From 03e91e6015e26a71024ab7411b4ff0f182a4c600 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20Pab=C3=B3n?= Date: Mon, 7 Aug 2017 15:28:43 -0400 Subject: [PATCH 01/23] Create new cloud-provider documentation This new document location now houses the specific configurations for cloud providers, starting with AWS. --- _data/concepts.yml | 1 + .../cluster-administration/cloud-providers.md | 61 +++++++++++++++++++ 2 files changed, 62 insertions(+) create mode 100644 docs/concepts/cluster-administration/cloud-providers.md diff --git a/_data/concepts.yml b/_data/concepts.yml index 6f80ff5e1d..087455eb36 100644 --- a/_data/concepts.yml +++ b/_data/concepts.yml @@ -81,6 +81,7 @@ toc: - title: Cluster Administration section: - docs/concepts/cluster-administration/cluster-administration-overview.md + - docs/concepts/cluster-administration/cloud-providers.md - docs/concepts/cluster-administration/manage-deployment.md - docs/concepts/cluster-administration/networking.md - docs/concepts/cluster-administration/network-plugins.md diff --git a/docs/concepts/cluster-administration/cloud-providers.md b/docs/concepts/cluster-administration/cloud-providers.md new file mode 100644 index 0000000000..e0b60896dd --- /dev/null +++ b/docs/concepts/cluster-administration/cloud-providers.md @@ -0,0 +1,61 @@ +--- +title: Cloud Providers +--- + +{% capture overview %} +This page explains how to manage Kubernetes running on a specific +cloud provider. +{% endcapture %} + +{% capture body %} +# AWS +This section describes all the possible configurations which can +be used when running Kubernetes on Amazon Web Services. + +## Load Balancers +You can setup [external load balancers](/docs/tasks/access-application-cluster/create-external-load-balancer) +to use specific features in AWS by configuring the annotations as shown below. + +```yaml +apiVersion: v1 +kind: Service +metadata: + name: example + namespace: kube-system + labels: + run: example + annotations: + service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:xx-xxxx-x:xxxxxxxxx:xxxxxxx/xxxxx-xxxx-xxxx-xxxx-xxxxxxxxx #replace this value + service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http +spec: + type: LoadBalancer + ports: + - port: 443 + targetPort: 5556 + protocol: TCP + selector: + app: example +``` +Different settings can be applied to a load balancer service in AWS using _annotations_. The following describes the annotations supported on AWS ELBs: + +* `service.beta.kubernetes.io/aws-load-balancer-access-log-emit-interval`: Used to specify access log emit interval. +* `service.beta.kubernetes.io/aws-load-balancer-access-log-enabled`: Used on the service to enable or disable access logs. +* `service.beta.kubernetes.io/aws-load-balancer-access-log-s3-bucket-name`: Used to specify access log s3 bucket name. +* `service.beta.kubernetes.io/aws-load-balancer-access-log-s3-bucket-prefix`: Used to specify access log s3 bucket prefix. +* `service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags`: Used on the service to specify a comma-separated list of key-value pairs which will be recorded as additional tags in the ELB. For example: `"Key1=Val1,Key2=Val2,KeyNoVal1=,KeyNoVal2"`. +* `service.beta.kubernetes.io/aws-load-balancer-backend-protocol`: Used on the service to specify the protocol spoken by the backend (pod) behind a listener. If `http` (default) or `https`, an HTTPS listener that terminates the connection and parses headers is created. If set to `ssl` or `tcp`, a "raw" SSL listener is used. If set to `http` and `aws-load-balancer-ssl-cert` is not used then a HTTP listener is used. +* `service.beta.kubernetes.io/aws-load-balancer-ssl-cert`: Used on the service to request a secure listener. Value is a valid certificate ARN. For more, see http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-listener-config.html CertARN is an IAM or CM certificate ARN, e.g. `arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012`. +* `service.beta.kubernetes.io/aws-load-balancer-connection-draining-enabled`: Used on the service to enable or disable connection draining. +* `service.beta.kubernetes.io/aws-load-balancer-connection-draining-timeout`: Used on the service to specify a connection