diff --git a/README-de.md b/README-de.md index c901fdde65..75b56c635b 100644 --- a/README-de.md +++ b/README-de.md @@ -3,13 +3,13 @@ [![Build Status](https://api.travis-ci.org/kubernetes/website.svg?branch=master)](https://travis-ci.org/kubernetes/website) [![GitHub release](https://img.shields.io/github/release/kubernetes/website.svg)](https://github.com/kubernetes/website/releases/latest) -Herzlich willkommen! Dieses Repository enthält alle Assets, die zur Erstellung der [Kubernetes-Website und Dokumentation](https://kubernetes.io/) erforderlich sind. Wir freuen uns sehr, dass Sie dazu beitragen wollen! +Herzlich Willkommen! Dieses Repository enthält alle Assets, die zur Erstellung der [Kubernetes-Website und Dokumentation](https://kubernetes.io/) erforderlich sind. Wir freuen uns sehr, dass Sie dazu beitragen wollen! ## Beiträge zur Dokumentation -Sie können auf die Schaltfläche **Fork** im oberen rechten Bereich des Bildschirms klicken, um eine Kopie dieses Repositorys in Ihrem GitHub-Konto zu erstellen. Diese Kopie wird als *Fork* bezeichnet. Nehmen Sie die gewünschten Änderungen an Ihrem Fork vor. Wenn Sie bereit sind, diese Änderungen an uns zu senden, gehen Sie zu Ihrem Fork und erstellen Sie eine neue Pull-Anforderung, um uns darüber zu informieren. +Sie können auf die Schaltfläche **Fork** im oberen rechten Bereich des Bildschirms klicken, um eine Kopie dieses Repositorys in Ihrem GitHub-Konto zu erstellen. Diese Kopie wird als *Fork* bezeichnet. Nehmen Sie die gewünschten Änderungen an Ihrem Fork vor. Wenn Sie bereit sind, diese Änderungen an uns zu senden, gehen Sie zu Ihrem Fork und erstellen Sie eine neue Pull-Request, um uns darüber zu informieren. -Sobald Ihre Pull-Anfrage erstellt wurde, übernimmt ein Rezensent von Kubernetes die Verantwortung für klares, umsetzbares Feedback. Als Eigentümer des Pull-Request **liegt es in Ihrer Verantwortung Ihren Pull-Reqest entsprechend des Feedbacks, dass Sie vom Kubernetes-Reviewer erhalten haben abzuändern.** Beachten Sie auch, dass Sie am Ende mehr als einen Rezensenten von Kubernetes erhalten, der Ihnen Feedback gibt, oder dass Sie Rückmeldungen von einem Rezensenten von Kubernetes erhalten, der sich von demjenigen unterscheidet, der ursprünglich für das Feedback zugewiesen wurde. In einigen Fällen kann es vorkommen, dass einer Ihrer Prüfer bei Bedarf eine technische Überprüfung von einem [Kubernetes Tech-Reviewer](https://github.com/kubernetes/website/wiki/tech-reviewers) anfordert. Reviewer geben ihr Bestes, um zeitnah Feedback zu geben, die Antwortzeiten können jedoch je nach den Umständen variieren. +Sobald Ihre Pull-Request erstellt wurde, übernimmt ein Rezensent von Kubernetes die Verantwortung für klares, umsetzbares Feedback. Als Eigentümer des Pull-Request **liegt es in Ihrer Verantwortung Ihre Pull-Request entsprechend des Feedbacks, welches Sie vom Kubernetes-Reviewer erhalten haben, abzuändern.** Beachten Sie auch, dass Sie am Ende mehr als einen Rezensenten von Kubernetes erhalten, der Ihnen Feedback gibt, oder dass Sie Rückmeldungen von einem Rezensenten von Kubernetes erhalten, der sich von demjenigen unterscheidet, der ursprünglich für das Feedback zugewiesen wurde. In einigen Fällen kann es vorkommen, dass einer Ihrer Prüfer bei Bedarf eine technische Überprüfung von einem [Kubernetes Tech-Reviewer](https://github.com/kubernetes/website/wiki/tech-reviewers) anfordert. Reviewer geben ihr Bestes, um zeitnah Feedback zu geben, die Antwortzeiten können jedoch je nach den Umständen variieren. Weitere Informationen zum Beitrag zur Kubernetes-Dokumentation finden Sie unter: @@ -28,14 +28,14 @@ Die Betreuer der deutschen Lokalisierung erreichen Sie unter: * Max Körbächer ([@mkorbi](https://github.com/mkorbi)) * [Slack Kanal](https://kubernetes.slack.com/messages/kubernetes-docs-de) -## Site lokal mit Docker ausführen +## Website lokal mit Docker ausführen -Um die Kubernetes-Website lokal laufen zu lassen, empfiehlt es sich, ein spezielles [Docker](https://docker.com) Image auszuführen, das den statischen Site-Generator [Hugo](https://gohugo.io) enthält. +Um die Kubernetes-Website lokal laufen zu lassen, empfiehlt es sich, ein spezielles [Docker](https://docker.com) Image auszuführen, das den statischen Website-Generator [Hugo](https://gohugo.io) enthält. > Unter Windows benötigen Sie einige weitere Tools, die Sie mit [Chocolatey](https://chocolatey.org) installieren können. `choco install make` -> Wenn Sie die Website