-scheduling-k8s-io","delete-priorityclass-v1-scheduling-k8s-io","replace-priorityclass-v1-scheduling-k8s-io","patch-priorityclass-v1-scheduling-k8s-io","create-priorityclass-v1-scheduling-k8s-io","-strong-write-operations-priorityclass-v1-scheduling-k8s-io-strong-","priorityclass-v1-scheduling-k8s-io","replace-status-poddisruptionbudget-v1-policy","read-status-poddisruptionbudget-v1-policy","patch-status-poddisruptionbudget-v1-policy","-strong-status-operations-poddisruptionbudget-v1-policy-strong-","watch-list-all-namespaces-poddisruptionbudget-v1-policy","watch-list-poddisruptionbudget-v1-policy","watch-poddisruptionbudget-v1-policy","list-all-namespaces-poddisruptionbudget-v1-policy","list-poddisruptionbudget-v1-policy","read-poddisruptionbudget-v1-policy","-strong-read-operations-poddisruptionbudget-v1-policy-strong-","delete-collection-poddisruptionbudget-v1-policy","delete-poddisruptionbudget-v1-policy","replace-poddisruptionbudget-v1-policy","patch-poddisruptionbudget-v1-policy","create-poddisruptionbudget-v1-policy","-strong-write-operations-poddisruptionbudget-v1-policy-strong-","poddisruptionbudget-v1-policy","watch-list-all-namespaces-podtemplate-v1-core","watch-list-podtemplate-v1-core","watch-podtemplate-v1-core","list-all-namespaces-podtemplate-v1-core","list-podtemplate-v1-core","read-podtemplate-v1-core","-strong-read-operations-podtemplate-v1-core-strong-","delete-collection-podtemplate-v1-core","delete-podtemplate-v1-core","replace-podtemplate-v1-core","patch-podtemplate-v1-core","create-podtemplate-v1-core","-strong-write-operations-podtemplate-v1-core-strong-","podtemplate-v1-core","watch-list-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","watch-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","list-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","read-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","-strong-read-operations-validatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","delete-collection-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","delete-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","replace-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","patch-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","create-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","-strong-write-operations-validatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","validatingwebhookconfiguration-v1-admissionregistration-k8s-io","watch-list-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","watch-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","list-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","read-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","-strong-read-operations-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","delete-collection-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","delete-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","replace-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","patch-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","create-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","-strong-write-operations-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","replace-status-horizontalpodautoscaler-v1-autoscaling","read-status-horizontalpodautoscaler-v1-autoscaling","patch-status-horizontalpodautoscaler-v1-autoscaling","-strong-status-operations-horizontalpodautoscaler-v1-autoscaling-strong-","watch-list-all-namespaces-horizontalpodautoscaler-v1-autoscaling","watch-list-horizontalpodautoscaler-v1-autoscaling","watch-horizontalpodautoscaler-v1-autoscaling","list-all-namespaces-horizontalpodautoscaler-v1-autoscaling","list-horizontalpodautoscaler-v1-autoscaling","read-horizontalpodautoscaler-v1-autoscaling","-strong-read-operations-horizontalpodautoscaler-v1-autoscaling-strong-","delete-collection-horizontalpodautoscaler-v1-autoscaling","delete-horizontalpodautoscaler-v1-autoscaling","replace-horizontalpodautoscaler-v1-autoscaling","patch-horizontalpodautoscaler-v1-autoscaling","create-horizontalpodautoscaler-v1-autoscaling","-strong-write-operations-horizontalpodautoscaler-v1-autoscaling-strong-","horizontalpodautoscaler-v1-autoscaling","watch-list-all-namespaces-limitrange-v1-core","watch-list-limitrange-v1-core","watch-limitrange-v1-core","list-all-namespaces-limitrange-v1-core","list-limitrange-v1-core","read-limitrange-v1-core","-strong-read-operations-limitrange-v1-core-strong-","delete-collection-limitrange-v1-core","delete-limitrange-v1-core","replace-limitrange-v1-core","patch-limitrange-v1-core","create-limitrange-v1-core","-strong-write-operations-limitrange-v1-core-strong-","limitrange-v1-core","watch-list-all-namespaces-event-v1-events-k8s-io","watch-list-event-v1-events-k8s-io","watch-event-v1-events-k8s-io","list-all-namespaces-event-v1-events-k8s-io","list-event-v1-events-k8s-io","read-event-v1-events-k8s-io","-strong-read-operations-event-v1-events-k8s-io-strong-","delete-collection-event-v1-events-k8s-io","delete-event-v1-events-k8s-io","replace-event-v1-events-k8s-io","patch-event-v1-events-k8s-io","create-event-v1-events-k8s-io","-strong-write-operations-event-v1-events-k8s-io-strong-","event-v1-events-k8s-io","replace-status-customresourcedefinition-v1-apiextensions-k8s-io","read-status-customresourcedefinition-v1-apiextensions-k8s-io","patch-status-customresourcedefinition-v1-apiextensions-k8s-io","-strong-status-operations-customresourcedefinition-v1-apiextensions-k8s-io-strong-","watch-list-customresourcedefinition-v1-apiextensions-k8s-io","watch-customresourcedefinition-v1-apiextensions-k8s-io","list-customresourcedefinition-v1-apiextensions-k8s-io","read-customresourcedefinition-v1-apiextensions-k8s-io","-strong-read-operations-customresourcedefinition-v1-apiextensions-k8s-io-strong-","delete-collection-customresourcedefinition-v1-apiextensions-k8s-io","delete-customresourcedefinition-v1-apiextensions-k8s-io","replace-customresourcedefinition-v1-apiextensions-k8s-io","patch-customresourcedefinition-v1-apiextensions-k8s-io","create-customresourcedefinition-v1-apiextensions-k8s-io","-strong-write-operations-customresourcedefinition-v1-apiextensions-k8s-io-strong-","customresourcedefinition-v1-apiextensions-k8s-io","watch-list-all-namespaces-controllerrevision-v1-apps","watch-list-controllerrevision-v1-apps","watch-controllerrevision-v1-apps","list-all-namespaces-controllerrevision-v1-apps","list-controllerrevision-v1-apps","read-controllerrevision-v1-apps","-strong-read-operations-controllerrevision-v1-apps-strong-","delete-collection-controllerrevision-v1-apps","delete-controllerrevision-v1-apps","replace-controllerrevision-v1-apps","patch-controllerrevision-v1-apps","create-controllerrevision-v1-apps","-strong-write-operations-controllerrevision-v1-apps-strong-","controllerrevision-v1-apps","-strong-metadata-apis-strong-","replace-status-volumeattachment-v1-storage-k8s-io","read-status-volumeattachment-v1-storage-k8s-io","patch-status-volumeattachment-v1-storage-k8s-io","-strong-status-operations-volumeattachment-v1-storage-k8s-io-strong-","watch-list-volumeattachment-v1-storage-k8s-io","watch-volumeattachment-v1-storage-k8s-io","list-volumeattachment-v1-storage-k8s-io","read-volumeattachment-v1-storage-k8s-io","-strong-read-operations-volumeattachment-v1-storage-k8s-io-strong-","delete-collection-volumeattachment-v1-storage-k8s-io","delete-volumeattachment-v1-storage-k8s-io","replace-volumeattachment-v1-storage-k8s-io","patch-volumeattachment-v1-storage-k8s-io","create-volumeattachment-v1-storage-k8s-io","-strong-write-operations-volumeattachment-v1-storage-k8s-io-strong-","volumeattachment-v1-storage-k8s-io","volume-v1-core","watch-list-all-namespaces-csistoragecapacity-v1beta1-storage-k8s-io","watch-list-csistoragecapacity-v1beta1-storage-k8s-io","watch-csistoragecapacity-v1beta1-storage-k8s-io","list-all-namespaces-csistoragecapacity-v1beta1-storage-k8s-io","list-csistoragecapacity-v1beta1-storage-k8s-io","read-csistoragecapacity-v1beta1-storage-k8s-io","-strong-read-operations-csistoragecapacity-v1beta1-storage-k8s-io-strong-","delete-collection-csistoragecapacity-v1beta1-storage-k8s-io","delete-csistoragecapacity-v1beta1-storage-k8s-io","replace-csistoragecapacity-v1beta1-storage-k8s-io","patch-csistoragecapacity-v1beta1-storage-k8s-io","create-csistoragecapacity-v1beta1-storage-k8s-io","-strong-write-operations-csistoragecapacity-v1beta1-storage-k8s-io-strong-","csistoragecapacity-v1beta1-storage-k8s-io","watch-list-storageclass-v1-storage-k8s-io","watch-storageclass-v1-storage-k8s-io","list-storageclass-v1-storage-k8s-io","read-storageclass-v1-storage-k8s-io","-strong-read-operations-storageclass-v1-storage-k8s-io-strong-","delete-collection-storageclass-v1-storage-k8s-io","delete-storageclass-v1-storage-k8s-io","replace-storageclass-v1-storage-k8s-io","patch-storageclass-v1-storage-k8s-io","create-storageclass-v1-storage-k8s-io","-strong-write-operations-storageclass-v1-storage-k8s-io-strong-","storageclass-v1-storage-k8s-io","replace-status-persistentvolumeclaim-v1-core","read-status-persistentvolumeclaim-v1-core","patch-status-persistentvolumeclaim-v1-core","-strong-status-operations-persistentvolumeclaim-v1-core-strong-","watch-list-all-namespaces-persistentvolumeclaim-v1-core","watch-list-persistentvolumeclaim-v1-core","watch-persistentvolumeclaim-v1-core","list-all-namespaces-persistentvolumeclaim-v1-core","list-persistentvolumeclaim-v1-core","read-persistentvolumeclaim-v1-core","-strong-read-operations-persistentvolumeclaim-v1-core-strong-","delete-collection-persistentvolumeclaim-v1-core","delete-persistentvolumeclaim-v1-core","replace-persistentvolumeclaim-v1-core","patch-persistentvolumeclaim-v1-core","create-persistentvolumeclaim-v1-core","-strong-write-operations-persistentvolumeclaim-v1-core-strong-","persistentvolumeclaim-v1-core","watch-list-all-namespaces-secret-v1-core","watch-list-secret-v1-core","watch-secret-v1-core","list-all-namespaces-secret-v1-core","list-secret-v1-core","read-secret-v1-core","-strong-read-operations-secret-v1-core-strong-","delete-collection-secret-v1-core","delete-secret-v1-core","replace-secret-v1-core","patch-secret-v1-core","create-secret-v1-core","-strong-write-operations-secret-v1-core-strong-","secret-v1-core","watch-list-csinode-v1-storage-k8s-io","watch-csinode-v1-storage-k8s-io","list-csinode-v1-storage-k8s-io","read-csinode-v1-storage-k8s-io","-strong-read-operations-csinode-v1-storage-k8s-io-strong-","delete-collection-csinode-v1-storage-k8s-io","delete-csinode-v1-storage-k8s-io","replace-csinode-v1-storage-k8s-io","patch-csinode-v1-storage-k8s-io","create-csinode-v1-storage-k8s-io","-strong-write-operations-csinode-v1-storage-k8s-io-strong-","csinode-v1-storage-k8s-io","watch-list-csidriver-v1-storage-k8s-io","watch-csidriver-v1-storage-k8s-io","list-csidriver-v1-storage-k8s-io","read-csidriver-v1-storage-k8s-io","-strong-read-operations-csidriver-v1-storage-k8s-io-strong-","delete-collection-csidriver-v1-storage-k8s-io","delete-csidriver-v1-storage-k8s-io","replace-csidriver-v1-storage-k8s-io","patch-csidriver-v1-storage-k8s-io","create-csidriver-v1-storage-k8s-io","-strong-write-operations-csidriver-v1-storage-k8s-io-strong-","csidriver-v1-storage-k8s-io","watch-list-all-namespaces-configmap-v1-core","watch-list-configmap-v1-core","watch-configmap-v1-core","list-all-namespaces-configmap-v1-core","list-configmap-v1-core","read-configmap-v1-core","-strong-read-operations-configmap-v1-core-strong-","delete-collection-configmap-v1-core","delete-configmap-v1-core","replace-configmap-v1-core","patch-configmap-v1-core","create-configmap-v1-core","-strong-write-operations-configmap-v1-core-strong-","configmap-v1-core","-strong-config-and-storage-apis-strong-","replace-connect-proxy-path-service-v1-core","replace-connect-proxy-service-v1-core","head-connect-proxy-path-service-v1-core","head-connect-proxy-service-v1-core","get-connect-proxy-path-service-v1-core","get-connect-proxy-service-v1-core","delete-connect-proxy-path-service-v1-core","delete-connect-proxy-service-v1-core","create-connect-proxy-path-service-v1-core","create-connect-proxy-service-v1-core","-strong-proxy-operations-service-v1-core-strong-","replace-status-service-v1-core","read-status-service-v1-core","patch-status-service-v1-core","-strong-status-operations-service-v1-core-strong-","watch-list-all-namespaces-service-v1-core","watch-list-service-v1-core","watch-service-v1-core","list-all-namespaces-service-v1-core","list-service-v1-core","read-service-v1-core","-strong-read-operations-service-v1-core-strong-","delete-service-v1-core","replace-service-v1-core","patch-service-v1-core","create-service-v1-core","-strong-write-operations-service-v1-core-strong-","service-v1-core","watch-list-ingressclass-v1-networking-k8s-io","watch-ingressclass-v1-networking-k8s-io","list-ingressclass-v1-networking-k8s-io","read-ingressclass-v1-networking-k8s-io","-strong-read-operations-ingressclass-v1-networking-k8s-io-strong-","delete-collection-ingressclass-v1-networking-k8s-io","delete-ingressclass-v1-networking-k8s-io","replace-ingressclass-v1-networking-k8s-io","patch-ingressclass-v1-networking-k8s-io","create-ingressclass-v1-networking-k8s-io","-strong-write-operations-ingressclass-v1-networking-k8s-io-strong-","ingressclass-v1-networking-k8s-io","replace-status-ingress-v1-networking-k8s-io","read-status-ingress-v1-networking-k8s-io","patch-status-ingress-v1-networking-k8s-io","-strong-status-operations-ingress-v1-networking-k8s-io-strong-","watch-list-all-namespaces-ingress-v1-networking-k8s-io","watch-list-ingress-v1-networking-k8s-io","watch-ingress-v1-networking-k8s-io","list-all-namespaces-ingress-v1-networking-k8s-io","list-ingress-v1-networking-k8s-io","read-ingress-v1-networking-k8s-io","-strong-read-operations-ingress-v1-networking-k8s-io-strong-","delete-collection-ingress-v1-networking-k8s-io","delete-ingress-v1-networking-k8s-io","replace-ingress-v1-networking-k8s-io","patch-ingress-v1-networking-k8s-io","create-ingress-v1-networking-k8s-io","-strong-write-operations-ingress-v1-networking-k8s-io-strong-","ingress-v1-networking-k8s-io","watch-list-all-namespaces-endpointslice-v1-discovery-k8s-io","watch-list-endpointslice-v1-discovery-k8s-io","watch-endpointslice-v1-discovery-k8s-io","list-all-namespaces-endpointslice-v1-discovery-k8s-io","list-endpointslice-v1-discovery-k8s-io","read-endpointslice-v1-discovery-k8s-io","-strong-read-operations-endpointslice-v1-discovery-k8s-io-strong-","delete-collection-endpointslice-v1-discovery-k8s-io","delete-endpointslice-v1-discovery-k8s-io","replace-endpointslice-v1-discovery-k8s-io","patch-endpointslice-v1-discovery-k8s-io","create-endpointslice-v1-discovery-k8s-io","-strong-write-operations-endpointslice-v1-discovery-k8s-io-strong-","endpointslice-v1-discovery-k8s-io","watch-list-all-namespaces-endpoints-v1-core","watch-list-endpoints-v1-core","watch-endpoints-v1-core","list-all-namespaces-endpoints-v1-core","list-endpoints-v1-core","read-endpoints-v1-core","-strong-read-operations-endpoints-v1-core-strong-","delete-collection-endpoints-v1-core","delete-endpoints-v1-core","replace-endpoints-v1-core","patch-endpoints-v1-core","create-endpoints-v1-core","-strong-write-operations-endpoints-v1-core-strong-","endpoints-v1-core","-strong-service-apis-strong-","patch-scale-statefulset-v1-apps","replace-scale-statefulset-v1-apps","read-scale-statefulset-v1-apps","-strong-misc-operations-statefulset-v1-apps-strong-","replace-status-statefulset-v1-apps","read-status-statefulset-v1-apps","patch-status-statefulset-v1-apps","-strong-status-operations-statefulset-v1-apps-strong-","watch-list-all-namespaces-statefulset-v1-apps","watch-list-statefulset-v1-apps","watch-statefulset-v1-apps","list-all-namespaces-statefulset-v1-apps","list-statefulset-v1-apps","read-statefulset-v1-apps","-strong-read-operations-statefulset-v1-apps-strong-","delete-collection-statefulset-v1-apps","delete-statefulset-v1-apps","replace-statefulset-v1-apps","patch-statefulset-v1-apps","create-statefulset-v1-apps","-strong-write-operations-statefulset-v1-apps-strong-","statefulset-v1-apps","patch-scale-replicationcontroller-v1-core","replace-scale-replicationcontroller-v1-core","read-scale-replicationcontroller-v1-core","-strong-misc-operations-replicationcontroller-v1-core-strong-","replace-status-replicationcontroller-v1-core","read-status-replicationcontroller-v1-core","patch-status-replicationcontroller-v1-core","-strong-status-operations-replicationcontroller-v1-core-strong-","watch-list-all-namespaces-replicationcontroller-v1-core","watch-list-replicationcontroller-v1-core","watch-replicationcontroller-v1-core","list-all-namespaces-replicationcontroller-v1-core","list-replicationcontroller-v1-core","read-replicationcontroller-v1-core","-strong-read-operations-replicationcontroller-v1-core-strong-","delete-collection-replicationcontroller-v1-core","delete-replicationcontroller-v1-core","replace-replicationcontroller-v1-core","patch-replicationcontroller-v1-core","create-replicationcontroller-v1-core","-strong-write-operations-replicationcontroller-v1-core-strong-","replicationcontroller-v1-core","patch-scale-replicaset-v1-apps","replace-scale-replicaset-v1-apps","read-scale-replicaset-v1-apps","-strong-misc-operations-replicaset-v1-apps-strong-","replace-status-replicaset-v1-apps","read-status-replicaset-v1-apps","patch-status-replicaset-v1-apps","-strong-status-operations-replicaset-v1-apps-strong-","watch-list-all-namespaces-replicaset-v1-apps","watch-list-replicaset-v1-apps","watch-replicaset-v1-apps","list-all-namespaces-replicaset-v1-apps","list-replicaset-v1-apps","read-replicaset-v1-apps","-strong-read-operations-replicaset-v1-apps-strong-","delete-collection-replicaset-v1-apps","delete-replicaset-v1-apps","replace-replicaset-v1-apps","patch-replicaset-v1-apps","create-replicaset-v1-apps","-strong-write-operations-replicaset-v1-apps-strong-","replicaset-v1-apps","read-log-pod-v1-core","-strong-misc-operations-pod-v1-core-strong-","replace-connect-proxy-path-pod-v1-core","replace-connect-proxy-pod-v1-core","head-connect-proxy-path-pod-v1-core","head-connect-proxy-pod-v1-core","get-connect-proxy-path-pod-v1-core","get-connect-proxy-pod-v1-core","get-connect-portforward-pod-v1-core","delete-connect-proxy-path-pod-v1-core","delete-connect-proxy-pod-v1-core","create-connect-proxy-path-pod-v1-core","create-connect-proxy-pod-v1-core","create-connect-portforward-pod-v1-core","-strong-proxy-operations-pod-v1-core-strong-","replace-ephemeralcontainers-pod-v1-core","read-ephemeralcontainers-pod-v1-core","patch-ephemeralcontainers-pod-v1-core","-strong-ephemeralcontainers-operations-pod-v1-core-strong-","replace-status-pod-v1-core","read-status-pod-v1-core","patch-status-pod-v1-core","-strong-status-operations-pod-v1-core-strong-","watch-list-all-namespaces-pod-v1-core","watch-list-pod-v1-core","watch-pod-v1-core","list-all-namespaces-pod-v1-core","list-pod-v1-core","read-pod-v1-core","-strong-read-operations-pod-v1-core-strong-","delete-collection-pod-v1-core","delete-pod-v1-core","replace-pod-v1-core","patch-pod-v1-core","create-eviction-pod-v1-core","create-pod-v1-core","-strong-write-operations-pod-v1-core-strong-","pod-v1-core","replace-status-job-v1-batch","read-status-job-v1-batch","patch-status-job-v1-batch","-strong-status-operations-job-v1-batch-strong-","watch-list-all-namespaces-job-v1-batch","watch-list-job-v1-batch","watch-job-v1-batch","list-all-namespaces-job-v1-batch","list-job-v1-batch","read-job-v1-batch","-strong-read-operations-job-v1-batch-strong-","delete-collection-job-v1-batch","delete-job-v1-batch","replace-job-v1-batch","patch-job-v1-batch","create-job-v1-batch","-strong-write-operations-job-v1-batch-strong-","job-v1-batch","patch-scale-deployment-v1-apps","replace-scale-deployment-v1-apps","read-scale-deployment-v1-apps","-strong-misc-operations-deployment-v1-apps-strong-","replace-status-deployment-v1-apps","read-status-deployment-v1-apps","patch-status-deployment-v1-apps","-strong-status-operations-deployment-v1-apps-strong-","watch-list-all-namespaces-deployment-v1-apps","watch-list-deployment-v1-apps","watch-deployment-v1-apps","list-all-namespaces-deployment-v1-apps","list-deployment-v1-apps","read-deployment-v1-apps","-strong-read-operations-deployment-v1-apps-strong-","delete-collection-deployment-v1-apps","delete-deployment-v1-apps","replace-deployment-v1-apps","patch-deployment-v1-apps","create-deployment-v1-apps","-strong-write-operations-deployment-v1-apps-strong-","deployment-v1-apps","replace-status-daemonset-v1-apps","read-status-daemonset-v1-apps","patch-status-daemonset-v1-apps","-strong-status-operations-daemonset-v1-apps-strong-","watch-list-all-namespaces-daemonset-v1-apps","watch-list-daemonset-v1-apps","watch-daemonset-v1-apps","list-all-namespaces-daemonset-v1-apps","list-daemonset-v1-apps","read-daemonset-v1-apps","-strong-read-operations-daemonset-v1-apps-strong-","delete-collection-daemonset-v1-apps","delete-daemonset-v1-apps","replace-daemonset-v1-apps","patch-daemonset-v1-apps","create-daemonset-v1-apps","-strong-write-operations-daemonset-v1-apps-strong-","daemonset-v1-apps","replace-status-cronjob-v1-batch","read-status-cronjob-v1-batch","patch-status-cronjob-v1-batch","-strong-status-operations-cronjob-v1-batch-strong-","watch-list-all-namespaces-cronjob-v1-batch","watch-list-cronjob-v1-batch","watch-cronjob-v1-batch","list-all-namespaces-cronjob-v1-batch","list-cronjob-v1-batch","read-cronjob-v1-batch","-strong-read-operations-cronjob-v1-batch-strong-","delete-collection-cronjob-v1-batch","delete-cronjob-v1-batch","replace-cronjob-v1-batch","patch-cronjob-v1-batch","create-cronjob-v1-batch","-strong-write-operations-cronjob-v1-batch-strong-","cronjob-v1-batch","container-v1-core","-strong-workloads-apis-strong-","-strong-api-groups-strong-","-strong-api-overview-strong-"]};})(); \ No newline at end of file From 735701e1cc8bb44730351658babbce4356b3e103 Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Tue, 27 Jul 2021 13:07:10 +0800 Subject: [PATCH 138/279] Amend kubeadm join doc for node preparation We need to clarify that worker nodes need to be prepared in nearly the same way as control plane nodes. --- .../tools/kubeadm/create-cluster-kubeadm.md | 30 ++++++++++++------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md b/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md index 56deeb1985..3ed38b1c3c 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md @@ -8,9 +8,12 @@ weight: 30 -Using `kubeadm`, you can create a minimum viable Kubernetes cluster that conforms to best practices. In fact, you can use `kubeadm` to set up a cluster that will pass the [Kubernetes Conformance tests](https://kubernetes.io/blog/2017/10/software-conformance-certification). -`kubeadm` also supports other cluster -lifecycle functions, such as [bootstrap tokens](/docs/reference/access-authn-authz/bootstrap-tokens/) and cluster upgrades. + +Using `kubeadm`, you can create a minimum viable Kubernetes cluster that conforms to best practices. +In fact, you can use `kubeadm` to set up a cluster that will pass the +[Kubernetes Conformance tests](https://kubernetes.io/blog/2017/10/software-conformance-certification). +`kubeadm` also supports other cluster lifecycle functions, such as +[bootstrap tokens](/docs/reference/access-authn-authz/bootstrap-tokens/) and cluster upgrades. The `kubeadm` tool is good if you need: @@ -42,7 +45,8 @@ To follow this guide, you need: You also need to use a version of `kubeadm` that can deploy the version of Kubernetes that you want to use in your new cluster. -[Kubernetes' version and version skew support policy](/docs/setup/release/version-skew-policy/#supported-versions) applies to `kubeadm` as well as to Kubernetes overall. +[Kubernetes' version and version skew support policy](/docs/setup/release/version-skew-policy/#supported-versions) +applies to `kubeadm` as well as to Kubernetes overall. Check that policy to learn about what versions of Kubernetes and `kubeadm` are supported. This page is written for Kubernetes {{< param "version" >}}. @@ -97,7 +101,8 @@ a provider-specific value. See [Installing a Pod network add-on](#pod-network). 1. (Optional) Since version 1.14, `kubeadm` tries to detect the container runtime on Linux by using a list of well known domain socket paths. To use different container runtime or if there are more than one installed on the provisioned node, specify the `--cri-socket` -argument to `kubeadm init`. See [Installing runtime](/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#installing-runtime). +argument to `kubeadm init`. See +[Installing a runtime](/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#installing-runtime). 1. (Optional) Unless otherwise specified, `kubeadm` uses the network interface associated with the default gateway to set the advertise address for this particular control-plane node's API server. To use a different network interface, specify the `--apiserver-advertise-address=` argument @@ -139,9 +144,12 @@ is not supported by kubeadm. For more information about `kubeadm init` arguments, see the [kubeadm reference guide](/docs/reference/setup-tools/kubeadm/). -To configure `kubeadm init` with a configuration file see [Using kubeadm init with a configuration file](/docs/reference/setup-tools/kubeadm/kubeadm-init/#config-file). +To configure `kubeadm init` with a configuration file see +[Using kubeadm init with a configuration file](/docs/reference/setup-tools/kubeadm/kubeadm-init/#config-file). -To customize control plane components, including optional IPv6 assignment to liveness probe for control plane components and etcd server, provide extra arguments to each component as documented in [custom arguments](/docs/setup/production-environment/tools/kubeadm/control-plane-flags/). +To customize control plane components, including optional IPv6 assignment to liveness probe +for control plane components and etcd server, provide extra arguments to each component as documented in +[custom arguments](/docs/setup/production-environment/tools/kubeadm/control-plane-flags/). To run `kubeadm init` again, you must first [tear down the cluster](#tear-down). @@ -292,11 +300,13 @@ The nodes are where your workloads (containers and Pods, etc) run. To add new no * SSH to the machine * Become root (e.g. `sudo su -`) +* [Installing a runtime](/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#installing-runtime) + if needed * Run the command that was output by `kubeadm init`. For example: -```bash -kubeadm join --token : --discovery-token-ca-cert-hash sha256: -``` + ```bash + kubeadm join --token : --discovery-token-ca-cert-hash sha256: + ``` If you do not have the token, you can get it by running the following command on the control-plane node: From a783b05eb24b3f252294bccf3689d897cb1a5427 Mon Sep 17 00:00:00 2001 From: Rajula Vineet Reddy Date: Thu, 15 Jul 2021 13:59:46 +0200 Subject: [PATCH 139/279] Add memory manager feature blog post Co-authored-by: Artyom Lukianov Co-authored-by: Cezary Zukowski --- ...2021-08-11-memory-manager-moves-to-beta.md | 144 ++++++++++++++++++ .../MemoryManagerDiagram.svg | 3 + .../ReservedMemory.svg | 3 + .../SingleCrossNUMAAllocation.svg | 3 + 4 files changed, 153 insertions(+) create mode 100644 content/en/blog/_posts/2021-08-11-memory-manager-moves-to-beta.md create mode 100644 static/images/blog/2021-08-11-memory-manager-moves-to-beta/MemoryManagerDiagram.svg create mode 100644 static/images/blog/2021-08-11-memory-manager-moves-to-beta/ReservedMemory.svg create mode 100644 static/images/blog/2021-08-11-memory-manager-moves-to-beta/SingleCrossNUMAAllocation.svg diff --git a/content/en/blog/_posts/2021-08-11-memory-manager-moves-to-beta.md b/content/en/blog/_posts/2021-08-11-memory-manager-moves-to-beta.md new file mode 100644 index 0000000000..0eeb8bde83 --- /dev/null +++ b/content/en/blog/_posts/2021-08-11-memory-manager-moves-to-beta.md @@ -0,0 +1,144 @@ +--- +layout: blog +title: "Kubernetes Memory Manager moves to beta" +date: 2021-08-11 +slug: kubernetes-1-22-feature-memory-manager-moves-to-beta +--- + +**Authors:** Artyom Lukianov (Red Hat), Cezary Zukowski (Samsung) + +The blog post explains some of the internals of the _Memory manager_, a beta feature +of Kubernetes 1.22. In Kubernetes, the Memory Manager is a +[kubelet](https://kubernetes.io/docs/concepts/overview/components/#kubelet) subcomponent. +The memory manage provides guaranteed memory (and hugepages) +allocation for pods in the `Guaranteed` [QoS class](https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/#qos-classes). + +This blog post covers: + +1. [Why do you need it?](#Why-do-you-need-it?) +2. [The internal details of how the **MemoryManager** works](#How-does-it-work?) +3. [Current limitations of the **MemoryManager**](#Current-limitations) +4. [Future work for the **MemoryManager**](#Future-work-for-the-Memory-Manager) + +## Why do you need it? + +Some Kubernetes workloads run on nodes with +[non-uniform memory access](https://en.wikipedia.org/wiki/Non-uniform_memory_access) (NUMA). +Suppose you have NUMA nodes in your cluster. In that case, you'll know about the potential for extra latency when +compute resources need to access memory on the different NUMA locality. + +To get the best performance and latency for your workload, container CPUs, +peripheral devices, and memory should all be aligned to the same NUMA +locality. +Before Kubernetes v1.22, the kubelet already provided a set of managers to +align CPUs and PCI devices, but you did not have a way to align memory. +The Linux kernel was able to make best-effort attempts to allocate +memory for tasks from the same NUMA node where the container is +executing are placed, but without any guarantee about that placement. + +## How does it work? + +The memory manager is doing two main things: +- provides the topology hint to the Topology Manager +- allocates the memory for containers and updates the state + +The overall sequence of the Memory Manager under the Kubelet + +![MemoryManagerDiagram](/images/blog/2021-08-11-memory-manager-moves-to-beta/MemoryManagerDiagram.svg "MemoryManagerDiagram") + +During the Admission phase: + +1. When first handling a new pod, the kubelet calls the TopologyManager's `Admit()` method. +2. The Topology Manager is calling `GetTopologyHints()` for every hint provider including the Memory Manager. +3. The Memory Manager calculates all possible NUMA nodes combinations for every container inside the pod and returns hints to the Topology Manager. +4. The Topology Manager calls to `Allocate()` for every hint provider including the Memory Manager. +5. The Memory Manager allocates the memory under the state according to the hint that the Topology Manager chose. + +During Pod creation: + +1. The kubelet calls `PreCreateContainer()`. +2. For each container, the Memory Manager looks the NUMA nodes where it allocated the + memory for the container and then returns that information to the kubelet. +3. The kubelet creates the container, via CRI, using a container specification + that incorporates information from the Memory Manager information. + +### Let's talk about the configuration + +By default, the Memory Manager runs with the `None` policy, meaning it will just +relax and not do anything. To make use of the Memory Manager, you should set +two command line options for the kubelet: + +- `--memory-manager-policy=Static` +- `--reserved-memory=":="` + +The value for `--memory-manager-policy` is straightforward: `Static`. Deciding what to specify for `--reserved-memory` takes more thought. To configure it correctly, you should follow two main rules: + +- The amount of reserved memory for the `memory` resource must be greater than zero. +- The amount of reserved memory for the resource type must be equal + to [NodeAllocatable](/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable) + (`kube-reserved + system-reserved + eviction-hard`) for the resource. + You can read more about memory reservations in [Reserve Compute Resources for System Daemons](/docs/tasks/administer-cluster/reserve-compute-resources/). + +![Reserved memory](/images/blog/2021-08-11-memory-manager-moves-to-beta/ReservedMemory.svg) + +## Current limitations + +The 1.22 release and promotion to beta brings along enhancements and fixes, but the Memory Manager still has several limitations. + +### Single vs Cross NUMA node allocation + +The NUMA node can not have both single and cross NUMA node allocations. When the container memory is pinned to two or more NUMA nodes, we can not know from which NUMA node the container will consume the memory. + +![Single vs Cross NUMA allocation](/images/blog/2021-08-11-memory-manager-moves-to-beta/SingleCrossNUMAAllocation.svg "SingleCrossNUMAAllocation") + +1. The `container1` started on the NUMA node 0 and requests *5Gi* of the memory but currently is consuming only *3Gi* of the memory. +2. For container2 the memory request is 10Gi, and no single NUMA node can satisfy it. +3. The `container2` consumes *3.5Gi* of the memory from the NUMA node 0, but once the `container1` will require more memory, it will not have it, and the kernel will kill one of the containers with the *OOM* error. + +To prevent such issues, the Memory Manager will fail the admission of the `container2` until the machine has two NUMA nodes without a single NUMA node allocation. + +### Works only for Guaranteed pods + +The Memory Manager can not guarantee memory allocation for Burstable pods, +also when the Burstable pod has specified equal memory limit and request. + +Let's assume you have two Burstable pods: `pod1` has containers with +equal memory request and limits, and `pod2` has containers only with a +memory request set. You want to guarantee memory allocation for the `pod1`. +To the Linux kernel, processes in either pod have the same *OOM score*, +once the kernel finds that it does not have enough memory, it can kill +processes that belong to pod `pod1`. + +### Memory fragmentation + +The sequence of Pods and containers that start and stop can fragment the memory on NUMA nodes. +The alpha implementation of the Memory Manager does not have any mechanism to balance pods and defragment memory back. + +## Future work for the Memory Manager + +We do not want to stop with the current state of the Memory Manager and are looking to +make improvements, including in the following areas. + +### Make the Memory Manager allocation algorithm smarter + +The current algorithm ignores distances between NUMA nodes during the +calculation of the allocation. If same-node placement isn't available, we can still +provide better performance compared to the current implementation, by changing the +Memory Manager to prefer the closest NUMA nodes for cross-node allocation. + +### Reduce the number of admission errors + +The default Kubernetes scheduler is not aware of the node's NUMA topology, and it can be a reason for many admission errors during the pod start. +We're hoping to add a KEP (Kubernetes Enhancement Proposal) to cover improvements in this area. +Follow [Topology aware scheduler plugin in kube-scheduler](https://github.com/kubernetes/enhancements/issues/2044) to see how this idea progresses. + + +## Conclusion +With the promotion of the Memory Manager to beta in 1.22, we encourage everyone to give it a try and look forward to any feedback you may have. While there are still several limitations, we have a set of enhancements planned to address them and look forward to providing you with many new features in upcoming releases. +If you have ideas for additional enhancements or a desire for certain features, please let us know. The team is always open to suggestions to enhance and improve the Memory Manager. +We hope you have found this blog informative and helpful! Let us know if you have any questions or comments. + +You can contact us via: +- The Kubernetes [#sig-node ](https://kubernetes.slack.com/messages/sig-node) + channel in Slack (visit https://slack.k8s.io/ for an invitation if you need one) +- The SIG Node mailing list, [kubernetes-sig-node@googlegroups.com](https://groups.google.com/g/kubernetes-sig-node) diff --git a/static/images/blog/2021-08-11-memory-manager-moves-to-beta/MemoryManagerDiagram.svg b/static/images/blog/2021-08-11-memory-manager-moves-to-beta/MemoryManagerDiagram.svg new file mode 100644 index 0000000000..af22c48c52 --- /dev/null +++ b/static/images/blog/2021-08-11-memory-manager-moves-to-beta/MemoryManagerDiagram.svg @@ -0,0 +1,3 @@ + + +
        Kubelet
        Kubelet
        Topology Manager
        Topology Manager
        Memory
        Manager
        Memory...
        Memory Map
        Memory Map
        Admit()
        Admit()
        GetTopologyHints()
        GetTopologyHints()
        Calculates Affinity
        Calculates Affinity
        Hint
        Hint
        Allocate()
        Allocate()
        Updates Memory Map
        Updates Memory Map
        PreCreateContainer()
        PreCreateContainer()
        Gets Container Memory
         Allocation
        Gets Container Memory...        Viewer does not support full SVG 1.1         \ No newline at end of file diff --git a/static/images/blog/2021-08-11-memory-manager-moves-to-beta/ReservedMemory.svg b/static/images/blog/2021-08-11-memory-manager-moves-to-beta/ReservedMemory.svg new file mode 100644 index 0000000000..e89faf3156 --- /dev/null +++ b/static/images/blog/2021-08-11-memory-manager-moves-to-beta/ReservedMemory.svg @@ -0,0 +1,3 @@ + + +
        --kube-reserved memory=500Mi
        --system-reserved memory=500Mi
        --eviction-hard memory.available<100Mi
        --reserved-memory 0:memory=600Mi
        --reserved-memory 1:memory=500Mi
        --kube-reserved memory=500Mi--system-reserv...
        --kube-reserved memory=500Mi
        --system-reserved memory=500Mi
        --eviction-hard memory.available<100Mi
        --reserved-memory 0:memory=600Mi
        --reserved-memory 1:memory=600Mi
        --kube-reserved memory=500Mi--system-reserv...        Viewer does not support full SVG 1.1         \ No newline at end of file diff --git a/static/images/blog/2021-08-11-memory-manager-moves-to-beta/SingleCrossNUMAAllocation.svg b/static/images/blog/2021-08-11-memory-manager-moves-to-beta/SingleCrossNUMAAllocation.svg new file mode 100644 index 0000000000..3cc323311c --- /dev/null +++ b/static/images/blog/2021-08-11-memory-manager-moves-to-beta/SingleCrossNUMAAllocation.svg @@ -0,0 +1,3 @@ + + +
        NUMA 0
        8Gi
        NUMA 0...
        NUMA 1
        8Gi
        NUMA 1...
        container2
        requested: 10Gi
        container2...
        The container1 requested 5Gi of memory, but is using only 3Gi now
        The container1 requested 5...
        The container2 requested 10Gi of memory and is using 3.5Gi from the NUMA node 0 and 1Gi from the NUMA node 1
        The container2 requested 1...