draining timeout. +* `service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout`: Used on the service to specify the idle connection timeout. +* `service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled`: Used on the service to enable or disable cross-zone load balancing. +* `service.beta.kubernetes.io/aws-load-balancer-extra-security-groups`: Used one the service to specify additional security groups to be added to ELB created +* `service.beta.kubernetes.io/aws-load-balancer-internal`: Used on the service to indicate that we want an internal ELB. +* `service.beta.kubernetes.io/aws-load-balancer-proxy-protocol`: Used on the service to enable the proxy protocol on an ELB. Right now we only accept the value `*` which means enable the proxy protocol on all ELB backends. In the future we could adjust this to allow setting the proxy protocol only on certain backends. +* `service.beta.kubernetes.io/aws-load-balancer-ssl-ports`: Used on the service to specify a comma-separated list of ports that will use SSL/HTTPS listeners. Defaults to `*` (all) + +The information for the annotations for AWS is taken from the comments on [aws.go](https://github.com/kubernetes/kubernetes/blob/master/pkg/cloudprovider/providers/aws/aws.go) + +{% endcapture %} + +{% include templates/concept.md %} From 8cec9c3987d75899ad5e0588a5d7ca169d76dd97 Mon Sep 17 00:00:00 2001 From: Dhilip Date: Thu, 31 Aug 2017 01:20:14 +0530 Subject: [PATCH 02/23] fix a broken link --- docs/concepts/cluster-administration/logging.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/concepts/cluster-administration/logging.md b/docs/concepts/cluster-administration/logging.md index 42475f124f..ad90ba9e4e 100644 --- a/docs/concepts/cluster-administration/logging.md +++ b/docs/concepts/cluster-administration/logging.md @@ -60,7 +60,7 @@ so that logs don't consume all available storage on the node. Kubernetes currently is not responsible for rotating logs, but rather a deployment tool should set up a solution to address that. For example, in Kubernetes clusters, deployed by the `kube-up.sh` script, -there is a [`logrotate`](http://www.linuxcommand.org/man_pages/logrotate8.html) +there is a [`logrotate`](https://linux.die.net/man/8/logrotate) tool configured to run each hour. You can also set up a container runtime to rotate application's logs automatically, e.g. by using Docker's `log-opt`. In the `kube-up.sh` script, the latter approach is used for COS image on GCP, From e9ca01a46e47c48c7c76ef2fe4f8803b570b540c Mon Sep 17 00:00:00 2001 From: mattjmcnaughton Date: Wed, 30 Aug 2017 20:41:15 -0400 Subject: [PATCH 03/23] Add links to cassandra example required knowledge When going through this section of the documentation, I found myself wishing the concepts linked to the relevant documentation, so I could verify I understood the concepts. --- docs/tutorials/stateful-application/cassandra.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/tutorials/stateful-application/cassandra.md b/docs/tutorials/stateful-application/cassandra.md index c7d23d0be3..1b729dfd42 100644 --- a/docs/tutorials/stateful-application/cassandra.md +++ b/docs/tutorials/stateful-application/cassandra.md @@ -24,11 +24,11 @@ The docker is based on `debian:jessie` and includes OpenJDK 8. This image includ {% endcapture %} {% capture objectives %} -* Create and Validate a Cassandra headless `Service`. -* Use a `StatefulSet` to create a Cassandra ring. -* Validate the `StatefulSet`. -* Modify the `StatefulSet`. -* Delete the `StatefulSet` and its `Pods`. +* Create and Validate a Cassandra headless [Services](/docs/concepts/services-networking/service/). +* Use a [StatefulSet](/docs/concepts/workloads/controllers/statefulset/) to create a Cassandra ring. +* Validate the [StatefulSet](/docs/concepts/workloads/controllers/statefulset/). +* Modify the [StatefulSet](/docs/concepts/workloads/controllers/statefulset/). +* Delete the [StatefulSet](/docs/concepts/workloads/controllers/statefulset/) and its [Pods](/docs/concepts/workloads/pods/pod/). {% endcapture %} {% capture prerequisites %} From b61bc9b32fb7fa48eefc3ae12803b1bf9ecfa9ae Mon Sep 17 00:00:00 2001 From: chenhuan12 Date: Thu, 31 Aug 2017 10:57:24 +0800 Subject: [PATCH 04/23] fix typo fix typo --- docs/tutorials/stateful-application/zookeeper.