lieber lokal ohne Docker ausführen möchten, finden Sie weitere Informationen unter [Website lokal mit Hugo ausführen](#Die-Site-lokal-mit-Hugo-ausführen). +> Wenn Sie die Website lieber lokal ohne Docker ausführen möchten, finden Sie weitere Informationen unter [Website lokal mit Hugo ausführen](#Die-Website-lokal-mit-Hugo-ausführen). Das benötigte [Docsy Hugo theme](https://github.com/google/docsy#readme) muss als git submodule installiert werden: @@ -50,26 +50,26 @@ Wenn Sie Docker [installiert](https://www.docker.com/get-started) haben, erstell make container-image ``` -Nachdem das Image erstellt wurde, können Sie die Site lokal ausführen: +Nachdem das Image erstellt wurde, können Sie die Website lokal öffnen: ```bash make container-serve ``` -Öffnen Sie Ihren Browser unter http://localhost:1313, um die Site anzuzeigen. Wenn Sie Änderungen an den Quelldateien vornehmen, aktualisiert Hugo die Site und erzwingt eine Browseraktualisierung. +Öffnen Sie Ihren Browser unter http://localhost:1313, um die Website anzuzeigen. Wenn Sie Änderungen an den Quelldateien vornehmen, aktualisiert Hugo die Website und erzwingt eine Browseraktualisierung. -## Die Site lokal mit Hugo ausführen +## Die Website lokal mit Hugo ausführen Hugo-Installationsanweisungen finden Sie in der [offiziellen Hugo-Dokumentation](https://gohugo.io/getting-started/installing/). Stellen Sie sicher, dass Sie die Hugo-Version installieren, die in der Umgebungsvariablen `HUGO_VERSION` in der Datei [`netlify.toml`](netlify.toml#L9) angegeben ist. -Das benötigte [Docsy Hugo theme](https://github.com/google/docsy#readme) muss als git submodule installiert werden: +Das benötigte [Docsy Hugo-Theme](https://github.com/google/docsy#readme) muss als git submodule installiert werden: ``` #Füge das Docsy submodule hinzu git submodule update --init --recursive --depth 1 ``` -So führen Sie die Site lokal aus, wenn Sie Hugo installiert haben: +So führen Sie die Website lokal aus, wenn Sie Hugo installiert haben: ```bash # Installieren der JavaScript Abhängigkeiten @@ -77,7 +77,7 @@ npm ci make serve ``` -Dadurch wird der lokale Hugo-Server an Port 1313 gestartet. Öffnen Sie Ihren Browser unter http://localhost:1313, um die Site anzuzeigen. Wenn Sie Änderungen an den Quelldateien vornehmen, aktualisiert Hugo die Site und erzwingt eine Browseraktualisierung. +Dadurch wird der lokale Hugo-Server an Port 1313 gestartet. Öffnen Sie Ihren Browser unter http://localhost:1313, um die Website anzuzeigen. Wenn Sie Änderungen an den Quelldateien vornehmen, aktualisiert Hugo die Website und erzwingt eine Browseraktualisierung. ## Community, Diskussion, Beteiligung und Unterstützung @@ -94,4 +94,4 @@ Die Teilnahme an der Kubernetes-Community unterliegt dem [Kubernetes-Verhaltensk ## Vielen Dank! -Kubernetes lebt vom Community Engagement und wir freuen uns sehr über Ihre Beiträge zu unserer Website und unserer Dokumentation! +Kubernetes lebt vom Community-Engagement und wir freuen uns sehr über Ihre Beiträge zu unserer Website und unserer Dokumentation! diff --git a/assets/scss/_custom.scss b/assets/scss/_custom.scss index 82ebd232c0..d46bac0924 100644 --- a/assets/scss/_custom.scss +++ b/assets/scss/_custom.scss @@ -329,6 +329,11 @@ main { .td-content>table td { word-break: break-word; } + + table.no-word-break td, + table.no-word-break code { + word-break: normal; + } } @@ -396,16 +401,24 @@ body { } .deprecation-warning, .pageinfo.deprecation-warning { - padding: 20px; - margin: 20px 0; + padding: clamp(10px, 2vmin, 20px); + margin: clamp(10px, 1vh, 20px) 0; background-color: #faf5b6; color: #000; } +.deprecation-warning.outdated-blog, .pageinfo.deprecation-warning.outdated-blog { + background-color: $blue; + color: $white; +} + body.td-home .deprecation-warning, body.td-blog .deprecation-warning, body.td-documentation .deprecation-warning { border-radius: 3px; } +.deprecation-warning p:only-child { + margin-bottom: 0; +} .td-documentation .td-content > .highlight { max-width: initial; @@ -766,6 +779,10 @@ figure { max-width: clamp(0vw, 95vw, 100%); max-height: calc(80vh - 8rem); } + + figure + noscript > *{ + max-width: calc(max(100%, 100vw)); + } } @media only screen and (min-width: 768px) { @@ -788,6 +805,9 @@ figure { max-height: calc(100vh - 10rem); } } + figure + noscript > * { + max-width: 80%; + } } // Indent definition lists @@ -820,3 +840,13 @@ dl { margin-bottom: 1em; } } + +.no-js .mermaid { + display: none; +} + +div.alert > em.javascript-required { + display: inline-block; + min-height: 1.5em; + margin: calc(max(4em, ( 8vh + 4em ) / 2)) 0 0.25em 0; +} diff --git a/assets/scss/_reset.scss b/assets/scss/_reset.scss old mode 100755 new mode 100644 diff --git a/assets/scss/_skin.scss b/assets/scss/_skin.scss old mode 100755 new mode 100644 diff --git a/content/en/blog/_posts/2019-12-09-kubernetes-1.17-release-announcement.md b/content/en/blog/_posts/2019-12-09-kubernetes-1.17-release-announcement.md index 983d7ba31e..6fb460acfb 100644 --- a/content/en/blog/_posts/2019-12-09-kubernetes-1.17-release-announcement.md +++ b/content/en/blog/_posts/2019-12-09-kubernetes-1.17-release-announcement.md @@ -3,6 +3,7 @@ layout: blog title: "Kubernetes 1.17: Stability" date: 2019-12-09T13:00:00-08:00 slug: kubernetes-1-17-release-announcement +evergreen: true --- **Authors:** [Kubernetes 1.17 Release Team](https://github.com/kubernetes/sig-release/blob/master/releases/release-1.17/release_team.md) diff --git a/content/en/blog/_posts/2020-03-25-kubernetes-1.18-release-announcement.md b/content/en/blog/_posts/2020-03-25-kubernetes-1.18-release-announcement.md index d4fb5dc7df..a65924b174 100644 --- a/content/en/blog/_posts/2020-03-25-kubernetes-1.18-release-announcement.md +++ b/content/en/blog/_posts/2020-03-25-kubernetes-1.18-release-announcement.md @@ -3,6 +3,7 @@ layout: blog title: 'Kubernetes 1.18: Fit & Finish' date: 2020-03-25 slug: kubernetes-1-18-release-announcement +evergreen: true --- **Authors:** [Kubernetes 1.18 Release Team](https://github.com/kubernetes/sig-release/blob/master/releases/release-1.18/release_team.md) diff --git a/content/en/blog/_posts/2020-08-26-kubernetes-release-1.19.md b/content/en/blog/_posts/2020-08-26-kubernetes-release-1.19.md index 6f7a4c4096..39559ffe4c 100644 --- a/content/en/blog/_posts/2020-08-26-kubernetes-release-1.19.md +++ b/content/en/blog/_posts/2020-08-26-kubernetes-release-1.19.md @@ -3,6 +3,7 @@ layout: blog title: 'Kubernetes 1.19: Accentuate the Paw-sitive' date: 2020-08-26 slug: kubernetes-release-1.19-accentuate-the-paw-sitive +evergreen: true --- **Authors:** [Kubernetes 1.19 Release Team](https://github.com/kubernetes/sig-release/blob/master/releases/release-1.19/release_team.md) diff --git a/content/en/blog/_posts/2020-09-03-warnings/index.md b/content/en/blog/_posts/2020-09-03-warnings/index.md index 50576c0329..5d34fb11cf 100644 --- a/content/en/blog/_posts/2020-09-03-warnings/index.md +++ b/content/en/blog/_posts/2020-09-03-warnings/index.md @@ -3,9 +3,10 @@ layout: blog title: "Warning: Helpful Warnings Ahead" date: 2020-09-03 slug: warnings +evergreen: true --- -**Author**: Jordan Liggitt (Google) +**Author**: [Jordan Liggitt](https://github.com/liggitt) (Google) As Kubernetes maintainers, we're always looking for ways to improve usability while preserving compatibility. As we develop features, triage bugs, and answer support questions, we accumulate information that would be helpful for Kubernetes users to know. @@ -327,7 +328,3 @@ A couple areas we're looking at next are warning about [known problematic values we cannot reject outright for compatibility reasons, and warning about use of deprecated fields or field values (like selectors using beta os/arch node labels, [deprecated in v1.14](/docs/reference/labels-annotations-taints/#beta-kubernetes-io-arch-deprecated)). I'm excited to see progress in this area, continuing to make it easier to use Kubernetes. - ---- - -_[Jordan Liggitt](https://twitter.com/liggitt) is a software engineer at Google, and helps lead Kubernetes authentication, authorization, and API efforts._ \ No newline at end of file diff --git a/content/en/blog/_posts/2020-12-02-dockershim-faq.md b/content/en/blog/_posts/2020-12-02-dockershim-faq.md index b5f226e926..ebf6511af4 100644 --- a/content/en/blog/_posts/2020-12-02-dockershim-faq.md +++ b/content/en/blog/_posts/2020-12-02-dockershim-faq.md @@ -3,9 +3,11 @@ layout: blog title: "Dockershim Deprecation FAQ" date: 2020-12-02 slug: dockershim-faq -aliases: [ '/dockershim' ] --- + +_**Update**: There is a [newer version](/blog/2022/02/17/dockershim-faq/) of this article available._ + This document goes over some frequently asked questions regarding the Dockershim deprecation announced as a part of the Kubernetes v1.20 release. For more detail on the deprecation of Docker as a container runtime for Kubernetes kubelets, and diff --git a/content/en/blog/_posts/2020-12-02-dont-panic-kubernetes-and-docker.md