        The container2
        uses the memory
        from
        the NUMA node 0
        that should be
        guaranteed for the
        container1
        The container2...
        uses: 1Gi
        uses: 1Gi
        uses: 3Gi
        uses: 3Gi
        uses: 3.5Gi
        uses: 3.5Gi
        container1
        requested: 5Gi
        container1...        Viewer does not support full SVG 1.1         \ No newline at end of file From 7b0ca655ce852076cbf9fcdd1e116890adeff614 Mon Sep 17 00:00:00 2001 From: zhang-wei Date: Thu, 12 Aug 2021 14:51:19 +0800 Subject: [PATCH 140/279] fix typo --- .../production-environment/tools/kubeadm/kubelet-integration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md b/content/zh/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md index 809b94a1fe..3ba5a093d2 100644 --- a/content/zh/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md +++ b/content/zh/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md @@ -384,7 +384,7 @@ Kubernetes 版本对应的 DEB 和 RPM 软件包是： | Package name | Description | |--------------|-------------| | `kubeadm` | 给 kubelet 安装 `/usr/bin/kubeadm` CLI 工具和 [kubelet 的 systemd 文件](#the-kubelet-drop-in-file-for-systemd)。 | -| `kubelet` | 安装 kublet 可执行文件到 `/usr/bin` 路径，安装 CNI 可执行文件到 `/opt/cni/bin` 路径。 | +| `kubelet` | 安装 kubelet 可执行文件到 `/usr/bin` 路径，安装 CNI 可执行文件到 `/opt/cni/bin` 路径。 | | `kubectl` | 安装 `/usr/bin/kubectl` 可执行文件。 | | `cri-tools` | 从 [cri-tools git 仓库](https://github.com/kubernetes-sigs/cri-tools)中安装 `/usr/bin/crictl` 可执行文件。 | From c07cd0489421a00c830b5a63539c5071343449b7 Mon Sep 17 00:00:00 2001 From: Maciej Filocha Date: Thu, 12 Aug 2021 09:06:25 +0200 Subject: [PATCH 141/279] Update Polish localization of the home page Update Polish localization of the main index page up to 08d92f9137924abdf442e7d9fb7372901379b993. --- content/pl/_index.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/pl/_index.html b/content/pl/_index.html index 1096114700..03ec4a4c44 100644 --- a/content/pl/_index.html +++ b/content/pl/_index.html @@ -44,12 +44,12 @@ Kubernetes jako projekt open-source daje Ci wolność wyboru ⏤ skorzystaj z pr

        - Weź udział w wirtualnym KubeCon NA, 17-20.11.2020 + Weź udział w KubeCon North America 11-15.10.2021



        - Weź udział w wirtualnym KubeCon EU 4–7.05.2021 + Weź udział w wirtualnym KubeCon Europe 17-20.5.2022
      From 49d64fc388627cbf411e178c65de0e2bf8f36087 Mon Sep 17 00:00:00 2001 From: Maciej Filocha Date: Thu, 12 Aug 2021 09:51:46 +0200 Subject: [PATCH 142/279] Synchronize Polish localization for ver 1.22, part 1 Synchronize Polish localization with upstream up to 08d92f9137924abdf442e7d9fb7372901379b993. Part 1 --- content/pl/docs/setup/_index.md | 38 +++++++++++++++++++++---- content/pl/docs/setup/release/_index.md | 4 --- 2 files changed, 33 insertions(+), 9 deletions(-) delete mode 100644 content/pl/docs/setup/release/_index.md diff --git a/content/pl/docs/setup/_index.md b/content/pl/docs/setup/_index.md index 6107fe0f03..a2908369f7 100644 --- a/content/pl/docs/setup/_index.md +++ b/content/pl/docs/setup/_index.md @@ -1,9 +1,9 @@ --- -no_issue: true title: Od czego zacząć main_menu: true weight: 20 content_type: concept +no_list: true card: name: setup weight: 20 @@ -19,16 +19,44 @@ card: Ten rozdział poświęcony jest różnym metodom konfiguracji i uruchomienia Kubernetesa. Instalując Kubernetesa, przy wyborze platformy kieruj się: łatwością w utrzymaniu, spełnianymi wymogami bezpieczeństwa, poziomem sterowania, dostępnością zasobów oraz doświadczeniem wymaganym do zarządzania klastrem. -Klaster Kubernetes możesz zainstalować na lokalnym komputerze, w chmurze czy w prywatnym centrum obliczeniowym albo skorzystać z klastra Kubernetes udostępnianego jako usługa. Inną możliwością jest budowa własnego systemu opartego o różnych dostawców usług chmurowych, bądź bazującego bezpośrednio na sprzęcie fizycznym. +Możesz [pobrać Kubernetesa](/releases/download/), aby zainstalować klaster +na lokalnym komputerze, w chmurze czy w prywatnym centrum obliczeniowym. + +Jeśli nie chcesz zarządzać klastrem Kubernetesa samodzielnie, możesz wybrać serwis zarządzany przez zewnętrznego dostawcę, +wybierając na przykład spośród [certyfikowanych platform](/docs/setup/production-environment/turnkey-solutions/). +Dostępne są także inne standardowe i specjalizowane rozwiązania dla różnych środowisk chmurowych +bądź bazujące bezpośrednio na sprzęcie fizycznym. ## Środowisko do nauki {#srodowisko-do-nauki} -Do nauki Kubernetesa wykorzystaj narzędzia wspierane przez społeczność Kubernetesa lub inne narzędzia dostępne w ekosystemie, aby uruchomić klaster Kubernetesa na swoim komputerze lokalnym. +Do nauki Kubernetesa wykorzystaj narzędzia wspierane przez społeczność Kubernetesa +lub inne narzędzia dostępne w ekosystemie, aby uruchomić klaster Kubernetesa na swoim komputerze lokalnym. +Zapoznaj się z [narzędziami instalacyjnymi](/docs/tasks/tools/). ## Środowisko produkcyjne {#srodowisko-produkcyjne} -Wybierając rozwiązanie dla środowiska produkcyjnego musisz zdecydować, którymi poziomami zarządzania klastrem (_abstrakcjami_) chcesz zajmować się sam, a które będą realizowane po stronie zewnętrznego operatora. +Wybierając rozwiązanie dla +[środowiska produkcyjnego](/docs/setup/production-environment/) musisz zdecydować, +którymi poziomami zarządzania klastrem (_abstrakcjami_) chcesz zajmować się sam, +a które będą realizowane po stronie zewnętrznego operatora. -Na stronie [Partnerzy Kubernetes](https://kubernetes.io/partners/#conformance) znajdziesz listę dostawców posiadających [certyfikację Kubernetes](https://github.com/cncf/k8s-conformance/#certified-kubernetes). +Do instalacji klastra Kubernetesa zarządzanego samodzielnie oficjalnym narzędziem +jest [kubeadm](/docs/setup/production-environment/tools/kubeadm/). + +## {{% heading "whatsnext" %}} + +- [Pobierz Kubernetesa](/releases/download/) +- Pobierz i [zainstaluj narzędzia](/docs/tasks/tools/), w tym `kubectl` +- Wybierz [środowisko uruchomieniowe dla kontenerów](/docs/setup/production-environment/container-runtimes/) w nowym klastrze +- Naucz się [najlepszych praktyk](/docs/setup/best-practices/) przy konfigurowaniu klastra + +Na stronie [Partnerów Kubernetesa](https://kubernetes.io/partners/#conformance) znajdziesz listę dostawców posiadających +[certyfikację Kubernetes](https://github.com/cncf/k8s-conformance/#certified-kubernetes). + +Kubernetes zaprojektowano w ten sposób, że {{< glossary_tooltip term_id="control-plane" text="warstwa sterowania" >}} +wymaga do działania systemu Linux. W ramach klastra aplikacje mogą być uruchamiane na systemie Linux i innych, +w tym Windows. + +- Naucz się, [jak zbudować klaster z węzłami Windows](/docs/setup/production-environment/windows/) diff --git a/content/pl/docs/setup/release/_index.md b/content/pl/docs/setup/release/_index.md deleted file mode 100644 index 2783105198..0000000000 --- a/content/pl/docs/setup/release/_index.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: "Informacje o wydaniach i dozwolonych różnicach wersji" -weight: 10 ---- From 29ff83785e4f941eceaf597529ccdde641ed9a03 Mon Sep 17 00:00:00 2001 From: Mengjiao Liu Date: Mon, 9 Aug 2021 18:36:53 +0800 Subject: [PATCH 143/279] [zh] Link to new API reference page for APIService --- .../api-extension/apiserver-aggregation.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/content/zh/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation.md b/content/zh/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation.md index 2dd14158f0..738ba23e06 100644 --- a/content/zh/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation.md +++ b/content/zh/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation.md @@ -78,12 +78,14 @@ If your extension API server cannot achieve that latency requirement, consider m * 阅读[配置聚合层](/zh/docs/tasks/extend-kubernetes/configure-aggregation-layer/) 文档， 了解如何在自己的环境中启用聚合器。 * 接下来，了解[安装扩展 API 服务器](/zh/docs/tasks/extend-kubernetes/setup-extension-api-server/)， 开始使用聚合层。 -* 也可以学习怎样[使用自定义资源定义扩展 Kubernetes API](/zh/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/)。 -* 阅读 [APIService](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#apiservice-v1-apiregistration-k8s-io) 的规范 +* 从 API 参考资料中研究关于 [APIService](/docs/reference/kubernetes-api/cluster-resources/api-service-v1/) 的内容。 + +或者，学习如何[使用自定义资源定义扩展 Kubernetes API](/zh/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/)。 From 41aa2ba72772b9445459dbd56172070ce1efa9df Mon Sep 17 00:00:00 2001 From: Wesley Williams Date: Thu, 12 Aug 2021 22:48:50 +0100 Subject: [PATCH 144/279] Revert chinese changes --- .../docs/tasks/administer-cluster/cpu-management-policies.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/zh/docs/tasks/administer-cluster/cpu-management-policies.md b/content/zh/docs/tasks/administer-cluster/cpu-management-policies.md index 67c8298222..a264ee538a 100644 --- a/content/zh/docs/tasks/administer-cluster/cpu-management-policies.md +++ b/content/zh/docs/tasks/administer-cluster/cpu-management-policies.md @@ -94,8 +94,7 @@ CPU 管理器定期通过 CRI 写入资源更新，以保证内存中 CPU 分配 The `none` policy explicitly enables the existing default CPU affinity scheme, providing no affinity beyond what the OS scheduler does automatically.  Limits on CPU usage for -[Guaranteed pods](/docs/tasks/configure-pod-container/quality-service-pod/) and -[Burstable pods](/docs/tasks/configure-pod-container/quality-service-pod/) +[Guaranteed pods](/docs/tasks/configure-pod-container/quality-service-pod/) are enforced using CFS quota. --> ### none 策略 From 74d7ad31182eb27330dc537e0820b167bf350c9a Mon Sep 17 00:00:00 2001 From: Arhell Date: Fri, 13 Aug 2021 02:13:25 +0300 Subject: [PATCH 145/279] [id] Fix list all uniq container images --- .../list-all-running-container-images.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/id/docs/tasks/access-application-cluster/list-all-running-container-images.md b/content/id/docs/tasks/access-application-cluster/list-all-running-container-images.md index f2140e5276..86a6b267e2 100644 --- a/content/id/docs/tasks/access-application-cluster/list-all-running-container-images.md +++ b/content/id/docs/tasks/access-application-cluster/list-all-running-container-images.md @@ -28,7 +28,7 @@ Container untuk masing-masing Pod. - Silakan ambil semua Pod dalam Namespace dengan menggunakan perintah `kubectl get pods --all-namespaces` - Silakan format keluarannya agar hanya menyertakan daftar nama _image_ dari Container - dengan menggunakan perintah `-o jsonpath={..image}`. Perintah ini akan mem-_parsing field_ + dengan menggunakan perintah `-o jsonpath={.items[*].spec.containers[*].image}`. Perintah ini akan mem-_parsing field_ `image` dari keluaran json yang dihasilkan. - Silakan lihat [referensi jsonpath](/docs/user-guide/jsonpath/) untuk informasi lebih lanjut tentang cara menggunakan `jsonpath`. @@ -38,7 +38,7 @@ Container untuk masing-masing Pod. - Gunakan `uniq` untuk mengumpulkan jumlah _image_ ```sh -kubectl get pods --all-namespaces -o jsonpath="{..image}" |\ +kubectl get pods --all-namespaces -o jsonpath="{.items[*].spec.containers[*].image}" |\ tr -s '[[:space:]]' '\n' |\ sort |\ uniq -c @@ -86,7 +86,7 @@ Untuk menargetkan hanya Pod yang cocok dengan label tertentu saja, gunakan tanda dibawah ini akan menghasilkan Pod dengan label yang cocok dengan `app=nginx`. ```sh -kubectl get pods --all-namespaces -o=jsonpath="{..image}" -l app=nginx +kubectl get pods --all-namespaces -o=jsonpath="{.items[*].spec.containers[*].image}" -l app=nginx ``` ## Membuat daftar _image_ Container yang difilter berdasarkan Namespace Pod @@ -95,7 +95,7 @@ Untuk hanya menargetkan Pod pada Namespace tertentu, gunakankan tanda Namespace. dibawah ini hanya menyaring Pod pada Namespace `kube-system`. ```sh -kubectl get pods --namespace kube-system -o jsonpath="{..image}" +kubectl get pods --namespace kube-system -o jsonpath="{.items[*].spec.containers[*].image}" ``` ## Membuat daftar _image_ Container dengan menggunakan go-template sebagai alternatif dari jsonpath From d5de9efdb60a6f4c40c0bc4b2fcd8c055bd3046f Mon Sep 17 00:00:00 2001 From: Jim Angel Date: Fri, 13 Aug 2021 06:39:39 +0000 Subject: [PATCH 146/279] updating co-chairs --- OWNERS | 2 ++ OWNERS_ALIASES | 9 --------- SECURITY_CONTACTS | 2 -- 3 files changed, 2 insertions(+), 11 deletions(-) diff --git a/OWNERS b/OWNERS index 9b12305b4b..8e4e14f60c 100644 --- a/OWNERS +++ b/OWNERS @@ -8,7 +8,9 @@ approvers: emeritus_approvers: # - chenopis, commented out to disable PR assignments +# - irvifa, commented out to disable PR assignments # - jaredbhatti, commented out to disable PR assignments +# - kbarnard10, commented out to disable PR assignments # - steveperry-53, commented out to disable PR assignments - stewart-yu # - zacharysarah, commented out to disable PR assignments diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES index ea9761f277..ab0771933c 100644 --- a/OWNERS_ALIASES +++ b/OWNERS_ALIASES @@ -1,10 +1,8 @@ aliases: sig-docs-blog-owners: # Approvers for blog content - - kbarnard10 - onlydole - mrbobbytables sig-docs-blog-reviewers: # Reviewers for blog content - - kbarnard10 - mrbobbytables - onlydole - sftim @@ -20,9 +18,7 @@ aliases: - annajung - bradtopol - celestehorgan - - irvifa - jimangel - - kbarnard10 - kbhawkey - onlydole - pi-victor @@ -35,7 +31,6 @@ aliases: - celestehorgan - daminisatya - jimangel - - kbarnard10 - kbhawkey - onlydole - rajeshdeshpande02 @@ -88,7 +83,6 @@ aliases: - danninov - girikuncoro - habibrosyad - - irvifa - phanama - wahyuoi sig-docs-id-reviews: # PR reviews for Indonesian content @@ -96,7 +90,6 @@ aliases: - danninov - girikuncoro - habibrosyad - - irvifa - phanama - wahyuoi sig-docs-it-owners: # Admins for Italian content @@ -138,9 +131,7 @@ aliases: - yoonian - ysyukr sig-docs-leads: # Website chairs and tech leads - - irvifa - jimangel - - kbarnard10 - kbhawkey - onlydole - sftim diff --git a/SECURITY_CONTACTS b/SECURITY_CONTACTS index 5b0cc85b45..64a1ca5415 100644 --- a/SECURITY_CONTACTS +++ b/SECURITY_CONTACTS @@ -10,7 +10,5 @@ # DO NOT REPORT SECURITY VULNERABILITIES DIRECTLY TO THESE NAMES, FOLLOW THE # INSTRUCTIONS AT https://kubernetes.io/security/ -irvifa jimangel -kbarnard10 sftim \ No newline at end of file From d55d7703652db7771b6a7eafc80a33c72e116ca8 Mon Sep 17 00:00:00 2001 From: Manish Kumar Date: Fri, 13 Aug 2021 12:54:47 +0530 Subject: [PATCH 147/279] Removed reference for broken link --- SECURITY.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 2083d44cdf..2f3c214352 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,8 +4,6 @@ Join the [kubernetes-security-announce] group for security and vulnerability announcements. -You can also subscribe to an RSS feed of the above using [this link][kubernetes-security-announce-rss]. - ## Reporting a Vulnerability Instructions for reporting a vulnerability can be found on the @@ -17,6 +15,5 @@ Information about supported Kubernetes versions can be found on the [Kubernetes version and version skew support policy] page on the Kubernetes website. [kubernetes-security-announce]: https://groups.google.com/forum/#!forum/kubernetes-security-announce -[kubernetes-security-announce-rss]: https://groups.google.com/forum/feed/kubernetes-security-announce/msgs/rss_v2_0.xml?num=50 [Kubernetes version and version skew support policy]: https://kubernetes.io/docs/setup/release/version-skew-policy/#supported-versions [Kubernetes Security and Disclosure Information]: https://kubernetes.io/docs/reference/issues-security/security/#report-a-vulnerability From 9314e3be286fa0fe99239c3fcae77cd86376b11d Mon Sep 17 00:00:00 2001 From: Maciej Filocha Date: Fri, 13 Aug 2021 09:36:31 +0200 Subject: [PATCH 148/279] Synchronize Polish localization for ver 1.22, part 2 Synchronize Polish localization with upstream up to 08d92f9137924abdf442e7d9fb7372901379b993. Part 2 --- .../pl/docs/concepts/overview/components.md | 7 +-- .../concepts/overview/what-is-kubernetes.md | 3 +- content/pl/docs/reference/tools.md | 48 ------------------- content/pl/releases/_index.md | 2 +- 4 files changed, 6 insertions(+), 54 deletions(-) delete mode 100644 content/pl/docs/reference/tools.md diff --git a/content/pl/docs/concepts/overview/components.md b/content/pl/docs/concepts/overview/components.md index dba2d1e782..b6843e04db 100644 --- a/content/pl/docs/concepts/overview/components.md +++ b/content/pl/docs/concepts/overview/components.md @@ -27,7 +27,7 @@ Poniższy rysunek przedstawia klaster Kubernetes i powiązania pomiędzy jego r Komponenty warstwy sterowania podejmują ogólne decyzje dotyczące klastra (np. zlecanie zadań), a także wykrywają i reagują na zdarzenia w klastrze (przykładowo, start nowego {{< glossary_tooltip text="poda" term_id="pod">}}, kiedy wartość `replicas` dla deploymentu nie zgadza się z faktyczną liczbą replik). -Komponenty warstwy sterowania mogą być uruchomione na dowolnej maszynie w klastrze. Dla uproszczenia jednak skrypty instalacyjne zazwyczaj startują wszystkie składniki na tej samej maszynie i jednocześnie nie pozwalają na uruchamianie na niej kontenerów użytkowników. Na stronie [Tworzenie Wysoko Dostępnych Klastrów](/docs/admin/high-availability/) jest więcej informacji o konfiguracji typu *multi-master-VM*. +Komponenty warstwy sterowania mogą być uruchomione na dowolnej maszynie w klastrze. Dla uproszczenia jednak skrypty instalacyjne zazwyczaj startują wszystkie składniki na tej samej maszynie i jednocześnie nie pozwalają na uruchamianie na niej kontenerów użytkowników. Na stronie [Creating Highly Available clusters with kubeadm](/docs/setup/production-environment/tools/kubeadm/high-availability/) znajdziesz opis konfiguracji warstwy sterowania działającej na wielu maszynach wirtualnych. ### kube-apiserver @@ -45,10 +45,11 @@ Komponenty warstwy sterowania mogą być uruchomione na dowolnej maszynie w klas {{< glossary_definition term_id="kube-controller-manager" length="all" >}} -Kontrolerami są: +Przykładowe kontrolery: * Node controller: Odpowiada za rozpoznawanie i reagowanie na sytuacje, kiedy węzeł staje się z jakiegoś powodu niedostępny. -* Replication controller: Odpowiada za utrzymanie prawidłowej liczby podów dla każdego obiektu typu *ReplicationController* w systemie. +* Job controller: Czeka na obiekty typu *Job*, które definiują zadania uruchamiane jednorazowo + i startuje Pody, odpowiadające za ich wykonanie tych zadań. * Endpoints controller: Dostarcza informacji do obiektów typu *Endpoints* (tzn. łączy ze sobą Serwisy i Pody). * Service Account & Token controllers: Tworzy domyślne konta i tokeny dostępu API dla nowych przestrzeni nazw (*namespaces*). diff --git a/content/pl/docs/concepts/overview/what-is-kubernetes.md b/content/pl/docs/concepts/overview/what-is-kubernetes.md index d28c841553..7391ed6602 100644 --- a/content/pl/docs/concepts/overview/what-is-kubernetes.md +++ b/content/pl/docs/concepts/overview/what-is-kubernetes.md @@ -14,11 +14,10 @@ sitemap: Na tej stronie znajdziesz ogólne informacje o Kubernetesie. - Kubernetes to przenośna, rozszerzalna platforma oprogramowania *open-source* służąca do zarządzania zadaniami i serwisami uruchamianymi w kontenerach, która umożliwia deklaratywną konfigurację i automatyzację. Ekosystem Kubernetesa jest duży i dynamicznie się rozwija. Serwisy Kubernetesa, wsparcie i narzędzia są szeroko dostępne. -Nazwa Kubernetes pochodzi z greki i oznacza sternika albo pilota. Google otworzyło projekt Kubernetes publicznie w 2014. Kubernetes korzysta z [piętnastoletniego doświadczenia Google w uruchamianiu wielkoskalowych serwisów](/blog/2015/04/borg-predecessor-to-kubernetes/) i łączy je z najlepszymi pomysłami i praktykami wypracowanymi przez społeczność. +Nazwa Kubernetes pochodzi z greki i oznacza sternika albo pilota. Skrót K8s powstał poprzez zastąpienie ośmiu liter pomiędzy "K" i "s" .Google otworzyło projekt Kubernetes publicznie w 2014. Kubernetes korzysta z [piętnastoletniego doświadczenia Google w uruchamianiu wielkoskalowych serwisów](/blog/2015/04/borg-predecessor-to-kubernetes/) i łączy je z najlepszymi pomysłami i praktykami wypracowanymi przez społeczność. ## Trochę historii diff --git a/content/pl/docs/reference/tools.md b/content/pl/docs/reference/tools.md deleted file mode 100644 index 2ec66964ed..0000000000 --- a/content/pl/docs/reference/tools.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Narzędzia -content_type: concept ---- - - -Kubernetes zawiera różne wbudowane narzędzia służące do pracy z systemem: - - - -## Kubectl - -[`kubectl`](/docs/tasks/tools/install-kubectl/) to narzędzie tekstowe (linii poleceń) do Kubernetes. Służy do zarządzania klastrem Kubernetes. - -## Kubeadm - -[`kubeadm`](/docs/setup/production-environment/tools/kubeadm/install-kubeadm/) to narzędzie tekstowe do łatwej instalacji klastra Kubernetes w bezpiecznej konfiguracji, uruchamianego na infrastrukturze serwerów fizycznych, serwerów w chmurze bądź na maszynach wirtualnych (aktualnie w fazie rozwojowej alfa). - -## Minikube - -[`minikube`](https://minikube.sigs.k8s.io/docs/) to narzędzie do uruchamiania jednowęzłowego klastra Kubernetes na twojej stacji roboczej na potrzeby rozwoju oprogramowania lub prowadzenia testów. - -## Pulpit *(Dashboard)* - -[`Dashboard`](/docs/tasks/access-application-cluster/web-ui-dashboard/) - graficzny interfejs użytkownika w przeglądarce web, który umożliwia instalację aplikacji w kontenerach na klastrze Kubernetes, rozwiązywanie problemów z nimi związanych oraz zarządzanie samym klastrem i jego zasobami. - -## Helm - -[`Kubernetes Helm`](https://github.com/kubernetes/helm) — narzędzie do zarządzania pakietami wstępnie skonfigurowanych zasobów Kubernetes (nazywanych *Kubernetes charts*). - -Helm-a można używać do: - -* Wyszukiwania i instalowania popularnego oprogramowania dystrybuowanego jako Kubernetes *charts* -* Udostępniania własnych aplikacji w postaci pakietów Kubernetes *charts* -* Definiowania powtarzalnych instalacji aplikacji na Kubernetes -* Inteligentnego zarządzania plikami list (*manifests*) Kubernetes -* Zarządzaniem kolejnymi wydaniami pakietów Helm - -## Kompose - -[`Kompose`](https://github.com/kubernetes/kompose) to narzędzie, które ma pomóc użytkownikom Docker Compose przenieść się na Kubernetes. - -Kompose można używać do: - -* Tłumaczenia plików Docker Compose na obiekty Kubernetes -* Zmiany sposóbu zarządzania twoimi aplikacjami z lokalnego środowiska Docker na system Kubernetes -* Zamiany plików `yaml` Docker Compose v1 lub v2 oraz [Distributed Application Bundles](https://docs.docker.com/compose/bundles/) - diff --git a/content/pl/releases/_index.md b/content/pl/releases/_index.md index 5df8f36264..46c2a7659f 100644 --- a/content/pl/releases/_index.md +++ b/content/pl/releases/_index.md @@ -24,4 +24,4 @@ Więcej informacji można z znaleźć w dokumencie [version skew policy](/releas Zajrzyj na [harmonogram](https://github.com/kubernetes/sig-release/tree/master/releases/release-{{< skew nextMinorVersion >}}) nadchodzącego wydania Kubernetesa numer **{{< skew nextMinorVersion >}}**! -## Przydatne zasoby \ No newline at end of file +## Przydatne zasoby From 5962a5e9391fcb2721e9bb1d9b6fa9f23d8d380b Mon Sep 17 00:00:00 2001 From: Anubhav Vardhan Date: Fri, 13 Aug 2021 13:39:43 +0530 Subject: [PATCH 149/279] Create _index.md --- content/hi/docs/_index.md | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 content/hi/docs/_index.md diff --git a/content/hi/docs/_index.md b/content/hi/docs/_index.md new file mode 100644 index 0000000000..2244c2f26b --- /dev/null +++ b/content/hi/docs/_index.md @@ -0,0 +1,6 @@ +--- +linktitle: कुबेरनेट्स प्रलेखन +title: प्रलेखन +sitemap: + priority: 1.0 +--- From d1a502072e0927c396d959fe25ac2ada4599a0a5 Mon Sep 17 00:00:00 2001 From: EricWvi Date: Fri, 13 Aug 2021 18:12:06 +0800 Subject: [PATCH 150/279] [zh] Concept files to sync for 1.22 - (8) Service --- .../services-networking/dns-pod-service.md | 34 +++++- .../services-networking/endpoint-slices.md | 2 - .../concepts/services-networking/ingress.md | 10 +- .../services-networking/network-policies.md | 27 +++-- .../concepts/services-networking/service.md | 104 +++++++++++++++--- 5 files changed, 143 insertions(+), 34 deletions(-) diff --git a/content/zh/docs/concepts/services-networking/dns-pod-service.md b/content/zh/docs/concepts/services-networking/dns-pod-service.md index 50a6c47d86..8be050a328 100644 --- a/content/zh/docs/concepts/services-networking/dns-pod-service.md +++ b/content/zh/docs/concepts/services-networking/dns-pod-service.md @@ -92,10 +92,10 @@ options ndots:5 概括起来，名字空间 `test` 中的 Pod 可以成功地解析 `data.prod` 或者 -`data.prod.cluster.local`。 +`data.prod.svc.cluster.local`。 ### Pod 的 setHostnameAsFQDN 字段 {#pod-sethostnameasfqdn-field} -{{< feature-state for_k8s_version="v1.20" state="beta" >}} +{{< feature-state for_k8s_version="v1.22" state="stable" >}} ### Pod 的 DNS 配置 {#pod-dns-config} +{{< feature-state for_k8s_version="v1.14" state="stable" >}} + Pod 的 DNS 配置可让用户对 Pod 的 DNS 设置进行更多控制。 `dnsConfig` 字段是可选的，它可以与任何 `dnsPolicy` 设置一起使用。 @@ -541,6 +545,28 @@ search default.svc.cluster-domain.example svc.cluster-domain.example cluster-dom options ndots:5 ``` + +#### 扩展 DNS 配置 + +{{< feature-state for_k8s_version="1.22" state="alpha" >}} + +对于 Pod DNS 配置，Kubernetes 默认允许最多 6 个 search domain +以及一个最多 256 个字符的 search domain 列表。 + +如果启用 kube-apiserver 和 kubelet 的特性门控 `ExpandedDNSConfig`，Kubernetes 将可以有最多 32 个 +search domain 以及一个最多 2048 个字符的 search domain 列表。 + -* 了解[启用 EndpointSlice](/zh/docs/tasks/administer-cluster/enabling-endpointslices) * 阅读[使用服务连接应用](/zh/docs/concepts/services-networking/connect-applications-service/) diff --git a/content/zh/docs/concepts/services-networking/ingress.md b/content/zh/docs/concepts/services-networking/ingress.md index 2364096a53..5874b0ea7e 100644 --- a/content/zh/docs/concepts/services-networking/ingress.md +++ b/content/zh/docs/concepts/services-networking/ingress.md @@ -421,7 +421,7 @@ IngressClass 资源包含一个可选的 `parameters` 字段，可用于为该 --> #### 名字空间域的参数 -{{< feature-state for_k8s_version="v1.21" state="alpha" >}} +{{< feature-state for_k8s_version="v1.22" state="beta" >}} `parameters` 字段有一个 `scope` 和 `namespace` 字段，可用来引用特定 于名字空间的资源，对 Ingress 类进行配置。 @@ -436,6 +441,9 @@ will reference a parameters resource in a specific namespace: 将 `scope` 设置为 `Namespace` 并设置 `namespace` 字段就可以引用某特定 名字空间中的参数资源。 +将 `scope` 设置为 `Namespace` 后不再需要为一个参数资源配置集群范围的 CustomResourceDefinition。 +除此之外，之前对访问集群范围的资源进行授权，需要用到 RBAC 相关的资源，现在也不再需要了。 + {{< codenew file="service/networking/namespaced-params.yaml" >}} ## SCTP 支持 -{{< feature-state for_k8s_version="v1.19" state="beta" >}} +{{< feature-state for_k8s_version="v1.20" state="stable" >}} -作为一个 Beta 特性，SCTP 支持默认是被启用的。 +作为一个 Stable 特性，SCTP 支持默认是被启用的。 要在集群层面禁用 SCTP，你（或你的集群管理员）需要为 API 服务器指定 `--feature-gates=SCTPSupport=false,...` 来禁用 `SCTPSupport` [特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/)。 @@ -439,7 +440,7 @@ You must be using a {{< glossary_tooltip text="CNI" term_id="cni" >}} plugin tha --> ## 针对某个端口范围 {#targeting-a-range-of-ports} -{{< feature-state for_k8s_version="v1.21" state="alpha" >}} +{{< feature-state for_k8s_version="v1.22" state="beta" >}} 上面的规则允许名字空间 `default` 中所有带有标签 `db` 的 Pod 使用 TCP 协议 与 `10.0.0.0/24` 范围内的 IP 通信，只要目标端口介于 32000 和 32768 之间就可以。 使用此字段时存在以下限制： -* 作为一种 Alpha 阶段的特性，端口范围设定默认是被禁用的。要在整个集群 - 范围内允许使用 `endPort` 字段，你（或者你的集群管理员）需要为 API - 服务器设置 `-feature-gates=NetworkPolicyEndPort=true,...` 以启用 +* 作为一种 Beta 阶段的特性，端口范围设定默认是被启用的。要在整个集群 + 范围内禁止使用 `endPort` 字段，你（或者你的集群管理员）需要为 API + 服务器设置 `-feature-gates=NetworkPolicyEndPort=false,...` 以禁用 `NetworkPolicyEndPort` [特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/)。 * `endPort` 字段必须等于或者大于 `port` 字段的值。 @@ -499,9 +502,15 @@ The following restrictions apply when using this field: 你的集群所使用的 {{< glossary_tooltip text="CNI" term_id="cni" >}} 插件 必须支持在 NetworkPolicy 规约中使用 `endPort` 字段。 +如果你的 [网络插件](/zh/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) +不支持 `endPort` 字段的情况下，你指定一个有 `endPort` 字段的网络策略， +策略只对单个 `port` 字段生效。 {{< /note >}} ### 超出容量的 Endpoints {#over-capacity-endpoints} -如果某个 Endpoints 资源中包含的端点个数超过 1000，则 Kubernetes v1.21 版本 +如果某个 Endpoints 资源中包含的端点个数超过 1000，则 Kubernetes v1.22 版本 （及更新版本）的集群会将为该 Endpoints 添加注解 -`endpoints.kubernetes.io/over-capacity: warning`。 -这一注解表明所影响到的 Endpoints 对象已经超出容量。 +`endpoints.kubernetes.io/over-capacity: truncated`。 +这一注解表明所影响到的 Endpoints 对象已经超出容量，此外 Endpoints Controller 还会将 Endpoints 对象数量截断到 1000。 +## 流量策略 + + +### 外部流量策略 + + + +你可以通过设置 `spec.externalTrafficPolicy` 字段来控制来自于外部的流量是如何路由的。 +可选值有 `Cluster` 和 `Local`。字段设为 `Cluster` 会将外部流量路由到所有就绪的端点， +设为 `Local` 会只路由到当前节点上就绪的端点。如果流量策略设置为 `Local`，而且当前节点上没有就绪的端点，kube-proxy 不会转发请求相关服务的任何流量。 + +{{< note >}} +{{< feature-state for_k8s_version="v1.22" state="alpha" >}} + + + +如果你启用了 kube-proxy 的 `ProxyTerminatingEndpoints` [特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/)，kube-proxy 会检查节点是否有本地的端点，以及是否所有的本地端点都被标记为终止中。 + + + +如果本地有端点，而且所有端点处于终止中的状态，那么 kube-proxy 会忽略任何设为 `Local` 的外部流量策略。在所有本地端点处于终止中的状态的同时，kube-proxy 将请求指定服务的流量转发到位于其它节点的状态健康的端点，如同外部流量策略设为 `Cluster`。 + + +在端点都处于终止中的情况下，这个转发行为使得外部的负载均衡器可以优雅地排出由 `NodePort` 服务支持的连接，就算是健康检查节点端口开始失败也是如此。 +否则，在节点还在负载均衡器的节点池中，到一个 Pod 终止过程中正在丢弃流量之间，流量可能会丢失。 + +{{< /note >}} + + +### 内部流量策略 + +{{< feature-state for_k8s_version="v1.22" state="beta" >}} + + +你可以设置 `spec.internalTrafficPolicy` 字段来控制内部来源的流量是如何转发的。可设置的值有 `Cluster` 和 `Local`。 +将字段设置为 `Cluster` 会将内部流量路由到所有就绪端点，设置为 `Local` 只会路由到当前节点上就绪的端点。 +如果流量策略是 `Local`，而且当前节点上没有就绪的端点，那么 kube-proxy 会丢弃流量。 + #### 设置负载均衡器实现的类别 {#load-balancer-class} -{{< feature-state for_k8s_version="v1.21" state="alpha" >}} +{{< feature-state for_k8s_version="v1.22" state="beta" >}} -从 v1.21 开始，你可以有选择地为 `LoadBalancer` 类型的服务设置字段 -`.spec.loadBalancerClass`，以指定其负载均衡器实现的类别。 -默认情况下，`.spec.loadBalancerClass` 的取值是 `nil`，`LoadBalancer` 类型 -服务会使用云提供商的默认负载均衡器实现。 +`spec.loadBalancerClass` 允许你不使用云提供商的默认负载均衡器实现，转而使用指定的负载均衡器实现。这个特性从 v1.21 版本开始可以使用，你在 v1.21 版本中使用这个字段必须启用 `ServiceLoadBalancerClass` 特性门控，这个特性门控从 v1.22 版本及以后默认打开。 +默认情况下，`.spec.loadBalancerClass` 的取值是 `nil`，如果集群使用 `--cloud-provider` 配置了云提供商， +`LoadBalancer` 类型服务会使用云提供商的默认负载均衡器实现。 如果设置了 `.spec.loadBalancerClass`，则假定存在某个与所指定的类相匹配的 负载均衡器实现在监视服务变化。 所有默认的负载均衡器实现（例如，由云提供商所提供的）都会忽略设置了此字段 @@ -1152,12 +1222,10 @@ Once set, it cannot be changed. The value of `spec.loadBalancerClass` must be a label-style identifier, with an optional prefix such as "`internal-vip`" or "`example.com/internal-vip`". Unprefixed names are reserved for end-users. -You must enable the `ServiceLoadBalancerClass` feature gate to use this field. --> `.spec.loadBalancerClass` 的值必须是一个标签风格的标识符， 可以有选择地带有类似 "`internal-vip`" 或 "`example.com/internal-vip`" 这类 前缀。没有前缀的名字是保留给最终用户的。 -你必须启用 `ServiceLoadBalancerClass` 特性门控才能使用此字段。 #### 绑定的服务账号令牌卷 {#bound-service-account-token-volume} - -{{< feature-state for_k8s_version="v1.21" state="beta" >}} +{{< feature-state for_k8s_version="v1.22" state="stable" >}} 当 `BoundServiceAccountTokenVolume` -[特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/) -被启用时，服务账号准入控制器将添加如下投射卷，而不是为令牌控制器 +ServiceAccount 准入控制器将添加如下投射卷，而不是为令牌控制器 所生成的不过期的服务账号令牌而创建的基于 Secret 的卷。 ```yaml @@ -165,7 +162,7 @@ add the following projected volume instead of a Secret-based volume for the non- This projected volume consists of three sources: 1. A ServiceAccountToken acquired from kube-apiserver via TokenRequest API. It will expire after 1 hour by default or when the pod is deleted. It is bound to the pod and has kube-apiserver as the audience. -1. A ConfigMap containing a CA bundle used for verifying connections to the kube-apiserver. This feature depends on the `RootCAConfigMap` feature gate being enabled, which publishes a "kube-root-ca.crt" ConfigMap to every namespace. `RootCAConfigMap` is enabled by default in 1.20, and always enabled in 1.21+. +1. A ConfigMap containing a CA bundle used for verifying connections to the kube-apiserver. This feature depends on the `RootCAConfigMap` feature gate, which publishes a "kube-root-ca.crt" ConfigMap to every namespace. `RootCAConfigMap` feature gate is graduated to GA in 1.21 and default to true. (This feature will be removed from --feature-gate arg in 1.22). 1. A DownwardAPI that references the namespace of the pod. --> 此投射卷有三个数据源： @@ -174,27 +171,18 @@ This projected volume consists of three sources: 这一令牌默认会在一个小时之后或者 Pod 被删除时过期。 该令牌绑定到 Pod 实例上，并将 kube-apiserver 作为其受众（audience）。 1. 包含用来验证与 kube-apiserver 连接的 CA 证书包的 ConfigMap 对象。 - 这一特性依赖于 `RootCAConfigMap` 特性门控被启用。该特性被启用时， + 这一特性依赖于 `RootCAConfigMap` 特性门控。该特性被启用时， 控制面会公开一个名为 `kube-root-ca.crt` 的 ConfigMap 给所有名字空间。 - `RootCAConfigMap` 在 1.20 版本中是默认被启用的，在 1.21 及之后版本中 - 总是被启用。 + `RootCAConfigMap` 在 1.21 版本中进入 GA 状态，默认被启用， + 该特性门控会在 1.22 版本中从 `--feature-gate` 参数中删除。 1. 引用 Pod 名字空间的一个 DownwardAPI。 参阅[投射卷](/zh/docs/tasks/configure-pod-container/configure-projected-volume-storage/) 了解进一步的细节。 -如果 `BoundServiceAccountTokenVolume` 特性门控未被启用， -你可以手动地将一个基于 Secret 的服务账号卷升级为一个投射卷， -方法是将上述投射卷添加到 Pod 规约中。 -不过，这时仍需要启用 `RootCAConfigMap` 特性门控。 - 如果转换失败，则 Webhook 应该返回包含以下字段的 `response` 节： -*`uid`，从发送到 Webhook 的 `request.uid` 复制而来 -*`result`，设置为 `{"status": "Failed"}` +* `uid`，从发送到 Webhook 的 `request.uid` 复制而来 +* `result`，设置为 `{"status": "Failed"}` {{< warning >}} -#### 扩展 DNS 配置 +#### 扩展 DNS 配置 {#expanded-dns-configuration} {{< feature-state for_k8s_version="1.22" state="alpha" >}} -对于 Pod DNS 配置，Kubernetes 默认允许最多 6 个 search domain -以及一个最多 256 个字符的 search domain 列表。 +对于 Pod DNS 配置，Kubernetes 默认允许最多 6 个 搜索域（ Search Domain） +以及一个最多 256 个字符的搜索域列表。 如果启用 kube-apiserver 和 kubelet 的特性门控 `ExpandedDNSConfig`，Kubernetes 将可以有最多 32 个 -search domain 以及一个最多 2048 个字符的 search domain 列表。 +搜索域以及一个最多 2048 个字符的搜索域列表。 -作为一个 Stable 特性，SCTP 支持默认是被启用的。 +作为一个稳定特性，SCTP 支持默认是被启用的。 要在集群层面禁用 SCTP，你（或你的集群管理员）需要为 API 服务器指定 `--feature-gates=SCTPSupport=false,...` 来禁用 `SCTPSupport` [特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/)。 @@ -508,8 +508,8 @@ the policy will be applied only for the single `port` field. --> 你的集群所使用的 {{< glossary_tooltip text="CNI" term_id="cni" >}} 插件 必须支持在 NetworkPolicy 规约中使用 `endPort` 字段。 -如果你的 [网络插件](/zh/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) -不支持 `endPort` 字段的情况下，你指定一个有 `endPort` 字段的网络策略， +如果你的[网络插件](/zh/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) +不支持 `endPort` 字段，而你指定了一个包含 `endPort` 字段的 NetworkPolicy， 策略只对单个 `port` 字段生效。 {{< /note >}} diff --git a/content/zh/docs/concepts/services-networking/service.md b/content/zh/docs/concepts/services-networking/service.md index bccba445af..05b50c1ee1 100644 --- a/content/zh/docs/concepts/services-networking/service.md +++ b/content/zh/docs/concepts/services-networking/service.md @@ -325,7 +325,7 @@ the endpoints controller has truncated the number of endpoints to 1000. 如果某个 Endpoints 资源中包含的端点个数超过 1000，则 Kubernetes v1.22 版本 （及更新版本）的集群会将为该 Endpoints 添加注解 `endpoints.kubernetes.io/over-capacity: truncated`。 -这一注解表明所影响到的 Endpoints 对象已经超出容量，此外 Endpoints Controller 还会将 Endpoints 对象数量截断到 1000。 +这一注解表明所影响到的 Endpoints 对象已经超出容量，此外 Endpoints 控制器还会将 Endpoints 对象数量截断到 1000。 -## 流量策略 +## 流量策略 {#traffic-policies} -### 外部流量策略 +### 外部流量策略 {#external-traffic-policy} -如果你启用了 kube-proxy 的 `ProxyTerminatingEndpoints` [特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/)，kube-proxy 会检查节点是否有本地的端点，以及是否所有的本地端点都被标记为终止中。 +如果你启用了 kube-proxy 的 `ProxyTerminatingEndpoints` +[特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/)， +kube-proxy 会检查节点是否有本地的端点，以及是否所有的本地端点都被标记为终止中。 -如果本地有端点，而且所有端点处于终止中的状态，那么 kube-proxy 会忽略任何设为 `Local` 的外部流量策略。在所有本地端点处于终止中的状态的同时，kube-proxy 将请求指定服务的流量转发到位于其它节点的状态健康的端点，如同外部流量策略设为 `Cluster`。 +如果本地有端点，而且所有端点处于终止中的状态，那么 kube-proxy 会忽略任何设为 `Local` 的外部流量策略。 +在所有本地端点处于终止中的状态的同时，kube-proxy 将请求指定服务的流量转发到位于其它节点的 +状态健康的端点，如同外部流量策略设为 `Cluster`。 -在端点都处于终止中的情况下，这个转发行为使得外部的负载均衡器可以优雅地排出由 `NodePort` 服务支持的连接，就算是健康检查节点端口开始失败也是如此。 -否则，在节点还在负载均衡器的节点池中，到一个 Pod 终止过程中正在丢弃流量之间，流量可能会丢失。 +针对处于正被终止状态的端点这一转发行为使得外部负载均衡器可以优雅地排出由 +`NodePort` 服务支持的连接，就算是健康检查节点端口开始失败也是如此。 +否则，当节点还在负载均衡器的节点池内，在 Pod 终止过程中的流量会被丢掉，这些流量可能会丢失。 {{< /note >}} -### 内部流量策略 +### 内部流量策略 {#internal-traffic-policy} {{< feature-state for_k8s_version="v1.22" state="beta" >}} @@ -1209,7 +1215,9 @@ the cloud provider) will ignore Services that have this field set. `spec.loadBalancerClass` can be set on a Service of type `LoadBalancer` only. Once set, it cannot be changed. --> -`spec.loadBalancerClass` 允许你不使用云提供商的默认负载均衡器实现，转而使用指定的负载均衡器实现。这个特性从 v1.21 版本开始可以使用，你在 v1.21 版本中使用这个字段必须启用 `ServiceLoadBalancerClass` 特性门控，这个特性门控从 v1.22 版本及以后默认打开。 +`spec.loadBalancerClass` 允许你不使用云提供商的默认负载均衡器实现，转而使用指定的负载均衡器实现。 +这个特性从 v1.21 版本开始可以使用，你在 v1.21 版本中使用这个字段必须启用 `ServiceLoadBalancerClass` +特性门控，这个特性门控从 v1.22 版本及以后默认打开。 默认情况下，`.spec.loadBalancerClass` 的取值是 `nil`，如果集群使用 `--cloud-provider` 配置了云提供商， `LoadBalancer` 类型服务会使用云提供商的默认负载均衡器实现。 如果设置了 `.spec.loadBalancerClass`，则假定存在某个与所指定的类相匹配的 From 28cb1efbedd50a016562860d939b0ce836ce5019 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9my=20L=C3=A9one?= Date: Mon, 16 Aug 2021 10:24:22 +0200 Subject: [PATCH 160/279] Apply suggestions from code review --- content/fr/docs/concepts/workloads/_index.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/content/fr/docs/concepts/workloads/_index.md b/content/fr/docs/concepts/workloads/_index.md index df4e9d800e..4561edb155 100644 --- a/content/fr/docs/concepts/workloads/_index.md +++ b/content/fr/docs/concepts/workloads/_index.md @@ -28,9 +28,11 @@ pour améliorer la résilience global. * Le [`DaemonSet`](/docs/concepts/workloads/controllers/daemonset/) permet de définir les `Pods` qui effectuent des actions sur le noeud local. Ceux-ci peuvent être fondamental aux opérations de votre cluster, comme un outil d’aide réseau, ou peuvent faire part d’un module complémentaire (add-on). Pour chaque nouveau noeud ajouté au cluster, le controle plane organise l'ajout d'un `Pod` pour ce `DaemonSet` sur le nouveau noeud. -* Les [`Job`](/docs/concepts/workloads/controllers/job/) et [`CronJob`](/docs/concepts/workloads/controllers/cron-jobs/) sont des tâchent lancées jusqu’à accomplissement puis s’arrêtent. Les `Jobs` réprésentent une tâche ponctuelle, les `CronJob` sont des tâches récurrentes planifiés. +* Les [`Job`](/docs/concepts/workloads/controllers/job/) et [`CronJob`](/docs/concepts/workloads/controllers/cron-jobs/) sont des taches lancées jusqu’à accomplissement puis s’arrêtent. Les `Jobs` réprésentent une tâche ponctuelle, les `CronJob` sont des tâches récurrentes planifiés. -Dans l’écosystème étendu de Kubernetes, vous pouvez trouver des ressources workload de fournisseurs tiers qui permetent des fonctionnalités supplémentaires. L’utilisation d’un [`CustomResourceDefinition`](/docs/concepts/extend-kubernetes/api-extension/custom-resources/) permet d’ajouter une ressource workload d’un fournisseur tiers si vous souhaites une fonctionnalité ou un comportement spécifique qui ne fait pas partie du noyau de Kubernetes. Par exemple, si vous voulez lancer un groupe de `Pods` pour votre application mais vous devez arrêter leurs fonctionnement tant qu’ils ne sont pas tous disponibles, alors vous pouvez implémenter ou installer une extension qui permet cette fonctionnalité. +Dans l’écosystème étendu de Kubernetes, vous pouvez trouver des ressources workload de fournisseurs tiers qui offrent des fonctionnalités supplémentaires. +L’utilisation d’un [`CustomResourceDefinition`](/docs/concepts/extend-kubernetes/api-extension/custom-resources/) permet d’ajouter une ressource workload d’un fournisseur tiers si vous souhaitez rajouter une fonctionnalité ou un comportement spécifique qui ne fait pas partie du noyau de Kubernetes. +Par exemple, si vous voulez lancer un groupe de `Pods` pour votre application mais que vous devez arrêter leurs fonctionnement tant qu’ils ne sont pas tous disponibles, alors vous pouvez implémenter ou installer une extension qui permet cette fonctionnalité. ## {{% heading "whatsnext" %}} Vous pouvez continuer la lecture des ressources, vous pouvez aussi apprendre à connaitre les taches qui leurs sont liées : From 43d0461908b2603199ba7077d4839fc36e940ce8 Mon Sep 17 00:00:00 2001 From: Jonathan Lopez Torres Date: Mon, 16 Aug 2021 08:52:41 -0500 Subject: [PATCH 161/279] Update content/es/docs/concepts/workloads/controllers/deployment.md Co-authored-by: Rael Garcia --- content/es/docs/concepts/workloads/controllers/deployment.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/es/docs/concepts/workloads/controllers/deployment.md b/content/es/docs/concepts/workloads/controllers/deployment.md index 4fa236fcfb..cb6b7741f7 100644 --- a/content/es/docs/concepts/workloads/controllers/deployment.md +++ b/content/es/docs/concepts/workloads/controllers/deployment.md @@ -104,7 +104,7 @@ Nótese cómo los valores de cada campo corresponden a los valores de la especif * El número de réplicas actualizadas es 0 de acuerdo con el campo `.status.updatedReplicas`. * El número de réplicas disponibles es 0 de acuerdo con el campo `.status.availableReplicas`. -Si deseamos obtener mas información del Deployment utlize el parámetro `-o wide`, ejecutando el comando `kubectl get deployments -o wide`. La salida sera parecida a la siguiente: +Si deseamos obtener más información del Deployment utilice el parámetro '-o wide', ejecutando el comando 'kubectl get deployments -o wide'. La salida será parecida a la siguiente: ```shell NAME READY UP-TO-DATE AVAILABLE AGE CONTAINERS IMAGES SELECTOR From 55d477f61cd55d96667d90d8237a497ff8cc6984 Mon Sep 17 00:00:00 2001 From: Jonathan Lopez Torres Date: Mon, 16 Aug 2021 08:52:57 -0500 Subject: [PATCH 162/279] Update content/es/docs/concepts/workloads/controllers/deployment.md Co-authored-by: Rael Garcia --- content/es/docs/concepts/workloads/controllers/deployment.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/es/docs/concepts/workloads/controllers/deployment.md b/content/es/docs/concepts/workloads/controllers/deployment.md index cb6b7741f7..7cc534e270 100644 --- a/content/es/docs/concepts/workloads/controllers/deployment.md +++ b/content/es/docs/concepts/workloads/controllers/deployment.md @@ -111,7 +111,7 @@ NAME READY UP-TO-DATE AVAILABLE AGE CONTAINERS IMAGES nginx-deployment 3/3 3 3 10s nginx nginx:1.7.9 app=nginx ``` -ejecutando el comando anterior se muestran los siguientes campos adicionales: +Ejecutando el comando anterior se muestran los siguientes campos adicionales: * `CONTAINERS` muestra los nombres de los contenedores declarados en `.spec.template.spec.containers.[name]`. * `IMAGES` muestra los nombres de las imágenes declaradas en `.spec.template.spec.containers.[image]`. From aa30cf0ef81c22b35559fbd7efbe71644c529351 Mon Sep 17 00:00:00 2001 From: Jonathan Lopez Torres Date: Mon, 16 Aug 2021 08:53:09 -0500 Subject: [PATCH 163/279] Update content/es/docs/concepts/workloads/controllers/deployment.md Co-authored-by: Rael Garcia --- content/es/docs/concepts/workloads/controllers/deployment.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/es/docs/concepts/workloads/controllers/deployment.md b/content/es/docs/concepts/workloads/controllers/deployment.md index 7cc534e270..b643b9de37 100644 --- a/content/es/docs/concepts/workloads/controllers/deployment.md +++ b/content/es/docs/concepts/workloads/controllers/deployment.md @@ -115,7 +115,7 @@ Ejecutando el comando anterior se muestran los siguientes campos adicionales: * `CONTAINERS` muestra los nombres de los contenedores declarados en `.spec.template.spec.containers.[name]`. * `IMAGES` muestra los nombres de las imágenes declaradas en `.spec.template.spec.containers.[image]`. -* `SELECTOR` muestra el Label selector que se declaro en matchLabels o matchExpressions. +* 'SELECTOR' muestra el Label selector que se declaró en matchLabels o matchExpressions. Para ver el estado del Deployment, ejecuta el comando `kubectl rollout status deployment.v1.apps/nginx-deployment`. Este comando devuelve el siguiente resultado: From 7bb5df553c5e45b11c01eb04b7724227eb398748 Mon Sep 17 00:00:00 2001 From: Jonathan Lopez Torres Date: Mon, 16 Aug 2021 08:53:21 -0500 Subject: [PATCH 164/279] Update content/es/docs/concepts/workloads/controllers/deployment.md Co-authored-by: Rael Garcia --- content/es/docs/concepts/workloads/controllers/deployment.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/es/docs/concepts/workloads/controllers/deployment.md b/content/es/docs/concepts/workloads/controllers/deployment.md index b643b9de37..9fc506ae01 100644 --- a/content/es/docs/concepts/workloads/controllers/deployment.md +++ b/content/es/docs/concepts/workloads/controllers/deployment.md @@ -91,8 +91,7 @@ nginx-deployment 3/3 3 3 1s Cuando inspeccionas los Deployments de tu clúster, se muestran los siguientes campos: * `NAME` enumera los nombre de los Deployments del clúster. -* `READY` muestra cuántas réplicas de la aplicación están disponibles para sus usuarios. Sigue el patrón listo/deseado. - cuando se crea el Deployment. Esto se conoce como el _estado deseado_. +* `READY` muestra cuántas réplicas de la aplicación están disponibles para sus usuarios. Sigue el patrón número de réplicas `listas/deseadas`. * `UP-TO-DATE` muestra el número de réplicas que se ha actualizado para alcanzar el estado deseado. * `AVAILABLE` muestra cuántas réplicas de la aplicación están disponibles para los usuarios. * `AGE` muestra la cantidad de tiempo que la aplicación lleva ejecutándose. From c0b5d85371bedeb94075ff8fe665c8f8aeb88ef8 Mon Sep 17 00:00:00 2001 From: Ben Swartzlander Date: Thu, 15 Jul 2021 21:57:05 -0600 Subject: [PATCH 165/279] Volume Populators Redesign Blog For https://github.com/kubernetes/enhancements/issues/1495 --- .../2021-08-30-volume-populators-alpha.md | 219 ++++++++++++++++++ 1 file changed, 219 insertions(+) create mode 100644 content/en/blog/_posts/2021-08-30-volume-populators-alpha.md diff --git a/content/en/blog/_posts/2021-08-30-volume-populators-alpha.md b/content/en/blog/_posts/2021-08-30-volume-populators-alpha.md new file mode 100644 index 0000000000..01eabda421 --- /dev/null +++ b/content/en/blog/_posts/2021-08-30-volume-populators-alpha.md @@ -0,0 +1,219 @@ +--- +layout: blog +title: "Kubernetes 1.22: A New Design for Volume Populators" +date: 2021-08-30 +slug: volume-populators-redesigned +--- + +**Authors:** +Ben Swartzlander (NetApp) + +Kubernetes v1.22, released earlier this month, introduced a redesigned approach for volume +populators. Originally implemented +in v1.18, the API suffered from backwards compatibility issues. Kubernetes v1.22 includes a new API +field called `dataSourceRef` that fixes these problems. + +## Data sources + +Earlier Kubernetes releases already added a `dataSource` field into the +[PersistentVolumeClaim](/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims) API, +used for cloning volumes and creating volumes from snapshots. You could use the `dataSource` field when +creating a new PVC, referencing either an existing PVC or a VolumeSnapshot in the same namespace. +That also modified the normal provisioning process so that instead of yielding an empty volume, the +new PVC contained the same data as either the cloned PVC or the cloned VolumeSnapshot. + +Volume populators embrace the same design idea, but extend it to any type of object, as long +as there exists a [custom resource](/docs/concepts/extend-kubernetes/api-extension/custom-resources/) +to define the data source, and a populator controller to implement the logic. Initially, +the `dataSource` field was directly extended to allow arbitrary objects, if the `AnyVolumeDataSource` +feature gate was enabled on a cluster. That change unfortunately caused backwards compatibility +problems, and so the new `dataSourceRef` field was born. + +In v1.22 if the `AnyVolumeDataSource` feature gate is enabled, the `dataSourceRef` field is +added, which behaves similarly to the `dataSource` field except that it allows arbitrary +objects to be specified. The API server ensures that the two fields always have the same +contents, and neither of them are mutable. The differences is that at creation time +`dataSource` allows only PVCs or VolumeSnapshots, and ignores all other values, while +`dataSourceRef` allows most types of objects, and in the few cases it doesn't allow an +object (core objects other than PVCs) a validation error occurs. + +When this API change graduates to stable, we would deprecate using `dataSource` and recommend +using `dataSourceRef` field for all use cases. +In the v1.22 release, `dataSourceRef` is available (as an alpha feature) specifically for cases +where you want to use for custom volume populators. + +## Using populators + +Every volume populator must have one or more CRDs that it supports. Administrators may +install the CRD and the populator controller and then PVCs with a `dataSourceRef` specifies +a CR of the type that the populator supports will be handled by the populator controller +instead of the CSI driver directly. + +Underneath the covers, the CSI driver is still invoked to create an empty volume, which +the populator controller fills with the appropriate data. The PVC doesn't bind to the PV +until it's fully populated, so it's safe to define a whole application manifest including +pod and PVC specs and the pods won't begin running until everything is ready, just as if +the PVC was a clone of another PVC or VolumeSnapshot. + +## How it works + +PVCs with data sources are still noticed by the external-provisioner sidecar for the +related storage class (assuming a CSI provisioner is used), but because the sidecar +doesn't understand the data source kind, it doesn't do anything. The populator controller +is also watching for PVCs with data sources of a kind that it understands and when it +sees one, it creates a temporary PVC of the same size, volume mode, storage class, +and even on the same topology (if topology is used) as the original PVC. The populator +controller creates a worker pod that attaches to the volume and writes the necessary +data to it, then detaches from the volume and the populator controller rebinds the PV +from the temporary PVC to the orignal PVC. + +## Trying it out + +The following things are required to use volume populators: +* Enable the `AnyVolumeDataSource` feature gate +* Install a CRD for the specific data source / populator +* Install the populator controller itself + +Populator controllers may use the [lib-volume-populator](https://github.com/kubernetes-csi/lib-volume-populator) +library to do most of the Kubernetes API level work. Individual populators only need to +provide logic for actually writing data into the volume based on a particular CR +instance. This library provides a sample populator implementation. + +These optional components improve user experience: +* Install the VolumePopulator CRD +* Create a VolumePopulator custom respource for each specific data source +* Install the [volume data source validator](https://github.com/kubernetes-csi/volume-data-source-validator) + controller (alpha) + +The purpose of these components is to generate warning events on PVCs with data sources +for which there is no populator. + +## Putting it all together + +To see how this works, you can install the sample "hello" populator and try it +out. + +First install the volume-data-source-validator controller. + +```terminal +kubectl apply -f https://github.com/kubernetes-csi/volume-data-source-validator/blob/master/deploy/kubernetes/rbac-data-source-validator.yaml +kubectl apply -f https://github.com/kubernetes-csi/volume-data-source-validator/blob/master/deploy/kubernetes/setup-data-source-validator.yaml +``` + +Next install the example populator. + +```terminal +kubectl apply -f https://github.com/kubernetes-csi/lib-volume-populator/blob/master/example/hello-populator/crd.yaml +kubectl apply -f https://github.com/kubernetes-csi/lib-volume-populator/blob/master/example/hello-populator/deploy.yaml +``` + +Create an instance of the `Hello` CR, with some text. + +```yaml +apiVersion: hello.k8s.io/v1alpha1 +kind: Hello +metadata: + name: example-hello +spec: + fileName: example.txt + fileContents: Hello, world! +``` + +Create a PVC that refers to that CR as its data source. + +```yaml +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: example-pvc +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 10Mi + dataSourceRef: + apiGroup: hello.k8s.io + kind: Hello + name: example-hello + volumeMode: Filesystem +``` + +Next, run a job that reads the file in the PVC. + +```yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: example-job +spec: + template: + spec: + containers: + - name: example-container + image: busybox:latest + command: + - cat + - /mnt/example.txt + volumeMounts: + - name: vol + mountPath: /mnt + restartPolicy: Never + volumes: + - name: vol + persistentVolumeClaim: + claimName: example-pvc +``` + +Wait for the job to complete (including all of its dependencies). + +```terminal +kubectl wait --for=condition=Complete job/example-job +``` + +And last examine the log from the job. + +```terminal +kubectl logs job/example-job +Hello, world! +``` + +Note that the volume already contained a text file with the string contents from +the CR. This is only the simplest example. Actual populators can set up the volume +to contain arbitrary contents. + +## How to write your own volume populator + +Developers interested in writing new poplators are encouraged to use the +[lib-volume-populator](https://github.com/kubernetes-csi/lib-volume-populator) library +and to only supply a small controller wrapper around the library, and a pod image +capable of attaching to volumes and writing the appropriate data to the volume. + +Individual populators can be extremely generic such that they work with every type +of PVC, or they can do vendor specific things to rapidly fill a volume with data +if the volume was provisioned by a specific CSI driver from the same vendor, for +example, by communicating directly with the storage for that volume. + +## The future + +As this feature is still in alpha, we expect to update the out of tree controllers +with more tests and documentation. The community plans to eventually re-implement +the populator library as a sidecar, for ease of operations. + +We hope to see some official community-supported populators for some widely-shared +use cases. Also, we expect that volume populators will be used by backup vendors +as a way to "restore" backups to volumes, and possibly a standardized API to do +this will evolve. + +## How can I learn more? + +The enhancement proposal, +[Volume Populators](https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/1495-volume-populators), includes lots of detail about the history and technical implementation +of this feature. + +[Volume populators and data sources] (in the documenation topic about persistent volumes) +explains how to use this feature in your cluster. + +Please get involved by joining the Kubernetes storage SIG to help us enhance this +feature. There are a lot of good ideas already and we'd be thrilled to have more! + From bfb3d16846373b8d13bf523ca0bf26f14d5fbc3c Mon Sep 17 00:00:00 2001 From: Arhell Date: Tue, 17 Aug 2021 02:30:23 +0300 Subject: [PATCH 166/279] [zh] Delete logging-stackdriver.md --- .../logging-stackdriver.md | 629 ------------------ 1 file changed, 629 deletions(-) delete mode 100644 content/zh/docs/tasks/debug-application-cluster/logging-stackdriver.md diff --git a/content/zh/docs/tasks/debug-application-cluster/logging-stackdriver.md b/content/zh/docs/tasks/debug-application-cluster/logging-stackdriver.md deleted file mode 100644 index aacac3e5f0..0000000000 --- a/content/zh/docs/tasks/debug-application-cluster/logging-stackdriver.md +++ /dev/null @@ -1,629 +0,0 @@ ---- -title: 使用 Stackdriver 生成日志 -content_type: concept ---- - - - - - - -在阅读这篇文档之前，强烈建议你先熟悉一下 [Kubernetes 日志概况](/zh/docs/concepts/cluster-administration/logging) - - - -{{< note >}} -默认情况下，Stackdriver 日志机制仅收集容器的标准输出和标准错误流。 -如果要收集你的应用程序写入一个文件（例如）的任何日志，请参见 Kubernetes 日志概述中的 [sidecar 方式](/zh/docs/concepts/cluster-administration/logging#sidecar-container-with-a-logging-agent) -{{< /note >}} - - - - - -## 部署 {#deploying} - - -为了接收日志，你必须将 Stackdriver 日志代理部署到集群中的每个节点。 -此代理是一个已配置的 `fluentd`，其配置存在一个 `ConfigMap` 中，且实例使用 Kubernetes 的 `DaemonSet` 进行管理。 -`ConfigMap` 和 `DaemonSet` 的实际部署，取决你的集群设置。 - - - -### 部署到一个新的集群 - -#### Google Kubernetes Engine - - -对于部署在 Google Kubernetes Engine 上的集群，Stackdriver 是默认的日志解决方案。 -Stackdriver 日志机制会默认部署到你的新集群上，除非你明确地不选择。 - - - -#### 其他平台 - - -为了将 Stackdriver 日志机制部署到你正在使用 `kube-up.sh` 创建的*新*集群上，执行如下操作： - - -1. 设置环境变量 `KUBE_LOGGING_DESTINATION` 为 `gcp`。 -1. **如果不是跑在 GCE 上**，在 `KUBE_NODE_LABELS` 变量中包含 `beta.kubernetes.io/fluentd-ds-ready=true`。 - - - -集群启动后，每个节点都应该运行 Stackdriver 日志代理。 -`DaemonSet` 和 `ConfigMap` 作为附加组件进行配置。 -如果你不是使用 `kube-up.sh`，可以考虑不使用预先配置的日志方案启动集群，然后部署 Stackdriver 日志代理到正在运行的集群。 - - - -{{< warning >}} -除了 Google Kubernetes Engine，Stackdriver 日志守护进程在其他的平台有已知的问题。 -请自行承担风险。 -{{< /warning >}} - - -### 部署到一个已知集群 - - -1. 在每个节点上打标签（如果尚未存在） - - - Stackdriver 日志代理部署使用节点标签来确定应该将其分配到给哪些节点。 - 引入这些标签是为了区分 Kubernetes 1.6 或更高版本的节点。 - 如果集群是在配置了 Stackdriver 日志机制的情况下创建的，并且节点的版本为 1.5.X 或更低版本，则它将使用 fluentd 用作静态容器。 - 节点最多只能有一个 fluentd 实例，因此只能将标签打在未分配过 fluentd pod 的节点上。 - 你可以通过运行 `kubectl describe` 来确保你的节点被正确标记，如下所示： - - ``` - kubectl describe node $NODE_NAME - ``` - - 输出应类似于如下内容： - - ``` - Name: NODE_NAME - Role: - Labels: beta.kubernetes.io/fluentd-ds-ready=true - ... - ``` - - 确保输出内容包含 `beta.kubernetes.io/fluentd-ds-ready=true` 标签。 - 如果不存在，则可以使用 `kubectl label` 命令添加，如下所示： - - ``` - kubectl label node $NODE_NAME beta.kubernetes.io/fluentd-ds-ready=true - ``` - - - {{< note >}} - 如果节点发生故障并且必须重新创建，则必须将标签重新打在重新创建了的节点。 - 为了让此操作更便捷，你可以在节点启动脚本中使用 Kubelet 的命令行参数给节点添加标签。 - {{< /note >}} - - -2. 通过运行以下命令，部署一个带有日志代理配置的 `ConfigMap`： - - ``` - kubectl apply -f https://k8s.io/examples/debug/fluentd-gcp-configmap.yaml - ``` - - 该命令在 `default` 命名空间中创建 `ConfigMap`。你可以在创建 `ConfigMap` 对象之前手动下载文件并进行更改。 - - -3. 通过运行以下命令，部署日志代理的 `DaemonSet`： - - ``` - kubectl apply -f https://k8s.io/examples/debug/fluentd-gcp-ds.yaml - ``` - - 你也可以在使用前下载和编辑此文件。 - - -## 验证日志代理部署 - - -部署 Stackdriver `DaemonSet` 之后，你可以通过运行以下命令来查看日志代理的部署状态： - -```shell -kubectl get ds --all-namespaces -``` - - -如果你的集群中有 3 个节点，则输出应类似于如下： - -``` -NAMESPACE NAME DESIRED CURRENT READY NODE-SELECTOR AGE -... -default fluentd-gcp-v2.0 3 3 3 beta.kubernetes.io/fluentd-ds-ready=true 5m -... -``` - - -要了解使用 Stackdriver 进行日志记录的工作方式，请考虑以下具有日志生成的 pod 定义 [counter-pod.yaml](/examples/debug/counter-pod.yaml)： - -{{< codenew file="debug/counter-pod.yaml" >}} - - -这个 pod 定义里有一个容器，该容器运行一个 bash 脚本，脚本每秒写一次计数器的值和日期时间，并无限期地运行。 -让我们在默认命名空间中创建此 pod。 - -```shell -kubectl apply -f https://k8s.io/examples/debug/counter-pod.yaml -``` - - -你可以观察到正在运行的 pod： - -```shell -kubectl get pods -``` -``` -NAME READY STATUS RESTARTS AGE -counter 1/1 Running 0 5m -``` - - -在短时间内，你可以观察到 "pending" 的 pod 的状态，因为 kubelet 必须先下载容器镜像。 -当 pod 状态变为 `Running` 时，你可以使用 `kubectl logs` 命令查看此 counter pod 的输出。 - -```shell -kubectl logs counter -``` -``` -0: Mon Jan 1 00:00:00 UTC 2001 -1: Mon Jan 1 00:00:01 UTC 2001 -2: Mon Jan 1 00:00:02 UTC 2001 -... -``` - - -正如日志概览所述，此命令从容器日志文件中获取日志项。 -如果该容器被 Kubernetes 杀死然后重新启动，你仍然可以访问前一个容器的日志。 -但是，如果将 Pod 从节点中驱逐，则日志文件会丢失。让我们通过删除当前运行的 counter 容器来演示这一点： - -```shell -kubectl delete pod counter -``` -``` -pod "counter" deleted -``` - - -然后重建它： - -```shell -kubectl create -f https://k8s.io/examples/debug/counter-pod.yaml -``` -``` -pod/counter created -``` - - -一段时间后，你可以再次从 counter pod 访问日志： - -```shell -kubectl logs counter -``` -``` -0: Mon Jan 1 00:01:00 UTC 2001 -1: Mon Jan 1 00:01:01 UTC 2001 -2: Mon Jan 1 00:01:02 UTC 2001 -... -``` - - -如预期的那样，日志中仅出现最近的日志记录。 -但是，对于实际应用程序，你可能希望能够访问所有容器的日志，特别是出于调试的目的。 -这就是先前启用的 Stackdriver 日志机制可以提供帮助的地方。 - - -## 查看日志 - - -Stackdriver 日志代理为每个日志项关联元数据，供你在后续的查询中只选择感兴趣的消息： -例如，来自某个特定 Pod 的消息。 - - -元数据最重要的部分是资源类型和日志名称。 -容器日志的资源类型为 `container`，在用户界面中名为 `GKE Containers`（即使 Kubernetes 集群不在 Google Kubernetes Engine 上）。 -日志名称是容器的名称，因此，如果你有一个包含两个容器的 pod，在 spec 中名称定义为 `container_1` 和 `container_2`，则它们的日志的名称分别为 `container_1` 和 `container_2`。 - - -系统组件的资源类型为 `compute`，在接口中名为 `GCE VM Instance`。 -系统组件的日志名称是固定的。 -对于 Google Kubernetes Engine 节点，系统组件中的每个日志项都具有以下日志名称之一： - -* docker -* kubelet -* kube-proxy - - -你可以在[Stackdriver 专用页面](https://cloud.google.com/logging/docs/view/overview) -上了解有关查看日志的更多信息。 - - -查看日志的一种可能方法是使用 [Google Cloud SDK](https://cloud.google.com/sdk/) -中的 [`gcloud logging`](https://cloud.google.com/logging/docs/reference/tools/gcloud-logging) -命令行接口。 -它使用 Stackdriver 日志机制的 -[过滤语法](https://cloud.google.com/logging/docs/view/advanced_filters)查询特定日志。 -例如，你可以运行以下命令： - -```none -gcloud beta logging read 'logName="projects/$YOUR_PROJECT_ID/logs/count"' --format json | jq '.[].textPayload' -``` -``` -... -"2: Mon Jan 1 00:01:02 UTC 2001\n" -"1: Mon Jan 1 00:01:01 UTC 2001\n" -"0: Mon Jan 1 00:01:00 UTC 2001\n" -... -"2: Mon Jan 1 00:00:02 UTC 2001\n" -"1: Mon Jan 1 00:00:01 UTC 2001\n" -"0: Mon Jan 1 00:00:00 UTC 2001\n" -``` - - -如你所见，尽管 kubelet 已经删除了第一个容器的日志，日志中仍会包含 counter -容器第一次和第二次运行时输出的消息。 - - -### 导出日志 - - -你可以将日志导出到 [Google Cloud Storage](https://cloud.google.com/storage/) 或 -[BigQuery](https://cloud.google.com/bigquery/) 进行进一步的分析。 -Stackdriver 日志机制提供了接收器（Sink）的概念，你可以在其中指定日志项的存放地。 -可在 Stackdriver [导出日志页面](https://cloud.google.com/logging/docs/export/configure_export_v2) -上获得更多信息。 - - -## 配置 Stackdriver 日志代理 - - -有时默认的 Stackdriver 日志机制安装可能无法满足你的需求，例如： - - -* 你可能需要添加更多资源，因为默认的行为表现无法满足你的需求。 -* 你可能需要引入额外的解析机制以便从日志消息中提取更多元数据，例如严重性或源代码引用。 -* 你可能想要将日志不仅仅发送到 Stackdriver 或仅将部分日志发送到 Stackdriver。 - - -在这种情况下，你需要更改 `DaemonSet` 和 `ConfigMap` 的参数。 - - -### 先决条件 - - -如果使用的是 GKE，并且集群中启用了 Stackdriver 日志机制，则无法更改其配置， -因为它是由 GKE 管理和支持的。 -但是，你可以禁用默认集成的日志机制并部署自己的。 - - -{{< note >}} -你将需要自己支持和维护新部署的配置了：更新映像和配置、调整资源等等。 -{{< /note >}} - - -若要禁用默认的日志记录集成，请使用以下命令： - -``` -gcloud beta container clusters update --logging-service=none CLUSTER -``` - - -你可以在[部署部分](#deploying)中找到有关如何将 Stackdriver 日志代理安装到 -正在运行的集群中的说明。 - - -### 更改 `DaemonSet` 参数 {#changing-daemonset-parameters} - - -当集群中有 Stackdriver 日志机制的 `DaemonSet` 时，你只需修改其 spec 中的 -`template` 字段，DaemonSet 控制器将为你管理 Pod。 -例如，假设你按照上面的描述已经安装了 Stackdriver 日志机制。 -现在，你想更改内存限制，来给 fluentd 提供的更多内存，从而安全地处理更多日志。 - - -获取集群中运行的 `DaemonSet` 的 spec： - -```shell -kubectl get ds fluentd-gcp-v2.0 --namespace kube-system -o yaml > fluentd-gcp-ds.yaml -``` - - -然后在 spec 文件中编辑资源需求，并使用以下命令更新 apiserver 中的 `DaemonSet` 对象： - -```shell -kubectl replace -f fluentd-gcp-ds.yaml -``` - - -一段时间后，Stackdriver 日志代理的 pod 将使用新配置重新启动。 - - -### 更改 fluentd 参数 - - -Fluentd 的配置存在 `ConfigMap` 对象中。 -它实际上是一组合并在一起的配置文件。 -你可以在[官方网站](https://docs.fluentd.org)上了解 fluentd 的配置。 - - -假设你要向配置添加新的解析逻辑，以便 fluentd 可以理解默认的 Python 日志记录格式。 -一个合适的 fluentd 过滤器类似如下： - -``` - - type parser - format /^(?\w):(?\w):(?.*)/ - reserve_data true - suppress_parse_error_log true - key_name log - -``` - - -现在，你需要将其放入配置中，并使 Stackdriver 日志代理感知它。 -通过运行以下命令，获取集群中当前版本的 Stackdriver 日志机制的 `ConfigMap`： - -```shell -kubectl get cm fluentd-gcp-config --namespace kube-system -o yaml > fluentd-gcp-configmap.yaml -``` - - -然后在 `containers.input.conf` 键的值中，在 `source` 部分之后插入一个新的过滤器。 - - - -{{< note >}} -顺序很重要。 -{{< /note >}} - - -在 apiserver 中更新 `ConfigMap` 比更新 `DaemonSet` 更复杂。 -最好考虑 `ConfigMap` 是不可变的。 -如果是这样，要更新配置，你应该使用新名称创建 `ConfigMap`，然后使用 -[上面的指南](#changing-daemonset-parameters)将 `DaemonSet` 更改为指向它。 - - -### 添加 fluentd 插件 - - -Fluentd 用 Ruby 编写，并允许使用 [plugins](https://www.fluentd.org/plugins) 扩展其功能。 -如果要使用默认的 Stackdriver 日志机制容器镜像中未包含的插件，则必须构建自定义镜像。 -假设你要为来自特定容器添加 Kafka 信息接收器，以进行其他处理。 -你可以复用默认的[容器镜像源](https://git.k8s.io/contrib/fluentd/fluentd-gcp-image)，并仅添加少量更改： - - -* 将 Makefile 更改为指向你的容器仓库，例如 `PREFIX=gcr.io/`。 -* 将你的依赖项添加到 Gemfile 中，例如 `gem 'fluent-plugin-kafka'`。 - - -然后在该目录运行 `make build push`。 -在更新 `DaemonSet` 以使用新镜像后，你就可以使用在 fluentd 配置中安装的插件了。 - From ec405cce3c359740966d075aa9f6025a79e2ec6b Mon Sep 17 00:00:00 2001 From: Mengjiao Liu Date: Mon, 16 Aug 2021 19:20:10 +0800 Subject: [PATCH 167/279] [zh] Concept files to sync for 1.22 - (9) Scheduling --- .../scheduling-eviction/assign-pod-node.md | 8 +- .../scheduling-eviction/eviction-policy.md | 47 ----------- .../scheduling-eviction/kube-scheduler.md | 6 +- .../pod-priority-preemption.md | 27 ++++--- .../resource-bin-packing.md | 80 +++++++++++-------- .../scheduler-perf-tuning.md | 8 +- .../scheduling-framework.md | 2 +- .../taint-and-toleration.md | 50 +++++++++--- 8 files changed, 111 insertions(+), 117 deletions(-) delete mode 100644 content/zh/docs/concepts/scheduling-eviction/eviction-policy.md diff --git a/content/zh/docs/concepts/scheduling-eviction/assign-pod-node.md b/content/zh/docs/concepts/scheduling-eviction/assign-pod-node.md index 7f93a31186..ca16706ff2 100644 --- a/content/zh/docs/concepts/scheduling-eviction/assign-pod-node.md +++ b/content/zh/docs/concepts/scheduling-eviction/assign-pod-node.md @@ -579,7 +579,7 @@ must be satisfied for the pod to be scheduled onto a node. --> #### 名字空间选择算符 -{{< feature-state for_k8s_version="v1.21" state="alpha" >}} +{{< feature-state for_k8s_version="v1.22" state="beta" >}} -此功能特性是 Alpha 版本的，默认是被禁用的。你可以通过针对 kube-apiserver 和 +此功能特性是 Beta 版本的，默认是被启用的。你可以通过针对 kube-apiserver 和 kube-scheduler 设置 [特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/) -`PodAffinityNamespaceSelector` 来启用此特性。 +`PodAffinityNamespaceSelector` 来禁用此特性。 - - - -本页提供 Kubernetes 驱逐策略的概览。 - - - - -## 驱逐策略 {#eviction-policy} - -{{< glossary_tooltip text="Kubelet" term_id="kubelet" >}} 主动监测和防止 -计算资源的全面短缺。在资源短缺时，`kubelet` 可以主动地结束一个或多个 Pod -以回收短缺的资源。 -当 `kubelet` 结束一个 Pod 时，它将终止 Pod 中的所有容器，而 Pod 的 `Phase` -将变为 `Failed`。 -如果被驱逐的 Pod 由 Deployment 管理，这个 Deployment 会创建另一个 Pod 给 -Kubernetes 来调度。 - -## {{% heading "whatsnext" %}} - - -- 阅读[配置资源不足的处理](/zh/docs/tasks/administer-cluster/out-of-resource/)， - 进一步了解驱逐信号和阈值。 - diff --git a/content/zh/docs/concepts/scheduling-eviction/kube-scheduler.md b/content/zh/docs/concepts/scheduling-eviction/kube-scheduler.md index 65306db584..c950fb1e20 100644 --- a/content/zh/docs/concepts/scheduling-eviction/kube-scheduler.md +++ b/content/zh/docs/concepts/scheduling-eviction/kube-scheduler.md @@ -95,7 +95,7 @@ the API server about this decision in a process called _binding_. kube-apiserver，这个过程叫做 _绑定_。 -如果悬决 Pod 与节点上的一个或多个较低优先级 Pod 具有 Pod 间亲和性， +如果悬决 Pod 与节点上的一个或多个较低优先级 Pod 具有 Pod 间{{< glossary_tooltip text="亲和性" term_id="affinity" >}}， 则在没有这些较低优先级 Pod 的情况下，无法满足 Pod 间亲和性规则。 在这种情况下，调度程序不会抢占节点上的任何 Pod。 相反，它寻找另一个节点。调度程序可能会找到合适的节点， @@ -620,7 +620,7 @@ Pod 优先级和 {{}} 或者最低优先级的 Pod 受 PodDisruptionBudget 保护时，才会考虑优先级较高的 Pod。 kubelet 使用优先级来确定 -[资源不足时驱逐](/zh/docs/tasks/administer-cluster/out-of-resource/) Pod 的顺序。 +[节点压力驱逐](/zh/docs/concepts/scheduling-eviction/node-pressure-eviction/) Pod 的顺序。 你可以使用 QoS 类来估计 Pod 最有可能被驱逐的顺序。kubelet 根据以下因素对 Pod 进行驱逐排名： 1. 对紧俏资源的使用是否超过请求值 1. Pod 优先级 1. 相对于请求的资源使用量 -有关更多详细信息，请参阅[驱逐最终用户的 Pod](/zh/docs/tasks/administer-cluster/out-of-resource/#evicting-end-user-pods)。 +有关更多详细信息，请参阅 +[kubelet 驱逐时 Pod 的选择](/zh/docs/concepts/scheduling-eviction/node-pressure-eviction/#pod-selection-for-kubelet-eviction)。 -当某 Pod 的资源用量未超过其请求时，kubelet 资源不足驱逐不会驱逐该 Pod。 +当某 Pod 的资源用量未超过其请求时，kubelet 节点压力驱逐不会驱逐该 Pod。 如果优先级较低的 Pod 没有超过其请求，则不会被驱逐。 另一个优先级高于其请求的 Pod 可能会被驱逐。 diff --git a/content/zh/docs/concepts/scheduling-eviction/resource-bin-packing.md b/content/zh/docs/concepts/scheduling-eviction/resource-bin-packing.md index b8c097e5df..08eb73003a 100644 --- a/content/zh/docs/concepts/scheduling-eviction/resource-bin-packing.md +++ b/content/zh/docs/concepts/scheduling-eviction/resource-bin-packing.md @@ -32,60 +32,70 @@ The kube-scheduler can be configured to enable bin packing of resources along wi ## 使用 RequestedToCapacityRatioResourceAllocation 启用装箱 -在 Kubernetes 1.15 之前，Kube-scheduler 通常允许根据对主要资源（如 CPU 和内存） -的请求数量和可用容量 之比率对节点评分。 -Kubernetes 1.16 在优先级函数中添加了一个新参数，该参数允许用户指定资源以及每类资源的权重， +Kubernetes 允许用户指定资源以及每类资源的权重， 以便根据请求数量与可用容量之比率为节点评分。 这就使得用户可以通过使用适当的参数来对扩展资源执行装箱操作，从而提高了大型集群中稀缺资源的利用率。 `RequestedToCapacityRatioResourceAllocation` 优先级函数的行为可以通过名为 -`requestedToCapacityRatioArguments` 的配置选项进行控制。 +`RequestedToCapacityRatioArgs` 的配置选项进行控制。 该标志由两个参数 `shape` 和 `resources` 组成。 -`shape` 允许用户根据 `utilization` 和 `score` 值将函数调整为最少请求 -（least requested）或 -最多请求（most requested）计算。 +`shape` 允许用户根据 `utilization` 和 `score` 值将函数调整为 +最少请求（least requested）或最多请求（most requested）计算。 `resources` 包含由 `name` 和 `weight` 组成，`name` 指定评分时要考虑的资源， `weight` 指定每种资源的权重。 以下是一个配置示例，该配置将 `requestedToCapacityRatioArguments` 设置为对扩展资源 `intel.com/foo` 和 `intel.com/bar` 的装箱行为 -```json -{ - "kind": "Policy", - "apiVersion": "v1", - ... - "priorities": [ - ... - { - "name": "RequestedToCapacityRatioPriority", - "weight": 2, - "argument": { - "requestedToCapacityRatioArguments": { - "shape": [ - {"utilization": 0, "score": 0}, - {"utilization": 100, "score": 10} - ], - "resources": [ - {"name": "intel.com/foo", "weight": 3}, - {"name": "intel.com/bar", "weight": 5} - ] - } - } - } - ], -} +```yaml +apiVersion: kubescheduler.config.k8s.io/v1beta1 +kind: KubeSchedulerConfiguration +profiles: +# ... + pluginConfig: + - name: RequestedToCapacityRatio + args: + shape: + - utilization: 0 + score: 10 + - utilization: 100 + score: 0 + resources: + - name: intel.com/foo + weight: 3 + - name: intel.com/bar + weight: 5 ``` + +使用 kube-scheduler 标志 `--config=/path/to/config/file` +引用 `KubeSchedulerConfiguration` 文件将配置传递给调度器。 + diff --git a/content/zh/docs/concepts/scheduling-eviction/scheduler-perf-tuning.md b/content/zh/docs/concepts/scheduling-eviction/scheduler-perf-tuning.md index 8a43385d13..398a06f18d 100644 --- a/content/zh/docs/concepts/scheduling-eviction/scheduler-perf-tuning.md +++ b/content/zh/docs/concepts/scheduling-eviction/scheduler-perf-tuning.md @@ -81,11 +81,11 @@ kube-scheduler 的表现等价于设置值为 100。 -要修改这个值，先编辑 [kube-scheduler 的配置文件](/zh/docs/reference/config-api/kube-scheduler-config.v1beta1/) +要修改这个值，先编辑 [kube-scheduler 的配置文件](/zh/docs/reference/config-api/kube-scheduler-config.v1beta2/) 然后重启调度器。 大多数情况下，这个配置文件是 `/etc/kubernetes/config/kube-scheduler.yaml`。 @@ -298,6 +298,6 @@ After going over all the Nodes, it goes back to Node 1. ## {{% heading "whatsnext" %}} - + -* 参见 [kube-scheduler 配置参考 (v1beta1)](/zh/docs/reference/config-api/kube-scheduler-config.v1beta1/) +* 参见 [kube-scheduler 配置参考 (v1beta1)](/zh/docs/reference/config-api/kube-scheduler-config.v1beta2/) diff --git a/content/zh/docs/concepts/scheduling-eviction/scheduling-framework.md b/content/zh/docs/concepts/scheduling-eviction/scheduling-framework.md index 1107c19565..303b707a2f 100644 --- a/content/zh/docs/concepts/scheduling-eviction/scheduling-framework.md +++ b/content/zh/docs/concepts/scheduling-eviction/scheduling-framework.md @@ -16,7 +16,7 @@ weight: 90 -{{< feature-state for_k8s_version="1.15" state="alpha" >}} +{{< feature-state for_k8s_version="1.19" state="stable" >}} + +控制平面使用节点{{}}自动创建 +与[节点状况](/zh/docs/concepts/scheduling-eviction/node-pressure-eviction/#node-conditions)对应的带有 `NoSchedule` 效应的污点。 + +调度器在进行调度时检查污点，而不是检查节点状况。这确保节点状况不会直接影响调度。 +例如，如果 `DiskPressure` 节点状况处于活跃状态，则控制平面 +添加 `node.kubernetes.io/disk-pressure` 污点并且不会调度新的 pod +到受影响的节点。如果 `MemoryPressure` 节点状况处于活跃状态，则 +控制平面添加 `node.kubernetes.io/memory-pressure` 污点。 + + + +对于新创建的 Pod，可以通过添加相应的 Pod 容忍度来忽略节点状况。 +控制平面还在具有除 `BestEffort` 之外的 {{}}的 pod 上 +添加 `node.kubernetes.io/memory-pressure` 容忍度。 +这是因为 Kubernetes 将 `Guaranteed` 或 `Burstable` QoS 类中的 Pod（甚至没有设置内存请求的 Pod） +视为能够应对内存压力，而新创建的 `BestEffort` Pod 不会被调度到受影响的节点上。 + + -Node 生命周期控制器会自动创建与 Node 条件相对应的带有 `NoSchedule` 效应的污点。 -同样，调度器不检查节点条件，而是检查节点污点。这确保了节点条件不会影响调度到节点上的内容。 -用户可以通过添加适当的 Pod 容忍度来选择忽略某些 Node 的问题(表示为 Node 的调度条件)。 DaemonSet 控制器自动为所有守护进程添加如下 `NoSchedule` 容忍度以防 DaemonSet 崩溃： @@ -512,8 +542,8 @@ arbitrary tolerations to DaemonSets. ## {{% heading "whatsnext" %}} -* 阅读[资源耗尽的处理](/zh/docs/tasks/administer-cluster/out-of-resource/)，以及如何配置其行为 -* 阅读 [Pod 优先级](/zh/docs/concepts/configuration/pod-priority-preemption/) +* 阅读[节点压力驱逐](/zh/docs/concepts/scheduling-eviction/node-pressure-eviction/)，以及如何配置其行为 +* 阅读 [Pod 优先级](/zh/docs/concepts/scheduling-eviction/pod-priority-preemption/) From 9075aa237fdfabfd016ba5d0a85d6ff10aaadf09 Mon Sep 17 00:00:00 2001 From: howieyuen Date: Mon, 16 Aug 2021 10:49:33 +0800 Subject: [PATCH 168/279] [zh]sync tutorials files for 1.22 --- content/zh/docs/tutorials/_index.md | 4 +- .../zh/docs/tutorials/clusters/apparmor.md | 9 ++ content/zh/docs/tutorials/clusters/seccomp.md | 127 ++++++++++++++++-- .../configure-redis-using-configmap.md | 4 +- content/zh/docs/tutorials/hello-minikube.md | 21 ++- .../basic-stateful-set.md | 9 +- .../stateful-application/cassandra.md | 4 +- .../stateful-application/zookeeper.md | 8 +- .../stateless-application/guestbook.md | 4 +- 9 files changed, 156 insertions(+), 34 deletions(-) diff --git a/content/zh/docs/tutorials/_index.md b/content/zh/docs/tutorials/_index.md index c30f00019c..d6c16b2e2c 100644 --- a/content/zh/docs/tutorials/_index.md +++ b/content/zh/docs/tutorials/_index.md @@ -99,11 +99,11 @@ Kubernetes 文档的这一部分包含教程。每个教程展示了如何完成 ## 集群 -* [AppArmor](/zh/docs/tutorials/clusters/apparmor/) +* [seccomp](/zh/docs/tutorials/clusters/seccomp/) ### 使用 PodSecurityPolicy 限制配置文件 +{{< note >}} + +PodSecurityPolicy 在 Kubernetes v1.21 版本中已被废弃，将在 v1.25 版本移除。 +查看 [PodSecurityPolicy 文档](/zh/docs/concepts/policy/pod-security-policy/)获取更多信息。 +{{< /note >}} + 如果启用了 PodSecurityPolicy 扩展，则可以应用群集范围的 AppArmor 限制。要启用 PodSecurityPolicy，必须在“apiserver”上设置以下标志： diff --git a/content/zh/docs/tutorials/clusters/seccomp.md b/content/zh/docs/tutorials/clusters/seccomp.md index 9f8d7dc2f3..d724d605b6 100644 --- a/content/zh/docs/tutorials/clusters/seccomp.md +++ b/content/zh/docs/tutorials/clusters/seccomp.md @@ -2,6 +2,7 @@ title: 使用 Seccomp 限制容器的系统调用 content_type: tutorial weight: 20 +min-kubernetes-server-version: v1.22 --- @@ -10,7 +11,7 @@ weight: 20 为了完成本教程中的所有步骤，你必须安装 [kind](https://kind.sigs.k8s.io/docs/user/quick-start/) -和 [kubectl](/zh/docs/tasks/tools/)。本教程将显示同时具有 alpha（v1.19 之前的版本） -和通常可用的 seccomp 功能的示例，因此请确保为所使用的版本[正确配置](https://kind.sigs.k8s.io/docs/user/quick-start/#setting-kubernetes-version)了集群。 +和 [kubectl](/zh/docs/tasks/tools/)。本教程将显示同时具有 alpha（v1.22 新版本） +和通常可用的 seccomp 功能的示例。 +你应该确保为所使用的版本[正确配置](https://kind.sigs.k8s.io/docs/user/quick-start/#setting-kubernetes-version)了集群。 + + +## 启用 `RuntimeDefault` 作为所有工作负载的默认 seccomp 配置文件 + +{{< feature-state state="alpha" for_k8s_version="v1.22" >}} + +`SeccompDefault` 是一个可选的 kubelet +[特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates)， +相应地，`--seccomp-default` 是此特性门控的 +[命令行标志](/zh/docs/reference/command-line-tools-reference/kubelet)。 +必须同时启用两者才能使用该功能。 + + +如果启用，kubelet 将默认使用 `RuntimeDefault` seccomp 配置， +而不是使用 `Unconfined`（禁用 seccomp）模式，该配置由容器运行时定义。 +默认配置旨在提供一组强大的安全默认值设置，同时避免影响工作负载的功能。 +不同的容器运行时之间及其不同的发布版本之间的默认配置可能不同， +例如在比较 CRI-O 和 containerd 的配置文件时（就会发现这点）。 + + +某些工作负载可能相比其他工作负载需要更少的系统调用限制。 +这意味着即使使用 `RuntimeDefault` 配置文件，它们也可能在运行时失败。 +要处理此类失效，你可以： + +- 将工作负载显式运行为 `Unconfined`。 +- 禁用节点的 `SeccompDefault` 功能。 + 还要确保工作负载被安排在禁用该功能的节点上。 +- 为工作负载创建自定义 seccomp 配置文件。 + + +如果你将此功能引入到类似生产的集群中， +Kubernetes 项目建议你在节点的子集上启用此特性门控， +然后在集群范围内推出更改之前测试工作负载的执行情况。 + +有关可能的升级和降级策略的更多详细信息， +请参见[相关 Kubernetes 增强提案 (KEP)](https://github.com/kubernetes/enhancements/tree/a70cc18/keps/sig-node/2413-seccomp-by-default#upgrade--downgrade-strategy)。 + + +由于该功能处于 alpha 状态，因此默认情况下是被禁用的。要启用它， +请将标志 `--feature-gates=SeccompDefault=true --seccomp-default` +传递给 `kubelet` CLI 或通过 +[kubelet 配置文件](/zh/docs/tasks/administer-cluster/kubelet-config-file/)启用它。 +要在 [kind](https://kind.sigs.k8s.io) 中启用特性门控， +请确保 `kind` 提供所需的最低 Kubernetes 版本并 +[在 kind 配置中](https://kind.sigs.k8s.io/docs/user/quick-start/#enable-feature-gates-in-your-cluster) +启用 `SeccompDefault` 功能： + +```yaml +kind: Cluster +apiVersion: kind.x-k8s.io/v1alpha4 +featureGates: + SeccompDefault: true +``` + -## 使用 Seccomp 配置文件创建 Pod 以进行系统调用审核 +## 使用 seccomp 配置文件创建 Pod 以进行系统调用审核 首先，将 `audit.json` 配置文件应用到新的 Pod 中，该配置文件将记录该进程的所有系统调用。 @@ -297,14 +396,14 @@ kubectl delete svc/audit-pod ``` -## 使用导致违规的 Seccomp 配置文件创建 Pod +## 使用导致违规的 seccomp 配置文件创建 Pod 为了进行演示，请将不允许任何系统调用的配置文件应用于 Pod。 @@ -364,7 +463,7 @@ kubectl delete svc/violation-pod ``` -## 使用设置仅允许需要的系统调用的配置文件来创建 Pod +## 使用设置仅允许需要的系统调用的 seccomp 配置文件来创建 Pod 如果你看一下 `fine-pod.json` 文件，你会注意到在第一个示例中配置文件设置为 `"defaultAction": "SCMP_ACT_LOG"` 的一些系统调用。 现在，配置文件设置为 `"defaultAction": "SCMP_ACT_ERRNO"`，但是在 `"action": "SCMP_ACT_ALLOW"` 块中明确允许一组系统调用。 @@ -482,7 +581,7 @@ kubectl delete svc/fine-pod ``` -## 使用容器运行时默认的 Seccomp 配置文件创建 Pod +## 使用容器运行时默认的 seccomp 配置文件创建 Pod 大多数容器运行时都提供一组允许或不允许的默认系统调用。通过使用 `runtime/default` 注释 或将 Pod 或容器的安全上下文中的 seccomp 类型设置为 `RuntimeDefault`，可以轻松地在 Kubernetes 中应用默认值。 @@ -518,10 +617,10 @@ The default seccomp profile should provide adequate access for most workloads. 额外的资源： -* [Seccomp 概要](https://lwn.net/Articles/656307/) +* [seccomp 概要](https://lwn.net/Articles/656307/) * [Seccomp 在 Docker 中的安全配置](https://docs.docker.com/engine/security/seccomp/) \ No newline at end of file diff --git a/content/zh/docs/tutorials/configuration/configure-redis-using-configmap.md b/content/zh/docs/tutorials/configuration/configure-redis-using-configmap.md index 027771a28c..fc6f0fa2f1 100644 --- a/content/zh/docs/tutorials/configuration/configure-redis-using-configmap.md +++ b/content/zh/docs/tutorials/configuration/configure-redis-using-configmap.md @@ -79,7 +79,7 @@ Apply the ConfigMap created above, along with a Redis pod manifest: ```shell kubectl apply -f example-redis-config.yaml -kubectl apply -f https://raw.githubusercontent.com/kubernetes/website/master/content/en/examples/pods/config/redis-pod.yaml +kubectl apply -f https://k8s.io/examples/pods/config/redis-pod.yaml ``` {{< note >}} -`dashboard` 命令启用仪表板插件，并在默认的 Web 浏览器中打开代理。你可以在仪表板上创建 Kubernetes 资源，例如 Deployment 和 Service。 +`dashboard` 命令启用仪表板插件，并在默认的 Web 浏览器中打开代理。 +你可以在仪表板上创建 Kubernetes 资源，例如 Deployment 和 Service。 如果你以 root 用户身份在环境中运行， 请参见[使用 URL 打开仪表板](#open-dashboard-with-url)。 +默认情况下，仪表板只能从内部 Kubernetes 虚拟网络中访问。 +`dashboard` 命令创建一个临时代理，使仪表板可以从 Kubernetes 虚拟网络外部访问。 + 要停止代理，请运行 `Ctrl+C` 退出该进程。仪表板仍在运行中。 +命令退出后，仪表板仍然在 Kubernetes 集群中运行。 +你可以再次运行 `dashboard` 命令创建另一个代理来访问仪表板。 + {{< /note >}} 使用 [`kubectl delete`](/zh/docs/reference/generated/kubectl/kubectl-commands/#delete) 删除 StatefulSet。 -请确保提供了 `--cascade=false` 参数给命令。这个参数告诉 Kubernetes 只删除 StatefulSet 而不要删除它的任何 Pod。 +请确保提供了 `--cascade=orphan` 参数给命令。这个参数告诉 Kubernetes 只删除 StatefulSet 而不要删除它的任何 Pod。 ```shell -kubectl delete statefulset web --cascade=false +kubectl delete statefulset web --cascade=orphan ``` ``` statefulset.apps "web" deleted @@ -1416,9 +1416,10 @@ kubectl get pods -w -l app=nginx -在另一个窗口中再次删除这个 StatefulSet。这次省略 `--cascade=false` 参数。 +在另一个窗口中再次删除这个 StatefulSet。这次省略 `--cascade=orphan` 参数。 ```shell kubectl delete statefulset web diff --git a/content/zh/docs/tutorials/stateful-application/cassandra.md b/content/zh/docs/tutorials/stateful-application/cassandra.md index d3a4d7e118..461b050938 100644 --- a/content/zh/docs/tutorials/stateful-application/cassandra.md +++ b/content/zh/docs/tutorials/stateful-application/cassandra.md @@ -87,14 +87,14 @@ To complete this tutorial, you should already have a basic familiarity with ### Additional Minikube setup instructions {{< caution >}} -[Minikube](https://minikube.sigs.k8s.io/docs/) defaults to 1024MiB of memory and 1 CPU. +[Minikube](https://minikube.sigs.k8s.io/docs/) defaults to 2048MB of memory and 2 CPU. Running Minikube with the default resource configuration results in insufficient resource errors during this tutorial. To avoid these errors, start Minikube with the following settings: --> ### 额外的 Minikube 设置说明 {{< caution >}} -[Minikube](https://minikube.sigs.k8s.io/docs/)默认为 1024MiB 内存和 1 个 CPU。 +[Minikube](https://minikube.sigs.k8s.io/docs/)默认为 2048MB 内存和 2 个 CPU。 在本教程中，使用默认资源配置运行 Minikube 会导致资源不足的错误。为避免这些错误，请使用以下设置启动 Minikube： ```shell diff --git a/content/zh/docs/tutorials/stateful-application/zookeeper.md b/content/zh/docs/tutorials/stateful-application/zookeeper.md index 3f5baf3c27..7f3a0e9548 100644 --- a/content/zh/docs/tutorials/stateful-application/zookeeper.md +++ b/content/zh/docs/tutorials/stateful-application/zookeeper.md @@ -1412,7 +1412,7 @@ drain the node on which the `zk-0` Pod is scheduled. 来隔离和腾空 `zk-0` Pod 调度所在的节点。 ```shell -kubectl drain $(kubectl get pod zk-0 --template {{.spec.nodeName}}) --ignore-daemonsets --force --delete-local-data +kubectl drain $(kubectl get pod zk-0 --template {{.spec.nodeName}}) --ignore-daemonsets --force --delete-emptydir-data ``` ``` @@ -1453,7 +1453,7 @@ Keep watching the `StatefulSet`'s Pods in the first terminal and drain the node 在第一个终端中持续观察 StatefulSet 的 Pods 并腾空 `zk-1` 调度所在的节点。 ```shell -kubectl drain $(kubectl get pod zk-1 --template {{.spec.nodeName}}) --ignore-daemonsets --force --delete-local-data "kubernetes-node-ixsl" cordoned +kubectl drain $(kubectl get pod zk-1 --template {{.spec.nodeName}}) --ignore-daemonsets --force -delete-emptydir-data "kubernetes-node-ixsl" cordoned ``` ``` @@ -1504,7 +1504,7 @@ Continue to watch the Pods of the stateful set, and drain the node on which 继续观察 StatefulSet 中的 Pods 并腾空 `zk-2` 调度所在的节点。 ```shell -kubectl drain $(kubectl get pod zk-2 --template {{.spec.nodeName}}) --ignore-daemonsets --force --delete-local-data +kubectl drain $(kubectl get pod zk-2 --template {{.spec.nodeName}}) --ignore-daemonsets --force --delete-emptydir-data ``` ``` node "kubernetes-node-i4c4" cordoned @@ -1610,7 +1610,7 @@ Attempt to drain the node on which `zk-2` is scheduled. 尝试腾空 `zk-2` 调度所在的节点。 ```shell -kubectl drain $(kubectl get pod zk-2 --template {{.spec.nodeName}}) --ignore-daemonsets --force --delete-local-data +kubectl drain $(kubectl get pod zk-2 --template {{.spec.nodeName}}) --ignore-daemonsets --force --delete-emptydir-data ``` -* 单实例 [Redis](https://www.redis.com/) 以保存留言板条目 +* 单实例 [Redis](https://www.redis.io/) 以保存留言板条目 * 多个 web 前端实例 ## {{% heading "objectives" %}} From 711d4ec1f62bd6b951c12544cff04048c330c7d1 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Tue, 17 Aug 2021 09:52:59 +0100 Subject: [PATCH 169/279] Fix HTML language attribute --- .../kubernetes-basics/create-cluster/cluster-interactive.html | 2 +- .../kubernetes-basics/deploy-app/deploy-interactive.html | 2 +- .../docs/tutorials/kubernetes-basics/explore/explore-intro.html | 2 +- .../tutorials/kubernetes-basics/expose/expose-interactive.html | 2 +- .../docs/tutorials/kubernetes-basics/expose/expose-intro.html | 2 +- .../tutorials/kubernetes-basics/update/update-interactive.html | 2 +- .../docs/tutorials/kubernetes-basics/update/update-intro.html | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/content/de/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html b/content/de/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html index 7a5fe0ce4f..4b7d5ddaae 100644 --- a/content/de/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html +++ b/content/de/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html @@ -5,7 +5,7 @@ weight: 20 - + diff --git a/content/de/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html b/content/de/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html index 8c74aafd78..b8eae305f3 100644 --- a/content/de/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html +++ b/content/de/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html @@ -5,7 +5,7 @@ weight: 20 - + diff --git a/content/de/docs/tutorials/kubernetes-basics/explore/explore-intro.html b/content/de/docs/tutorials/kubernetes-basics/explore/explore-intro.html index f220ff5eb7..5e64134a44 100644 --- a/content/de/docs/tutorials/kubernetes-basics/explore/explore-intro.html +++ b/content/de/docs/tutorials/kubernetes-basics/explore/explore-intro.html @@ -5,7 +5,7 @@ weight: 10 - + diff --git a/content/de/docs/tutorials/kubernetes-basics/expose/expose-interactive.html b/content/de/docs/tutorials/kubernetes-basics/expose/expose-interactive.html index ab5b880397..5b4c1a4ae8 100644 --- a/content/de/docs/tutorials/kubernetes-basics/expose/expose-interactive.html +++ b/content/de/docs/tutorials/kubernetes-basics/expose/expose-interactive.html @@ -5,7 +5,7 @@ weight: 20 - + diff --git a/content/de/docs/tutorials/kubernetes-basics/expose/expose-intro.html b/content/de/docs/tutorials/kubernetes-basics/expose/expose-intro.html index 07e76654a4..ce0f9caaae 100644 --- a/content/de/docs/tutorials/kubernetes-basics/expose/expose-intro.html +++ b/content/de/docs/tutorials/kubernetes-basics/expose/expose-intro.html @@ -5,7 +5,7 @@ weight: 10 - + diff --git a/content/de/docs/tutorials/kubernetes-basics/update/update-interactive.html b/content/de/docs/tutorials/kubernetes-basics/update/update-interactive.html index 448ddc81b9..086b90d6b7 100644 --- a/content/de/docs/tutorials/kubernetes-basics/update/update-interactive.html +++ b/content/de/docs/tutorials/kubernetes-basics/update/update-interactive.html @@ -5,7 +5,7 @@ weight: 20 - + diff --git a/content/de/docs/tutorials/kubernetes-basics/update/update-intro.html b/content/de/docs/tutorials/kubernetes-basics/update/update-intro.html index 61ee05d662..74e3e40982 100644 --- a/content/de/docs/tutorials/kubernetes-basics/update/update-intro.html +++ b/content/de/docs/tutorials/kubernetes-basics/update/update-intro.html @@ -5,7 +5,7 @@ weight: 10 - + From f146e0103f9c74edec2027d094b8172e413a1253 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Tue, 17 Aug 2021 09:54:43 +0100 Subject: [PATCH 170/279] Fix HTML language attribute --- .../kubernetes-basics/create-cluster/cluster-interactive.html | 2 +- .../kubernetes-basics/deploy-app/deploy-interactive.html | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/es/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html b/content/es/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html index a91e00f679..6743729d49 100644 --- a/content/es/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html +++ b/content/es/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html @@ -5,7 +5,7 @@ weight: 20 - + diff --git a/content/es/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html b/content/es/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html index 28a2f35a0e..2ec6de59e9 100644 --- a/content/es/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html +++ b/content/es/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html @@ -5,7 +5,7 @@ weight: 20 - + From a9e6ea897bb5e021b0fff4a425b240c8a8c90061 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Tue, 17 Aug 2021 09:57:53 +0100 Subject: [PATCH 171/279] Fix HTML language attribute --- .../configure-java-microservice-interactive.html | 2 +- content/zh/docs/tutorials/kubernetes-basics/_index.html | 2 +- .../kubernetes-basics/create-cluster/cluster-interactive.html | 2 +- .../kubernetes-basics/create-cluster/cluster-intro.html | 2 +- .../kubernetes-basics/deploy-app/deploy-interactive.html | 2 +- .../tutorials/kubernetes-basics/deploy-app/deploy-intro.html | 2 +- .../kubernetes-basics/explore/explore-interactive.html | 2 +- .../docs/tutorials/kubernetes-basics/explore/explore-intro.html | 2 +- .../tutorials/kubernetes-basics/expose/expose-interactive.html | 2 +- .../docs/tutorials/kubernetes-basics/expose/expose-intro.html | 2 +- .../tutorials/kubernetes-basics/scale/scale-interactive.html | 2 +- .../zh/docs/tutorials/kubernetes-basics/scale/scale-intro.html | 2 +- .../tutorials/kubernetes-basics/update/update-interactive.html | 2 +- .../docs/tutorials/kubernetes-basics/update/update-intro.html | 2 +- 14 files changed, 14 insertions(+), 14 deletions(-) diff --git a/content/zh/docs/tutorials/configuration/configure-java-microservice/configure-java-microservice-interactive.html b/content/zh/docs/tutorials/configuration/configure-java-microservice/configure-java-microservice-interactive.html index f453fc75cb..5a119fcd37 100644 --- a/content/zh/docs/tutorials/configuration/configure-java-microservice/configure-java-microservice-interactive.html +++ b/content/zh/docs/tutorials/configuration/configure-java-microservice/configure-java-microservice-interactive.html @@ -11,7 +11,7 @@ weight: 20 - + diff --git a/content/zh/docs/tutorials/kubernetes-basics/_index.html b/content/zh/docs/tutorials/kubernetes-basics/_index.html index a53858ca02..7cf767d5af 100644 --- a/content/zh/docs/tutorials/kubernetes-basics/_index.html +++ b/content/zh/docs/tutorials/kubernetes-basics/_index.html @@ -11,7 +11,7 @@ card: - + diff --git a/content/zh/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html b/content/zh/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html index 2231587445..87e0659ef8 100644 --- a/content/zh/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html +++ b/content/zh/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html @@ -12,7 +12,7 @@ weight: 20 - + diff --git a/content/zh/docs/tutorials/kubernetes-basics/create-cluster/cluster-intro.html b/content/zh/docs/tutorials/kubernetes-basics/create-cluster/cluster-intro.html index 7147587d51..d6a0d4a9ec 100644 --- a/content/zh/docs/tutorials/kubernetes-basics/create-cluster/cluster-intro.html +++ b/content/zh/docs/tutorials/kubernetes-basics/create-cluster/cluster-intro.html @@ -5,7 +5,7 @@ weight: 10 - + diff --git a/content/zh/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html b/content/zh/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html index 8b6693beae..fbb85aeb4c 100644 --- a/content/zh/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html +++ b/content/zh/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html @@ -5,7 +5,7 @@ weight: 20 - + diff --git a/content/zh/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro.html b/content/zh/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro.html index 550ccb488d..cf44c3f5d5 100644 --- a/content/zh/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro.html +++ b/content/zh/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro.html @@ -5,7 +5,7 @@ weight: 10 - + diff --git a/content/zh/docs/tutorials/kubernetes-basics/explore/explore-interactive.html b/content/zh/docs/tutorials/kubernetes-basics/explore/explore-interactive.html index 3d94bda16f..5e469b8a5a 100644 --- a/content/zh/docs/tutorials/kubernetes-basics/explore/explore-interactive.html +++ b/content/zh/docs/tutorials/kubernetes-basics/explore/explore-interactive.html @@ -12,7 +12,7 @@ weight: 20 - + diff --git a/content/zh/docs/tutorials/kubernetes-basics/explore/explore-intro.html b/content/zh/docs/tutorials/kubernetes-basics/explore/explore-intro.html index d07d155926..2a756d9d55 100644 --- a/content/zh/docs/tutorials/kubernetes-basics/explore/explore-intro.html +++ b/content/zh/docs/tutorials/kubernetes-basics/explore/explore-intro.html @@ -5,7 +5,7 @@ weight: 10 - + diff --git a/content/zh/docs/tutorials/kubernetes-basics/expose/expose-interactive.html b/content/zh/docs/tutorials/kubernetes-basics/expose/expose-interactive.html index bf20a9e4f3..6e3f84b6cf 100644 --- a/content/zh/docs/tutorials/kubernetes-basics/expose/expose-interactive.html +++ b/content/zh/docs/tutorials/kubernetes-basics/expose/expose-interactive.html @@ -12,7 +12,7 @@ weight: 20 - + diff --git a/content/zh/docs/tutorials/kubernetes-basics/expose/expose-intro.html b/content/zh/docs/tutorials/kubernetes-basics/expose/expose-intro.html index 307260631e..cf21b08728 100644 --- a/content/zh/docs/tutorials/kubernetes-basics/expose/expose-intro.html +++ b/content/zh/docs/tutorials/kubernetes-basics/expose/expose-intro.html @@ -6,7 +6,7 @@ weight: 10 - + diff --git a/content/zh/docs/tutorials/kubernetes-basics/scale/scale-interactive.html b/content/zh/docs/tutorials/kubernetes-basics/scale/scale-interactive.html index 9f29959853..14ae3cdbad 100644 --- a/content/zh/docs/tutorials/kubernetes-basics/scale/scale-interactive.html +++ b/content/zh/docs/tutorials/kubernetes-basics/scale/scale-interactive.html @@ -11,7 +11,7 @@ weight: 20 - + diff --git a/content/zh/docs/tutorials/kubernetes-basics/scale/scale-intro.html b/content/zh/docs/tutorials/kubernetes-basics/scale/scale-intro.html index ff6094eada..5d6e13af8d 100644 --- a/content/zh/docs/tutorials/kubernetes-basics/scale/scale-intro.html +++ b/content/zh/docs/tutorials/kubernetes-basics/scale/scale-intro.html @@ -11,7 +11,7 @@ weight: 10 --> - +
      diff --git a/content/zh/docs/tutorials/kubernetes-basics/update/update-interactive.html b/content/zh/docs/tutorials/kubernetes-basics/update/update-interactive.html index 777d7515ad..9befc40bd7 100644 --- a/content/zh/docs/tutorials/kubernetes-basics/update/update-interactive.html +++ b/content/zh/docs/tutorials/kubernetes-basics/update/update-interactive.html @@ -12,7 +12,7 @@ weight: 20 - + diff --git a/content/zh/docs/tutorials/kubernetes-basics/update/update-intro.html b/content/zh/docs/tutorials/kubernetes-basics/update/update-intro.html index e4dab0b07c..8f53c752c3 100644 --- a/content/zh/docs/tutorials/kubernetes-basics/update/update-intro.html +++ b/content/zh/docs/tutorials/kubernetes-basics/update/update-intro.html @@ -12,7 +12,7 @@ weight: 10 - + From c1af1ad3f50e22c64430eeba31293c49cb1d8805 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Tue, 17 Aug 2021 12:21:47 +0100 Subject: [PATCH 172/279] Fix HTML language attribute --- content/vi/docs/tutorials/kubernetes-basics/_index.html | 2 +- .../kubernetes-basics/create-cluster/cluster-interactive.html | 2 +- .../kubernetes-basics/create-cluster/cluster-intro.html | 2 +- .../kubernetes-basics/explore/explore-interactive.html | 2 +- .../docs/tutorials/kubernetes-basics/explore/explore-intro.html | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/content/vi/docs/tutorials/kubernetes-basics/_index.html b/content/vi/docs/tutorials/kubernetes-basics/_index.html index 2440ca5e67..30e370294f 100644 --- a/content/vi/docs/tutorials/kubernetes-basics/_index.html +++ b/content/vi/docs/tutorials/kubernetes-basics/_index.html @@ -10,7 +10,7 @@ card: - + diff --git a/content/vi/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html b/content/vi/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html index 76fd8004ee..4c2ea13af3 100644 --- a/content/vi/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html +++ b/content/vi/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html @@ -5,7 +5,7 @@ weight: 20 - + diff --git a/content/vi/docs/tutorials/kubernetes-basics/create-cluster/cluster-intro.html b/content/vi/docs/tutorials/kubernetes-basics/create-cluster/cluster-intro.html index 9fc822147c..c5d8e13ad9 100644 --- a/content/vi/docs/tutorials/kubernetes-basics/create-cluster/cluster-intro.html +++ b/content/vi/docs/tutorials/kubernetes-basics/create-cluster/cluster-intro.html @@ -5,7 +5,7 @@ weight: 10 - + diff --git a/content/vi/docs/tutorials/kubernetes-basics/explore/explore-interactive.html b/content/vi/docs/tutorials/kubernetes-basics/explore/explore-interactive.html index 2a8d45f170..8169a3b989 100644 --- a/content/vi/docs/tutorials/kubernetes-basics/explore/explore-interactive.html +++ b/content/vi/docs/tutorials/kubernetes-basics/explore/explore-interactive.html @@ -5,7 +5,7 @@ weight: 20 - + diff --git a/content/vi/docs/tutorials/kubernetes-basics/explore/explore-intro.html b/content/vi/docs/tutorials/kubernetes-basics/explore/explore-intro.html index fbde8b0797..7a27af279a 100644 --- a/content/vi/docs/tutorials/kubernetes-basics/explore/explore-intro.html +++ b/content/vi/docs/tutorials/kubernetes-basics/explore/explore-intro.html @@ -5,7 +5,7 @@ weight: 10 - + From 399c7749c788d135dc07d2a605d613819eb17ef2 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Tue, 17 Aug 2021 12:23:43 +0100 Subject: [PATCH 173/279] Fix HTML language attribute --- content/pl/docs/tutorials/kubernetes-basics/_index.html | 2 +- .../kubernetes-basics/create-cluster/cluster-interactive.html | 2 +- .../kubernetes-basics/create-cluster/cluster-intro.html | 2 +- .../kubernetes-basics/deploy-app/deploy-interactive.html | 2 +- .../tutorials/kubernetes-basics/deploy-app/deploy-intro.html | 2 +- .../kubernetes-basics/explore/explore-interactive.html | 2 +- .../docs/tutorials/kubernetes-basics/explore/explore-intro.html | 2 +- .../tutorials/kubernetes-basics/expose/expose-interactive.html | 2 +- .../docs/tutorials/kubernetes-basics/expose/expose-intro.html | 2 +- .../tutorials/kubernetes-basics/scale/scale-interactive.html | 2 +- .../pl/docs/tutorials/kubernetes-basics/scale/scale-intro.html | 2 +- .../tutorials/kubernetes-basics/update/update-interactive.html | 2 +- .../docs/tutorials/kubernetes-basics/update/update-intro.html | 2 +- 13 files changed, 13 insertions(+), 13 deletions(-) diff --git a/content/pl/docs/tutorials/kubernetes-basics/_index.html b/content/pl/docs/tutorials/kubernetes-basics/_index.html index e27a3ad6bf..0996edc64b 100644 --- a/content/pl/docs/tutorials/kubernetes-basics/_index.html +++ b/content/pl/docs/tutorials/kubernetes-basics/_index.html @@ -11,7 +11,7 @@ card: - + diff --git a/content/pl/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html b/content/pl/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html index 12211e42b6..72409e9238 100644 --- a/content/pl/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html +++ b/content/pl/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html @@ -5,7 +5,7 @@ weight: 20 - + diff --git a/content/pl/docs/tutorials/kubernetes-basics/create-cluster/cluster-intro.html b/content/pl/docs/tutorials/kubernetes-basics/create-cluster/cluster-intro.html index 3955e557c4..c5eddaf5f9 100644 --- a/content/pl/docs/tutorials/kubernetes-basics/create-cluster/cluster-intro.html +++ b/content/pl/docs/tutorials/kubernetes-basics/create-cluster/cluster-intro.html @@ -5,7 +5,7 @@ weight: 10 - + diff --git a/content/pl/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html b/content/pl/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html index 64c1a0a9a1..954bad22b3 100644 --- a/content/pl/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html +++ b/content/pl/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html @@ -5,7 +5,7 @@ weight: 20 - + diff --git a/content/pl/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro.html b/content/pl/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro.html index c879aa82b9..f4b893d60b 100644 --- a/content/pl/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro.html +++ b/content/pl/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro.html @@ -5,7 +5,7 @@ weight: 10 - + diff --git a/content/pl/docs/tutorials/kubernetes-basics/explore/explore-interactive.html b/content/pl/docs/tutorials/kubernetes-basics/explore/explore-interactive.html index 1ae1e88382..14afae5a3d 100644 --- a/content/pl/docs/tutorials/kubernetes-basics/explore/explore-interactive.html +++ b/content/pl/docs/tutorials/kubernetes-basics/explore/explore-interactive.html @@ -5,7 +5,7 @@ weight: 20 - + diff --git a/content/pl/docs/tutorials/kubernetes-basics/explore/explore-intro.html b/content/pl/docs/tutorials/kubernetes-basics/explore/explore-intro.html index edfff527e6..f62563e1cd 100644 --- a/content/pl/docs/tutorials/kubernetes-basics/explore/explore-intro.html +++ b/content/pl/docs/tutorials/kubernetes-basics/explore/explore-intro.html @@ -5,7 +5,7 @@ weight: 10 - + diff --git a/content/pl/docs/tutorials/kubernetes-basics/expose/expose-interactive.html b/content/pl/docs/tutorials/kubernetes-basics/expose/expose-interactive.html index a1aca99ce3..1aefa3e793 100644 --- a/content/pl/docs/tutorials/kubernetes-basics/expose/expose-interactive.html +++ b/content/pl/docs/tutorials/kubernetes-basics/expose/expose-interactive.html @@ -5,7 +5,7 @@ weight: 20 - + diff --git a/content/pl/docs/tutorials/kubernetes-basics/expose/expose-intro.html b/content/pl/docs/tutorials/kubernetes-basics/expose/expose-intro.html index f9f9134e4a..199ab9dfe7 100644 --- a/content/pl/docs/tutorials/kubernetes-basics/expose/expose-intro.html +++ b/content/pl/docs/tutorials/kubernetes-basics/expose/expose-intro.html @@ -5,7 +5,7 @@ weight: 10 - + diff --git a/content/pl/docs/tutorials/kubernetes-basics/scale/scale-interactive.html b/content/pl/docs/tutorials/kubernetes-basics/scale/scale-interactive.html index e8017f5ad6..7990fbd1a6 100644 --- a/content/pl/docs/tutorials/kubernetes-basics/scale/scale-interactive.html +++ b/content/pl/docs/tutorials/kubernetes-basics/scale/scale-interactive.html @@ -5,7 +5,7 @@ weight: 20 - + diff --git a/content/pl/docs/tutorials/kubernetes-basics/scale/scale-intro.html b/content/pl/docs/tutorials/kubernetes-basics/scale/scale-intro.html index 91eb10eb6d..bb2c40ffee 100644 --- a/content/pl/docs/tutorials/kubernetes-basics/scale/scale-intro.html +++ b/content/pl/docs/tutorials/kubernetes-basics/scale/scale-intro.html @@ -5,7 +5,7 @@ weight: 10 - + diff --git a/content/pl/docs/tutorials/kubernetes-basics/update/update-interactive.html b/content/pl/docs/tutorials/kubernetes-basics/update/update-interactive.html index 07731b5849..5664abc0e6 100644 --- a/content/pl/docs/tutorials/kubernetes-basics/update/update-interactive.html +++ b/content/pl/docs/tutorials/kubernetes-basics/update/update-interactive.html @@ -5,7 +5,7 @@ weight: 20 - + diff --git a/content/pl/docs/tutorials/kubernetes-basics/update/update-intro.html b/content/pl/docs/tutorials/kubernetes-basics/update/update-intro.html index b51779237d..2c42eee6d6 100644 --- a/content/pl/docs/tutorials/kubernetes-basics/update/update-intro.html +++ b/content/pl/docs/tutorials/kubernetes-basics/update/update-intro.html @@ -5,7 +5,7 @@ weight: 10 - + From 43bf8f2a109c9a1bf46b5b3ee4f1b7bbfbe8e545 Mon Sep 17 00:00:00 2001 From: ialidzhikov Date: Tue, 17 Aug 2021 16:08:05 +0300 Subject: [PATCH 174/279] Fix EoL dates in data/releases/schedule.yaml Signed-off-by: ialidzhikov --- data/releases/schedule.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/data/releases/schedule.yaml b/data/releases/schedule.yaml index 412ed74e2c..3c76a4040c 100644 --- a/data/releases/schedule.yaml +++ b/data/releases/schedule.yaml @@ -9,7 +9,7 @@ schedules: next: 1.21.4 cherryPickDeadline: 2021-08-07 targetDate: 2021-08-11 - endOfLifeDate: 2022-04-30 + endOfLifeDate: 2022-06-28 previousPatches: - release: 1.21.3 cherryPickDeadline: 2021-07-10 @@ -25,7 +25,7 @@ schedules: next: 1.20.10 cherryPickDeadline: 2021-08-07 targetDate: 2021-08-11 - endOfLifeDate: 2021-12-30 + endOfLifeDate: 2022-02-28 previousPatches: - release: 1.20.9 cherryPickDeadline: 2021-07-10 @@ -61,7 +61,7 @@ schedules: next: 1.19.14 cherryPickDeadline: 2021-08-07 targetDate: 2021-08-11 - endOfLifeDate: 2021-09-30 + endOfLifeDate: 2021-10-28 previousPatches: - release: 1.19.13 cherryPickDeadline: 2021-07-10 From 1df20dc263c146f007f6dc394d8540b8cc29b856 Mon Sep 17 00:00:00 2001 From: Edith Puclla <58795858+edithturn@users.noreply.github.com> Date: Tue, 17 Aug 2021 10:43:06 -0500 Subject: [PATCH 175/279] Update content/es/docs/concepts/storage/volume-snapshot-classes.md Thank you, Rael! :) Co-authored-by: Rael Garcia --- .../es/docs/concepts/storage/volume-snapshot-classes.md | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/content/es/docs/concepts/storage/volume-snapshot-classes.md b/content/es/docs/concepts/storage/volume-snapshot-classes.md index cf18340869..497b256e67 100644 --- a/content/es/docs/concepts/storage/volume-snapshot-classes.md +++ b/content/es/docs/concepts/storage/volume-snapshot-classes.md @@ -1,11 +1,7 @@ --- reviewers: -- saad-ali -- thockin -- msau42 -- jingxu97 -- xing-yang -- yuxiangqian +- edithturn +- raelga title: Volume Snapshot Classes content_type: concept weight: 30 From 57c0fe11202bf033a2ee4f05401992f6eef6384f Mon Sep 17 00:00:00 2001 From: Geoffrey Cline Date: Wed, 30 Jun 2021 00:13:20 +0000 Subject: [PATCH 176/279] update desc of namespace defaulting in CLI --- content/en/docs/reference/kubectl/overview.md | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/content/en/docs/reference/kubectl/overview.md b/content/en/docs/reference/kubectl/overview.md index 2ec88f2aa0..611065eead 100644 --- a/content/en/docs/reference/kubectl/overview.md +++ b/content/en/docs/reference/kubectl/overview.md @@ -71,6 +71,32 @@ Flags that you specify from the command line override default values and any cor If you need help, run `kubectl help` from the terminal window. +## In-cluster authentication and namespace overrides + +By default `kubectl` will first determine if it is running within a pod, and thus in a cluster. It starts by checking for the `KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT` environment variables and the existence of a service account token file at `/var/run/secrets/kubernetes.io/serviceaccount/token`. If all three are found in-cluster authentication is assumed. + +To maintain backwards compatibility, if the `POD_NAMESPACE` environment variable is set during in-cluster authentication it will override the default namespace from the from the service account token. Any manifests or tools relying on namespace defaulting will be affected by this. + +**`POD_NAMESPACE` environment variable** + +If the `POD_NAMESPACE` environment variable is set, cli operations on namespaced resources will default to the variable value. For example, if the variable is set to `seattle`, `kubectl get pods` would return pods in the `seattle` namespace. This is because pods are a namespaced resource, and no namespace was provided in the command. Review the output of `kubectl api-resources` to determine if a resource is namespaced. + +Explicit use of `--namespace ` overrides this behavior. + +**How kubectl handles ServiceAccount tokens** + +If: +* there is Kubernetes service account token file mounted at + `/var/run/secrets/kubernetes.io/serviceaccount/token`, and +* the `KUBERNETES_SERVICE_HOST` environment variable is set, and +* the `KUBERNETES_SERVICE_PORT` environment variable is set, and +* you don't explicitly specify a namespace on the kubectl command line +then kubectl assumes it is running in your cluster. The kubectl tool looks up the +namespace of that ServiceAccount (this is the same as the namespace of the Pod) +and acts against that namespace. This is different from what happens outside of a +cluster; when kubectl runs outside a cluster and you don't specify a namespace, +the kubectl command acts against the `default` namespace. + ## Operations The following table includes short descriptions and the general syntax for all of the `kubectl` operations: From 50c8238a2d73b1fd8b216e658238cee9eea61b4b Mon Sep 17 00:00:00 2001 From: Arhell Date: Wed, 18 Aug 2021 02:36:09 +0300 Subject: [PATCH 177/279] [es] Delete logging-stackdriver.md --- .../logging-stackdriver.md | 366 ------------------ 1 file changed, 366 deletions(-) delete mode 100644 content/es/docs/tasks/debug-application-cluster/logging-stackdriver.md diff --git a/content/es/docs/tasks/debug-application-cluster/logging-stackdriver.md b/content/es/docs/tasks/debug-application-cluster/logging-stackdriver.md deleted file mode 100644 index 3a247b5e88..0000000000 --- a/content/es/docs/tasks/debug-application-cluster/logging-stackdriver.md +++ /dev/null @@ -1,366 +0,0 @@ ---- -title: Escribiendo Logs con Stackdriver -content_type: concept ---- - - - -Antes de seguir leyendo esta página, deberías familiarizarte con el -[resumen de escritura de logs en Kubernetes](/docs/concepts/cluster-administration/logging). - -{{< note >}} -Por defecto, Stackdriver recolecta toda la salida estándar de tus contenedores, así -como el flujo de la salida de error. Para recolectar cualquier log tu aplicación escribe en un archivo (por ejemplo), -ver la [estrategia de sidecar](/docs/concepts/cluster-administration/logging#sidecar-container-with-a-logging-agent) -en el resumen de escritura de logs en Kubernetes. -{{< /note >}} - - - - - - -## Despliegue - -Para ingerir logs, debes desplegar el agente de Stackdriver Logging en cada uno de los nodos de tu clúster. -Dicho agente configura una instancia de `fluentd`, donde la configuración se guarda en un `ConfigMap` -y las instancias se gestionan a través de un `DaemonSet` de Kubernetes. El despliegue actual del -`ConfigMap` y el `DaemonSet` dentro de tu clúster depende de tu configuración individual del clúster. - -### Desplegar en un nuevo clúster - -#### Google Kubernetes Engine - -Stackdriver es la solución por defecto de escritura de logs para aquellos clústeres desplegados en Google Kubernetes Engine. -Stackdriver Logging se despliega por defecto en cada clúster a no ser que se le indique de forma explícita no hacerlo. - -#### Otras plataformas - -Para desplegar Stackdriver Logging en un *nuevo* clúster que estés creando con -`kube-up.sh`, haz lo siguiente: - -1. Configura la variable de entorno `KUBE_LOGGING_DESTINATION` con el valor `gcp`. -1. **Si no estás trabajando en GCE**, incluye `beta.kubernetes.io/fluentd-ds-ready=true` -en la variable `KUBE_NODE_LABELS`. - -Una vez que tu clúster ha arrancado, cada nodo debería ejecutar un agente de Stackdriver Logging. -Los `DaemonSet` y `ConfigMap` se configuran como extras. Si no estás usando `kube-up.sh`, -considera la posibilidad de arrancar un clúster sin una solución pre-determinada de escritura de logs -y entonces desplegar los agentes de Stackdriver Logging una vez el clúster esté ejecutándose. - -{{< warning >}} -El proceso de Stackdriver Logging reporta problemas conocidos en plataformas distintas -a Google Kubernetes Engine. Úsalo bajo tu propio riesgo. -{{< /warning >}} - -### Desplegar a un clúster existente - -1. Aplica una etiqueta en cada nodo, si no estaba presente ya. - - El despliegue del agente de Stackdriver Logging utiliza etiquetas de nodo para - determinar en qué nodos debería desplegarse. Estas etiquetas fueron introducidas - para distinguir entre nodos de Kubernetes de la versión 1.6 o superior. - Si el clúster se creó con Stackdriver Logging configurado y el nodo tiene la - versión 1.5.X o inferior, ejecutará fluentd como un pod estático. Puesto que un nodo - no puede tener más de una instancia de fluentd, aplica únicamente las etiquetas - a los nodos que no tienen un pod de fluentd ya desplegado. Puedes confirmar si tu nodo - ha sido etiquetado correctamente ejecutando `kubectl describe` de la siguiente manera: - - ``` - kubectl describe node $NODE_NAME - ``` - - La salida debería ser similar a la siguiente: - - ``` - Name: NODE_NAME - Role: - Labels: beta.kubernetes.io/fluentd-ds-ready=true - ... - ``` - - Asegúrate que la salida contiene la etiqueta `beta.kubernetes.io/fluentd-ds-ready=true`. - Si no está presente, puedes añadirla usando el comando `kubectl label` como se indica: - - ``` - kubectl label node $NODE_NAME beta.kubernetes.io/fluentd-ds-ready=true - ``` - - {{< note >}} - Si un nodo falla y tiene que volver a crearse, deberás volver a definir - la etiqueta al nuevo nodo. Para facilitar esta tarea, puedes utilizar el - parámetro de línea de comandos del Kubelet para aplicar dichas etiquetas - cada vez que se arranque un nodo. - {{< /note >}} - -1. Despliega un `ConfigMap` con la configuración del agente de escritura de logs ejecutando el siguiente comando: - - ``` - kubectl apply -f https://k8s.io/examples/debug/fluentd-gcp-configmap.yaml - ``` - - Este comando crea el `ConfigMap` en el espacio de nombres `default`. Puedes descargar el archivo - manualmente y cambiarlo antes de crear el objeto `ConfigMap`. - -1. Despliega el agente `DaemonSet` de escritura de logs ejecutando el siguiente comando: - - ``` - kubectl apply -f https://k8s.io/examples/debug/fluentd-gcp-ds.yaml - ``` - - Puedes descargar y editar este archivo antes de usarlo igualmente. - -## Verificar el despliegue de tu agente de escritura de logs - -Tras el despliegue del `DaemonSet` de StackDriver, puedes comprobar el estado de -cada uno de los despliegues de los agentes ejecutando el siguiente comando: - -```shell -kubectl get ds --all-namespaces -``` - -Si tienes 3 nodos en el clúster, la salida debería ser similar a esta: - -``` -NAMESPACE NAME DESIRED CURRENT READY NODE-SELECTOR AGE -... -default fluentd-gcp-v2.0 3 3 3 beta.kubernetes.io/fluentd-ds-ready=true 5m -... -``` -Para comprender cómo funciona Stackdriver, considera la siguiente especificación -de un generador de logs sintéticos [counter-pod.yaml](/examples/debug/counter-pod.yaml): - -{{< codenew file="debug/counter-pod.yaml" >}} - -Esta especificación de pod tiene un contenedor que ejecuta una secuencia de comandos bash -que escribe el valor de un contador y la fecha y hora cada segundo, de forma indefinida. -Vamos a crear este pod en el espacio de nombres por defecto. - -```shell -kubectl apply -f https://k8s.io/examples/debug/counter-pod.yaml -``` - -Puedes observar el pod corriendo: - -```shell -kubectl get pods -``` -``` -NAME READY STATUS RESTARTS AGE -counter 1/1 Running 0 5m -``` - -Durante un período de tiempo corto puedes observar que el estado del pod es 'Pending', debido a que el kubelet -tiene primero que descargar la imagen del contenedor. Cuando el estado del pod cambia a `Running` -puedes usar el comando `kubectl logs` para ver la salida de este pod contador. - -```shell -kubectl logs counter -``` -``` -0: Mon Jan 1 00:00:00 UTC 2001 -1: Mon Jan 1 00:00:01 UTC 2001 -2: Mon Jan 1 00:00:02 UTC 2001 -... -``` - -Como se describe en el resumen de escritura de logs, este comando visualiza las entradas de logs -del archivo de logs del contenedor. Si se termina el contenedor y Kubernetes lo reinicia, -todavía puedes acceder a los logs de la ejecución previa del contenedor. Sin embargo, -si el pod se desaloja del nodo, los archivos de log se pierden. Vamos a demostrar este -comportamiento mediante el borrado del contenedor que ejecuta nuestro contador: - -```shell -kubectl delete pod counter -``` -``` -pod "counter" deleted -``` - -y su posterior re-creación: - -```shell -kubectl create -f https://k8s.io/examples/debug/counter-pod.yaml -``` -``` -pod/counter created -``` - -Tras un tiempo, puedes acceder a los logs del pod contador otra vez: - -```shell -kubectl logs counter -``` -``` -0: Mon Jan 1 00:01:00 UTC 2001 -1: Mon Jan 1 00:01:01 UTC 2001 -2: Mon Jan 1 00:01:02 UTC 2001 -... -``` - -Como era de esperar, únicamente se visualizan las líneas de log recientes. Sin embargo, -para una aplicación real seguramente prefieras acceder a los logs de todos los contenedores, -especialmente cuando te haga falta depurar problemas. Aquí es donde haber habilitado -Stackdriver Logging puede ayudarte. - -## Ver logs - -El agente de Stackdriver Logging asocia metadatos a cada entrada de log, para que puedas usarlos posteriormente -en consultas para seleccionar sólo los mensajes que te interesan: por ejemplo, -los mensajes de un pod en particular. - -Los metadatos más importantes son el tipo de recurso y el nombre del log. -El tipo de recurso de un log de contenedor tiene el valor `container`, que se muestra como -`GKE Containers` en la UI (incluso si el clúster de Kubernetes no está en Google Kubernetes Engine). -El nombre de log es el nombre del contenedor, de forma que si tienes un pod con -dos contenedores, denominados `container_1` y `container_2` en la especificación, sus logs -tendrán los nombres `container_1` y `container_2` respectivamente. - -Los componentes del sistema tienen el valor `compute` como tipo de recursos, que se muestra como -`GCE VM Instance` en la UI. Los nombres de log para los componentes del sistema son fijos. -Para un nodo de Google Kubernetes Engine, cada entrada de log de cada componente de sistema tiene uno de los siguientes nombres: - -* docker -* kubelet -* kube-proxy - -Puedes aprender más acerca de cómo visualizar los logs en la [página dedicada a Stackdriver](https://cloud.google.com/logging/docs/view/logs_viewer). - -Uno de los posibles modos de ver los logs es usando el comando de línea de interfaz -[`gcloud logging`](https://cloud.google.com/logging/docs/api/gcloud-logging) -del [SDK de Google Cloud](https://cloud.google.com/sdk/). -Este comando usa la [sintaxis de filtrado](https://cloud.google.com/logging/docs/view/advanced_filters) de StackDriver Logging -para consultar logs específicos. Por ejemplo, puedes ejecutar el siguiente comando: - -```none -gcloud beta logging read 'logName="projects/$YOUR_PROJECT_ID/logs/count"' --format json | jq '.