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/tutorials/stateful-application/zookeeper.md b/docs/tutorials/stateful-application/zookeeper.md index 1ef52a7a23..cbf60d159e 100644 --- a/docs/tutorials/stateful-application/zookeeper.md +++ b/docs/tutorials/stateful-application/zookeeper.md @@ -367,7 +367,7 @@ statefulset "zk" deleted Watch the termination of the Pods in the StatefulSet. ```shell -get pods -w -l app=zk +kubectl get pods -w -l app=zk ``` When `zk-0` if fully terminated, use `CRTL-C` to terminate kubectl. From e99a7c9db83fff6fbe465e137423fa6ac45e0bb8 Mon Sep 17 00:00:00 2001 From: Matt Dorn Date: Thu, 31 Aug 2017 17:41:35 -0700 Subject: [PATCH 05/23] use the term 'node' for consistency --- docs/concepts/storage/volumes.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/concepts/storage/volumes.md b/docs/concepts/storage/volumes.md index 28cb140e48..e6030cf18a 100644 --- a/docs/concepts/storage/volumes.md +++ b/docs/concepts/storage/volumes.md @@ -112,11 +112,11 @@ Some uses for an `emptyDir` are: container serves the data By default, `emptyDir` volumes are stored on whatever medium is backing the -machine - that might be disk or SSD or network storage, depending on your +node - that might be disk or SSD or network storage, depending on your environment. However, you can set the `emptyDir.medium` field to `"Memory"` to tell Kubernetes to mount a tmpfs (RAM-backed filesystem) for you instead. While tmpfs is very fast, be aware that unlike disks, tmpfs is cleared on -machine reboot and any files you write will count against your container's +node reboot and any files you write will count against your container's memory limit. #### Example pod From 4cd97a2162d79dee365e24a1b59aab168c47c886 Mon Sep 17 00:00:00 2001 From: kairen Date: Fri, 1 Sep 2017 11:33:08 +0800 Subject: [PATCH 06/23] Fix curl does not work in zsh --- docs/tasks/tools/install-kubectl.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/tasks/tools/install-kubectl.md b/docs/tasks/tools/install-kubectl.md index c47ec67d3b..5d52e04c74 100644 --- a/docs/tasks/tools/install-kubectl.md +++ b/docs/tasks/tools/install-kubectl.md @@ -20,7 +20,7 @@ Here are a few methods to install kubectl. {% capture macos %} 1. Download the latest release with the command: - curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/darwin/amd64/kubectl + curl -LO https://storage.googleapis.com/kubernetes-release/release/`curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/darwin/amd64/kubectl To download a specific version, replace the `$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)` portion of the command with the specific version. From e8ade710001d1ac264b6a87cdbf0c004d35ffb9f Mon Sep 17 00:00:00 2001 From: chenhuan12 Date: Fri, 1 Sep 2017 16:34:07 +0800 Subject: [PATCH 07/23] fix the command output fix the command output --- docs/admin/authentication.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/admin/authentication.md b/docs/admin/authentication.md index 324330cf39..c0d4932cf1 100644 --- a/docs/admin/authentication.md +++ b/docs/admin/authentication.md @@ -224,6 +224,7 @@ $ kubectl get secret jenkins-token-1yvwg -o yaml apiVersion: v1 data: ca.crt: (APISERVER'S CA BASE64 ENCODED) + namespace: ZGVmYXVsdA== token: (BEARER TOKEN BASE64 ENCODED) kind: Secret metadata: From 90877ea0b92b5fa14b1e5bb4fa2bec68aeed546f Mon Sep 17 00:00:00 2001 From: chenhuan12 Date: Sat, 2 Sep 2017 10:01:53 +0800 Subject: [PATCH 08/23] fix typo fix typo --- docs/admin/authorization/rbac.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/admin/authorization/rbac.md b/docs/admin/authorization/rbac.md index 1bf36a4b15..5e7ce7de5d 100644 --- a/docs/admin/authorization/rbac.md +++ b/docs/admin/authorization/rbac.md @@ -682,6 +682,7 @@ In order from most secure to least secure, the approaches are: NOTE: Permissions given to the "default" service account are available to any pod in the namespace that does not specify a `serviceAccountName`. For example, grant read-only permission within "my-namespace" to the "default" service account: + ```shell kubectl create rolebinding default-view \ --clusterrole=view \ From 67fa4f23126e9db1800afcf06e605dee52f7c642 Mon Sep 17 00:00:00 2001 From: chenhuan12 Date: Sat, 2 Sep 2017 10:24:35 +0800 Subject: [PATCH 09/23] fix the command output fix the command output --- docs/user-guide/docker-cli-to-kubectl.