b/content/en/blog/_posts/2020-12-02-dont-panic-kubernetes-and-docker.md index 944704967b..f66391de9e 100644 --- a/content/en/blog/_posts/2020-12-02-dont-panic-kubernetes-and-docker.md +++ b/content/en/blog/_posts/2020-12-02-dont-panic-kubernetes-and-docker.md @@ -101,4 +101,4 @@ questions regardless of experience level or complexity! Our goal is to make sure everyone is educated as much as possible on the upcoming changes. We hope this has answered most of your questions and soothed some anxieties! ❤️ -Looking for more answers? Check out our accompanying [Dockershim Deprecation FAQ](/blog/2020/12/02/dockershim-faq/). +Looking for more answers? Check out our accompanying [Dockershim Removal FAQ](/blog/2022/02/17/dockershim-faq/) _(updated February 2022)_. diff --git a/content/en/blog/_posts/2020-12-08-kubernetes-release-1.20.md b/content/en/blog/_posts/2020-12-08-kubernetes-release-1.20.md index deb459c4be..8eb382cac1 100644 --- a/content/en/blog/_posts/2020-12-08-kubernetes-release-1.20.md +++ b/content/en/blog/_posts/2020-12-08-kubernetes-release-1.20.md @@ -3,6 +3,7 @@ layout: blog title: 'Kubernetes 1.20: The Raddest Release' date: 2020-12-08 slug: kubernetes-1-20-release-announcement +evergreen: true --- **Authors:** [Kubernetes 1.20 Release Team](https://github.com/kubernetes/sig-release/blob/master/releases/release-1.20/release_team.md) diff --git a/content/en/blog/_posts/2021-04-08-kubernetes-release-1.21.md b/content/en/blog/_posts/2021-04-08-kubernetes-release-1.21.md index ed0da32f25..b22eeeb027 100644 --- a/content/en/blog/_posts/2021-04-08-kubernetes-release-1.21.md +++ b/content/en/blog/_posts/2021-04-08-kubernetes-release-1.21.md @@ -3,6 +3,7 @@ layout: blog title: 'Kubernetes 1.21: Power to the Community' date: 2021-04-08 slug: kubernetes-1-21-release-announcement +evergreen: true --- **Authors:** [Kubernetes 1.21 Release Team](https://github.com/kubernetes/sig-release/blob/master/releases/release-1.21/release-team.md) diff --git a/content/en/blog/_posts/2021-08-04-kubernetes-release-1.22.md b/content/en/blog/_posts/2021-08-04-kubernetes-release-1.22.md index 9a196f7fba..4189d1a4c8 100644 --- a/content/en/blog/_posts/2021-08-04-kubernetes-release-1.22.md +++ b/content/en/blog/_posts/2021-08-04-kubernetes-release-1.22.md @@ -3,6 +3,7 @@ layout: blog title: 'Kubernetes 1.22: Reaching New Peaks' date: 2021-08-04 slug: kubernetes-1-22-release-announcement +evergreen: true --- **Authors:** [Kubernetes 1.22 Release Team](https://github.com/kubernetes/sig-release/blob/master/releases/release-1.22/release-team.md) diff --git a/content/en/blog/_posts/2021-08-30-volume-populators-alpha.md b/content/en/blog/_posts/2021-08-30-volume-populators-alpha.md index 4f3a408584..a632415f50 100644 --- a/content/en/blog/_posts/2021-08-30-volume-populators-alpha.md +++ b/content/en/blog/_posts/2021-08-30-volume-populators-alpha.md @@ -96,15 +96,16 @@ out. First install the volume-data-source-validator controller. ```terminal -kubectl apply -f https://github.com/kubernetes-csi/volume-data-source-validator/blob/master/deploy/kubernetes/rbac-data-source-validator.yaml -kubectl apply -f https://github.com/kubernetes-csi/volume-data-source-validator/blob/master/deploy/kubernetes/setup-data-source-validator.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes-csi/volume-data-source-validator/master/client/config/crd/populator.storage.k8s.io_volumepopulators.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes-csi/volume-data-source-validator/master/deploy/kubernetes/rbac-data-source-validator.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes-csi/volume-data-source-validator/master/deploy/kubernetes/setup-data-source-validator.yaml ``` Next install the example populator. ```terminal -kubectl apply -f https://github.com/kubernetes-csi/lib-volume-populator/blob/master/example/hello-populator/crd.yaml -kubectl apply -f https://github.com/kubernetes-csi/lib-volume-populator/blob/master/example/hello-populator/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes-csi/lib-volume-populator/master/example/hello-populator/crd.