[].textPayload' -``` -``` -... -"2: Mon Jan 1 00:01:02 UTC 2001\n" -"1: Mon Jan 1 00:01:01 UTC 2001\n" -"0: Mon Jan 1 00:01:00 UTC 2001\n" -... -"2: Mon Jan 1 00:00:02 UTC 2001\n" -"1: Mon Jan 1 00:00:01 UTC 2001\n" -"0: Mon Jan 1 00:00:00 UTC 2001\n" -``` - -Como puedes observar, muestra los mensajes del contenedor contador tanto de la -primera como de la segunda ejecución, a pesar de que el kubelet ya había eliminado los logs del primer contenedor. - -### Exportar logs - -Puedes exportar los logs al [Google Cloud Storage](https://cloud.google.com/storage/) -o a [BigQuery](https://cloud.google.com/bigquery/) para llevar a cabo un análisis más profundo. -Stackdriver Logging ofrece el concepto de destinos, donde puedes especificar el destino de -las entradas de logs. Más información disponible en la [página de exportación de logs](https://cloud.google.com/logging/docs/export/configure_export_v2) de StackDriver. - -## Configurar los agentes de Stackdriver Logging - -En ocasiones la instalación por defecto de Stackdriver Logging puede que no se ajuste a tus necesidades, por ejemplo: - -* Puede que quieras añadir más recursos porque el rendimiento por defecto no encaja con tus necesidades. -* Puede que quieras añadir un parseo adicional para extraer más metadatos de tus mensajes de log, -como la severidad o referencias al código fuente. -* Puede que quieras enviar los logs no sólo a Stackdriver o sólo enviarlos a Stackdriver parcialmente. - -En cualquiera de estos casos, necesitas poder cambiar los parámetros del `DaemonSet` y el `ConfigMap`. - -### Prerequisitos - -Si estás usando GKE y Stackdriver Logging está habilitado en tu clúster, no puedes -cambiar su configuración, porque ya está gestionada por GKE. -Sin embargo, puedes deshabilitar la integración por defecto y desplegar la tuya propia. - -{{< note >}} -Tendrás que mantener y dar soporte tú mismo a la nueva configuración desplegada: -actualizar la imagen y la configuración, ajustar los recuros y todo eso. -{{< /note >}} - -Para deshabilitar la integración por defecto, usa el siguiente comando: - -``` -gcloud beta container clusters update --logging-service=none CLUSTER -``` - -Puedes encontrar notas acerca de cómo instalar los agentes de Stackdriver Logging - en un clúster ya ejecutándose en la [sección de despliegue](#deploying). - -### Cambiar los parámetros del `DaemonSet` - -Cuando tienes un `DaemonSet` de Stackdriver Logging en tu clúster, puedes simplemente -modificar el campo `template` en su especificación, y el controlador del daemonset actualizará los pods por ti. Por ejemplo, -asumamos que acabas de instalar el Stackdriver Logging como se describe arriba. Ahora quieres cambiar -el límite de memoria que se le asigna a fluentd para poder procesar más logs de forma segura. - -Obtén la especificación del `DaemonSet` que corre en tu clúster: - -```shell -kubectl get ds fluentd-gcp-v2.0 --namespace kube-system -o yaml > fluentd-gcp-ds.yaml -``` - -A continuación, edita los requisitos del recurso en el `spec` y actualiza el objeto `DaemonSet` -en el apiserver usando el siguiente comando: - -```shell -kubectl replace -f fluentd-gcp-ds.yaml -``` - -Tras un tiempo, los pods de agente de Stackdriver Logging se reiniciarán con la nueva configuración. - -### Cambiar los parámetros de fluentd - -La configuración de Fluentd se almacena en un objeto `ConfigMap`. Realmente se trata de un conjunto -de archivos de configuración que se combinan conjuntamente. Puedes aprender acerca de -la configuración de fluentd en el [sitio oficial](http://docs.fluentd.org). - -Imagina que quieres añadir una nueva lógica de parseo a la configuración actual, de forma que fluentd pueda entender -el formato de logs por defecto de Python. Un filtro apropiado de fluentd para conseguirlo sería: - -``` - - type parser - format /^(?\w):(?\w):(?.*)/ - reserve_data true - suppress_parse_error_log true - key_name log - -``` - -Ahora tienes que añadirlo a la configuración actual y que los agentes de Stackdriver Logging la usen. -Para ello, obtén la versión actual del `ConfigMap` de Stackdriver Logging de tu clúster -ejecutando el siguiente comando: - -```shell -kubectl get cm fluentd-gcp-config --namespace kube-system -o yaml > fluentd-gcp-configmap.yaml -``` - -Luego, como valor de la clave `containers.input.conf`, inserta un nuevo filtro justo después -de la sección `source`. - -{{< note >}} -El orden es importante. -{{< /note >}} - -Actualizar el `ConfigMap` en el apiserver es más complicado que actualizar el `DaemonSet`. -Es mejor considerar que un `ConfigMap` es inmutable. Así, para poder actualizar la configuración, deberías -crear un nuevo `ConfigMap` con otro nombre y cambiar el `DaemonSet` para que apunte al nuevo -siguiendo la [guía de arriba](#changing-daemonset-parameters). - -### Añadir plugins de fluentd - -Fluentd está desarrollado en Ruby y permite extender sus capacidades mediante el uso de -[plugins](http://www.fluentd.org/plugins). Si quieres usar un plugin que no está incluido en -la imagen por defecto del contenedor de Stackdriver Logging, debes construir tu propia imagen. -Imagina que quieres añadir un destino Kafka para aquellos mensajes de un contenedor en particular -para poder procesarlos posteriormente. Puedes reusar los [fuentes de imagen de contenedor](https://git.k8s.io/contrib/fluentd/fluentd-gcp-image) -con algunos pequeños cambios: - -* Cambia el archivo Makefile para que apunte a tu repositorio de contenedores, ej. `PREFIX=gcr.io/`. -* Añade tu dependencia al archivo Gemfile, por ejemplo `gem 'fluent-plugin-kafka'`. - -Luego, ejecuta `make build push` desde ese directorio. Cuando el `DaemonSet` haya tomado los cambios de la nueva imagen, -podrás usar el plugin que has indicado en la configuración de fluentd. - - From ee99447c9d37a625de58995b477a29213b514588 Mon Sep 17 00:00:00 2001 From: Kunal Kushwaha Date: Wed, 18 Aug 2021 20:02:08 +0530 Subject: [PATCH 178/279] 1.22 Feature Blog for Support for Windows privileged containers (#29022) * 1.22 feature blog for Support for Windows privileged containers * Rebased with latest blog content * dates updated * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md.md Co-authored-by: Chris Negus * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md.md Co-authored-by: Chris Negus * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md.md Co-authored-by: Chris Negus * Update index.md.md * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md.md Co-authored-by: Tim Bannister * Rename index.md.md to index.md * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md Co-authored-by: Tim Bannister * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md Co-authored-by: Tim Bannister * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md Co-authored-by: Tim Bannister * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md Co-authored-by: Tim Bannister * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md Co-authored-by: Tim Bannister * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md Co-authored-by: Tim Bannister * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md Co-authored-by: Tim Bannister * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md Co-authored-by: Tim Bannister * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md Co-authored-by: Tim Bannister * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md Co-authored-by: Tim Bannister * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md Co-authored-by: Brandon Smith * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md Co-authored-by: Brandon Smith * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md Co-authored-by: Brandon Smith * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md Co-authored-by: Brandon Smith * Update content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md Co-authored-by: Brandon Smith * Fix broken hyperlink * Fix broken hyperlink Co-authored-by: Rey Lejano * Fix hyperlink Co-authored-by: Rey Lejano Co-authored-by: Brandon Smith Co-authored-by: Chris Negus Co-authored-by: Tim Bannister Co-authored-by: Rey Lejano --- .../hostprocess-architecture.png | Bin 0 -> 73106 bytes .../index.md | 79 ++++++++++++++++++ 2 files changed, 79 insertions(+) create mode 100755 content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/hostprocess-architecture.png create mode 100644 content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md diff --git a/content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/hostprocess-architecture.png b/content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/hostprocess-architecture.png new file mode 100755 index 0000000000000000000000000000000000000000..b28bfcf80876836081b1a12b7d6252d07aa337be GIT binary patch literal 73106 zcmeFZc~n!`(=HrDK~ca~5Je%Vtq6!XFvyfhBTf)NW<&@|qf7ynL8c@itq3U4jfjE} z#$cF566OS21_fn?KmvpYA&?MbfFzKK8?gKL4&Pnx{qFt#_|{$PJ!`SZNpiAl*Qu&q z_0+RZg01ysSs7&+001C+^~yy%06;1c0NA!=yOj7H(}g@e@jr=RyUV`-DtZnrh)=fO zHG`M|0Pj+E3T|x^pYOPL#WffJP>J98lSr9mc>@6JMOQDHIfQ#G3T2!0oZTtN-s=I( zUxIg+?IWjd-}5y_XjwDcaJc69QxAz~z*=|QBlv>*(cE`k7FClswy&;a?9O{4(?N8{ z=BtUW+eXxtrTXkx$Q%BR*!@6Zx788F^sM-TDOk~$X2Q8;^0J%%h{?Ax>S8l>*?P|C zod3v;_jkT5!Z{vijB}@yGEhyY~cg%RgtHceX1?{B!bIA@;~WuVY>xvEBO5 z$!YtoVs-p|+)2Ff(?73UtbRK2uitv5vBlz_4*=&Za<~6;;)(w6K{j>q-|G6?B>peA zuA#|^owFw5x#)imYFhpAXpXm~h1|8KZH}LhNUw zKFX=fJy4{pp|jF@x=?bxzq#5uCn~(&L5Yf71PhxMGmD{r^mdZjbnAi8$_OaOZJp8E zT{P(5Y2^EzExA6EHfxuiT!4;C(wQnru-}JD8Q^4^Xat96hubqNY43@-NbM32kB5&T zrvH9eP31EGJ?oCmQYP_Vi7_XvJ={{S)ObkN$k4LqhTUHoH2!gMu;NX;%u9dh3U7dZ z5}{3^Tl1SfIrlA2zuSl?)_XRBNmYNyu>|5iho|eLMoTwQc;nXJ_2ZJklC8z+2$ityCb(?YP~$?^7BJ}j3Q3kJbz!`kjF*G}j*48H;6BZYY__3~mpx?kFeL;*Fc z^#{$jfCpZH<#c^w6tXVIy~jwns!qy3%V^NFX-!!bjyyWr1m1{djWFi7#}8Bi0MDbo zwu92qcJhHXrat2C4XH1>j23tZ-Ru~7y1)*TXVm&tb6(|WKH}SF?Rp35b z{;Z9P3%oxZif<#Q;i|p5bXlFH3;RQ~wx`Q06Hfr#cgy}mi$-2V5mb#*G5r6ICv=$iDw z++W9gj+cNPQ{KuImEyy}x>NIGp0_{OnlIls-BXM8RSQ;`hVdobuClvFLFca38cj3Y z)`sqLy{8{&7KCCR4AhvutA2OJJF^XbOLA;-l;LVPn}9i0RI8Grue`ms!JcsgD|$t< zb;mH+V=o8n;d#}X8KijpkW$Vg2`^|VjIVKxh|taMy?5RxqR-q&A_p{!p4&FDE53q5ma^UXq&~~en z9+ZcTU3=xX($BBJ-XE~Pqv%y@(9U|5C=XbX&0UT0M-j1C8J4J}(nEuFi=#wZs&Ghu zX4w$k(7@>?FrOLfn-^{|Gv74ZA zUli^c)|LC@kwZi1jYDOBoS)hwKY&qj@~Bm!9o0J>6zXC;EliTW(1=T?G0$sH)@tw_ zrWxgS>k9A@$9SIZ@FnOax;E0Uv5Ve2T%li_JoD;o>Hhc48p)TTBz&ct{W!W#dqheH z6bAD7NnZ32rZbtLF{wmq;~O}YWW)FvMhCN51D~^6*XfKu(VOb!)$vB!OLh#%B0uL^ zz&N2RjKLQ}Of!Nu`|`NQhB2MmNB}&w+9aJ2sakC3vHJ+%$EV9F!ldO_Qp5mTJ1|*F z)jlpN^5t*o&i78L0w4*}%8niK&-_4$99t8BG7~ut#z+i0kc{T*ibQ_+-r#dX>-u#i zs5^-udWkv1UIo#}LbQ=>BTS9kEVIeS1K;BoYBSEFKWp*=f)Z!?+i|5ReBkvPWPbN< zO)B>?)sx5(;H}vB(`~P~;B|y13AMT(Q_hO=B(I(9V$u`nFWz-t8bYU?m;c-+e9bfc z(}%DKw*_M>--T1sFOzL%#mQaEx5FE$5bhU~r?b+X)3IZxSZcv0p64(5HJVF#+RqMG z;DlFYZ|gHG$C0cHl}hsC1}t(4KP0`?!t~sSOu=)CP1ba& zZd09U7s@ZmKrH-|K(X*=9@l*X#WCUY0<0Ik7#~}4hPhMya3FFVc^o0X7#Xy%x5cFx z(;Mf=RS*4E(|ozmCrV~@l&&fA4GCxn^xib0&7>>fad=C=l;%wAoo*%hzO`5g7M73{=PHBn;rHNg9j30wbts#R z+`qQXz2k*zdkHyfI=rTzGc0#7q!tr&uco`Ck{&8vt9~20pMkIZkcRuV>{;eWIcoQ$ z30(tc$8EVp1Bwmev-IW~pg1kj36k_f?EbuDV|p5|H68O>)`gF7Lh_>Z-zv+Wus)N^ z919C27eZ9RJ(R$JN_bF1=C#gWBwnuyRK+f)-rS6@fyg5K`Nb-`oc)e;d*}V}^-Hs}*vf|#b z06r+SzLK~Ad&7m+?z*69gl&|-6VHY_i^I&phwVdV?T(L*$-MDRJ+Ie74te}h?4d4P z4o_8{9W3D4Wd-EA+uPgvJC@=rh%9_6tu{?&JbRA+!8b?RD|_gEKfhtiB@D==(@?y^ z#e6Z}3?a`~Oa2H4l-hhR(5?#kV;YB+n$f*7${~u}TUF9Z)D^!c@Xe8M$}!PSAw*sQ z(tp>S*0&6@8YkFqwH$i6n)qU<{_As%_lY=$>_Rt)dJkwMXWq^ELSd^8dna-qpTfWw zBFo9k(N+SZAWb0jd37>3KFvga1g66L$$a5ZGWqvNh*$%jwLcV5+N)LueD!RZ+kE7f zik;*Ogsr1waD#<&M);JYx8PiygN@14gYsK4ab|u56)5Q2V0doyUa?ddBY|fLEhz;$ zPEcNS#)t2A@-DJ2yRm?g{eW5Zt`C-H}4DgDoyMJSV?4a^|aMIrhX= z1VhoIsJu?^dH>cGQ=3kFrKDKZjXzRFP34+v{hlsez8-o*7I6=|b71uZ>U(TpF3&#n6yUd{% z;Hgg%C!r*g&I}AWrZk}*L?||!l}D}wEkzJaWy}0xPE{268bib>m0dj*#5TiLpGk)k`#Zae zekqyY)=x2qmP}_#PtnT2v%`c4XG7;*R>?bV>?-$41ljY>^?D423mibhaz&VR4wLPQ z)sh|xE4N3je{_`Bve(i)ig0t9!xBM9#zw^1NfWn%Ad}okd&<54nezhI#hQ;a_46RF ze^eLUtqx>|qKK{~a_P=h>XROW^@nNlDl@p?!i6RpAKw@6L4+`#^|m_*H7iXZ)atI1 zW)?qwf#1NUj?0Tm<6j0VV#|Bq`F5$hQ_WBtdCT>B9AdZu&3#%yd~`ii<>9arFsd0v zXNy6Hn24znF`n@Eajw0b`p;{?|9$m0sWEEPDgYzj#)y<0_!KhwEDAXVZgA#w1z12ISj-bsFauGQKXe!h{WJ`i1gye?q;}^Svq;rlxluujl=mO*MC(AU4mz z$AW~lV4VzW?oAU}dnSSQKDZNQUh=SH*_+%BKh?zCxHXEKdGvV;<(7awP~Tj$sl#h} zSDrEYLcP;R{Bzx6TL$q*c4e8x-pbx-q!WT@qo!u-$c)2iin@_tdw#(5wT-Yd6|xyK z&zm)9w)yYe-G-E)6lo)y+#g*bTT(xlwC0EA$iMNY-*uM9H6z1=8bZ%Wo`#bNC98*? z^@v2^ybw(aj`boj%8O1GR@wyz7jkDPSaS<0o3I zmywP-Fr+JRJv1u1$TIp^%v%t|ykh&)+O&pzHLUiaI#Q6ahJcsI+c^VIKw7u|U0Bft zrAU|!f1W!?Qh>_#hgn=NQN0eF53{>(+`wyH^-875FO*mc(;5bfF)$c!=AmTZC|2FNiwz#BA&@l4ILK4Jezq)2Yi0lYN16!_tpFE@EAuhMD zHXhNTiSV@)a$fZ{Vy@rba{Kx^i2JMwg?isKf5ic={2Mz{>U0Coe44=n4Tm{CbR%2e z7~hBOFJALn7}P_NkXIR~6Ue~^d}u98crd7VVKl2ExY*JyLR-t7p2e|T@Ix_!uDhlm z96Y|4(CY&TTvW4k25U5zqh`)_Wt5bb5_ki6Hv*beT7!nQcVq7AL$Kh|H;oYHhf8c% z)$;cfwVe>;jD2za!mscrV2<~)X1J1i|V1+H# z{=Bn;?f8#Rfp4=O;SWWyJZ}rUZy@he+t=EQ+u8C(;)2L9MLRi$bF#$s^z_a z&W&| zEWvaoL!2KkXj0InpZS?3ssOs#M*6ha6y9=1FI7pNHOd zaz(6#>?9x7wq_4|lZapR2hVt>w@Liw0I(2x&GK8#GHf^;2yTLmghIHCKr5ErVFf#G48qF0VR6Nl}XYX~=5 zN?kLc$~w%=D$9SUh3b+@!0lmg#7wc4d`0YNUx?<_>dYCnph2QRf;hdZ(B!SM7 zL}CaIDa(8vGF`cbs1!|?7A`73d!CU_;aSWM+qlPNU}8n#EiR!QFcy6GW{Ea~x<>Ct zX=T>7{*HNTBlgx6L+X%?Uy^JY_slHa`)xRQ#;cOi##rto*6M*CI*gzUSfF{m`N0Z0uKX!-p;QuAt5w%0B;Ic;qrj0`oAY9(GafoB}rOA2=Fyg!^D2AaFb&HRNE=P zzawtgeL7Z9_rL$&n9O3(;PIc9T{cQ^P0JfGE}tW0caMI){R-psIm)gt#;PljKbR7|M#ThZ!%YluWHPG|sM(si9> zS0`e64mJpDwj2ngXEyS^LQ(??Z-_Y4$9Xce14 zm@qGTA5{vDTdJjEd)@Ry-DOev440T+$T-e?u`j>L$2;2CVUl^74BWQL;KRsFmD0i5 z&LB&BRPV!=4~HW^D^MTxi`?Ata)ZP1Er&KysrR>_r`qu6+n{{{rR_G*J?w2Ch_`sr zu2-)PE6NLaI?neI@cM*hn~2a({Um;Ca;;E7R<3O=1hi_hM;dss^O)%NA{M^JJSzI5 zd|78WIrPRX`)qn0(9Yfj@Oz|t`-@`#sbBanNja#FU8?0rzA@c*yjsa??O4Uuf3l-m zn#dk7v2^WZ9s|631k#x|{Ww|62Bq^36-09yts+(?-$q9whYBN_iDUdXv?Oqn)%DJX zc~cVTgR9$%J9fzLc><>n`-q|}5K5v(n*bAzJJ8Q3JEc^9;1aS?0GZ8YAYfE!=Q-WJ ze4YKgNBKI3STT%OI?5Q%st%l`&)XV1)B(9~2mSNdx9&RNv`*SfLMdT7(u?;eX8Ew5 zOC!TMs<5XwP0mWrG=At(l(rb@^S|P&?=$E<+!`0U3slJC7kb=vuY4Rj0O}B8X5JEW zAgp&Fn0n|%Q_YcshZ9$h-&zkQ?ru$^i13@$A>u;%Qsrj$&y}cK)p(p-KfXq z5ap5ItZyY!ECHvBD!@J8346(t#2HHeq(W$!xtp6Hirp|-Y!iue)??ql*-72!N&I15 z(*)f%$$AzbYrZ>6%1UpPR&F$vHE`FnpKoimc%NxsnJv#!;)i>}m3G0K%QQiEjNEO|1Y%%Tx zgv_Da#VL#4*cu8SvrBa6=X}A#FVUbxN-;Y6Ipm9U`LvJ~OK$R3u`bU8cSWJpS_uvX2o@k_>AjDTu4(Ky@e8JU2oggw`?&(HL z;8i+KM~Za;)t|8&uCWXqn3jMJlR3m72#J(d667OFd!c;A3G9kuubnN1Ka~^%f%F7| zn!&b{B;JQw>_S~F8%vrZzaSBC zhs!i95EXYk^c(Mi{T24_HSFJe!L$AWj+oqZY%AAUa3gtHPbDR-hE{LilW+(x#V`)d(F0 zqY`@XJm1FhOIc_gbBN@7`u;a4yJ)Pr6`!m(U*>WHCba}H`dES# z+T_tNj~#lLs@6js@$iydRIW>mvmg~$1dk>`Q%DGBa{LhGB7BIeCl*VhYQv;#kzCUe z_@tXPS(Ey0$YFg{Y*$s9%>+K>97{3v9cIgXV~h02P`qegLncoonsf@@`Aj0~w@t-o z4*}c<)e7PLj<4(9ymSmqZ>>Ye&Z1*%2U}Pdk;s%^}z0uMX?YuDvw6WMo51CLAwM zf=0mugJz0EU9O!yQn&5+fn+DXU8gJTTDoIq_CbXEpnr2xj}RT^H%7v63Q2~;{#MhB ztW~|C5oivKV(*GIz-p6i2!R2Ft`h#axp9auNgC!H>H^Psi4}s_k}XDS6d+IXxuYxK zFoJUMcA^n_D(psFM?v9@6!+0zt7Ct{UyCVY~F1M0Q6<7H%HCoab*z{ z$y($X26xuYV1G#Lfga%;+qyaVN!){y_?>cq|FYk?$H`C=EfsH3td$ z39jE#<{Uk|+2^o98YJBM$)$>d6m7bln+K4dSOo zPns+*TFl;T4FY>)*sCGn>2;d zNES5R4{!k)TH=;Es<5sYNQN$L0mKZiX+`UO2QK%%8e|3vD@K?>5D^y_cx)s@t5&Qu z)X}mg1iIokntALl7VO>BZ=;bmuw{PUS=QbCj1MpDglH5-E0bh(y;q_0ror^nn2^MIK*03LW-*tcM>B)bZ$AADm;cSWMwktBB^YO!n4-W$2D{~?D?%AGtUTpBCprGJ^@58?T+WZ^c87L5+t&Ut$ABzXA zk`o*Y}Kf-79 zufJ{?Dhi$6DG25EKO}z2P zY+9`DTlC|`mb4OkavF=?xP4ip>u6D(&N)Wu%l^msf!=5i&OO@j&-r+*#44Fh?DWU4 z{GYhrCcfOMKT6iRdt|Rl$Homk6|y-Oy}P{=c0G?b`7`3S1ORa1uhrG_#zsb(8Jc2K z8f$Ges~5L+M@%akH%;PSg2ZSSfj^IgO!!YaqZca-8Cv)L*scJ}$_l(@^FvO+2u+M- z<99g;I*h?L(bGToQCfKS=!RQ=Xr#(?ahdJ4zCiURnh5`hRvkSy9vK+QE9FyoLCBn5 zsPL=KXFTsZx0{;fvsFg`lgnp&SvhfsTXNaCyt&!;!!jxX49Qdverl zeLQs;qN@h~Kwm$BV)9kHqn1oo-<5+ZF=?kWf`dNOA6SdWcWT{4%K=q+x@!5YK!|eF zwiw4l6ReEco9BQr3&H;CJNIDUX`OyyAotzJb>Rjj412*%C4U9PzETqXnVU{y3=~&Z z9Xxpg6EkysYr+VGit}*J{JXs`*4CfWhIVOE!u>A(#Jjdi7tD}Xvoq&<*4yFEF+a;y z?fMiHM?Hgl{KpB@arcD0PZ{sEw%s*wIN05}NWz#( z@*mtAwq*mz008{^6~Ff7-k=aflUw&q8GV|12@Ht-^XS9%%9j#l@fFdj=U0D9qSVHJ z1=p=UdQdSfY2p_rMP%dASDkPBRGV?nk9s{B%FF%z>b9ilgM2~q5^t^+FBOx${HGFH zeR1oL^=ZUf@-8QX0znF&>&hbhGCwe2fUb2y%7l1lboE~Rn#RCA;LC-kK%|B9!4JH zTiCZ)w94%y(M`#7sr)V(DQINEN+6 zq8KIVv{Na8#x2X7UKI^KpgBdJDR)lomOc?}iuN@|_i}1fW)r&oT|*7hu@CUi^B-Ir z_zA|8}QXE54EwFT3&JLVvbsSYc5DaolIS&#iLvPn1$-u z7RKJYZYmSDkf;t^p~)zW0vfyAT%nVrVQoRBOwJ0wjrm^3AD*h*M`Rw-x=S8X)W{5I zyaCK`JSgClJv%;pn022Wy2|jeQyJ;OJfHYh(pi`^yg)8!C^w~1R)e3+E|a;ldhNnM z{!c-@L6)cjJASS%MIJ97Z7lJxxk4nRW&8?7MvjY>R%9t_^xJ|@sb)K6D~d=}T^w>* zFhL?f3F&R6`Mr!Q`A%XCza~_xW=SZP2EBEpeTUhwBuCB=D)qNd8mueSwhrXh1x}zF zYT!bLOkWwN16aq|@__N8=57|EmUiwu!nhAAZG8phmHAPMVa2dpZbLxD>hxgY12)& zRBsbK0_VgSF2`-r58u5Ux1(!j{m&tJTTQ5ai&ub(a$yzWiC$NbZ>B)aGAsPv7vilr zpz^NQ0}60yPlHu%#*iBRoth;@K>oOnPvEu_Y_dRW#kt(MA*KXsMDG=aZTyJ|9b~>) z9p%G0u_b77XNfFtVs7oh{gyv{8b^p2gvub%Jr)~!pnAeFhHRMhD6436WjpmxeTu$PO9u4p^+go!O3+G$v9Q zNZlbFgJ$S+WXawivEPqH;60Sd#y&tzVE)*)|9vgLqsLY(T6P z#X|=V*4QG~dL>!E3Vp#A!XRO32>eOk8ku9<4Xw}jDg)Tl-Wc3K`K6$758maG*-oa% z-G}6`>XSq?vBiaT7XVuW}Ewm}VGmQr?;u zsOs!UpON4~xILh=c7pS%YYY@+z8uuxh~%zS z+VunLW9G1wIDG_}HMAnF4S5nkbYs8Ly}rI*tR^s}Lt}omjeG?{mw6_!KmLaSVF$}y zbk%aNie$KXL6|r0`7j^-35SD7tK!^h>~#3<`tDQ#LYNh(!UgG~ z<&f={oB^G*lu8$xvK26sP>JLE15YS-%Xjc|&9B*ec1fE&+3!{X5xC~3O1h`kx~NKn!vTh?&8IlV9Ppp~=d?T;;W!xQ^%E}12O*5dtm zaT35>H}5D=UGB`N!m9yJG&mAbzYzY`L&dVvrv6MOX{?R8d{xxrPx_|NSy<^XaqZyJ zfzPNU4~o!dptuQVT38Nva#)<|R@5Cag?ycwQZtkoJ;b|LC_llHX4Y51gLpBKnfmpx zI|oVIJv{`uZYC$Dr0p6+kA|dd+T`^&AaP$e^YtSQ-TGq3AM}#^B4SgHrxSYlkL7L9g5RfDt@OeB<@eB*7 zz6x^%lQ=a&ERI6-GBs|glK~O-o0q&G^EO22>AiiA1l>Yh`;JEkM{c>NxpK<_ zcwque5dJauG@%ivyYer?N>mDOqvo(wfj87`= z5yw%U@V)R4hxJ{G++vE;cnYLdA5|g1aL}X@Ks>v0NrM2d?fVsW+CfzMQA+M1}vl|g@Xft(a=?4!Wu4-lHBE!P2)xYtf=QI z-A_>8$$G5hKR8}}ES|MV2~vuj8%ye{|5B_os3RH!f8@??;9HBW+;#qJrmk!uO(|=M zJ7xn#IwNKsL8Z_^W8`|l8uYmb#|BjVdH9rLJbIIm)Ig&3>qL;zh`ieV`1n$&=$rQh zoOGAX{en~;3Yz&%b#$!>cqVtq>(x39 zHVk1sqqz|_;lP&-NRo%oo6p{y|8u9#Nvh`x;ufJ8LF@^|V`S z0vFN4*$uYS2&bRJ5Ywvi-yul|rNXy4IQ$T+4-u*&&we}_@v~8e!e<{|PVS0>;X7F8 zEWc*h9;gc|D22my;p$ND4SU7~Um!b70N2{qZ{jT17Mtuco24@G8E@s*a}JY=gCYd& zvvzs@;F?pRpRMfOgd+dXmZ8O*&~K}zPaPNk9d@8?_>A}9O+JA$wvTtDl5l6Y&~CAT z`i?@)Tg&2Ev=*-_1tx-;4B*=r+~ReI2aC%)xLLbCQHm+nNmzTJE&9;ScX$Z9nVAKP zWLTL=T;ACuYpP?NPg$&kEg2eH95lEOuAL42i(=4R-~93nP=p=h)ECl)6O}>vly;cp zX?j@!lNy8O0tOvy$oxQJ)RMx+ZTPn;Rc_QIScH)Fyy3rYIvOJJVJFn3$203b-Oy8Q zeOr^3xOp}=nJVB_qxMLLzpzP@g6gh4fW&RtD5>@`lUAcKY>y_U`BG5Vg^)xNT7KDH zD&bEOIRa%Cj@beiO2o-JE5Nn_eSG~J*SpmQ4G8$YPUxsGjNOihoo=Ni)*2Mb zZ3~XB(g;k0R+>G*na!+@a=%c9I}9_Ip>Jdjsn+I1XlT$Qn9t09@>0WSIwelL593J1 zi9hu-m$}A(!5e&Lt2Qv>lCik#zGVCT&v|qAz5FUF*8S>CWqv~3MNOhX%TZ-O^7?eB zkBYd=OMCuJlD?*o<_s6|J~I73bAM<0Z`6$9BUD;i`qPeiG0|vK>Sq;N9)fgvnbDPc znS6$hP?&zft8(l2(83BAzv&dW=rREmtT*gSc7*!Uc>WkiQGVAyH560K{!->rI7A$S zycfuHaD(4)2J^k9xmd={E3k9NCW9784-3K)bg~A-T^n3Eu_r6A{88p@Z|_A#3pgKQ z$H=IFKTXNvSV%Y_MLx>Qyyw|>4w8Fpg3^~S*iml@GOKYl3r3Ub7)*24&?Pa$^vedc zr9`4obf_{num1+q{Td|$c%xY%hKg=p-}o!@(}8lGHv#78FIMf8rZSz<2Pl^?0FIFP;_G(W8Os)Ai| zdA7VvhtkF@0LG-O#V$E=^!71pMVgQ_PAje;tcWwwmAJ&Oz7%>wJM`FuCfO;Ig6}GQ zqeEWdy-uXy8FAQFVAQO?@x$ntHd>zz0q7-phCFo1pW;A`WuQoRyvqaK)L-5iOl>(Y zmiXQuEAhFUdPP9Y;4it`_kV)w{lV)Fmwl8do5=aXls0}Y|JDU=F3!Ayq7s3t&)4AC zRuX=#)5CDq_nxbS>~Il-UOZrBU)A-tTrg0I0{zj3<&?<@SKw1A zNGN&al0T|nKU!$sD@j1QSGsRlIsmXD=6UbG8u#+JsueqKe&4SPS;&K9xs`4F+kD#c z$|vwP*%N$(0Z3c1Y)SX6=@a>iPuipvqmC+*i{XcVBU)0GP98;U? z-AVB{y)*COpk-X$X+pP zbdMY8)bp^d;?Sw{@%dhP>o8d-xi3M2sp(e|E(hE$lVjc~$*XpDzsp^Qx0lu(oxf4MuRsAK`ho#*7O)xyWr^>a$FiLWxehd3)X2AHl zTkqjq`M)qbzD%3h6-W%7GGF4e8?;CFd(mudKb)}b>!8)P-Wb%|4bnwIWi)kt8~yHF zL*$YJ!FS2uXuWv??WPWsjE-8%&I^)6eU04Vu$xX3IHHr7c%8M&mjHg4x#a+i>P(Ip zyF(o2%@FgTS(E@Y!0M)n(MnIzthNS@kk zVu=Cnf1kmnF7;5>eK?!BEF|v3fI; z{kLvz#KcBQ>>{V|qd++^K})?GJ#6uu@8u9*=~iP3UZoc;Z4&bv7g5pHAn+3orPhtj z7eLDe`We5Q6|N_`xooa)`T@pC5;$pVYw`fywd3m z#+C^=oz`*lB~a(|HT}0Jhf1t-grJZ?)08i_$=+ES;5NM!Hoh3W(h1=m0#?#p^k5Xi z@iJLb7!4QO<>fHKeNC(9%`#6B_er$<$N|Aw1D8sVhVB{(RUHMx&pE;BAZHk*Ll|OuTrkY^pBXFdOj%bGPZ2h^*rFe zb4%e8H_wPYE(i5MhE@_p#KH*3r3f#lcq+XrGWvpft*Sp6nASCjtAx{TK4uhCz+|1P z>|Uc?j10%NP9nz*XbW5FBn~QC!x(l4=-orLf~;wdzSDl8_{9MhXt%-Pl0eePyaZsW+kZlYImlC(+eH8S@U_Eii*3q8dR>u3xW-FL(I4SJV~8Cv54LO zE|9*SKdq{&`Z750+})lR!7XVoC-bm>fXS41N0#G zrdc-IJz%isDqJ<3@m`dBbBliWpa(m345>ftztXVmoFNV~^>d4|Y4}SiDJf~aUnVG& zUO73ruA(iJyJrm4S@q-i%P=yRkk&VB5FPYqkLz-suC>wz=U_>`4o#N~h;Hw|O;t9d zTeTI%Qpc?Iam|I-_nPG!@uXT#ZBP}r*KFG&U@YMDJZs7slNY6xpte05+n~j%MWNO` z`@MY|sPu)?Q^<|hjr{g@iKFhJg`s!cPGu7jZy7hQ*C-pSPljmypg91ld_x*XhPJM> zo)ZV<-VImvi2v zV7rS-?+I}`d^AA(n!M4b%2{7QdWNyn2vzK;6uh~LxD|x$?c((mViuOG;dl-TgM|}d z<%7VLcCrmzKcyWtT%KJ*3HtC2*T)f7(2a3$JT{cY?W(|kuPLv4E`}4P@ipMU_eKrL zc^O7IFb0!sz+!#x$T7drMMBCiJlyh(50FiI=U&0c|`!4Ys0ctnA^8({VLM>!w? zsKPE*%6N&h>6K1J3vrJ9MJ(Ou@qLF*^WskMk7^*(FGo8j68^Y2{XqF^t>5@ z0DeC$<1q>#NPSmSd)n=53#DI-6KW1#BEK^>@L8HIDvdrkOeN22KqO=errI^jzyaWB zVB$8A39|he$IaVnTnY4+*aqwz0vY(q?72E#;aEO%XiJRaKhNiASzOi9x0BdbG^U1U znH_E1a-v;otzEkCHm2pb)drz{vA!eVBENL%k`;eWQuU1GvP9`CW)dzYfp&#GyPLk~ ze~xXq6=1))wQ|F%U0Ke(s}gIcL}9mJW(jzSSB{bgvuknL4oU_D$;sja0n8|N*Qvi%{Vm>H1s}`L&T}%e> zTAuMNV>Q(AJLgKn++h$l4yJH_`JnJ}l&%J)fGb2vhjw|fy56%$O z?66~8gV38CQM8fZmo+NupMPdkj2>B#Rcj=x+sfkaMKa4-R?k=FS{Z%K7`|dERs5;e zw`8U+L2Tgv&{$d)=j+d3id&M|u5mi|>T)Fd!6DCn?N0*5!~3ozb{~Lwxz|Q5JMVBk zxLC}B4I34h_(c&NwdwnSlJv_q3@10D;!rgYzW$WNLc5jXtU?bNEF9Vb*xXJko^(L7 zI1c};o|_;=5e};~lvuRNK*G|KNBli0gN%=Y3&@f;CsN<{NFb2u30N~Q{NButlwFmi z>wsULiR^BKFpLdJsjh+*-7F0oNP*#yMJ1KqhQ$&uO8 z*89C*4L^{XbG;y>+-95WiwdI|z~IodTGCrn(D_0WY9-;M4Hq`t)TPg$T&)&9O^J1B zBqz6*guH1;o;7-;mvv80B4%u3&)I+C1n3S!Z!PGYwOh&CCVnhLtu{fL9WjON<;6YN zF?!M_YS{b^@^Oqu0Wq7b-3@xRq8Aw*{YG5prdy^9g~G+DDe>w80MJ#5?%aQt z2(jcF$N$dLb6R#7B8A?cc5GfaRrAk%6rcW|@E`t*C-wB>>KD)}|MnoC-Ld(w;I-L> zA0vy$^ZcJuwgQ^P@YGlFWykL^unS@|=$~5z0QhkJeJ6c$0_Xl`&-#gZjwKMFS*Plz z9zEEoA)WsDQozsK9*fsrzrn{!9xij@Pg+X;@dNS64=u**eIR~T%74^P%LsoY1ALs% zB8$8^@SteB*VU@(Sd{{pFHgw^e8N5^B3y7ZC)0Etqw@t>k%nV+>x4UV_EOe(XE(M2 zz5@P;Krzpkw4HOhMPo|Bq{XhwCPh{oOHkFRP10Y?>ng1mF%WJsuvu$;O&!T<6;NFo zZd}nxdW8>fJznsEGLn!P-^}Ces)0cnMSu3KZYm~ZjwHG%&7W2#gMN0ETZ*C)w zUHtyN>dnqm)xBu)waR{a z57hk>ESU;s7p(<9el`KJc9xC^(>m{drcevMVshjYeZu%L6 z%5^AV*Hs!EJxZEKa!?U;_E;8$ZMoL;F47LRzxp}k{+F?X)(pLdZ_M}N2yzx7e_K(! z?zV`j4iCisGkOV>nh)rD;ZVCRK_TELSgFQ|0>QqY?GTWzN~4;?ps;oHX}j4?un0dLEH12=Kk!3Uodng-gSHV z&6VUvVKZ-Qrz!uRU{F~8LPOhM^w-G#)%+pc78ITv;;Wy#lW>=eA#d!d8+ymJ0PNxAI4 z&k2%-A{n)GgO@h5(TyDe8|1_NNf*SW zWMJ6%zT3(F!P$2PG_`H(VnGyC+|pD8tn?;g0cjRgK%^Ie5EN-rrAi5*s(=cLbV%q( zOQ=Cwf+(UydM5%3h5(^RLV$z>-b&E3_daKz`|f-BArg|g)|_+9QNHnwu|jx~oU$Q2 z?8y_B1Jv^>(_aV#^-!Ol((bugVRom9W6!pq(hWV#uEI-~2W?9?L7mG(ogdl|kK?J- zNN#fmE8bBX=T`6)1TNWhh$YcwM&75Nv)d2woidCQH9>NJ9pY2nXoKaW-l#>nA5J21 zi+C*33t+CV@6`-d1~q9NK9bvA>HASRDnvgz>{5Q=KF*M+PN_C`A|mL65lL$fjz?t?&-ySye9=p9(wci)VMQp@>?G*bC|Vy2=%^%Qt~mGiU> zADA8jP28+%YB_+}e79-QL8)v*<==BXFiMj-H=LlRhAg+7l!z6bkHN@flmJ;Zwvg&a z-7!7C`9pJiK`FLog!BQvb0`KcySrh0d2uLByFX8BWMrF-5C2@0SUhJ0wKzJLSX5-p zNd3}f1FS@om=PP>I2N|^{*w>-&#^H-fMrbyV6uv38&22oFpM`MjSS(L1hlR zH?2<8SA6QZXIlfPov9gC#u4&sow^g0e2M2&D;*unZgy@u_40<0oP2${plb^?1a-UU z%mi5DsRAEo)uu`UQT$D}x7`;qoYv#%c22CeRCL4timt2Uy-xlL!a*v5k6LFs{1E|g zjBW!-*USnG2A&?GwlzPonE_{h>AE>5?$6L8Tw~(j$fa`7TWWHgKb9Loprau@4Lu*i zl=7t<^AyKlocGnaRNYuuS|n91HZI!q-C-?0l})*ikWS+cu>) zl_F->@d6FS{6Q7U7<`-8XN?y<6AIduQW4S`xwwxrZ6^#sW67>_lI#%x@99A=lQyZq zWaa%b4VQ}N{WbX&yZf(N6ljGW#XsMndM2SimyRweC7b;b#ce@VNDZc=peY4DpqBgI zd9N_lu(no8A;MUGx>Ic}ie4~ZnZRzk1VTRY+%O6~z;4QG)177LQr8 z*)ZzdUeOdAymB`*B4N^yz%^S{wDIMxa~d*8Jy*DkO4`Soqba47b=XP6@K{q()VOeIzp%_>iD z32$uNN_NiGTDH}8v51#|k_F*Nfj@u#lnQ5KmvFZ~Ya}FQ2z~F|6O^jefCt znGE*(+3z1cdSnhzRDpfzD9xXl-SP~wbb8Nh59w9xUyRyvRO_ey=BRGMat5b;2uRta zkakbN)QUo$3yX+2+_-TAZ)gXFs$aTzQ9Oy0xS__y)+A~PP&hA?Bnx0qwV!t zr`eI~-T?EpV6jE7mScy!Di9``-pG9O==nkM=6vQhH_e!@FJ9iR$pm13@6n$tQ$|@9 z=q+SAk@NrIyKPPSe=jV6JFxXiF8qr$D|FvgVdB_V96Hh^2&P_uI|wALSv?%4vu&5d z1|fit9@4uyQSjBaVw`7aFAYQ1 z?FCxZ@r=v0-dTOSP}iFGunyq)3U1e|EU>+nxw}aeAcq7l*8?HSdA`u>iF4YSyVIgI zx_!T|pAOM|zlvP~sKYv$jx|8G_V+aYe`fw~oihQFhPP3`zZT}uQ>JS`C;iQjKk=W} zLyZCCaHf03^LAxqIU+;jPft`a@H^L^BwOZJ|M@nXJ_312q^^LK$K_gn;8Vq{BOj8n zve~$%Hq0UXaFZ^^_GpvrE*uXbArYUU_s&X)Gnw;gvJF3*x3u|I(aHTMPo4lf_9f*k zK-gz7!nraq8x@}WLEg`-f7a9Bdwtm&@H5nXD99{aZXD2Ye2pfJrXl0SVoo$i3{_(bo?`y$(YHh~IAJ9BDPa1w&a+7{XQZxV>v2l>FA#GC8a_wUQ3_GlrlOCM_2Tu*jjMUsvn?qBp zir0U|1~wMIDN#-54dSkCJHdWyV@Z82(C)!yr_O+h9b`&DdzhJ#|LVG$b%))s;076< z==E#IyPh${VIq22@nv{;_>Y|~JnUi88s0?crlT*u)-tiTciFvo}4AW%;C&Nm;RUpOoJMM`rC{tZP|~S;sZh4|$mD+n(?A zh??;cA7E35xvW=bJolWbPe?x- z%9vhE(1}Fh+FPh5d47yC!Z#KpDVAM^Na%WMBDWul4=m7`SKb98;JMj{FS#>22jR>N+eWvSIAI#8^lfebk<3 zC&~76qs)03BoWyu(f+sn1#mwb2XPG>!)