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/user-guide/docker-cli-to-kubectl.md b/docs/user-guide/docker-cli-to-kubectl.md index 42d124bb50..2f4b4b7948 100644 --- a/docs/user-guide/docker-cli-to-kubectl.md +++ b/docs/user-guide/docker-cli-to-kubectl.md @@ -235,8 +235,8 @@ With kubectl: ```shell $ kubectl version -Client Version: version.Info{Major:"0", Minor:"20.1", GitVersion:"v0.20.1", GitCommit:"", GitTreeState:"not a git tree"} -Server Version: version.Info{Major:"0", Minor:"21+", GitVersion:"v0.21.1-411-g32699e873ae1ca-dirty", GitCommit:"32699e873ae1caa01812e41de7eab28df4358ee4", GitTreeState:"dirty"} +Client Version: version.Info{Major:"1", Minor:"6", GitVersion:"v1.6.9+a3d1dfa6f4335", GitCommit:"9b77fed11a9843ce3780f70dd251e92901c43072", GitTreeState:"dirty", BuildDate:"2017-08-29T20:32:58Z", OpenPaasKubernetesVersion:"v1.03.02", GoVersion:"go1.7.5", Compiler:"gc", Platform:"linux/amd64"} +Server Version: version.Info{Major:"1", Minor:"6", GitVersion:"v1.6.9+a3d1dfa6f4335", GitCommit:"9b77fed11a9843ce3780f70dd251e92901c43072", GitTreeState:"dirty", BuildDate:"2017-08-29T20:32:58Z", OpenPaasKubernetesVersion:"v1.03.02", GoVersion:"go1.7.5", Compiler:"gc", Platform:"linux/amd64"} ``` #### docker info From a9d76d294e943fe3482f20068f96f89fc001f888 Mon Sep 17 00:00:00 2001 From: TigerXu Date: Sat, 2 Sep 2017 11:41:03 +0800 Subject: [PATCH 10/23] Update disruptions.md --- docs/concepts/workloads/pods/disruptions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/concepts/workloads/pods/disruptions.md b/docs/concepts/workloads/pods/disruptions.md index d0a6fb93b1..89c324b5bc 100644 --- a/docs/concepts/workloads/pods/disruptions.md +++ b/docs/concepts/workloads/pods/disruptions.md @@ -128,7 +128,7 @@ Pods which are deleted or unavailable due to a rolling upgrade to an application against the disruption budget, but controllers (like deployment and stateful-set) are not limited by PDBs when doing rolling upgrades -- the handling of failures during application updates is configured in the controller spec. -(Learn about [updating a deployment](/docs/concepts/cluster-administration/manage-deployment/#updating-your-application-without-a-service-outage).) +(Learn about [updating a deployment](/docs/concepts/workloads/controllers/deployment/#updating-a-deployment).) When a pod is evicted using the eviction API, it is gracefully terminated (see `terminationGracePeriodSeconds` in [PodSpec](/docs/resources-reference/{{page.version}}/#podspec-v1-core).) From 41067dec8ad5269778a9ede45753a639a20fce5c Mon Sep 17 00:00:00 2001 From: Stewart-YU Date: Sun, 3 Sep 2017 11:09:38 +0800 Subject: [PATCH 11/23] Update binary_release.md It should add a url. --- docs/getting-started-guides/binary_release.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started-guides/binary_release.md b/docs/getting-started-guides/binary_release.md index e6a40dde35..ca1baf2c6d 100644 --- a/docs/getting-started-guides/binary_release.md +++ b/docs/getting-started-guides/binary_release.md @@ -37,7 +37,7 @@ For more details on the release process see the [`build`](http://releases.k8s.io ### Download Kubernetes and automatically set up a default cluster -The bash script at `https://get.k8s.io`, which can be run with `wget` or `curl`, automatically downloads Kubernetes, and provisions a cluster based on your desired cloud provider. +The bash script at [`https://get.k8s.io`](https://get.k8s.io), which can be run with `wget` or `curl`, automatically downloads Kubernetes, and provisions a cluster based on your desired cloud provider. ```shell # wget version From 64e198b9ff2121b77a4dcf1137b2507f462731a9 Mon Sep 17 00:00:00 2001 From: Cao Shufeng Date: Mon, 4 Sep 2017 14:35:10 +0800 Subject: [PATCH 12/23] fix 404 page --- docs/getting-started-guides/mesos/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started-guides/mesos/index.md b/docs/getting-started-guides/mesos/index.md index 26cc6c248a..c2fb280fbc 100644 --- a/docs/getting-started-guides/mesos/index.md +++ b/docs/getting-started-guides/mesos/index.md @@ -327,7 +327,7 @@ Future work will add instructions to this guide to enable support for Kubernetes [1]: https://docs.mesosphere.com/latest/usage/service-guides/hdfs/ [2]: https://docs.mesosphere.com/latest/usage/service-guides/spark/ -[3]: https://docs.mesosphere.com/latest/usage/service-guides/chronos/ +[3]: https://mesos.github.io/chronos/docs/getting-started.html [4]: https://releases.k8s.io/{{page.githubbranch}}/cluster/addons/dns/README.md [5]: https://dcos.io/docs/latest/administration/installing/cloud/gce/ [6]: http://mesos.apache.org/ From c6636e89df2a1c0f7bbe944fe02a1a228568e5ce Mon Sep 17 00:00:00 2001 From: kairen Date: Mon, 4 Sep 2017 15:08:07 +0800 Subject: [PATCH 13/23] Fix CRD page typo --- .../extend-api-custom-resource-definitions.md | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/docs/tasks/access-kubernetes-api/extend-api-custom-resource-definitions.md b/docs/tasks/access-kubernetes-api/extend-api-custom-resource-definitions.md index 13e015c20b..e6a855b9ac 100644 --- a/docs/tasks/access-kubernetes-api/extend-api-custom-resource-definitions.md +++ b/docs/tasks/access-kubernetes-api/extend-api-custom-resource-definitions.md @@ -112,7 +112,7 @@ Note that resource names are not case-sensitive when using kubectl, and you can use either the singular or plural forms defined in the CRD, as well as any short names. -You can also view the raw JSON data: +You can also view the raw YAML data: ```shell kubectl get ct -o yaml @@ -178,7 +178,3 @@ meaning all finalizers are done. {% endcapture %} {% include templates/task.md %} - - - - From fed5d25fb8da1782d9b80e26b4ecf27b7bbb6e12 Mon Sep 17 00:00:00 2001 From: chenhuan12 Date: Mon, 4 Sep 2017 15:37:12 +0800 Subject: [PATCH 14/23] fix the command output fix the command output --- .../workloads/controllers/replicaset.md | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/docs/concepts/workloads/controllers/replicaset.md b/docs/concepts/workloads/controllers/replicaset.md index da9275177e..a9247f15aa 100644 --- a/docs/concepts/workloads/controllers/replicaset.md +++ b/docs/concepts/workloads/controllers/replicaset.md @@ -61,12 +61,25 @@ replicaset "frontend" created $ kubectl describe rs/frontend Name: frontend Namespace: default -Image(s): gcr.io/google_samples/gb-frontend:v3 Selector: tier=frontend,tier in (frontend) Labels: app=guestbook,tier=frontend +Annotations: Replicas: 3 current / 3 desired Pods Status: 3 Running / 0 Waiting / 0 Succeeded / 0 Failed -No volumes. +Pod Template: + Labels: app=guestbook + tier=frontend + Containers: + php-redis: + Image: gcr.io/google_samples/gb-frontend:v3 + Port: 80/TCP + Requests: + cpu: 100m + memory: 100Mi + Environment: + GET_HOSTS_FROM: dns + Mounts: + Volumes: Events: FirstSeen LastSeen Count From SubobjectPath Type Reason Message --------- -------- ----- ---- ------------- -------- ------ ------- From fe11347d6ffa8b63743dadc6e8d699174a150486 Mon Sep 17 00:00:00 2001 From: chenhuan12 Date: Mon, 4 Sep 2017 15:46:47 +0800 Subject: [PATCH 15/23] fix the command output fix the command output --- .../workloads/controllers/replicationcontroller.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/docs/concepts/workloads/controllers/replicationcontroller.md b/docs/concepts/workloads/controllers/replicationcontroller.md index e4b2529c95..42f929317f 100644 --- a/docs/concepts/workloads/controllers/replicationcontroller.md +++ b/docs/concepts/workloads/controllers/replicationcontroller.md @@ -55,11 +55,20 @@ Check on the status of the ReplicationController using this command: $ kubectl describe replicationcontrollers/nginx Name: nginx Namespace: default -Image(s): nginx Selector: app=nginx Labels: app=nginx +Annotations: Replicas: 3 current / 3 desired Pods Status: 0 Running / 3 Waiting / 0 Succeeded / 0 Failed +Pod Template: + Labels: app=nginx + Containers: + nginx: + Image: nginx + Port: 80/TCP + Environment: + Mounts: + Volumes: Events: FirstSeen LastSeen Count From SubobjectPath Type Reason Message --------- -------- ----- ---- ------------- ---- ------ ------- From 2c5ae8d514e75f7f497adfc087eecb737ad05c23 Mon Sep 17 00:00:00 2001 From: chenhuan12 Date: Tue, 5 Sep 2017 