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes-csi/lib-volume-populator/master/example/hello-populator/deploy.yaml ``` Create an instance of the `Hello` CR, with some text. diff --git a/content/en/blog/_posts/2021-12-07-kubernetes-release-1.23.md b/content/en/blog/_posts/2021-12-07-kubernetes-release-1.23.md index 32336dd2d8..f0bce232dd 100644 --- a/content/en/blog/_posts/2021-12-07-kubernetes-release-1.23.md +++ b/content/en/blog/_posts/2021-12-07-kubernetes-release-1.23.md @@ -3,6 +3,7 @@ layout: blog title: 'Kubernetes 1.23: The Next Frontier' date: 2021-12-07 slug: kubernetes-1-23-release-announcement +evergreen: true --- **Authors:** [Kubernetes 1.23 Release Team](https://github.com/kubernetes/sig-release/blob/master/releases/release-1.23/release-team.md) diff --git a/content/en/blog/_posts/2022-02-07-sig-multicluster-spotlight/index.md b/content/en/blog/_posts/2022-02-07-sig-multicluster-spotlight/index.md new file mode 100644 index 0000000000..4f155ed54d --- /dev/null +++ b/content/en/blog/_posts/2022-02-07-sig-multicluster-spotlight/index.md @@ -0,0 +1,63 @@ +--- +layout: blog +title: "Spotlight on SIG Multicluster" +date: 2022-02-07 +slug: sig-multicluster-spotlight-2022 +canonicalUrl: https://www.kubernetes.dev/blog/2022/02/04/sig-multicluster-spotlight-2022/ +--- + +**Authors:** Dewan Ahmed (Aiven) and Chris Short (AWS) + +## Introduction + +[SIG Multicluster](https://github.com/kubernetes/community/tree/master/sig-multicluster) is the SIG focused on how Kubernetes concepts are expanded and used beyond the cluster boundary. Historically, Kubernetes resources only interacted within that boundary - KRU or Kubernetes Resource Universe (not an actual Kubernetes concept). Kubernetes clusters, even now, don't really know anything about themselves or, about other clusters. Absence of cluster identifiers is a case in point. With the growing adoption of multicloud and multicluster deployments, the work SIG Multicluster doing is gaining a lot of attention. In this blog, [Jeremy Olmsted-Thompson, Google](https://twitter.com/jeremyot) and [Chris Short, AWS](https://twitter.com/ChrisShort) discuss the interesting problems SIG Multicluster is solving and how you can get involved. Their initials **JOT** and **CS** will be used for brevity. + +## A summary of their conversation + +**CS**: How long has the SIG Multicluster existed and how was the SIG in its infancy? How long have you been with this SIG? + +**JOT**: I've been around for almost two years in the SIG Multicluster. All I know about the infancy years is from the lore but even in the early days, it was always about solving this same problem. Early efforts have been things like [KubeFed](https://github.com/kubernetes-sigs/kubefed). I think there are still folks using KubeFed but it's a smaller slice. Back then, I think people out there deploying large numbers of Kubernetes clusters were really not at a point where we had a ton of real concrete use cases. Projects like KubeFed and [Cluster Registry](https://github.com/kubernetes-retired/cluster-registry) were developed around that time and the need back then can be associated to these projects. The motivation for these projects were how do we solve the problems that we think people are **going to have**, when they start expanding to multiple clusters. Honestly, in some ways, it was trying to do too much at that time. + +**CS**: How does KubeFed differ from the current state of SIG Multicluster? How does the **lore** differ from the **now**? + +**JOT**: Yeah, it was like trying to get ahead of potential problems instead of addressing specific problems. I think towards the end of 2019, there was a slow down in SIG multicluster work and we kind of picked it back up with one of the most active recent projects that is the [SIG Multicluster services (MCS)](https://github.com/kubernetes-sigs/mcs-api). + +Now this is the shift to solving real specific problems. For example, + +> I've got workloads that are spread across multiple clusters and I need them to talk to each other. + +Okay, that's very straightforward and we know that we need to solve that. To get started, let's make sure that these projects can work together on a common API so you get the same kind of portability that you get with Kubernetes. + +There's a few implementations of the MCS API out there and more are being developed. But, we didn't build an implementation because depending on how you're deploying things there could be hundreds of implementations. As long as you only need the basic Multicluster service functionality, it'll just work on whatever background you want, whether it's Submariner, GKE, or a service mesh. + +My favorite example of "then vs. now" is cluster ID. A few years ago, there was an effort to define a cluster ID. A lot of really good thought went into this concept, for