=kWoQ`X_0g0weEi9*sx9Z?cqKrnCXLiLy zrQ*R#MfQ+qVTXWDNy61<(RQGQuet7*p7+Sy{DJE#(5vDe2&TT$QL9e}RCASW=4X^x z@zHS9w{-JkUr6XYIZjI+1l`Rp)>oX-=If^A zXNIzS2i4@Z(0rREj^a0u)tw&E zS9|jZhqJfOD|SKYLkS0y`Wq4iufB`!OEBQPUvlr}rBbkAOszWMXO(7*Y`z6UR6%A}e%S#WkmnB>CY!}5vMbCbdg#8}#eT%lPUdDezl}vp zmlWu6Riz%rJfyHtNEdI~-It`hJ{9h&JHK2*Cre+fMljnQvazLU`*}Im}qxrxF?&&7XYZw4JqiYW5Z`l~w*FnK8$Gk1=WDd!kT6i_0Z>D1Sv@^*Htxvu zD3{N7Re%gKP$hz%yi9&`R9M(v?$Kxg_VgoKrfePODIY9KbY+`)=yMdV?ha#P#U5mb z8z=yh>vtQ7O4raOok-k(zwL;V6J+m9ysR2q!ofkDL!hZcklS9RT@T^eB)}@2yyP`? zt2W|1U06lP4CH6&+xkR30WzSfc5?m3=C@6Q{Ov=Ut#CSS4!J>t+CeuLA@(RJvQyG1 zjS(A5->kqemNz?O(c`L>g2>vcTP>mn8bJNc#<2Ac@Df;ySZ~M)H%eV%RHUJKg4%P` zpXP5*frtscw`+t0f?== zp=pev(148e=g05m)iT25db<`spEsM8`<^;GU)h+CcDuBzq7D6JkI0Yp$<=Q&k4AMx z+JcD~hJWo&o1{^y1H27$WX8D{P$4k82Q{r5y`5N?XN$UQQkm9n-co^aIUH5}zVrHv z!k{IQ)r?c<8k;0QzlSpmu9%ta(Cp#K@SsbAYe}eYkJUbnQyrjGoe_C#>`ybp!^y2fKjGbnBmus3XF)?h|s%~Z{+ z-cnKMWUDaKNc|yhA%_N|fV5}`+AkX8nlZ~duJm9#T<d&Y=cs8nKz8p35hr4a-^Z;3X*{(#$Vw|_3d@%yW zoysdt%yzvKjI*~CeEwW$O|4f?s(A64ge`VklM~?8+Yrpl#C_PK)Y6?Yfc8C6$>u^q2Bb-wR}12W7XMyxzwr>Z^*PRAZpr2r^&db z8HqLrh`lRsg07Ie9>WdDuM?FQn3~cz9s)l^Yy7xfc7^ew*NBW4q6(U@>Veb}i`A2;yKg2HvvH)9csYC$iTUqOMrD81Ab!M185i+69$c->*3xlRmd)MO-e`-^-mxIr{oUjgBpxlE}=;e6B0jzl$iqZbV;k ztswMSpp&=D+e+-_TU_O>gT3s#@1n$JF1B5B_cXHF@K2oa)qQOF04BQ))B{gtt|tJyG{aJI*xsXz;y#6)9FZGs zZWqOM#%JRY)cMxlE=$6>rJ4?-5Ye#($r3pn;)u>+%l&M(ne}N+w-3?c?!>NNWde3T zfkvKT`>$4yT7Pj{MYZ`Q9}kLi{6tP1_@3)lKUI_S4S=56GKH95Gwl@+VrUK}%c&UA z&m9K78!|e%gUi=Wn+H^$-se7%q@OUOZs9sV(K zM@a9#Q01r7zIN9;>!NnB9igw*`0$84>#j@AlL$Fu($s{S!M!A%i$&CI=DL*RTo$Q+ zA1asQ(^k+FA=+-aQ3z`}srKzYu2+xCGE5~Wf%f9z0~D5Q+Q zW(9DG_{x<-7zAj&jOB2C=5V83hZOH_sLO2BebiOk0LU(}FB5v4+&RP!?v$Fk{ ziz=%8?9X81=ZLG9Wc{|`m0O296X^B;jr>{!Bx~6vN=(t>H+~|wW?P`$cGEbDz;1@|Wh{Vz& z_Fohb)&zlnT+T2aYChP`j01kZ_1{XUUoX%rF|vfmEWr}|y$x)YtAIcL8sxu_NGBX% zDwzEL#aREZ;KP5xO#TDHV9mjX2qY~;nIH{IkblkVpF>CHAODKNG~N2Q3T{^Aa_a21 z%)b=nK9NrrVYXcHpk%|YQRR#3BzC7$*rj`8sy*W zt%ke+(4>DWp1dplJ0^4=ovb7Nu3_HtMYg#dQTw!7BNLj<%64pP@}*)YiTvZw7s}Vh zmS^U|7|w0RE)~ulV;Y&$yi1IOP5Ix~@jxSpGEO&Dz+d&a!h1klcWe3uk$)z`{%zHM zE7o&DC)qCQe!Uvt_w(5aHrz7@URM#Afp^`b>wf^K!P)4KlZQ2dur=G2g?W`2Na`U<%=UUNN49HD0x+B8 z7FGecz|T{+Yr^Rtahsb>6wPDr3Y&6^nlyE4J@5<85=`_bZu!f((o9 z%QMhhu&;RF zI7Q`d=#o!FB(1M9h6H=#cLRa$Xf!<~S^1?dU1D!QsdT<%V=9)NC`qw3V~)^FN!@dn zK*Ul-DYRZn)lAVz_ZzXw%_{V+6%2V5Ii7!HOMH0{P*e^)RQEA8YWU|0Qp$~l`{F{|$iNqfN z<_I;)Tv1RB&pINvK`+dw+qtEbi$8q19Le`ksS05w!WEmrA02_1v;d1R$Cy!Wz5=2w zm*!xLeEM+5@2bu)ADGefnWfS~f)9o#Q}rD-^w8$1!Cis1=CV7T++@LKh}g*RG7Is8 zb-Nsi#P?r7_|q8<=BgBm#cnR|{^O9@X~RzDk_las8`*4lLV}W7UR@$P6TfC#60~`< zhw<5#Zz>|9s1GF*w|`&iy_HZr|MoFH*BVvYkV}r(1ESnAcoN~S$iqKvc|#n;Y>eWO zx|I|u!|OZ9H_bdQOFArx)vW1A5WiLl{M5JG!$ZD|yC-pA|I~y0w*GS(f(T^Nyb&69 zV~@!_Gu3t<PWFjK#W|MOobh3jjVN{yfY^9xH6=KCgLLkQ_$~!41 zT_$P!%%tTTBv(H+G6mO`8UQPUskxe0?=K|m;d)kl_3>c%-DQ`@eSc=&@3O*HNBRNP z{;QoGFdg--WflkuG>cW7scd3Fz?>@{8wJ63OCB3RR%Z`=-TN4sN39G7AaW@Q_}uiopBP>dd>>m`IXS%h(jM9*nij>SWIBz*tG8ymtx?I zFgbRm;}-yq-M`_ikv>rPsOHWd`AD+{3J~oE2l=h|uLlnMSyNN&B;|z{ag#p-4-_BM zk6>e3!>Ljk{bfb=Xnv!-L-STI{I7?@-(_3cbk*0xB!Jb{Gq-uwre- zddb;Jfba4QT6)v`yp@@g@{PI|&Jaj)7op)M;jpQm*`@oBEc4%7{n%gG4(vAByWgkA z&M#=qXt-sy-obbBTvB2o+wCJ5j`A&SAM!`^@wuQcUP?xHWb1q+%a5-4&K#6Zcn_IT_B?Vt7msjOYS{llb;Ak!ZL68c8s?k}zbV=OvVYP(Jk~C#9_Er}8zf zyIE=!Kt$PoS)5%SSBEI&U6P+my-ss>&v|ys7~g6B5L8xe&KVJ2mRjiPv#;a-I-W-3 zR0sVHrYc!X#(}eXP`mb!olfozCH_h`CkaRp7juV^De_*HcZ@pEmcYvPiI$wq5Hs%N z;Xh>dWG|9q)SIHO0`hprj<*1Aj9Kvk{0Ojo;dgxp+~P}o;#u}xjX2^SoK3TGkN*{> zR(t64>1V(J18A)ppe?)wOgRx&x~?iRdr7BzE>SN5t8M4s?#?vA0NFZ3;Ppj-eQz6B5kw2-;3+W^!ul8-F!-O zseO~;dHhl7O~raEX@M}s3rR?+!Pe%juXTK2Dc=B{vi1bbbZj%w#y zmLAmwszZPS7m=>&r{g(diY?c_a9i2C3un*OpKedSJnGqv?M;$WG{Qd+%>2KN*X1@` zj0lWJCgAJvF7NULtX{Ol(yhc3xBJsPBkhZ4j_3tL-JPX)Q z9@M)CA3$f$0tb9@Htsu15YwJ*?Kigd3ME#MHzS}6m-k~fysZDqAe$>|15p+EFo#E~ zARk8v{BPz+K7@!pmRTh7PPxEJ!2W-*7=43z#Oa=a7l`vWm17SUeb_nzIG_U-FkhNi zc=q0a0#XERpxdrrd3HXo4CXETY^v_U*7kaHnIy`eQNIlwF_mE8L{tk6mZkS$QOq+c zpH&Q_1;_v!`%7Vi@Odx?D^+0FCe$yh)D~*6tFfNAM1;}>+&T-geyu#(C!&YqUAv&Z zVZDMMU!l>(Xc7Ss3?oBFUqkSI4R@7Pfkw!=gILS4I|)m;+Kv7iJMhvR zxE)40d4X?F-dmZNJd(pZB$O-zO$RN_V_xZ*F@EA=K16y81rD32FQev2#nvLX0%V4W z-*p$)CQsDcB9q+L-_;~YFsC-PmBAUi?b~Hp6iKVoe-JY0%-rMV09w^MezZ)P}0}UG3@7Q ziYKEO>Ta+o)Hw3TRQHtxeK6c^k*eV%i&^Z56(g@HkJW!V$&H?_Op2#I-=x2rJFUK2 zUl5FD3O`^cm?RnN#LFib9^pmr)*jR%+6>$AVLk~o4c7!I)u)zw2AxH}d^NGI+Q1`g zRWS#zm}vsFo%!fsxl50lAXut&;MW}41(O@eH@Hl$Kp-Gxz2vR}SYab!hlmWJD0KDw zr85_iYQBu4-u|_+UnV>qLA7f9!k1)t_kdcf(Q3@04Sncqa$iw<52!8}fa4ei(9I8c z?}aqk_Fle20mWR2sYnKi!yZXTxBlpLXZ(n-@akOanR~S^&`Qfw9}lKje0_1RNO2yU zHpXO`oyIHq^mCh-@wHIalwprr1nkur?wAws;PnD{y6Pr4c$n1CM`dP@T%-UDWNvX$ z48XcV9vwYz{-;h$-4#ft7jDm^(d50%{I&4@=DG znJp7_hlAbk!>)n#u~*K{90ZU$$BlPPt8z^!=K<*SFDvyI7i!L~lUhEjeVjcKwyw)9 zm&9o%YrTW>5Z-L>xxVkJ8x=8?$a;Dx-jM%mn5-`Tz4FM)4Ku0FJR8&<6=DfEiLh5Q z0V68kyTNgA_~T+Go35;s*;YvkaZ`^+>Egwk09S=g^w4b|uKwf)$;sR!{5qi?@@8jE z5QuFf9*{;CI0-N*SIkt6`i`@7^y9(ffM-Z4bO5=qF^V^-I}&#gAqYwB;rw^h5d(37 zqCcIkX=Mb(^X?Q=K@}7^_@C~!1IKYh8X9jTjQeQ{Uv$k@L1p9z0c1hF zKHa7Fs}M_i@btU&)O%_SnVPRJA?w`ZuT`h+U@Fr4U~lDAR3pZPKS8M`m{*`xa*dsP zN4V(SjTlEYy=&FxH`r zCFhgc&a+4HOAMbD7#9Nvj|+(qO_=_6SyvQ`zHG&m-_^PwU#Gj5=TN{L%fYMesN(MvTq`q+?R*W}h)aEW%$VFlSf znp~8lS?l+?J-K@XHbWrw+7qqNr4@P>JzyX@{~qLzpI!4MFh)*`%-f(#scva}KWgzW z=nr;{k~(I2*bU~+-+}e;9__ih#^+I<8MCVioULH@O{`xm`&%p~wUxtymzPxYv^Tdw zTO^P@&OC$vo4<$B#m%ux(Z!d1O&>-N$G*BGZo!OPT5oe{Ug>>!jzVF2GOs#}kOYPw zU#lFZ)GF8d2|utt=nUz4K*1+?wUka5sZf*+@wSOK-Whkh5=vmsFlrvPvz$=FU1d#f z*JKuZHlbKuutPRhqQCb)a6zTA+)sbnJ;S)09crYBIWgEOet6$tkpD^|bhUcePo437 zI3cF0aAN z?VVBF&28B=m|0?_AoSarVO@0!1^Z;K0P(h5ai6c$=5zI*e8cS*)RY1@E4|~#8|)n&GgHxdGN)=3*R$wL+zNQG&@~m-mh`l zj|Ar&qZ12)wd6yJ*}5^oBT27y?yM}fg}fq3Y8dxf^Ily46jOnu3iQ8Uh$#-A<>fUD z`Lu3fb~|X@kRG6#i+R+c?Snhp&Bq-p7k@h&C8RsOC}p-P=h_UK~+;CU$C!Rm{LlVqoww;L?w_W6#{U(C*`HJS#& z&}MIE8hZPE&QrUFnTKBH5Pep>E{Wi`@#D0zk#gQDNo0ZPtZ(#$Cn}`W* z9{lr~Op2KrDI0I1c>|ihKRV*_@&588u=-dLK?sQ%E%7Mol>RfypUD*dt9< z@gF<%+-vg!OkcusPOMn**}9h7+`@&_aBn{hjlBJ!vFGDXyOG&Z#yfu@MZX5D?GMAm zX7Wug%`l-sQPu?O0pB|oaCSkIKC?XHO@qw7aZdx@PZEfq#hgCXmwWtQmnAV)x%n4) zIP*XHKeqawuX29os4-+`6jQ~_vs6r`*o8Wa{hzK+mezV4Fa-vO@txwPhRJ`rOFxFh ztFDFpHvb(I0f$FNun&&X2ob6s=2aars_m(IHu}A#6j2QsSV3cS5*Ob_gejY`u2FW zpN{cP_076w1H&?c=Vp%nsJ#Z*7^9;{j{;>FTO77&cjTeC(&wLLBX%@19o>D)kGC#% zK@&!k%!?@O+~`iLXjLnCtC|SY`XSa^n~~^~51Zv4G|X5+-3RT%lV^k_Hj57!{25hwvGMR zWh>-QtI9&F-RcSe5@g46w~=ZZNm^J5#w5s*ILg~@KhsOdwG8Oa<&)s>IxT?mI<@CB8JHj4Q|{Qq}R^jZrbuK zNL&TYiew=G@&MS!T;gsnpME27O%mWAnuILV%r>o^{YSHxXlCOBsW+-NqLKtU=X+#? z82uWx_x(?sN*O;He*qe{@BI1Tp4r5(%u&GA4XNF7b>B6=8+#CUUO1D22>Q`N)f23e zF;3|m4{-3^z z`4hExPe~bj*GnrU@IqwMQjMq1=&swB)3Yw0+C|{`KXaHiHw%nuPz zH+ymQ+3Z(pw8Q2ssqIA0H~o#Ha_kmKEwh5lxFxe`z-8{Qg}L2GK15jB_DM`d*#{5C zzY`EJyQzCvo>_Q-+Qtf1m!~+qCNGcBj=5?W1;x`tDh>Hnl}F5`l4r>tbIj|UzOd4)QEGXV0^d}n&J)RU1}|H*cd-6NzPvvHVu z&^Vd6ZWOw5h2Ohd0|osUTcFXIT%NGsRnWaK!_{l zA7#OU-lmOOC*|rd23k|Cj{DDaZdwb=SA2#M@}xFlN#G~}lREQT)j&CuY*@B?Kr4sf z$iW9~lSmh04bzvvHk-{`|*wU7x3!i^!1Uk8{bZND}s zJ;3N&RktrU9`~S8tpgfOYW$wx+#l@C%&$s;fYV#F3@>?l{+hnPG9Y zn?P9s(%HhD5{>V+sZk|=LWGqCah`H&!VS?{)oI%;iSQ*{C{$VcR>dBZSd&#x zp2QYERQy!xqdV^;SY_H6VBbY*%dWWXN+{TzH~T?`WUPE^cqVh9bi(GmP@vH-Kw9Pf zY$0;+ig{+?{>IzOa|ou|8ODK4bU6>G%5v^1q%$2DYTq?~H}n#bJhMbC@4LQA8vM59 z!b}|1t3GMp**qJlHf?1Vym_QT`LRCrEwd4XjnS`6mm)-PUi0Ja+ueyInD#PPf&tg_!a}H33c>Q4G z_{&jeb;gku)4;}vl-3MOg_12Kv=IOb?^~%}6uJtQWAcD2m?hIXKCP{-!`V;17JO8#f7%hm47gav zzzLDl^9$Vsaw>r82XG`8IAZb$D;(%lGWbWh5LlchkDbvT*}v$*E@%`G$g!CLP@h_O zJq6g2|9}e10-GlhDL+q5dszb^25=n{JqW1og{tRvUryEoDnmS2w7rwXu#5# zG;>4FXLmG!dcr?2h~0IFzoD*WMDOi;)#YaWs}Atb78Rgn zK{t|6zTPbVN&oapA#1(?Tg4|D-yPlH+r|QfSvibCq|RV>Ua1hsHI4-#LT29`W!@3_ z#Qy-3vXyXeO;P{(^yBbPPBW}f{dex>ub8U5-1pj~L>8|58{t&#G-jp0n31&&<5y1R zd-#WJ0Q+^0dt3WLn+Z^zH4$Qh;x@swbRIx3ck|TG0>CD5y^n<<0n4+8ht|g&;@c0_ zv^3lyyB_t1f4Do*<|A$Y>tp&%kBmojxsZdbNT>H)F@Hm(&syF{G9kXHx!N4i!+hL> zd?Y{=|FIJw%rYUD_&40!osS>oTR0-V0J@zHbxq!VcD+7{UB!A#f!%Th%Hp68YMRx99u(%(_}o4^1TyY=!BUd8BOE5M0*gGA~O zey@ei*{v5Kxye>yx*BMAk2I+5Nm?f;U-7*g4C33VWB7mtcB965Cx$<6Z{jNQtf0h_lRuZBs@ z?QAT2p+;~}1yVg$LJAGcy2trCW^F&QeIt0(F4tH+Q z41AG+n3MH`!L)O8!$iD}EH!;@^X(5WY+u_?vh&wH!ziJShb7qgMaE6vb&(Ct#laXW zua(CGi)sIqT!kGTBx zBf}((?(=)&fErU-+)?rEUC?iW8ql55A@jhK#)tMYsSPYGXLCeF6OnXArvB?F`X{{KH0&V-Z}ILPNRm1fo7YF$`czV+3=lS6(tCIJ5Sf2(;; zj{~Y@6Vut|V5}n5s`)Bz3_Z+m{sWph@XcS><1y67!y(<6PX(>&6NPrOzI8vnM7El6 z44G`*#+LzQL^74Zy)o!1iyfmQz>);!2sUT8Zbm-P$XY4qTi1n#wLhpV5>Fb?^@{lk z=IfvNEXn}OSE(iycq*v`;fl&9LEu@XnVs9WO33qb94J=Qrv>-n(DC&oi90LIvf@Bu zy>(K9Do!tmKqSM}Hld97Xz)uX`Iq-FWL=w-|BH(A_?yRwag{g`4@VgiD4oy_Us2ucTsKD!8& z9!vZS0o0mTqnu_qUmlV;IH1;BlX2Z?K<=SnYTF?kM~p6$zQ1^8 z&UTkMK?&K##sKgm08-6Sgr0kbHz~W~FO4Btczobcy=Otd&N>vOqX0%2T09mYnilu~ z&ukVpIHnnzoJB+Rnp+fcYZBAKGqqk;|_;A9TvdSjrhpg+X_7{EMstCLV=W(Wj7 zA>JBfo4s-!9u$Y!g|~P^X*W#2KC2M)SN{2r261sJw>dzkkH`<|POwm)141 z)WW^yKsvqKfeJL?+Ibyo=j*^6$?=`MLP^MuTVm%%cIBd^H(O<$2yV8DC zXSODP`%(mS8bQQW%;b*PFz$6;i!P87S$Z7==`Ec|rS*on?hFUM8{+><)Ma>|QGrTJ zDegY;Lz4yZ{O;qT$G?TwUQ$uH1t91)+y7F{%BHach_VmlIBbKwj}a+PH}${XeJH>_ zZai3}rBj9Jz>EH^HU4>RAo9&6`l}j|FJ~vwd&neeZ_j{SaT$cU5b}Ck2dU&a$j7#` zJ4$uq550D=@`kz=OCGKV%l=c{uWttg!YJ6j&TFJlIaR1c{^XSd%o3R)$nS5moAY{< zg~S7D0R55E^j;404dh>THGaE{+H?*)V1KN* z_yqZZwNslqzVcB}(`QrxoZnlk`i8om4FGS7{Z7Tpe z+ylimBU}C8fvc2BZfU>)?V5{5neP$S2KrZcBc6t<@$;6mMUoy=WNMnlec}i-G&Yv&8pxO{9kkk_zrXk;Id+d z4|~``D0R$6Mv!rc`h-k%c&Y|7MBTJJA@E}%6v{)+{0T*(&5`_~g0m|xEvt{(jJ84auf&;D*2 z0Zc*$ct!%VP=vK$<@;7vfX4zQ9{sqbd4F*`ZTwu{FTMkMSIn`xK1J#YlLL=9t&Zry zd(+RFU+8FTAM}29Z!o>_IIBA2wQo?6RY&B?>MFLD86bHB0n)jDT2dQ=3-zty2vZ9% zr!!;$SX9~%F=3GGw#dNIb)nL53NXF^b9~=t_dua1*rR|F=eE4)uxmiE29Nmm+kgvY zBf6V+Uhz+(i`${e9r%qPoxeWigw;E>kfZg!;I(hemB5FeJht9H=D=_*OvFBpKl9Pj7^r`TJL;%A*quHbwh(^9~JdMlNf;6CRvYr+>J0V6c^ z%|2|4qv&n0Y?@s_m3{fp1$QH;@ysX{N3*P>H53L}*7~>_rM4mJ+9mcWt$L5CQlzk} z#gTSr$tm|fx0@2}%DV`Sp9xx&t1kz{Vx2mr9&VtiUwElF(u&gcGut(rRsd!B)kp7x^7(puJbe<17Dbm<<0W-Bjiqqp z)D^lY$gR8LG5uho1Su^5l0d6l@TAc1ru0_0X!SkDPk7ord_8)v+9h$O1*(HxzM1lk zjG};FBA`WkU8z?`?QTID`T0xd3=oE|&p_II6JjY6@sc%XtZ<||45N;>!w;<6BG>4W z@m%;TLDv47RP035r6pMb-%l3Dy{6=c0$#D0JEs7y2VYdS%q)xA)^Qv04kxO-7TZx zfB2EHgR$Jvc<(u#B1q^fvVpczqY0-@qs1o%GTp!=Ar%HUk{3K(%rOy(vu3ZR;m;kqg?=MbC-3 z8!GY?5Xjak-#VWJp}r6eK>^I#b5X-TtE zWKs-vptnl@R4xgQvLj}vT!hpDV)I?;ZY6|to^m6BDKqo_x{bhXY9)ynU$yzh$BHe2trAwG4s&iWS`WrIzb0x~9^lJ6{t+5Wx%Pj-p zqy%6NEzP{t_xK0LJAe>BWOS0Lhg+cg|5l zGj+qM(^Aj5)4d1JFGB?7e{!cK#cxUc^J*8%hp)*kp7zY!W=Z=!3rT^XG1P`s4@EB_ zO9uL;{uuzSHD@QNwwXjLF@fNLHyUv~7ov_m4c;+E8grKAH$TY)Lq3D%{z@TCP# zS=vv@frXwFnk2=izxk)9$(152^L&`PiG3xntM&QH^gXGd`*-Nz4DMRHfHN{Oz3=Js z06U|(VV?S&zbL}^aIY~6Caj%QyjRZhbl;%Btkb9+N*67HZ}8Fa=x|ihlX4OTBS;@0 z1~NqWJxwp+?px&t2xklFg+T}N&A5uE20as)NAwo3woQl=`Vmd6FrSU>Q^MpEe5^Li zbRS}>?G`?^SwZGY+L5OvyTmDaFSDGw6mAuhbc_xc0!=j^*lgUBR7{9Rcs?8sun64H z&9k4w%lZ#AvrcR$5i9csuh$cvOpBR!r04&p5FD#d4>@CslVW@%3wp?i=ns!ZW7 z`ZCa~mb5usk#A#`qf)pbl}OPu6E>3hK)sc&Zc-321DrwA_VEkA^S0Q0fkK0wfK_@0 z*ya%9_fPW_?kcfKVXN+0wDlH+nrrR5Zt6rUut+&lRg%OFoUWU7R%dSFP9==@5sUi< ztCMsH$b%DfL8MFYTLCWY^3U|LVKslCH>FA4MxjC#9=R-K3xEe@j`*hv`DnG*vS6(Q zpuZb%>wX$&y@m8{?!1IbC7F7a!eH^9*Fy;fR-edxT!jq>3F@V|FD6Bi7g;wcvIQX( zgnno--ixd=Xi+ImPHfu=m-|yhd#}8VYg^1~t4=6H7V|$&k~)~$b`GDEuaGADH6~Kw zxX*&4B-FSq^4Q`PqfNdUT0vV^pC4se-l*uAR+6iFQZ5<+tl@bpWTa$PAw5~aQg0o< zQfV%mZ&mw^{DGlQ(S@sIGdCESODZ5~C0om!BKB9^>P(8RZHc`I-O|qjz>1Q$4i+Q9 zHu{LwbB?>`YI&3XuDv4cQX?pQ_~t5o2*^MbUR+vSl@M=S>z#51GMd<<<_K=vO#H2Q zFHmj(x|@dI*9#!8fNbPfxZ33wrr)V{DGI8yI&ETaCf%7*!JSxNloC{{jGPEA0yeum zTPfBt-~1^##dzbmKe_f;ofZOx}8W{jT7_WCkVYiugm+U%> z9sa6NdgN)smfDI=U`jU2FkGJ{rgAvyrel&hi(mgsXStVps)u>qsETcg)lTUm&|gZb zS`EVn0saR|P4Vpk*)>zPq|~-;VC(jA5_nmT`V=`cf=Q7`v>l^2q1Bk{p&AcCuV3PB z9dK(VWP)=dmTGvWX6-wfiEg2{OoD)VQ|e~dF_g- zw*MPhyo8+F1+{MZCm}3J1!GN8e{ZVz7QU&DH@B7l_!dxK01Dw)3sDb@DFtJ)_k-;qr~F8$yfoHNgPT7Q>0jI!xMLpn|y4T5dz4Ft0GXj&Dt2cKi?|2 zx&#`{*UnPw>7BWN$HFwBe0iWvt{Ry!%iweCDk>08JKibeIDXDG#a@5-K_TWi%sC?jiU8r&X+^c&8BZj^-5spyFw*U^%MQG9O zJ-z3Qq?bFvH}Tv_?;8N2T>Wd`m_ygYU&ItThhVgO)%)948uC>!T1is7oYMXj#(FDN zsJT67-H9Jq%shqK`Mh$d)dMNe7HP8Mnl95Rv|dTYRaTl|&ID2?9Nt=UweQ#vHTk$K zfiqDXFtLBi0bU+%>5N&7-~4*+;id`1tkkjNB%s8lL4;^g9s+pP>#3)~Mt;LxCYc3j z1i>Q3_BPp4!RR6R1Bdrp@EbB^@(rM=t&6OHtThBwE#F}EvdaQNpCRj5rkFIWzKBim zN;^5!ULi=Qo-9Paq21h!@W+t_0f(_r;iGBeA|f`)OLI8iHD&p{)O)Py9ttHgz`{5` zeUZpauieKmdi6RG)G0X`BVVI_IIUnhPqOrYtTRgukvH)j78}NDdwPo_-%+vf>(rtK zrX%PL+;8SqsoS!mTL|V~=5WuTQ$9o=gGPwkrnY_V@}yMBLvbkI#Fabi)*B9~v>a_> z(uG@tR}#96I{-5T*I|Osl3Atnp$bUb@zUwEBFrr0u$&p!D5Gd^JKqsR30?~VF0KLo)pkc0P8a)I!649kjrfR^oQmgR3hT3>o} zRgge(jQKeRloaJDfo107nY=5Vw!CI6n7lAoS~K<%xejv=dK4^GR)Z$L@N`X7oo)_v z*xU$|({u5Y3uN+w0cuUG-C}+5$j8&G7{8V3&56+AgxI=^l9fpefK{5Gt@5y_HV97TPXQsPmKGhgGa~aU&W|h3Y@@me<6~na+p~&61;PB zN)8JJ2oUORV}S*r(u$j#N#I0PfOV-a+YiBUqh&T{ut5}csKyGD?y z;kz~wRQty2Rawts(C7B={xuf`_M^X{u?i!J9T_!m$V1zr zXD=7H5yGt$XhD z=8_-zon;{ZGsiB|@R~DuP9E0O(q{?1Ho;c6Lr;Q{=7)84FP{Jxj9{!ypl{%*9q<#N z&4|Oir+O;Gz4s4Mk7)xOjtsn^$@Q8Y^#JSP?H7#7B0r%I8@z=2=6jce`>p#*W(##< zSSeTQUEY)6%S&^@LYvzCw*`k*-(Bw$LApu_g7jVk(nFV~p!A}Y&iqd*j31$_?K85}&Ea+q%9EQVoq{9f&aqhUUWIB4qO<|>&OXlK;|3RK`KL|ZKY$g$hIIV>J?HTXH|mLCX%af{2NhH>HRDzUCjE_Pr^8jT=@h$pH??b6->~{Cr&L2||$Wz7KG{WGrM#kAD21 zIv*9wQHJ;5U|D%OO>8(#x5DY$(_GYh<;>x7cSY^zH%gh8V|sbCq~WWwgDf^qKTl{v zi7YP>W}oj!hu%j=^HCzxGdCyY9JpA$6^#gV5xJRN%F=8gWadK zw|k4y-ygp(Pj)!;aoG(iM~1iP>8T!5&+?FtSxtbb@x0{rlL%-8C|HY;qg?)Fwc%aI zL0j>>8}(U|q2X?Y`M`BkdWsKPujq8mtHX^C_LjWzo4zof88MT)JcE`yGx;s?@`tlh zF%!MwBUkxY(%;26)voRX#|h1mo@fJk1b%zw{qb0rfRhoCeNO1G{U2!KG_rdDRBGUK z&6i*~e zRU7zZGrM~LC1s@uGDqq#>|aCcPYlj9InuJi{Zpa6ktg2?>0Z9u5234JapDtCM2Wqh z5NmNX>^(JJ?|6r`Lb@tys3~00-*CsEabxZ<79oI0xXEnOi?qG4^2l|GyckFf>JA9U z4wo$5@2h;F@6?6*^0`zQhxNcJ4Y=9f@49XRIdzFFm4hDr76dMgt^nh_y*_(jmA9~3 zX-WZH4pYaqJ5Pl@`{wgy~U;_zV8!3yLf82iW- zId~P88wr)y)GyOMvj}>1@8U#4=>lO3QY%MwXAOyt-FZ(7qX>HdInGFN_Ai?jC(|p?} zzy_kPD`PP938F95Q?te@+4K5GLQ%-7=hJF=KW#m|(bBtL$dxmL_jpV=dz`1M%8boN zswI01n#vXRFUgE%nqG)L$8^pHy?n`WKZ}$%KzxoSs8^{J9t!T?O*17u*mX!O{S*Sy z(~AF&9;?fofM6cmC52BsmX2uXrZm{HzP=A#`t)XCYfY%FdRL*z)AZrVIQIzYODi} z_?^&~FPMi5-rj7jw(SdJoER1FYY<~#wSR9BRC$`+JYWP1@4NKd9XZ#+z~S)z@rf=z zMv*T8Q3uF}h~YokC2&^dqpfGhc%dQj1;)nH&wm_Og`1In6ZaR_(A|P6tKD}_YU?lJ zZqclSX$toHyf~JV@w&r^kiGziO<-|unz1Lv_i5^K7RPN$8qdvd#MF&Rm~UvX%8nj< zMBPCh79t?p0yhz+^f%ebB&WkKHZA$UNzZr!#skqXL1+T#oq@4`&h5+^rqwAr*}VSn zWF*xulFmVluL&(ba*yY=)-@_>TwM+tQEcF5LZHv(Ts?_8{*g$)ocwLKZuH*LCIUCJF?UYLe?oM_oo*IhvU)$bgX_{AsN=-qhSTj%eN#1XB%#p zUEW;s@^kjF_Ba0fDtzTBqF)b3HKi4=J@vhJqYI7S z&?wk1y7rSrqZ^Ie^YM?CYBFeYqB=saKM;Y_ZtKv^R)h>dISsO9w4WkUTx}1F*$38^ z=U(f98%rN-u5gsqpgZ0z?amN%jarNgnuluy?~AP*+rAslXR1@c$ouNKW`5!YggJ_w_Y_j({%fBGU@1dM=wA*Q(^-`vk;M--u#{WLP z!FaV1m(e?RRWN^{%qBhz;TIx~ZW2N;PXPzc(iv z_c?87jNsnx$m7-&NPAXS@>n_^%3+1*pD_6N-{per?joma?hbsqV@pLqK|nDNsD8I7 zj$FxSd1LRFas}i8=#w;;hrv`0<4C9HrSr27VJM z@=oiOOSLu9YrpyKw)in&x)cHU7Q^nNg}tTK*D8(I>L@`m3+;Drc;Dj|8QfXrX%v7S znaghn6Rd^B&95?gfjEm}H?L8F79Q>Lknc;mBMlehk;lJqdTbjT zDp%&4tLq|E`TE7x>Yql@6+1qjdN*UL1;$6u-|Mxmf1)xm81O6Gt>3A+@7CZW7H;eR zG7z6F2Hf&iF}I=9K0sn^w$!|Jz*FIe_>!K1GESxZ9C0vAE<<)T$RBV{mv5K?;z`W= z`{3H)8kRqI7adY2>Ul2P_wLJYHZrkadwf+nSm@bbCoi->bvwhA4y3Qq{k}FR)hW+o z^C2Rot?62!AUv?J#evU*Z71BYus2}9{4e)Xnd|a1uIllNuAG--u6KA|W3+A-T%~*Y zZJeOU7Zl9<>}AQVzuxylH=L?@*6uV;$x*!W@)Xhv(JAYx0Z1s)HgDRe3Fi*Km&H0_ zPD%3eFXrU%K>tL5LqV4Q9<#FS6gEj8^h8g&T+BvOlQ*fn`4MRoM()0|Xc{_{bg03k znl^Filiy*P!qZXTj8ezRAbw#mTU1^Rxi2fK>=o8(nijUAz{a!xP1^-^vRUu5L_SO> zrpeagvG%$77`;Jvzb>x4T;K0PSj{9%^@xM%v~-xoodIk9!|J5t(aR%DuT_FsD$KT> zlkli%a;kBvKysUXELY7|*ULd-p82};rv-K+uI8l^z=;xGUS1I?DJiZmr!7VJ?@HjK zMV%{46?`CDEp0l?aEPCy3vlsv7OUjT9>=j)q`pY+r?-~%0ES%qT)ol|J}9V99I_-Z z{Il73Pi*AOJjMt+s--cWYOQBQyRot0azL7KTieKS-XyaBP7_fl`^S#RNy@42@ePkW z_KMx{mgdAko(q3+KU4=`%Rr;6)I({6X)h^RXCL0yQJ*4xZ(UrwBMPWx{cFXoq(^S>aQI1v_M8hLm+@WaO!O?<%&M z?7zw0`R!TbJJmIv#O(EDoah&YjDq!AX|3H+^I(M)Zdrxh*=d2&eOd*DhGDZf_Gpkm zHgtuvnmqpn_9H2JYgC#JK6YQU#H- zU+A!!S0uc-!q7^#`{{(j-Gi>xnXSn?(sHNvR10xBRC&6G0j4Z4Eb{J~b@BJr;*q02 z(<;Rax&2BTEy$#U3xznhN5a(NtkQ2X*@;{7{q*PU;5wzy?h_$x59I+E(dqt zv#U|VKNX~#6!cR7A~sT$%EM&NRN2`C-x)JR*dO*AhGw~JdbfXj2LE)aO5y28BvlCx zgLC&QhM$g52TvP=OU00~x@3XAspg#kDSA=mp4h(%|Kw1_mV|kW^reMMNW;vzqI+Ad z#UCpg8iPO8IGU69eGf30GUN@JUO-v&Q(%Kc08+)$0K`nq?2@PMJ9Sj;EkzyTXt73E z?$4}Op%*YqXuA;}#NNCipm$$e(P~_Nj($@?L)Om#Im;n!b|gDnP!FcIxVWZy3aG_m ztRi(lKU6Q7SX)*qRTb#%&bZBExjw@x>5E=&c#CsQJew5dHuf?j7ph~1N3u*+W2~tn z;hMHz0xs3@xI$eUFK91m;nl`D46)cXExSSq>NMECC~PbIC1WukJ=BV>`0xp{t|Lhx zr3MXkj%7eqW9FAdd!x8LL)|83}=*}^bPv~08OM_>2pWfzn}=g7Rm3V`~S_0p)A<2ofq*+7B! zs;1L9fKDZISlu(XUTw7({UVX!7=X-MV-I!dB2vf6{h9mf!G$EufXzWy?K*+mPhoXS z9uTtAk&v%E(N((yeBFpaUZM%rN>s!4`_D(aOt{Ds{32I%@{45DQ;@#Jp~!g|>07|$ zVyF_4KMxQcL^8;%!_}uog8DiDRY3Y?dC>Plj6)rzygAhvUQCFVBI*@pXK+w@?Msl* zT|K#`Kibj2Hrlnf=lSXwh;^ntZ2#+%qi4kf4;nyQ0W)|siZ$Gj+-{dQ>}&13tj6C{ zYtA*Q5fG_1%>XFMZD}r0;3El?3B=^g(Lx&?&i5^A^?+rUidF|4lK&bZKBlFO0ftcu zi;3gFjE?;Vm?b`=Q?2+m?hT+!^Q*>XKhl+*qkhrp)vNe>xVj~C9>Gx6DIXlR=L%?s zzk_m88%5l6ec3l(j{tMSRuL=+A7VuKSi{^`S4?Vk=ctFnJ2JTsmg7Cs>{n7tN^Z&^ zjP|5LwAa#f{FVmhF2FW(<{HifWJx;dQegFD{ExSb(C6C{ZMFC)yb(+bhdS6ZZptU@ zb)${g+{t8-@1lj$0Y7PFAhX4NV~Xv*vq|zaNCtatCDA zlIGkZCZZvF+9&CgahGxDnMIWW4JVJXGVe~|nzp{q6<4Gh$l`tsbr@4f1FkP%T7xEi z-YDZCQ#2lhY~W$#VwNM!1OdN*>r-g1-5JyX945!N89TagOL0kt+YCyKR{`zlchXW~ zRN4Bm((JP|-TLW^>F27gjnJX}(vtGj@7|D~&&{Wy*qs0qLtU|R=bkx>(WsPhe5U;r zn*NRvn3UxjWcoX~7z$B`xzCS02lR{ z#>ap_LXSz7nWaGR0pet#ItrjE>QD^{wfR1zGFE`rZ$O=LparImOZuxyo$UbhNlNU6 zgF_K#lFrb%`i%x6aJ?I-7$N+bHu(^&s5j}`H5Q@fsl�?r!*{Qn~uir*T_Nykled zw#+6c;e!Jq-HrWNJPU&?>AnlG1I=2))tveHH0NEk($W=vt6;#$CUp6fO^CfIJBu=2 zXy94OdVMxJq)*u7TyM~iwj4CODErwL0G$bFWdXqIblV--wNbh&A>r`P|HM!20?8%N zEFb>Y2$-mpA)x(qL>4rau~OG0&=e~!@L|q4DE-%nFXi>|hpxPdigHcQyc)XoKLQ^q z2G5CIz70WcZ$jAIc0}JTN0|T>DVC*q|Ed7TW^C)+Sir#t*O$@^a{KXf1$k*(0f__u zEwkeZt#xM~wXLr^0zwpFkGtoF@vawJ+o7fsfhWV>^K)q03NSLc=!*G`uz)NfG|C<) zZ%}O_@Gf-St(W5v8IZ7@J7!@h{FW}*)6N-B0u#@ z>-Up;a)1 znMJK^ZS$&+UV^Y{|0TkI6ZwC7dKJ|yBntof#ZP;a)t$Yjrlu!D&(zcuP$!Wh2h?u4 ztKD!4aA`cJRlGTDyJ_xqXd1t8GhuSBdfqtB;4xdx^seQWLo@k-l&3eh?~Y)HfsO(& z3#xvPghl}YmseC6M6X>sd#Yn;>A6&O7yhv%hdka=d^iPsZ`V(%;(CpSTji19eZk6^ zb_>$0Ojm$)@Ix@bOwZVoi8_S9LANxw(M`62P;=DIctkgK+>&O(a%1Acz@d&Qi-T@c zOJ8nce{R|6HNaT~1O8eYbSoS8TW@_~vhULmAdE@ee{_s0N?;Cwwk+_!T5L?rF8QTC zV_knMI#u#VU;p1c$Q?C0`UtT3=_&tdM*poFuRhCXaps=6d$;>__(`tLwY4=s?wO7t z-=FpJkLaV2xTP`pJy2QGXWII;e_y!WNN2w;hyBtPrHwlB%3Nlvs!LmyE!@CvXwTox z%d6(s@81Gld*@CCS-H7YaGr?%=*C|hVpD?^t~XE0y3UW`0L0;*fU~Tzr+MrYz2UuO zKD&_O1n#oiu0jMDZw(tv>&fElnhpHgaEJG#;%{^zh=J*J(!Em5kAl+Q`PA-kf?BSG zDdv}g%H(-Dr8h3=oCdb=FQ5HiO8JjL_)ppi^ew4=y%79I>;_EC9zQQln*i|ywdG#> z*Xiu{nV6WUItelf{1;mSpm3dkdtK_c{^!rMbaR|NMcYjTu6Uqcv(j)^J57)N-h7mN zO?7p52GI;x8WVpnYyFRfZFzw_T=4HW!JwdL7O+*<@u~~KpI1sN0iDLBPNWG7bG&4h zFoSwZo@QPd|eDLD9{&+%F5r6Q)${8*|?eNi;)RO%j3Pm zoxD*n{=7W{0|thT*x%U}lCwcxlV+rPD9lrGQe~rg79GLXym?zLJdn}%Z_nckSYXbN zgx34!$D%EQ@1gzYzoSC$`?F>A_BEnWwqTYTx-=wZeo=Q|H-z|8;2ZGcWH>eQ(*UY*SP+i6T@y=#(;gfjd0#XH?9ZQMrAk{v&S1Bkc| zEQh}Sq5TaVbFk2EGlf}->FIjA++k2tifMeaeLy$z9j()IW@ODC>7>&nS7%>S zadYYp|EK3^q~)p&j_9rcSXYVDMS8vw@`ojt7~b?~=s%4Ln1Bya$Elhy z;DCX#e3^gNJ_*hgI(zm?VTYi+sDz&ndzs_5D6f%{1Ug;r?=uncoOsrUmBTtBT zlYmh8dHxbX#09Gf19s*i+!)`r;~*2rk=>?O!MI#dQrR7}VH{l;(w|`he&s`i&-`r< zbpw8VV+n*r$*(383-0G{*>$cA3FZFo^=lqpYpdi!1gu~~VvI&S77^EXuZ3Ikr*XIW zqyy=IFV#_qunz;UXrK!5D|{Usnq*8CLx`XDzi; zY(mPhx!q<*dB{_2q-X2{LgqVO0to9>fUw>eVh&+_2AC77-}xbE-X!$);;S21P)I4+2|BtPw5P@7Bs^!4u3^B_eET{v=Sy&elFlE^9x z<2iy$7R4}gOV+%!=w_-0E(&Y@aj7V&QXYGy(UvzqOymYQv;=u*_@;#x6sS)1rGZuF zpXyGwD@@s54-3I1K4M$SR^2`CkxciRj*%$`uQ_>UnRXhwSYeY2W&X*#elZTw{G<>M zY?cYUL6vYij`!NbV|qK;`FAt(P%JB7%(Rkxxn10o))kmLrx3OS+wYh20`{ibX0ryX zAxj@Z^FW|JC%{*#Z4+AV z>^2mI=$02(Yuq^w>VI`K#3B6?{uq1FqT%^`;dV<=-hTBifj6PGPKLo;dUKLX89K5{ zUDwhiLad))l&blCX5vQS(-Vb`(7CNL<;?zS$oAT&#X)zkN$A05`TqW#Nk>yE-svpJ zB=zUdpX0}4sfi3IC7xE=hav9q{S$r|y$s`l?e^=vyvq*`q?Np42Z@NX?vDd0kv6m@4xZb|k?xuy;ePL=W3!femyyf=M zzfrTkz8aQhQ?iHL(Oo`4FhtHIZYVrv}6-iUMy^hc(*d9s??QlqZ6oZEO5eiMbBE z_P9ZHQQsCC!v}5FfQ2#|PmKnai%B8CwWZ{W;zi)yVygEA_1i;8+vw03c++xDTbBxP zhD(BhC(C%C2(piy6#?Q$B;%2^_uhi16#V?Q&VU`($T&IUrYb@me$q5LiVdEwaV1Wp zAD9yCQR3kK#O#JJgF6b=*2fSUOZSdfaeu&J+DQA;B-ISl1D`AAQ(_Fo^d>_f0RCyo zy-~Y+t1m=lpn~6*K8NX;9)>Yam`|dh!5HXXi!>8pJ%CUGSne%_5oOEsu+4#SOTJvn z3>3k6O2H#3H?+Z6&(vq;Krkwvh!!u{tg0&p^&8!WoZycvkplM}i zwKi(51=QC5hj0>0f?c~@vEXSRo$!AP^y<{~#@tEVDq8sG%Se?e)31m2wv@^W*!XXS zwbeA>=6Z#QaqWa2x$xyPc>Zy`+eV!ifzT@BD1128s360c+8)!q>)+Ouw*T9UfyaJ{ zTczKBU5`d?mRrR^3-Hgt4z~AnVHWsqiL*U;GvcW0O+dcFM*)z~x4dC0p1VYs2|&9leo=EoO}3XW<4&-gk&Xm{qQ(CFl9Ccv zx@Dvq&%u)|9fh5Pjt$B{8q4(lM_dGK`|9))Gw)W3xW4243;!NnBDv=%fqWZ&P$|`E z>LRJ4P#|!;dhjg;-?jSg@=U@UTmjNRcnd!lS_F@X2)yA(Vvv8*upaNkPLIZgGN4>= z-x}X-FB-$yT6Ki@61-L-EcRDjw{1E%0Zlwyz1>-Yz$T%b)Xi?^tskBaYEAz&IVse& zN02|GW}QNbp)vomgPZv{kt6j42wir5bOmh0gkI5m*Tqf?T8?0Dxj)0C)GOoY-?J%t z{8KKs4C8t`ZiIM`TUzU80^6)k(>Z$|QMrVR^ILu%{$mzCQ=5Q3v#RLQ^k0STwGVYT zk=E@*nCC^gK$cUBO1f3X+BCPda4F8*Sr0&gKj)xh#>r`g~WK|%c zgmk)ezNY=*I~`p&8^b;(a`&B3WXrj9*!A-;=HbgWvDOo6eCrI%bK6c^sVj3X$#)Y0 zpLO>QZ(!;>D5F0KPs!%I#4e4wr~@y?$DN zDhYT=-%MYp%)(rhDoC+jXNt1rx;*3WWTM5$+94OHZ^_In!o+$E)UO6SockU0d=yqx z?7J+eMd=@EiM-AbsT>SsJ^d2Yk0e&s^w(Ob0TzaTg9V^h`2!%jiQCX5EPqX26;$@p zR2UZvDio0YME9 ztuc>*XxE>Y`mllIvBy74F;MfLWWq5aAx?*`F~M2c;*l zeI1p|+nP*!**2XH-{5RR!78DGjWKg_32*8XS$BZCS9%Pv$Q)L^6b^oEqV5g7>*-UG z14-Uw?7!berroIZ@t#hr4b_y*4a_N3`^Kx{eIaR-r%~JL$z-yfe)*4lNKHefd;)k~ zow-YV&%dEdUy->>ELVbS$fe6S39n2zil9ugfrT}G9Hc0t#Mr_S(U0y+^+s|gYyQ}< zPyumPAyp5CYg0M!@GBcr2Idq%-R1onc2vMz^4eG5gwefowfEsHl`It~*0_E=8(GE& z98|SVG|@I_G||zF>5{guPfFG4DVcZ#Aj^Q~u+$;>XVMnBN5~wh13FzvAu`HlDOP2|cD=Ybj9KL)NLGJnc!ujrPW%xqt_H0qb&j zdFb~eJ(|5r^$9=#P@G|_&DP;Xj%QOvG#d!3oh3%Jff=sUW&^u(Z z4PY&ZAx|%}TpxvxUOe{kpbfB?SO9k~3$gJ0?$f~l!F}v>Rl3OBVLgQ_XmkM9B zn@d%uI;A#C{&*6%I`tb=*bh`3hdem(mIsDC=*}QR|N42=mtI^Qe--ehCSKII$8xcq z{Cc~L-<(M}8%h@y>kCrZj0@E)FRtCtP0qi7zuv8Zgy@;SI|=Bu(SLn`SLora=GnZJ zA+zJcOAL&+7kk1l=LuAin6Cj>`73!D*2dO$vV239h00Dx`*~rXxXR`$1 zspkBZ+g?Jd<7mcS7s)|+T2MNSir zP!lpfy-)}TMP3Hz5rf4O4g6aSn=ID&Q0zzm0e` zlquiWFuI`3_PuPT`E~P3KLK{B?iOd3_5klG!D$hpP{zod=6dExAY|pC_8Rm^mF8;3 z1{{AdOy&WH?tSfPJKtFQ_35q^P>~R)qavdwe+i^Nc&(DAA{pmf!Idx^fgNOPbSL~0 z|M%>_<>AVK4LUl!2e|w+%CVvRA9!PNu)Xh>c7G@}Heyr2r$WsaCt?eOi)F_HtbLQed#jB3etZ4!J~inI=V{zC zZzJM*hC3>efmd@Eae30B79|%l9*#$gK_(>%ILfkZZiqTPv52*=u3z^sG=dnvd!^MA zG4^qt7}xHt>GUz-!o+Eiq5^f8fvAIV~DOm7TV^Y%S$g_ksM^m+l?QJr9tM2L6kA^iX;<@{=s|XcIpgh33 z=RZUR4Vxfek6`mRys8An*8!V6K7lL5RWmAD70SX~b&^?NA^(h`@)RyMMB&PG2(Ww_ zJ-NQuwp^F!@zh~r9=YXY_AcHcE1k}S8Lj&d6q~9|ri@H)sh)AxI+^+N{S-P=Ua_#5 z9BrCgSCr%FvaC?T_Q*=JaUJ_+00cNZT70_U7ScX+%&+xmltxl{GybsZ674P9I@G9vq9m2LMrTskuPl)tVP@ zS&i3v0cmNuApRqFYYu+{AYP+sNAFj~e@%8kG&mAWSm1FENCv&z_I9_w`@cudoq-^m zIe}#{b%ZQSx()>KU1Xcoyt+|fXzsXkz8fsShG#GAy)a(@H`w7ktp{E=HH`n7&#dh+ zaD?U103pJk6=lk(m@{)jIfE{UcOi@k{w@Ng?DN1Vh3};Lh=mFx_ad&t`E(p|vcitb z0`M(E{{$r1XuR${N>Qw1Wq%bI_{;kq_uq_8PCEzHXJ^7jK+jxvQOK-3C#n;dZ;%3p zSR{el{X`q>4|1p0U2;=kpBp4bGU33PIhdouh9;YtzlW5r%b58hsKt9MtpVXZGs_p= z1D3C;T_dn88iK|Nf94!m>mA=^rY)jxsnM_$(CP%=G5J>g&f2H@JN8Lbxs<9Qc(dfF6sv=~(>U6*fN>4k|C%|GqO-@d(`n$#edPD`z z0qB?t*#0BS1_=rr&j7d+Cl*_2d4$k_Bd|E?GoV1J|M%hn;1z-P|3bV~SJ&4^SwTqb zIm!$=qM4!tYvfFx=2O5eJAW!54O7Tz-L^;10g~0LK*a-q#Cvux@DP4IAbjk;DeW@h zxy1(d4%ixi9VR>_Zcz>qaebU6bZw73(zrtCRtFDmd~J{(c@GAUNZX^lov59{Y5=}m zjbFTzGP)s8db#(Vts$H6t<@EqSFzv7tizTVv>LiE^<`D?uz z)Yk6YhpC|sm7u7(5QjeDyusYHgXdsPN z`x*{lKKPr&LfJ(1o^K%nKb& z2!kn#%kNsqVGJH_-SNQkPMD!WvSJI&iA5GHeJJ!NT45B@JMj&ua`vTLa{bHH&;{@%ABs#$WTr7n1 z?y6eYDRLs~>j$wW7QyFT3hE1EQ23e6tt4ykMfpc6?B`!Uc;}I`d&32s%xsy1wvwza zSeKU=h`o6{)a3aO8TAKo370(PEYz>ONd=yw@&LCm+mTs)Yw0K6C+=y!`*ReX?nid* zW9CWVR}dOWpG_vjt+%oT!MX1Xv;%(E8TPnS!vQ2=+*y{J^7GSHBEa=1J3Xgg@~2E1m>Rap>l?k$s$u?1 zB#PP2@I;LBipsPJ{ZC=x3v6?)FZBxL0>_1*6Bts*ncj=?OB2MmYKIM+<8bB19pv`y z0?BB`mx~$0f;}w=f&MUQA~G|;Ox4k>jHR(`5Xy(?u)&Q!rcsh0Ii(4q$juasEf{Hz z+%c~sFZY={hJpq<#NBr$a&+N)IZC&U})O|Kvl)!gi7oBTetkXh{Cv`S8oP)SnJ! zcF1K8Vu@^&y`i=)55|nX=EIRbxV4JQ&-iJ>&!lo=Hn{(gg-*G5JKqW)V=9iSFQbvX_B?EwHJ@z6g(62otQx{oAHiZt+pbyyocpO3gB z(#qZ~8s})#Ygv7mU_B62E=2bHT9n7Nq@Be(oi@-fDBN33Ql){E%ay14aTR2P1mCLn zeDv)siKvYz81LHMl*rmQvTO1<7%1vE#nCA& zF}AAHuntVz*jT&(w~tuNgP#4#s~m?pB$iB*=S0%Kok$+W7LNDW0iDN2N~;Hpd%#nH zpc-ydlwd|EQ`PF{HdnrIMwuIxNoHBo@1VCy0bM|ixRBp zh7L5i9)nj$K*!qUf_Wv?5m&x`V&H6kQHr{+C-LT;-*oVDNo<6LF(X~hE*dZLWVkxV zBiE+=I?C#z(Tcw3mKmytuNsV5Y}FFF^9E`1=!s(-9okg*OoW*^Z!J! zI7%EYq3mSVbI!xRXEbMqe%su3voYzgy8n)8woj*tyt^1DH*kXQYy5JDn2vX+D=9ff ze&=OOdM&MoX#7t8L=V(#R-<=Z=U7|anmgS!RN+nf;o;(21 z!ZtK_aY#-YEqqe==KxSFjsn8{z#Sf9?QAtvfHO*hGQ!5@6hQWaLz9hnUW8c)dAvSV zp>a@Enx|!^3KqUoQ>rweCco#r^hEe*EkENSmR z<1;4+0SC;$q{TVqH$J18*(^5CwLRTOXQ(ynQ;Qpjv|e@*p^tjrKF4cvzBR5WWf#|g*_H{is{Enm>U)aEyBu$e_UpCo*J1p185s# zbaNH)>1uikIrGB&Ph^!Ci{*j8Q%Z~g1B)tL(98onnx{-CK5`rnenzfL@(r(vf3N@1 zIOmJEsY*f(P>(7XEu5Y_uonOxksbl8Mson{1KyG%5n~}d@}2(SnN(=yC>yanHaAFi ziHYWS@?BF|G^E#<49Wl~QvKRg=m&IW^K(TX2kM(#w}&yzO^O9T43epN643sIGXubX z_#-9|fM-`FgmRM~N&%%y;BZ?i=+fvl2HV%C(vB+=@=^nGKVJgg8Vv=W6NswcM>OP9 z31@sasU5JP(oL3|qK0ha+T2?^Ri$*x)7xqr8_nsX#>dBRh601Q;qvM0@@v+Nxg$2f zm-Qw*Ux33e>}Fk`R1sk@jnwOUGoq}%-gI?!HO~6rRFG16UESm8V`|^)7#_6^PIw$? z>mX1)r?&qw2POYIblcwn#6_TnhLPPPLcpQpClYWLwU6nm`ru#F`6xRKK%jO`;czj9ikgCeRgzg+ zw~yKXa``Ch1Eu$}$!{IH=JN~JuGaTt1oir~_Vi@z5kJZ@Bk_Q@Td%XpBJ8L&HGc+{ z3`i(EJ>OxysUCpYI6tT<;5FL1YGut*YFEul?VH{ozn%e<7(krS|D>?9BF91E)ipH{ zd^%i$T?to(ue0G9PY>YoFx@r&&)Gp8*BA898%jWE9y0QF_zgtxs}Eg$UwG=liiK)< z!>{OCcXJeUr2^mJmOW-r3UH(Me3ct=-;YJDMQCg-VjU*--tYaaMHeBiYUw0lz&%o3 z+ALH8*{`{dgX$iX+rd9&IqrS8W1M1zdGMwi1mCT1>-JsbcjAqq$U|g80XD6sIArG{ z0fkL9(0)xMOr}O1Q9X|gO`@{jV-rtZW_?QowjbHLSC!%FOGP2vubw_^YG7Vpcx{+( zYRv7J1HGIh{p$523$P(J#Ls_Txw4X+u|_1-$zJQO*%fKaY@-XOpZBjno97A3C+y6_ zvb;xpnxAl9A{Dv5s1Z6K++EprX(np`#6m(hOUGhgGop4~WkWd6vqz5$uQI53w^5if zRW3a`JK2RX3B?WQJ>K`(%uNPJTbG=KXqRupQ%`^_9U1k5kp~Pa?>`)mcfq|~j=xhv zXKlsBn4b;h$njWe)&3ZIUleA+$KYSM?Q3tY$IA(9DB#vrv5PB;27;r#oW+pDggx8C zC)Q+iW554(VkQ-*;xpP+!l`K|P_5>OPV9B89y#=#!agMG=IETQ%BC02ac|PP znj7x;odxPM#mz`9Kz;sHA>DeQ#};3!iT|?0JT(}DKIibr&>cc1eND&~u;efXkHV`J z7~Up*Ew5|<9`ioV_wFJ*Rs$Q29I*t#*JZ?ia|A?cWaA3zi_N$_hu;d!D<`TX?J{}A z4)+9o&K4+p2!F59H@5qw@RY5+g6dRlyE)Cv<5w-G){X!POJJ)={;fa#IrBldJVE2> zgHmBl^(&g({3R94>)HMv_VkiceN9GA+ES4w#8tEKmSsS%RV`_XbN&-K)8rlI`e@Qu z0Fpf&s^6k_E^btPS6*dB^rZEOe_W`Y(ZC4-%;IZ3%u}kj8KPnmUipAe@jS%(i z^Z_}1!U%tm2&?whg7+7N*p2wd0yUb{>`~SdCdw`M*6KI3 zMuxg6|Ca|un+c5BcG9Kp483{G+nuB$yl7#FwI~D?bW@I}Cp9N@L>k`-ta8h`Ki{rG zYZ?T80L(~y+s9BzfjIR!3k9u-*s%y=;b5irPal!E>~w*XdLtHU^QjERjkulHue4hY zB#X<=0e)%sh{kW9B+O@gPM^L)O|w|01iX&DFsl(PyT$%mWAY$Rdsw5d!>_=?LLvdW z5egCgoOko2*1U3xOCNfI^ZHcsvIzbPAO`F`z?`>yUAUt84LWPMh?Cp-ZrYRadw6%| zyHQ$<2p>bR{xu>F{T` znq(wMF^Wpf_-~hUvl^h>m3QEpheX&^5)-wbj*O)5kbtm(wq`36b+^>#G$?B1Lo^xOI_?FbW zWU{5d@|u`$;W=S#TQwZ8in>Hr*u+Rb`b|$$J?A(j5|IFy3WMI(FCB;Udr~bxGze(= zn;(NMX#oSA=Zx`_U-TvqW{uBkoK@JbgK)@qy$GLAIi4vQkk*J!X`4@Y_#*NLtcpA8 zM}dpfQeTW$WS(@(i-%X7-t{e$oa7Hf?#V*%Ctec{v|+fB?Ufimm=s$N>w!!(+@HQo zhZ<6dVy{B=WIQXWvl(3m>A_V7-jM>?En*=yk;U0}aCa@*Fm+?Wocy4sn0U> z`}^o*zUWUbIuo78*vK-mZpu7_6?V8d=vL7FWjvtee4i1vogk**`_3n?K;h@zTp#78 zR1?()^RKWPxNG*5PHTXkakIR%vPpWVfjiKM%Af>_l5i{rzVqVy;t+;|QCU+5vNMF! zOXB!TIf*ZO-)BmlOlfTP4Zd}Q1lhmzz`kNC-#3yC@jgS3Y|Rh_*KS?K+@Gq9{G~Hg z3?6=E&4iFixQIi0a07YHrf6@5hyF%irNYF*6*D1)>CXJ-cYqQUQte`KT=l8Y_f3&w z;ud1!yumv;3b*b&^p)p0Iet9tS8nCxi>r#oZXZ>nFxUr(*etd#h26bE!2&%;rUFKR z1S$J@-3E!l1Kw8}G^!kMdNtCmM=?GYm<4!B^4_+-DD3ce-01Y)MHu-I zKU5k`o_|b80T->iiKVo4z1`n>GT7iEi~tm+j~BwwQuzCCnvU4yH&3Nd7bvuzlcNf# zT>#81b0+lOQLy$1;-{{2>|yZDx*fBsjLX@blSp)D78(S@89eH`1A*ldFviVKqSs`ws}B}x6+0xR*s)*udf-~r zqlm$pbi2vvr&E3_a*RuIcehaar&KHa5`NCxHW4!BKI9#`0#qimok>a!0SZ3+;2L>j z1-N>gGRDq#l1Y8a_R)Ctd2D`c!Uy?^8|1T`d=%M854D&gB>7Iy-4ONaij_N3S_tk6 zAH}0+6kc`ZWZ$^fW#>Bwse>O^a@+b z75_SINcFu5u>C~9tE2$A@oS^v>P{cb48R{;c5nPf8Re=CG*w%FN{u*GX_uW;sir3k zo8}$`f86Eg7!iX6_~BH$eHPLLBFxsWJ=$fP{F8gO^3a_<+I(=B-n@Y%P=d2QQYg>H z`{vdABs>Z!uuqE=L67GJceERN8`NGNO5Mfo-zb6a8H_7vQPj@Zqx=qX^wD`#zwO2N>->lgS+2>cULrg;|NS?5_j9#$d8*M(NRM7QU&dV;=yy_)}|RZIbxI> z@@yMF?aE4M+13qClX-ow-{83P)MK$xpT4LIQp`uDTu(8uYOp6)q&l!(SBBF)9;B4$ zmnE2v-p$3?j6>|@a3lpMCbh=CV^rE0@T(6X)$_Ln2m0UBO5;dh_(hVLd1mG*_r315)-)px^J2WjPow*F z47rZ$xFyky(J|Gt39GZ*X-dRPA8MTjmWbN;TQAd7GO_~9cc2AY?1}t=RS>h(nj$H6 z;jMFf5E(P76|n>9-;CM-K}|=F zmTa~M%!&dFe7H3|-AZxaV(iG`y(!X|Px_MYK+1;UD95%yxrHTRjHz;X6pgBDl{q@~ zR0q68%&F5TZWq+14AOu?#iPN(qC+9!E@3VWXkV_p4Zk0Sl58{Ci41ve>&ad4mrveK z-FY!vqfDsOYi@axyYm+TvUaF2Q=&4VdhSSfFmq0kd&m|U5_ID6Z(3Mr(N!3fHx^)^y94(^K#3&wTclywu=Ef}a<(@UY4sOlv|vux_D&wVA& zW(SQ|rAPetQ0jF$W8uPLwDey@@b@H9Z+S)@4SY1Rgm2AsA)!*i0M8zzz-;&(Ec7p|lS7<(EZ!K(RjKr@l zrgXnu{l^sj`7@X;4oxyX3x56v${5p9|5%r^*m^AcR62RrzsOel@6V`(M{E_9I#K4s*k7jDs%6Q zZ+{fa1D`%s9IzIKVB_pBaflkVw5RgQ7q>16TpRU&aW&T8FF|HZbL8p0IhmCqe*YQ^ zT^eIME`hpUi9O#oWx)9jVN!