09:40:07 +0800 Subject: [PATCH 16/23] fix the command output fix the command output --- .../controllers/jobs-run-to-completion.md | 21 ++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/docs/concepts/workloads/controllers/jobs-run-to-completion.md b/docs/concepts/workloads/controllers/jobs-run-to-completion.md index 1c5ceed3df..4ba2f74b00 100644 --- a/docs/concepts/workloads/controllers/jobs-run-to-completion.md +++ b/docs/concepts/workloads/controllers/jobs-run-to-completion.md @@ -41,14 +41,29 @@ Check on the status of the job using this command: $ kubectl describe jobs/pi Name: pi Namespace: default -Image(s): perl Selector: controller-uid=b1db589a-2c8d-11e6-b324-0209dc45a495 +Labels: controller-uid=b1db589a-2c8d-11e6-b324-0209dc45a495 + job-name=pi +Annotations: Parallelism: 1 Completions: 1 Start Time: Tue, 07 Jun 2016 10:56:16 +0200 -Labels: controller-uid=b1db589a-2c8d-11e6-b324-0209dc45a495,job-name=pi Pods Statuses: 0 Running / 1 Succeeded / 0 Failed -No volumes. +Pod Template: + Labels: controller-uid=b1db589a-2c8d-11e6-b324-0209dc45a495 + job-name=pi + Containers: + pi: + Image: perl + Port: + Command: + perl + -Mbignum=bpi + -wle + print bpi(2000) + Environment: + Mounts: + Volumes: Events: FirstSeen LastSeen Count From SubobjectPath Type Reason Message --------- -------- ----- ---- ------------- -------- ------ ------- From 14ce35f3ab7891d4a22c74e00dfeb516cb238e20 Mon Sep 17 00:00:00 2001 From: chenhuan12 Date: Tue, 5 Sep 2017 10:13:21 +0800 Subject: [PATCH 17/23] fix the command output fix the command output --- .../services-networking/connect-applications-service.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/concepts/services-networking/connect-applications-service.md b/docs/concepts/services-networking/connect-applications-service.md index 3209c50afb..b69c831383 100644 --- a/docs/concepts/services-networking/connect-applications-service.md +++ b/docs/concepts/services-networking/connect-applications-service.md @@ -80,13 +80,14 @@ $ kubectl describe svc my-nginx Name: my-nginx Namespace: default Labels: run=my-nginx +Annotations: Selector: run=my-nginx Type: ClusterIP IP: 10.0.162.149 Port: 80/TCP Endpoints: 10.244.2.5:80,10.244.3.4:80 Session Affinity: None -No events. +Events: $ kubectl get ep my-nginx NAME ENDPOINTS AGE From 06b396ff1ecde917f47117e67b77c269fa90d5e3 Mon Sep 17 00:00:00 2001 From: chenhuan12 Date: Tue, 5 Sep 2017 11:00:37 +0800 Subject: [PATCH 18/23] fix the command output fix the command output --- docs/getting-started-guides/scratch.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/getting-started-guides/scratch.md b/docs/getting-started-guides/scratch.md index 5894732059..de475a07bb 100644 --- a/docs/getting-started-guides/scratch.md +++ b/docs/getting-started-guides/scratch.md @@ -864,10 +864,10 @@ Example usage and output: ```shell KUBECTL_PATH=$(which kubectl) NUM_NODES=3 KUBERNETES_PROVIDER=local cluster/validate-cluster.sh Found 3 node(s). -NAME STATUS AGE -node1.local Ready 1h -node2.local Ready 1h -node3.local Ready 1h +NAME STATUS AGE VERSION +node1.local Ready 1h v1.6.9+a3d1dfa6f4335 +node2.local Ready 1h v1.6.9+a3d1dfa6f4335 +node3.local Ready 1h v1.6.9+a3d1dfa6f4335 Validate output: NAME STATUS MESSAGE ERROR controller-manager Healthy ok From 541323baca19b44a14701e5e8022877a64709554 Mon Sep 17 00:00:00 2001 From: cliffburdick <30670611+cliffburdick@users.noreply.github.com> Date: Tue, 5 Sep 2017 07:59:47 -0700 Subject: [PATCH 19/23] Update downward-api-volume-expose-pod-information.md Adding node IP, which was added as part of PR #42717 --- .../downward-api-volume-expose-pod-information.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information.md b/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information.md index a497f6f2bd..9caad6cdff 100644 --- a/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information.md +++ b/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information.md @@ -189,6 +189,7 @@ The following information is available to Containers through environment variables and DownwardAPIVolumeFiles: * The node’s name +* The node's IP * The Pod’s name * The Pod’s namespace * The Pod’s IP address From 8b154e2f45d16bac6b565d20af41e0aa50090474 Mon Sep 17 00:00:00 2001 From: Martin Zemlicka Date: Tue, 5 Sep 2017 17:03:41 +0200 Subject: [PATCH 20/23] Space needed before list in kramdown. Need to have a space there for the list to work with the kramdown markdown engine. Without it it is just a paragraph. --- docs/concepts/architecture/master-node-communication.