example, how do we make a cluster ID is unique across multiple clusters. How do we make this ID globally unique so it'll work in every contact? Let's say, there's an acquisition or merger of teams - does the cluster IDs still remain unique for those teams? + +With Multicluster services, we found the need for an actual cluster ID, and it has a very specific need. To address this specific need, we're no longer considering every single Kubernetes cluster out there rather the ClusterSets - a grouping of clusters that work together in some kind of bounds. That's a much narrower scope than considering clusters everywhere in time and space. It also leaves flexibility for an implementer to define the boundary (a ClusterSet) beyond which this cluster ID will no longer be unique. + + +**CS**: How do you feel about the current state of SIG Multicluster versus where you're hoping to be in future? + +**JOT**: There's a few projects that are kind of getting started, for example, Work API. In the future, I think that some common practices around how do we deploy things across clusters are going to develop. +> If I have clusters deployed in a bunch of different regions; what's the best way to actually do that? + +The answer is, almost always, "it depends". Why are you doing this? Is it because there's some kind of compliance that makes you care about locality? Is it performance? Is it availability? + +I think revisiting registry patterns will probably be a natural step after we have cluster IDs, that is, how do you actually associate these clusters together? Maybe you've got a distributed deployment that you run in your own data centers all over the world. I imagine that expanding the API in that space is going to be important as more multi cluster features develop. It really depends on what the community starts doing with these tools. + +**CS**: In the early days of Kubernetes, we used to have a few large Kubernetes clusters and now we're dealing with many small Kubernetes clusters - even multiple clusters for our own dev environments. How has this shift from a few large clusters to many small clusters affected the SIG? Has it accelerated the work or make it challenging in any way? + +**JOT**: I think that it has created a lot of ambiguity that needs solving. Originally, you'd have a dev cluster, a staging cluster, and a prod cluster. When the multi region thing came in, we started needing dev/staging/prod clusters, per region. And then, sometimes clusters really need more isolation due to compliance or some regulations issues. Thus, we're ending up with a lot of clusters. I think figuring out the right balance on how many clusters should you actually have is important. The power of Kubernetes is being able to deploy a lot of things managed by a single control plane. So, it's not like every single workload that gets deployed should be in its own cluster. But I think it's pretty clear that we can't put every single workload in a single cluster. + +**CS**: What are some of your favorite things about this SIG? + +**JOT**: The complexity of the problems, the people and the newness of the space. We don't have right answers and we have to figure this out. At the beginning, we couldn't even think about multi clusters because there was no way to connect services across clusters. Now there is and we're starting to go tackle those problems, I think that this is a really fun place to be in because I expect that the SIG is going to get a lot busier the next couple of years. It's a very collaborative group and we definitely would like more people to come join us, get involved, raise their problems and bring their ideas. + +**CS**: What do you think keeps people in this group? How has the pandemic affected you? + +**JOT**: I think it definitely got a little bit quieter during the pandemic. But for the most part; it's a very distributed group so whether you're calling in to our weekly meetings from a conference room or from your home, it doesn't make that huge of a difference. During the pandemic, a lot of people had time to focus on what's next for their scale and growth. I think that's what keeps people in the group - we have real problems that need to be solved which are very new in this space. And it's fun :) + +## Wrap up + +**CS**: That's all we have for today. Thanks Jeremy for your time. + +**JOT**: Thanks Chris. Everybody is welcome at our [bi-weekly meetings](https://github.com/kubernetes/community/tree/master/sig-multicluster#meetings). We