(p#oj|9Syq>XvaAdbgjU*H4DGt18!vI@w(7(YlBEAf z35O9H`HtGYcP$q`PJw{h&5ZRx5-~79G=!OnLZRjn5%FWDyV3Vv3`j|D4Q?s^9VA+T zOb9hJ+dFKf;_g&l7OA&Z!@yQXTpK;6H&9y%cFpI4D&^-iEIhIjq=dFSs?#gCxd7ise%NR4M$7g$uGc+u%SDH20M#1^xw^#Z>2&T?8l=&%=M9R9AvcFt^1?Sb+Q!U|vLoZ#K1e@~d&K{tRwT@9g zSX5r_lWKt+&Y*y|V!nk+>?#t=s8m?rmK1Lk=m>z<08JjLoPxYKYHWlJxB;-4mF6wO zW0h}0=QcsP3Mm%KQ6?WDoff^f9z$UhdLj?%XdB{70GT(bo*X^sgj+H|$m&46V^}Z* z`c<9@g;AhJ^?r^<%?4L_G;Fa_0%f^=wa-zc>%Z9p1ys%!yJr7z+eJ+NAnP*bY`cq+ ziz4=w%-NfE9Y68KsRNK`U@}*hAKP?^)~YuS<30}VP=YFYEOEmT9m7hFsm!^Z8AqS$ zek?ucwAr~Csl4!DTtF#kYR_+|3__9Sg|sJ3E|s*>3DNY$JpVtLQdjVrrA2(`7)fTA1iW^`Qah7&p%Hp|Iw zg*Gdd;pd)_C?AI}Tr>=&d6Fi69=$OLwAgGnASZ!`1?ZspSF$!V9I(-kK2IBbtW(UX z-(^p2E*iSQ!O+3RYFl|$eP&{`DetCc!EV+~f6&iX%4NTpw*Y%!1-D|4ocskmF%{15 zYMEcbw;#*2-`4mCL3l#}lyE)tY!+c*T8|_G9KW1K$&9I_Ft@J#3Ag?k20Ujz{kxVT zQqVDr9epjFU%qM0K_agOmIv=0zdC+npw+cDv8rAi1x|0kFX?62XHL*6+L*#puTQYz z%;vn zYtHj2l{)k*yix#H4W;6k9q>K4T^x5xb_j1r#_r^xoHP+7I{6f?SGt)NQ1)j%$MZ2> zMq4UNjjUqErmeia+sg=0hWaBYFw4PaPmmql-DseS`(z#!tWX~X56B&T?&(Ar`oN)> zNK-rbP~2t%K&5>|bXz&wZ$cPv%tWJzE1#0aMs|F-U`S})#!x}Euww zv8ojs@P8IUf{(z=Wm~;WK7xMH9tni)K$s5{IM8OM42?*z{bACAKKfT>3$OQ}`rvXy zYh{W_tpde6=Pj%%yvleIlyE>{c`t;GPrt4m{`HLw&f4w??^Clzn~&Yy;=vj&kYfQT z4@o9cheks5E&qT!-1hq^;Z+;hU?78gElp2R${#Yf1S@%l1tdjjS6*g^6hmP9qvREQ^#AH|{`OF~!Q2!X?N+fMV=8qq#&06(ndS`L}CKjO#A8c^r0o$Z8V*ckc-$eQ+IT*m#dVi-<@o z>-W!-s0(~DFel2(232cUEFHFU071leZ-lM2+P|fNjvhQ-_>+$XI2O#h!ntRmpf`gG zD#&us$@U$*+4eh_vKtNyEcd9Py-+v?wtwwb0cpmT6{p~*;C-M#@kz@bslN$4J^QVDVjEMn8s6-)3%T_ixkA{~87*)GFwrxFF{PFh0Q+NH6?*lZE`T z_(f&dT_kB#k8^@Jm5}S((7iUbU7<&$e={dS*^2k8b%Mj*9)~1$n~Ign*>E4eA^7OI z%ucf($PO^G=U%< zUuFb{=_xNthnXfZvTF){BOcCNZ8DY29+{Zx_^cdg`oZH6OW36+@=9}GIq%E3Ps()iM7W+qC;Z!1%d@Hv!$J~gd{R90XWjq@)gvNL2vJh&3sZ{$LSg#6ev z0}<{DL%a7-u-lhxej-^6LfAGJRRN|<=Wmsvg(*Y-SNC|E=O6c@G5~e@-D;w+%vRZtH`l5S{C8Ii1!6jt&W{JKj zT)}u>lnQeeJ6C*oG{K!@3fBzqQ#D!;MvO-UEBQG06F|Y0UM$>Z7u6np&lyP=eQzAe zC|fXNlG29uHNru%Vjt|8NeGESc+=(b=MUOb)q=&AdWEQxaTRorJ~^lGHtKldENxvh-! zblQ)O7^o9DJGa-A(G7K-Pw_sa(EguuX8GY=$0mddhqri%6a3DpcO5L36eAoUhe{L< zYhT6kz^~dNlj4%4HPk|xc6)UYQI7Xt5i25Ji0Tpq(srh6Eea8?61+%3G$}@B?4$Hr z^!u?Qlx+uSY(DzgMA1#u`&D!HkETptXz?_0y71Ph6cs-}Z^ornFM@||eyg{v_P&=z zi^r*eD^q0dk(6otqY??e{`q3l(nIff>csHvMT8wBY5YBJiHy;=Bk39>%tB%}4}$HD ziOV?sDct2^@(f+n78Ps;Z`H03*;T*QDS?(=TVw{uCX`5FG8w0%N~8zo_6N0inH`{3 zBZsHzW!=5}8$ugG_qB7CM1FuG-mAbgY@(YA%BlVc?pb}70TStfD0cI3Ix zZ4;*G6t*K-?wK7s;%ZxFu@Tx?O+u)=Hk~a6i?kDMugL~oBm?D?SYkI#=)5ffLyj?K zfH6kMq0Q}2XVjL}HhGJIOEe=@1ewrPg978FUjKv|*KfcWRWt6sDgn z+#`ZuGc0${lg8&t!cC0u_h*cXuP(-8d<1llkBdSrRm{TJOH8^dW8Td&)@5IOfa2V@ zU@5u4ccRU?KT&4(QGeol3yJgv<7Wv(j8k`T^jmpWN7chReF&fLjC3ko^k3Bih02xt z>Uqxf8OkAqq)Lo=Y+mNTL(8X^~bPIVs;&N3yNJs3}@=oO4b zOCybW-l@{P(-*i9{ga|i`BE-+IH!Ygvj#SV?f?lkV>w*GDY=g4jkOOCiIm^%yuR)l(orW5k= zQ>^oWyY(3ZZ01d7>};aZC)%r(?#&i7ydN*PTUPF6)NgirJn8bLLdll{b+T~RE81q$ zzJ=JaVzo_e=#iI-#O%qm|IN^tj2P4kbUr_-A?`UX4OOKi`4|D%kQ%q(A*(dwo~;doNw8iDpSB6R@@_#y;0wnx-J6xpzAHExwAbMHdD}9$iBTXgu*opw4A5_(Y>TZ2^viw({*N7f&I{Hi19)fVPG6 zl*Em}5HMJIAxzu;_LrOIuUpQ1QH_@l$&lzb84mYY+)}T8x;~=bw^eFSbrDYDUHE-& zNy9aoMs_MnJvJx<5|1TzPDJ^ti4Q(54|tN06Qyqo4g25c?!prD!P*frGHY5YTibFX z(%J0n_&aP-!#qCT$`zSH4yCl=>x5&v1$<7KbP=4RXr?^J?GnJuMQNBs4tDiuy-kr2 zap_5G8zt=+Nf*`VzBTJl!Sh4OM$?IDddzLR)+tX>MYbH#Q{-&iyG-<`ItM zMy>w9+R0P*b``7IE>?q{sjv|xT&YDR5aQ!6yH>t5MygO1NEp_F#w|JW#{Qi{0gqBg2p&`Rha!>VhJ9FC)Sp%Kt96sV|U-KlY zcE2)=A(=98nL9^ZfF^H7ulq~P3?K-YpQD$VGMtTWnQ@gyFbQuMI^y>_MMre|6gfKu z5QYmo=p$CXEhB7BC@Fkh9lm?V)IeVG=tA>>87W>(SG7W$;D@|K7 zr&^J}XByB>H{PagW+hsG${yt;#LJCL!P4}dCI^0~Qpn?)BayT2?^4*DoS!tY&`<%B zN&3b+0Jz)!P+J0D^xf$XeDeoFDfr}X@v+J?EP^Se*%hTJYfsAVo)51wY?E9%9PSc9 zZq9I7|NCcIk=1ToPz+xACVYMR79wRX$excoiiO9LJ(ejxl@}A)SD8sd?a!a&pPSD^ zpHiOya3ztKmb*+hWx>-MVbLDCYaw{~F4xxe5QulrQ1W({XMJsc&MjZ%`LJGR<_fJe z+I{(lf8pcE!fsmD@vss1xO1%vT=xM$a>-B`=~fk|bniAO?bwfQ)oRHmrZ!NwyGP#g zwE8^R>-JP!;mP>}wUa`%kuaP%yrl3J^GLdV3oAIDdF`m8bT&gWorX!4H1)Ob9p_HNx< zYH6Shx4L2%qERB;R2EYr0*7DGR4^5B-JzYQIOyuz1@nrAVpIst0S~lzM}$h#FC4@m zU55NCo{)I%{7Ixib6$S*m)#yn@mL-qF=^Mc*0ggN~H*^fQ=tJNacIKJ788`2+?@#xZ@3_e;8eF(uQPac&52$jTuU{ z(IrEJviy7yXv*u1pdy_1mvn^28Z&VzzZ!dQ4+B*5=vr&M3>a=NUw$`}vKCW2WtjAZ z?&&xy4FQoV=sAQY(2WgSc3brs*-ERqPM?G=V}!cwCn1#5WNpJtx7kodtIj8 zbKCJsSpA1;p{s^_MWn2C4lg0D6Ot>^$@fVK0bP8g8hezjywtr_jkU5n+eyIIaRu59 zEIy(2#5CH`A}qmG)6U3ZwFq~z;dzXoqK_6f?~ph(IzWiOb8jb4gd=yI*#?k26|aj+ z_7u#?gSgYnR*%-tGT_{LbIyZ~`eC&hI}lHL4~>!Tzj&IY~3Si{4vjhWX zTUa!1M`N4~BS(5DdB&7nc!puJF}zHn!Nx@zmR%?7{?JnpGWGz&Y)_wQo%{Bi76FAL z6-`du2FkAKVZAiu9wDiVH53ql)!JU5lN;TMA+(BPO5-EzQ(u56xu)!g{gu`>?cj(| zYjTW{4yp0qjM*Kb<+I;JRHCa|UhH~PpNCQ#0u$AvQgIkV&6BUa1=n9Qz1#zV%Pg1; z&cx3wZfFXL;U=av9X=zuxu&SZzE}}0ZI}_1@8}n9f6v)1p8i~^putR2R2hG7`hqPo zAn(o&P(L=NM%b@vWMv?*`l1yiic4{oQazx!?zspiV(-b;0*|e*OV_^+v=jIh&gGh^ zWvBMB;;3q7c7wvmbudpD3@VE7%Z@g$_#XXXz6;se^o;l;^|EZn({dTa0riAsF!ay3 z(Z6J4@|8eX+Hw~G)9X+^Xx%qq^gn~QF&}@f9-&}49EP6MD9xb;oDG>izVFCO7 z)n9n1-cXmPrEcURu|mdWGfi-j{|px!s`ze01MU3J_Wl7!{RZUy%Lnpphm+j4LK0D3yLdd;nZ!K@ob^CjCqI{&w9wMPGUZCRzGU&u zYj$yq1Lx9^80SMHaxeq>Syvi^1RSG3ALHyX$Q~(B?p!wTa+#x|n9RDc;H80)Bn1&9 z%iHT&$6}T|JP0zsa@6JFp{U#e?-T&wY!e3uqAN{l$7ss6pHKbO4-9$eAkH!0;G^5< z2TCiwm({ZCTyvS?2cQ3N!ghIrmBMphTr^c}96HjA+)pX$E}5y0couy6<8uhS^b>IH zc&$Hzey5ma6#;%Wl*OV(>x1e>?5PoKR`}r%afq>8E~E7&9ws; zK^!oo1gRLH?LTBlcd$IE!6Z5Jy}WSc#8>O(L*LzkSEZu9zV1OrWVKfuWY?yWr*@iy z?ZVWc5X=m#Tg zGkJ&*4}?PVCxJIrwy)BJ<3v4?=_Y%vF;l73T%mu71k2Y4x-QS3e%CYGiVjE3NGw@@ z85ulZgL(mjI0PSR$VRj%KaE0T}EqVm?#ZWPZ#+ z;7A>Y0c5$UGEBQX@j5WCP>ZzliVNRpLNU}t51}`zS25($PI{UWc=7@eq7hg;m6R7? zQ{cm7uGmz8=f8%v=EhzcHc1Cg8!YoN@LHD{l81t9&hlYeDLJjV1vw;FV$2AKYgTf0iLz2hvV+Iw&nl6(cO1ZnO$&p5G0QSY%)ys@{hnph*luP1b$?dn z6t7QSIo~+61gl82(hoN$K>d>y6EyPpEdLzF`Zf}nJhBeXa>WFR($W~E=7WRFR;Xk) zd-VtFO3~hPL$V;VWoY|%mAC(HZ#@LuDLx`hA$t|D#Wl0a_*_uMSHXv7CJRxxfN!Kc^?jBt zChp?FvoNj!vUsJDw?6$q$3@(W;Y;9ZELi@DagGd-^1Ah>u%?F zKd2C)CwGK8j|LT z`@CbTs#}rv!RuK1J@5zvl~^*5&2MfcY!ROu^B78nk|B?${)B-EiSdW0d`HSw2v^J2 zFZpTw3m+xe1p1rZ5Pi+=w=7&lwCKI?TDo{_V40|KNW-4NNO`Mo$k;HMZ?H$<* z^~4Wp(LBaVnw$(e#66`)=gXg(KI7?xKT8>VXUtX~Rdg4WJ<#T*W9o5UzLWG5qlJ=s zAwJFCqWeQoNy+RCU?{=7D)nW43a$HaaEy#ghJJ z&X;A(mu38C5Q0ZT5Y_&71@DK|6*VZNpPmfdH%JUY6)>Pm5ATvz4x3@@mAf)byX&F^Y=34Pz8F;K^BoiBphR$W!_#pUKr!Iq1Zqavwu@6eJ#ewR|>N?Wj ziGal*%ip^qMjGI*QN%Hv+&;cw^-q9e1DU9?s_=lD;e5z7KX2rGR4^aH=1tjA+XsfQ zUq^+;0KCn4WnfNtySS~7kBT9={_tq_fzi6BJZRtWK$rHTK)0cmmx^f=!jHWtlqH%M zr~ArfFtL~}Qvbks0&X-ksw86!4~BzR^f#$$eo3>?D~~2?IGa4}<-^u|IKJou?o6+4 z2WK1q(X3z-OSe6WsAj^w&w!P;Q4_;<*EY!suY55Sze{-0^DK1uWdTQ;2}1{| zBqo2y(M2%_SZCfi9rd!@Ne#wfo8*Fzy3_@)kD389#A!dbrYYiAXZ)~ zE26;b?-fr??#Septfr9TOGNTauRki06tnW=-zs#-P3xp_F}bOXT4ge>;BTE^S0VN= zLCxZXIA8W<{aCB(IZuWsy_%wjkDf{>u|85=bRKC6X6|ej)Wz58C0l;^ely2Gu~Wqx zbZ$%R46L@hy>Hm?iiv>)@vJ!(_?uHsbY+Wdw@@{D`YUiPOn8#+%l_`g_JlFh))^eY zSJnmu`#9kg-iMKa?Ri{#`xNMGL;TPzNRzI#3 z8MsqMsd24}0(sIUBJC+9B4;`TnD_*b{&o-x=3rLjh8hd#=eCY)rYWXz(06_d7Yt@g@X2I=cg9FxD-pHbQHs0j5eIXgF2fQm5 ze_?$ta~6smfwL3q8vgHt;vb^$zUokq)F;5EkvFadTKt`Bf3|4;+l=VP+|hhy(dja3 z4>VW|$dc>SElZ!4KK`0me$DRwCh7ab#|hV#L@(oc5B+E9(8`4*Ts^#@{cVJF>>AJK zf1Ta_yGFE(rKmqc@Bhx~{Lju0O<-XATkIM7@_(H52c6^}A>z=_|9`8XyYR0u6&9}f fzxH0?jX9Q-A5HEMKD21W3iY+rb=7iJt#AGx1YxA& literal 0 HcmV?d00001 diff --git a/content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md b/content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md new file mode 100644 index 0000000000..5475640e3b --- /dev/null +++ b/content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md @@ -0,0 +1,79 @@ +--- +layout: blog +title: 'Alpha in v1.22: Windows HostProcess Containers' +date: 2021-08-16 +slug: windows-hostprocess-containers +--- + +**Authors:** Brandon Smith (Microsoft) + +Kubernetes v1.22 introduced a new alpha feature for clusters that +include Windows nodes: HostProcess containers. + +HostProcess containers aim to extend the Windows container model to enable a wider +range of Kubernetes cluster management scenarios. HostProcess containers run +directly on the host and maintain behavior and access similar to that of a regular +process. With HostProcess containers, users can package and distribute management +operations and functionalities that require host access while retaining versioning +and deployment methods provided by containers. This allows Windows containers to +be used for a variety of device plugin, storage, and networking management scenarios +in Kubernetes. With this comes the enablement of host network mode—allowing +HostProcess containers to be created within the host's network namespace instead of +their own. HostProcess containers can also be built on top of existing Windows server +2019 (or later) base images, managed through the Windows container runtime, and run +as any user that is available on or in the domain of the host machine. + +Linux privileged containers are currently used for a variety of key scenarios in +Kubernetes, including kube-proxy (via kubeadm), storage, and networking scenarios. +Support for these scenarios in Windows previously required workarounds via proxies +or other implementations. Using HostProcess containers, cluster operators no longer +need to log onto and individually configure each Windows node for administrative +tasks and management of Windows services. Operators can now utilize the container +model to deploy management logic to as many clusters as needed with ease. + +## How does it work? + +Windows HostProcess containers are implemented with Windows _Job Objects_, a break from the +previous container model using server silos. Job objects are components of the Windows OS which offer the ability to +manage a group of processes as a group (a.k.a. _jobs_) and assign resource constraints to the +group as a whole. Job objects are specific to the Windows OS and are not associated with the Kubernetes [Job API](https://kubernetes.io/docs/concepts/workloads/controllers/job/). They have no process or file system isolation, +enabling the privileged payload to view and edit the host file system with the +correct permissions, among other host resources. The init process, and any processes +it launches or that are explicitly launched by the user, are all assigned to the +job object of that container. When the init process exits or is signaled to exit, +all the processes in the job will be signaled to exit, the job handle will be +closed and the storage will be unmounted. + +HostProcess and Linux privileged containers enable similar scenarios but differ +greatly in their implementation (hence the naming difference). HostProcess containers +have their own pod security policies. Those used to configure Linux privileged +containers **do not** apply. Enabling privileged access to a Windows host is a +fundamentally different process than with Linux so the configuration and +capabilities of each differ significantly. Below is a diagram detailing the +overall architecture of Windows HostProcess containers: + +{{< figure src="hostprocess-architecture.png" alt="HostProcess Architecture" >}} + +## How do I use it? + +HostProcess containers can be run from within a +[HostProcess Pod](/docs/tasks/configure-pod-container/create-hostprocess-pod). +With the feature enabled on Kubernetes version 1.22, a containerd container runtime of +1.5.4 or higher, and the latest version of hcsshim, deploying a pod spec with the +[correct HostProcess configuration](/docs/tasks/configure-pod-container/create-hostprocess-pod/#before-you-begin) +will enable you to run HostProcess containers. To get started with running +Windows containers see the general guidance for [Windows in Kubernetes](/docs/setup/production-environment/windows/) + +## How can I learn more? + +- Work through [Create a Windows HostProcess Pod](/docs/tasks/configure-pod-container/create-hostprocess-pod/) + +- Read about Kubernetes [Pod Security Standards](/docs/concepts/security/pod-security-standards/) + +- Read the enhancement proposal [Windows Privileged Containers and Host Networking Mode](https://github.com/kubernetes/enhancements/tree/master/keps/sig-windows/1981-windows-privileged-container-support) (KEP-1981) + +## How do I get involved? + +HostProcess containers are in active development. SIG Windows welcomes suggestions from the community. +Get involved with [SIG Windows](https://github.com/kubernetes/community/tree/master/sig-windows) +to contribute! From 944733cb20e6921b912cba395b96a66a9c5fb48e Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 18 Aug 2021 16:03:44 +0100 Subject: [PATCH 179/279] Fix date for published blog article This change affects the date shown in the repository and does NOT affect the URL or content of the published article. --- .../hostprocess-architecture.png | Bin .../index.md | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename content/en/blog/_posts/{2021-08-11-support-for-HostProcess-Containers => 2021-08-16-support-for-hostprocess-containers}/hostprocess-architecture.png (100%) rename content/en/blog/_posts/{2021-08-11-support-for-HostProcess-Containers => 2021-08-16-support-for-hostprocess-containers}/index.md (100%) diff --git a/content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/hostprocess-architecture.png b/content/en/blog/_posts/2021-08-16-support-for-hostprocess-containers/hostprocess-architecture.png similarity index 100% rename from content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/hostprocess-architecture.png rename to content/en/blog/_posts/2021-08-16-support-for-hostprocess-containers/hostprocess-architecture.png diff --git a/content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md b/content/en/blog/_posts/2021-08-16-support-for-hostprocess-containers/index.md similarity index 100% rename from content/en/blog/_posts/2021-08-11-support-for-HostProcess-Containers/index.md rename to content/en/blog/_posts/2021-08-16-support-for-hostprocess-containers/index.md From dad01370f87018d28f7ce6d88f5bf3a76d5d5e64 Mon Sep 17 00:00:00 2001 From: Jim Bugwadia Date: Wed, 18 Aug 2021 11:07:02 -0700 Subject: [PATCH 180/279] add kyverno and fix OPA/GK link Signed-off-by: Jim Bugwadia --- content/en/docs/concepts/security/pod-security-standards.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/en/docs/concepts/security/pod-security-standards.md b/content/en/docs/concepts/security/pod-security-standards.md index 5636f95eb4..f3b43344bf 100644 --- a/content/en/docs/concepts/security/pod-security-standards.md +++ b/content/en/docs/concepts/security/pod-security-standards.md @@ -499,8 +499,9 @@ built-in [Pod Security Admission Controller](/docs/concepts/security/pod-securit Other alternatives for enforcing security profiles are being developed in the Kubernetes ecosystem, such as: -- [OPA Gatekeeper](https://github.com/open-profile-agent/gatekeeper) +- [OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper). - [Kubewarden](https://github.com/kubewarden). +- [Kyverno](https://kyverno.io/policies/pod-security/). ### What profiles should I apply to my Windows Pods? From de7bca791e4441cb4775bb38be0f66840bc6e31e Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Thu, 19 Aug 2021 11:00:21 +0100 Subject: [PATCH 181/279] Fix hyperlink --- content/en/blog/_posts/2021-08-30-volume-populators-alpha.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/blog/_posts/2021-08-30-volume-populators-alpha.md b/content/en/blog/_posts/2021-08-30-volume-populators-alpha.md index 01eabda421..4f3a408584 100644 --- a/content/en/blog/_posts/2021-08-30-volume-populators-alpha.md +++ b/content/en/blog/_posts/2021-08-30-volume-populators-alpha.md @@ -211,7 +211,7 @@ The enhancement proposal, [Volume Populators](https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/1495-volume-populators), includes lots of detail about the history and technical implementation of this feature. -[Volume populators and data sources] (in the documenation topic about persistent volumes) +[Volume populators and data sources](/docs/concepts/storage/persistent-volumes/#volume-populators-and-data-sources), within the documentation topic about persistent volumes, explains how to use this feature in your cluster. Please get involved by joining the Kubernetes storage SIG to help us enhance this From 8c3eb6e414bbfda4c7dbb4ccab04ee9459b61702 Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Thu, 19 Aug 2021 09:51:54 -0400 Subject: [PATCH 182/279] Clarify audit annotation destination --- content/en/docs/concepts/security/pod-security-admission.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/security/pod-security-admission.md b/content/en/docs/concepts/security/pod-security-admission.md index 09387521ab..0ecea6d3ee 100644 --- a/content/en/docs/concepts/security/pod-security-admission.md +++ b/content/en/docs/concepts/security/pod-security-admission.md @@ -63,7 +63,7 @@ takes if a potential violation is detected: Mode | Description :---------|:------------ **`enforce`** | Policy violations will cause the pod to be rejected. -**`audit`** | Policy violations will trigger the addition of an audit annotation, but are otherwise allowed. +**`audit`** | Policy violations will trigger the addition of an audit annotation to the event recorded in the [audit log](/docs/tasks/debug-application-cluster/audit/), but are otherwise allowed. **`warn`** | Policy violations will trigger a user-facing warning, but are otherwise allowed. {{< /table >}} From 315e290107052cad4e19e6ab010042dac824746e Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Thu, 19 Aug 2021 10:04:34 -0400 Subject: [PATCH 183/279] Avoid word-break on narrow page widths --- content/en/docs/concepts/security/pod-security-admission.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/en/docs/concepts/security/pod-security-admission.md b/content/en/docs/concepts/security/pod-security-admission.md index 0ecea6d3ee..8df9d5616a 100644 --- a/content/en/docs/concepts/security/pod-security-admission.md +++ b/content/en/docs/concepts/security/pod-security-admission.md @@ -62,9 +62,9 @@ takes if a potential violation is detected: {{< table caption="Pod Security Admission modes" >}} Mode | Description :---------|:------------ -**`enforce`** | Policy violations will cause the pod to be rejected. -**`audit`** | Policy violations will trigger the addition of an audit annotation to the event recorded in the [audit log](/docs/tasks/debug-application-cluster/audit/), but are otherwise allowed. -**`warn`** | Policy violations will trigger a user-facing warning, but are otherwise allowed. +**enforce** | Policy violations will cause the pod to be rejected. +**audit** | Policy violations will trigger the addition of an audit annotation to the event recorded in the [audit log](/docs/tasks/debug-application-cluster/audit/), but are otherwise allowed. +**warn** | Policy violations will trigger a user-facing warning, but are otherwise allowed. {{< /table >}} A namespace can configure any or all modes, or even set a different level for different modes. From 162da6561bcf225fb97e537ca206ff4ad1a7e540 Mon Sep 17 00:00:00 2001 From: Abirdcfly Date: Thu, 19 Aug 2021 10:55:00 +0800 Subject: [PATCH 184/279] Update rbac.md: Describe in detail how to specify resourceNames when using list/watch verbs --- content/en/docs/reference/access-authn-authz/rbac.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/content/en/docs/reference/access-authn-authz/rbac.md b/content/en/docs/reference/access-authn-authz/rbac.md index a954b5c513..5faf4a3ea8 100644 --- a/content/en/docs/reference/access-authn-authz/rbac.md +++ b/content/en/docs/reference/access-authn-authz/rbac.md @@ -279,8 +279,9 @@ rules: ``` {{< note >}} -You cannot restrict `create` or `deletecollection` requests by resourceName. For `create`, this -limitation is because the object name is not known at authorization time. +You cannot restrict `create` or `deletecollection` requests by their resource name. +For `create`, this limitation is because the name of the new object may not be known at authorization time. +If you restrict `list` or `watch` by resourceName, then the only way that a client including kubectl can perform that `list` or `watch` is by specifying a field selector that matches on metadata.name. {{< /note >}} From 2b268b1a76ada89f3a01c76e59c7b771cd032e13 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Harris=20Brakmi=C4=87?= Date: Thu, 19 Aug 2021 22:07:59 +0200 Subject: [PATCH 185/279] trivial: typo A small typo. --- .../overview/working-with-objects/kubernetes-objects.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/overview/working-with-objects/kubernetes-objects.md b/content/en/docs/concepts/overview/working-with-objects/kubernetes-objects.md index 38165d0024..c763b40e05 100644 --- a/content/en/docs/concepts/overview/working-with-objects/kubernetes-objects.md +++ b/content/en/docs/concepts/overview/working-with-objects/kubernetes-objects.md @@ -84,7 +84,7 @@ In the `.yaml` file for the Kubernetes object you want to create, you'll need to The precise format of the object `spec` is different for every Kubernetes object, and contains nested fields specific to that object. The [Kubernetes API Reference](https://kubernetes.io/docs/reference/kubernetes-api/) can help you find the spec format for all of the objects you can create using Kubernetes. For example, the reference for Pod details the [`spec` field](/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodSpec) -for a Pod in the API, and the reference for Deployment details the [`spec` field](/docs/reference/kubernetes-api/workload-resources/deployment-v1/#DeploymentSpec) for Deployents. +for a Pod in the API, and the reference for Deployment details the [`spec` field](/docs/reference/kubernetes-api/workload-resources/deployment-v1/#DeploymentSpec) for Deployments. In those API reference pages you'll see mention of PodSpec and DeploymentSpec. These names are implementation details of the Golang code that Kubernetes uses to implement its API. From b3ecce8eb08f64fbb7a9b329a3e2390102d971bb Mon Sep 17 00:00:00 2001 From: Arhell Date: Fri, 20 Aug 2021 02:27:49 +0300 Subject: [PATCH 186/279] [id] Fixed link to API priority and fairness enhancement proposal --- content/id/docs/concepts/cluster-administration/flow-control.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/id/docs/concepts/cluster-administration/flow-control.md b/content/id/docs/concepts/cluster-administration/flow-control.md index b8d8f9acf7..4f6036c0ca 100644 --- a/content/id/docs/concepts/cluster-administration/flow-control.md +++ b/content/id/docs/concepts/cluster-administration/flow-control.md @@ -368,7 +368,7 @@ beban kerja yang berperilaku buruk yang dapat membahayakan kesehatan dari sistem Untuk latar belakang informasi mengenai detail desain dari prioritas dan kesetaraan API, silahkan lihat -[proposal pembaharuan](https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/20190228-priority-and-fairness.md). +[proposal pembaharuan](https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/1040-priority-and-fairness). Kamu juga dapat membuat saran dan permintaan akan fitur melalui [SIG API Machinery](https://github.com/kubernetes/community/tree/master/sig-api-machinery). From 64f91d8e2cb6a111bfc0857a9241adc64aad6842 Mon Sep 17 00:00:00 2001 From: Rey Lejano Date: Thu, 19 Aug 2021 17:00:10 -0700 Subject: [PATCH 187/279] add note on owner references in garbage collection page add note on owner references to owner dependents page --- .../architecture/garbage-collection.md | 18 ++++++++++++++++++ .../working-with-objects/owners-dependents.md | 18 ++++++++++++++++++ 2 files changed, 36 insertions(+) diff --git a/content/en/docs/concepts/architecture/garbage-collection.md b/content/en/docs/concepts/architecture/garbage-collection.md index f5f8c9c38e..7c70675fff 100644 --- a/content/en/docs/concepts/architecture/garbage-collection.md +++ b/content/en/docs/concepts/architecture/garbage-collection.md @@ -37,6 +37,24 @@ to the labels, each `EndpointSlice` that is managed on behalf of a Service has an owner reference. Owner references help different parts of Kubernetes avoid interfering with objects they don’t control. +{{< note >}} +Cross-namespace owner references are disallowed by design. +Namespaced dependents can specify cluster-scoped or namespaced owners. +A namespaced owner **must** exist in the same namespace as the dependent. +If it does not, the owner reference is treated as absent, and the dependent +is subject to deletion once all owners are verified absent. + +Cluster-scoped dependents can only specify cluster-scoped owners. +In v1.20+, if a cluster-scoped dependent specifies a namespaced kind as an owner, +it is treated as having an unresolvable owner reference, and is not able to be garbage collected. + +In v1.20+, if the garbage collector detects an invalid cross-namespace `ownerReference`, +or a cluster-scoped dependent with an `ownerReference` referencing a namespaced kind, a warning Event +with a reason of `OwnerRefInvalidNamespace` and an `involvedObject` of the invalid dependent is reported. +You can check for that kind of Event by running +`kubectl get events -A --field-selector=reason=OwnerRefInvalidNamespace`. +{{< /note >}} + ## Cascading deletion {#cascading-deletion} Kubernetes checks for and deletes objects that no longer have owner diff --git a/content/en/docs/concepts/overview/working-with-objects/owners-dependents.md b/content/en/docs/concepts/overview/working-with-objects/owners-dependents.md index a981745ca3..ea40c3b3a3 100644 --- a/content/en/docs/concepts/overview/working-with-objects/owners-dependents.md +++ b/content/en/docs/concepts/overview/working-with-objects/owners-dependents.md @@ -42,6 +42,24 @@ A Kubernetes admission controller controls user access to change this field for dependent resources, based on the delete permissions of the owner. This control prevents unauthorized users from delaying owner object deletion. +{{< note >}} +Cross-namespace owner references are disallowed by design. +Namespaced dependents can specify cluster-scoped or namespaced owners. +A namespaced owner **must** exist in the same namespace as the dependent. +If it does not, the owner reference is treated as absent, and the dependent +is subject to deletion once all owners are verified absent. + +Cluster-scoped dependents can only specify cluster-scoped owners. +In v1.20+, if a cluster-scoped dependent specifies a namespaced kind as an owner, +it is treated as having an unresolvable owner reference, and is not able to be garbage collected. + +In v1.20+, if the garbage collector detects an invalid cross-namespace `ownerReference`, +or a cluster-scoped dependent with an `ownerReference` referencing a namespaced kind, a warning Event +with a reason of `OwnerRefInvalidNamespace` and an `involvedObject` of the invalid dependent is reported. +You can check for that kind of Event by running +`kubectl get events -A --field-selector=reason=OwnerRefInvalidNamespace`. +{{< /note >}} + ## Ownership and finalizers When you tell Kubernetes to delete a resource, the API server allows the From 4211fa7007e63f0bfaae16fb022399b67284d40f Mon Sep 17 00:00:00 2001 From: cndoit18 Date: Wed, 18 Aug 2021 18:32:10 +0800 Subject: [PATCH 188/279] feat(cronjob): description of the cronjob schedule timezone Signed-off-by: cndoit18 --- .../workloads/controllers/cron-jobs.md | 27 ++++++++++--------- 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/content/en/docs/concepts/workloads/controllers/cron-jobs.md b/content/en/docs/concepts/workloads/controllers/cron-jobs.md index b441bdcd41..17c4699be5 100644 --- a/content/en/docs/concepts/workloads/controllers/cron-jobs.md +++ b/content/en/docs/concepts/workloads/controllers/cron-jobs.md @@ -10,13 +10,15 @@ weight: 80 -{{< feature-state for_k8s_version="v1.21" state="stable" >}} +{{< feature-state for_k8s_version="v1.22" state="stable" >}} A _CronJob_ creates {{< glossary_tooltip term_id="job" text="Jobs" >}} on a repeating schedule. One CronJob object is like one line of a _crontab_ (cron table) file. It runs a job periodically on a given schedule, written in [Cron](https://en.wikipedia.org/wiki/Cron) format. +In addition, the CronJob schedule supports timezone handling, you can specify the timezone by adding "CRON_TZ=