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/concepts/architecture/master-node-communication.md b/docs/concepts/architecture/master-node-communication.md index 1152beb383..4c6fa78bbd 100644 --- a/docs/concepts/architecture/master-node-communication.md +++ b/docs/concepts/architecture/master-node-communication.md @@ -65,6 +65,7 @@ or service through the apiserver's proxy functionality. ### apiserver -> kubelet The connections from the apiserver to the kubelet are used for: + * Fetching logs for pods. * Attaching (through kubectl) to running pods. * Providing the kubelet's port-forwarding functionality. From e6042bd5f59214ef33e99e95ffe7ea3f79c8f742 Mon Sep 17 00:00:00 2001 From: shashidharatd Date: Tue, 5 Sep 2017 22:39:51 +0530 Subject: [PATCH 21/23] Update static-pod.md for consistency It confuses user to use different directories for `--pod-manifest-path` within the same document. So fixed to maintain consistency. --- docs/tasks/administer-cluster/static-pod.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/tasks/administer-cluster/static-pod.md b/docs/tasks/administer-cluster/static-pod.md index a4c8671e87..1c21a6f178 100644 --- a/docs/tasks/administer-cluster/static-pod.md +++ b/docs/tasks/administer-cluster/static-pod.md @@ -29,8 +29,8 @@ For example, this is how to start a simple web server as a static pod: 2. Choose a directory, say `/etc/kubelet.d` and place a web server pod definition there, e.g. `/etc/kubelet.d/static-web.yaml`: ``` - [root@my-node1 ~] $ mkdir /etc/kubernetes.d/ - [root@my-node1 ~] $ cat </etc/kubernetes.d/static-web.yaml + [root@my-node1 ~] $ mkdir /etc/kubelet.d/ + [root@my-node1 ~] $ cat </etc/kubelet.d/static-web.yaml apiVersion: v1 kind: Pod metadata: From 1bc0bda657aa8150cde26bc59de00bb3c0332911 Mon Sep 17 00:00:00 2001 From: Stewart-YU Date: Wed, 6 Sep 2017 05:28:47 +0800 Subject: [PATCH 22/23] Update authentication.md (#5281) * Update authentication.md Add links, and fix format. * add that * add code format --- docs/admin/authentication.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/admin/authentication.md b/docs/admin/authentication.md index e47add4971..4a2fb19195 100644 --- a/docs/admin/authentication.md +++ b/docs/admin/authentication.md @@ -291,7 +291,7 @@ To enable the plugin, configure the following flags on the API server: | Parameter | Description | Example | Required | | --------- | ----------- | ------- | ------- | -| `--oidc-issuer-url` | URL of the provider which allows the API server to discover public signing keys. Only URLs which use the `https://` scheme are accepted. This is typically the provider's discovery URL without a path, for example "https://accounts.google.com" or "https://login.salesforce.com". This URL should point to the level below .well-known/openid-configuration | If the discovery URL is https://accounts.google.com/.well-known/openid-configuration the value should be https://accounts.google.com | Yes | +| `--oidc-issuer-url` | URL of the provider which allows the API server to discover public signing keys. Only URLs which use the `https://` scheme are accepted. This is typically the provider's discovery URL without a path, for example "https://accounts.google.com" or "https://login.salesforce.com". This URL should point to the level below .well-known/openid-configuration | If the discovery URL is `https://accounts.google.com/.well-known/openid-configuration`, the value should be `https://accounts.google.com` | Yes | | `--oidc-client-id` | A client id that all tokens must be issued for. | kubernetes | Yes | | `--oidc-username-claim` | JWT claim to use as the user name. By default `sub`, which is expected to be a unique identifier of the end user. Admins can choose other claims, such as `email` or `name`, depending on their provider. However, claims other than `email` will be prefixed with the issuer URL to prevent naming clashes with other plugins. | sub | No | | `--oidc-groups-claim` | JWT claim to use as the user's group. If the claim is present it must be an array of strings. | groups | No | @@ -324,7 +324,8 @@ For an identity provider to work with Kubernetes it must: 2. Run in TLS with non-obsolete ciphers 3. Have a CA signed certificate (even if the CA is not a commercial CA or is self signed) -A note about requirement #3 above, requiring a CA signed certificate. If you deploy your own identity provider (as opposed to one of the cloud providers like Google or Microsoft) you MUST have your identity provider's web server certificate signed by a certificate with the `CA` flag set to `TRUE`, even if it is self signed. This is due to GoLang's TLS client implementation being very strict to the standards around certificate validation. If you don't have a CA handy, you can use this script from the CoreOS team to create a simple CA and a signed certificate and key pair - https://github.com/coreos/dex/blob/1ee5920c54f5926d6468d2607c728b71cfe98092/examples/k8s/gencert.sh or this script based on it that will generate SHA256 certs with a longer life and larger key size https://raw.githubusercontent.com/TremoloSecurity/openunison-qs-kubernetes/master/makecerts.sh. +A note about requirement #3 above, requiring a CA signed certificate. If you deploy your own identity provider (as opposed to one of the cloud providers like Google or Microsoft) you MUST have your identity provider's web server certificate signed by a certificate with the `CA` flag set to `TRUE`, even if it is self signed. This is due to GoLang's TLS client implementation being very strict to the standards around certificate validation. If you don't have a CA handy, you can use [this script](https://github.com/coreos/dex/blob/1ee5920c54f5926d6468d2607c728b71cfe98092/examples/k8s/gencert.sh) from the CoreOS team to create a simple CA and a signed certificate and key pair. +Or you can use [this similar script](https://raw.githubusercontent.com/TremoloSecurity/openunison-qs-kubernetes/master/makecerts.sh) that generates SHA256 certs with a longer life and larger key size. Setup instructions for specific systems: From e0517e0799fce0b818a330a3f5180f3653c7194d Mon Sep 17 00:00:00 2001 From: Radhika Puthiyetath Date: Tue, 5 Sep 2017 15:28:36 -0700 Subject: [PATCH 23/23] concepts/configuration/manage-compute-resources-container.md: fix a conversion (#4952) Rewrite the description for spec.containers[].resources.limits.cpu --- .../manage-compute-resources-container.md | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/docs/concepts/configuration/manage-compute-resources-container.md b/docs/concepts/configuration/manage-compute-resources-container.md index e747e42642..c5a5be4ffc 100644 --- a/docs/concepts/configuration/manage-compute-resources-container.md +++ b/docs/concepts/configuration/manage-compute-resources-container.md @@ -135,14 +135,12 @@ When using Docker: [`--cpu-shares`](https://docs.docker.com/engine/reference/run/#/cpu-share-constraint) flag in the `docker run` command. -- The `spec.containers[].resources.limits.cpu` is converted to its millicore value, - multiplied by 100000, and then divided by 1000. This number is used as the value - of the [`--cpu-quota`](https://docs.docker.com/engine/reference/run/#/cpu-quota-constraint) - flag in the `docker run` command. The [`--cpu-period`] flag is set to 100000, - which represents the default 100ms period for measuring quota usage. The - kubelet enforces cpu limits if it is started with the - [`--cpu-cfs-quota`] flag set to true. As of Kubernetes version 1.2, this flag - defaults to true. +- The `spec.containers[].resources.limits.cpu` is converted to its millicore value and + multiplied by 100. The resulting value is the total amount of CPU time that a container can use + every 100ms. A container cannot use more than its share of CPU time during this interval. + + **Note**: The default quota period is 100ms. The minimum resolution of CPU quota is 1ms. + {: .note} - The `spec.containers[].resources.limits.memory` is converted to an integer, and used as the value of the @@ -434,4 +432,3 @@ consistency across providers and platforms. {% endcapture %} {% include templates/concept.md %} -