love as many people to come as possible and welcome all questions and all ideas. It's a new space and it'd be great to grow the community. \ No newline at end of file diff --git a/content/en/blog/_posts/2022-02-16-sig-node-ci-subproject-celebrates/index.md b/content/en/blog/_posts/2022-02-16-sig-node-ci-subproject-celebrates/index.md new file mode 100644 index 0000000000..86d31f5443 --- /dev/null +++ b/content/en/blog/_posts/2022-02-16-sig-node-ci-subproject-celebrates/index.md @@ -0,0 +1,192 @@ +--- +layout: blog +title: 'SIG Node CI Subproject Celebrates Two Years of Test Improvements' +date: 2022-02-16 +slug: sig-node-ci-subproject-celebrates +canonicalUrl: https://www.kubernetes.dev/blog/2022/02/16/sig-node-ci-subproject-celebrates-two-years-of-test-improvements/ +--- + +**Authors:** Sergey Kanzhelev (Google), Elana Hashman (Red Hat) + +Ensuring the reliability of SIG Node upstream code is a continuous effort +that takes a lot of behind-the-scenes effort from many contributors. +There are frequent releases of Kubernetes, base operating systems, +container runtimes, and test infrastructure that result in a complex matrix that +requires attention and steady investment to "keep the lights on." +In May 2020, the Kubernetes node special interest group ("SIG Node") organized a new +subproject for continuous integration (CI) for node-related code and tests. Since its +inauguration, the SIG Node CI subproject has run a weekly meeting, and even the full hour +is often not enough to complete triage of all bugs, test-related PRs and issues, and discuss all +related ongoing work within the subgroup. + +Over the past two years, we've fixed merge-blocking and release-blocking tests, reducing time to merge Kubernetes contributors' pull requests thanks to reduced test flakes. When we started, Node test jobs only passed 42% of the time, and through our efforts, we now ensure a consistent >90% job pass rate. We've closed 144 test failure issues and merged 176 pull requests just in kubernetes/kubernetes. And we've helped subproject participants ascend the Kubernetes contributor ladder, with 3 new org members, 6 new reviewers, and 2 new approvers. + +The Node CI subproject is an approachable first stop to help new contributors +get started with SIG Node. There is a low barrier to entry for new contributors +to address high-impact bugs and test fixes, although there is a long +road before contributors can climb the entire contributor ladder: +it took over a year to establish two new approvers for the group. +The complexity of all the different components that power Kubernetes nodes +and its test infrastructure requires a sustained investment over a long period +for developers to deeply understand the entire system, +both at high and low levels of detail. + +We have several regular contributors at our meetings, however; our reviewers +and approvers pool is still small. It is our goal to continue to grow +contributors to ensure a sustainable distribution of work +that does not just fall to a few key approvers. + +It's not always obvious how subprojects within SIGs are formed, operate, +and work. Each is unique to its sponsoring SIG and tailored to the projects +that the group is intended to support. As a group that has welcomed many +first-time SIG Node contributors, we'd like to share some of the details and +accomplishments over the past two years, +helping to demystify our inner workings and celebrate the hard work +of all our dedicated contributors! + +## Timeline + +***May 2020.*** SIG Node CI group was formed on May 11, 2020, with more than +[30 volunteers](https://docs.google.com/document/d/1fb-ugvgdSVIkkuJ388_nhp2pBTy_4HEVg5848Xy7n5U/edit#bookmark=id.vsb8pqnf4gib) +signed up, to improve SIG Node CI signal and overall observability. +Victor Pickard focused on getting +[testgrid jobs](https://testgrid.k8s.io/sig-node) passing +when Ning Liao suggested forming a group around this effort and came up with +the [original group charter document](https://docs.google.com/document/d/1yS-XoUl6GjZdjrwxInEZVHhxxLXlTIX2CeWOARmD8tY/edit#heading=h.te6sgum6s8uf). +The SIG Node chairs sponsored group creation with Victor as a subproject lead. +Sergey Kanzhelev joined Victor shortly after as a co-lead. + +At the kick-off meeting, we discussed which tests to concentrate on fixing first +and discussed merge-blocking and release-blocking tests, many of which were failing due +to infrastructure issues or buggy test code. + +The subproject launched weekly hour-long meetings to discuss ongoing work +discussion and triage. + +***June 2020.