Add kubelet config reference
This is a reference for kubelet config generated from github.com/tengqm/genref tool using the following command: ./genref -include kubelet-config
This commit is contained in:
@@ -224,7 +224,7 @@ When a ConfigMap currently consumed in a volume is updated, projected keys are e
|
||||
The kubelet checks whether the mounted ConfigMap is fresh on every periodic sync.
|
||||
However, the kubelet uses its local cache for getting the current value of the ConfigMap.
|
||||
The type of the cache is configurable using the `ConfigMapAndSecretChangeDetectionStrategy` field in
|
||||
the [KubeletConfiguration struct](https://github.com/kubernetes/kubernetes/blob/{{< param "docsbranch" >}}/staging/src/k8s.io/kubelet/config/v1beta1/types.go).
|
||||
the [KubeletConfiguration struct](/docs/reference/config-api/kubelet-config.v1beta1/)).
|
||||
A ConfigMap can be either propagated by watch (default), ttl-based, or by redirecting
|
||||
all requests directly to the API server.
|
||||
As a result, the total delay from the moment when the ConfigMap is updated to the moment
|
||||
@@ -233,6 +233,7 @@ propagation delay, where the cache propagation delay depends on the chosen cache
|
||||
(it equals to watch propagation delay, ttl of cache, or zero correspondingly).
|
||||
|
||||
ConfigMaps consumed as environment variables are not updated automatically and require a pod restart.
|
||||
|
||||
## Immutable ConfigMaps {#configmap-immutable}
|
||||
|
||||
{{< feature-state for_k8s_version="v1.19" state="beta" >}}
|
||||
|
||||
@@ -21,9 +21,6 @@ allowed to use more of that resource than the limit you set. The kubelet also re
|
||||
at least the _request_ amount of that system resource specifically for that container
|
||||
to use.
|
||||
|
||||
|
||||
|
||||
|
||||
<!-- body -->
|
||||
|
||||
## Requests and limits
|
||||
@@ -442,12 +439,15 @@ If you want to use project quotas, you should:
|
||||
|
||||
* Enable the `LocalStorageCapacityIsolationFSQuotaMonitoring=true`
|
||||
[feature gate](/docs/reference/command-line-tools-reference/feature-gates/)
|
||||
in the kubelet configuration.
|
||||
using the `featureGates` field in the
|
||||
[kubelet configuration](/docs/reference/config-api/kubelet-config.v1beta1/)
|
||||
or the `--feature-gates` command line flag.
|
||||
|
||||
* Ensure that the root filesystem (or optional runtime filesystem)
|
||||
has project quotas enabled. All XFS filesystems support project quotas.
|
||||
For ext4 filesystems, you need to enable the project quota tracking feature
|
||||
while the filesystem is not mounted.
|
||||
|
||||
```bash
|
||||
# For ext4, with /dev/block-device not mounted
|
||||
sudo tune2fs -O project -Q prjquota /dev/block-device
|
||||
|
||||
@@ -668,7 +668,7 @@ When a secret currently consumed in a volume is updated, projected keys are even
|
||||
The kubelet checks whether the mounted secret is fresh on every periodic sync.
|
||||
However, the kubelet uses its local cache for getting the current value of the Secret.
|
||||
The type of the cache is configurable using the `ConfigMapAndSecretChangeDetectionStrategy` field in
|
||||
the [KubeletConfiguration struct](https://github.com/kubernetes/kubernetes/blob/{{< param "docsbranch" >}}/staging/src/k8s.io/kubelet/config/v1beta1/types.go).
|
||||
the [KubeletConfiguration struct](/docs/reference/config-api/kubelet-config.v1beta1/).
|
||||
A Secret can be either propagated by watch (default), ttl-based, or by redirecting
|
||||
all requests directly to the API server.
|
||||
As a result, the total delay from the moment when the Secret is updated to the moment
|
||||
@@ -760,8 +760,8 @@ data has the following advantages:
|
||||
- improves performance of your cluster by significantly reducing load on kube-apiserver, by
|
||||
closing watches for secrets marked as immutable.
|
||||
|
||||
This feature is controlled by the `ImmutableEphemeralVolumes` [feature
|
||||
gate](/docs/reference/command-line-tools-reference/feature-gates/),
|
||||
This feature is controlled by the `ImmutableEphemeralVolumes`
|
||||
[feature gate](/docs/reference/command-line-tools-reference/feature-gates/),
|
||||
which is enabled by default since v1.19. You can create an immutable
|
||||
Secret by setting the `immutable` field to `true`. For example,
|
||||
```yaml
|
||||
@@ -865,6 +865,7 @@ start until all the Pod's volumes are mounted.
|
||||
### Use-Case: As container environment variables
|
||||
|
||||
Create a secret
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
@@ -877,6 +878,7 @@ data:
|
||||
```
|
||||
|
||||
Create the Secret:
|
||||
|
||||
```shell
|
||||
kubectl apply -f mysecret.yaml
|
||||
```
|
||||
@@ -992,7 +994,7 @@ For example, if your actual password is `S!B\*d$zDsb=`, you should execute the c
|
||||
kubectl create secret generic dev-db-secret --from-literal=username=devuser --from-literal=password='S!B\*d$zDsb='
|
||||
```
|
||||
|
||||
You do not need to escape special characters in passwords from files (`--from-file`).
|
||||
You do not need to escape special characters in passwords from files (`--from-file`).
|
||||
{{< /note >}}
|
||||
|
||||
Now make the Pods:
|
||||
@@ -1173,14 +1175,12 @@ privileged, system-level components.
|
||||
|
||||
Applications that need to access the Secret API should perform `get` requests on
|
||||
the secrets they need. This lets administrators restrict access to all secrets
|
||||
while [white-listing access to individual instances](
|
||||
/docs/reference/access-authn-authz/rbac/#referring-to-resources) that
|
||||
while [white-listing access to individual instances](/docs/reference/access-authn-authz/rbac/#referring-to-resources) that
|
||||
the app needs.
|
||||
|
||||
For improved performance over a looping `get`, clients can design resources that
|
||||
reference a secret then `watch` the resource, re-requesting the secret when the
|
||||
reference changes. Additionally, a ["bulk watch" API](
|
||||
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/bulk_watch.md)
|
||||
reference changes. Additionally, a ["bulk watch" API](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/bulk_watch.md)
|
||||
to let clients `watch` individual resources has also been proposed, and will likely
|
||||
be available in future releases of Kubernetes.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user