*** Morgan Bauer, Karan Goel, and Jorge Alarcon Ochoa were +recognized as reviewers for the SIG Node CI group for their contributions, +helping significantly with the early stages of the subproject. +David Porter and Roy Yang also joined the SIG test failures GitHub team. + +***August 2020.*** All merge-blocking and release-blocking tests were passing, +with some flakes. However, only 42% of all SIG Node test jobs were green, as there +were many flakes and failing tests. + +***October 2020.*** Amim Knabben becomes a Kubernetes org member for his +contributions to the subproject. + +***January 2021.*** With healthy presubmit and critical periodic jobs passing, +the subproject discussed its goal for cleaning up the rest of periodic tests +and ensuring they passed without flakes. + +Elana Hashman joined the subproject, stepping up to help lead it after +Victor's departure. + +***February 2021.*** Artyom Lukianov becomes a Kubernetes org member for his +contributions to the subproject. + +***August 2021.*** After SIG Node successfully ran a [bug scrub](https://groups.google.com/g/kubernetes-dev/c/w2ghO4ihje0/m/VeEql1LJBAAJ) +to clean up its bug backlog, the scope of the meeting was extended to +include bug triage to increase overall reliability, anticipating issues +before they affect the CI signal. + +Subproject leads Elana Hashman and Sergey Kanzhelev are both recognized as +approvers on all node test code, supported by SIG Node and SIG Testing. + +***September 2021.*** After significant deflaking progress with serial tests in +the 1.22 release spearheaded by Francesco Romani, the subproject set a goal +for getting the serial job fully passing by the 1.23 release date. + +Mike Miranda becomes a Kubernetes org member for his contributions +to the subproject. + +***November 2021.*** Throughout 2021, SIG Node had no merge or +release-blocking test failures. Many flaky tests from past releases are removed +from release-blocking dashboards as they had been fully cleaned up. + +Danielle Lancashire was recognized as a reviewer for SIG Node's subgroup, test code. + +The final node serial tests were completely fixed. The serial tests consist of +many disruptive and slow tests which tend to be flakey and are hard +to troubleshoot. By the 1.23 release freeze, the last serial tests were +fixed and the job was passing without flakes. + +[![Slack announcement that Serial tests are green](serial-tests-green.png)](https://kubernetes.slack.com/archives/C0BP8PW9G/p1638211041322900) + +The 1.23 release got a special shout out for the tests quality and CI signal. +The SIG Node CI subproject was proud to have helped contribute to such +a high-quality release, in part due to our efforts in identifying +and fixing flakes in Node and beyond. + +[![Slack shoutout that release was mostly green](release-mostly-green.png)](https://kubernetes.slack.com/archives/C92G08FGD/p1637175755023200) + +***December 2021.*** An estimated 90% of test jobs were passing at the time of +the 1.23 release (up from 42% in August 2020). + +Dockershim code was removed from Kubernetes. This affected nearly half of SIG Node's +test jobs and the SIG Node CI subproject reacted quickly and retargeted all the +tests. SIG Node was the first SIG to complete test migrations off dockershim, +providing examples for other affected SIGs. The vast majority of new jobs passed +at the time of introduction without further fixes required. The [effort of +removing dockershim](https://k8s.io/dockershim)) from Kubernetes is ongoing. +There are still some wrinkles from the dockershim removal as we uncover more +dependencies on dockershim, but we plan to stabilize all test jobs +by the 1.24 release. + +## Statistics + +Our regular meeting attendees and subproject participants for the past few months: + +- Aditi Sharma +- Artyom Lukianov +- Arnaud Meukam +- Danielle Lancashire +- David Porter +- Davanum Srinivas +- Elana Hashman +- Francesco Romani +- Matthias Bertschy +- Mike Miranda +- Paco Xu +- Peter Hunt +- Ruiwen Zhao +- Ryan Phillips +- Sergey Kanzhelev +- Skyler Clark +- Swati Sehgal +- Wenjun Wu + +The [kubernetes/test-infra](https://github.com/kubernetes/test-infra/) source code repository contains test definitions. The number of +Node PRs just in that repository: +- 2020 PRs (since May): [183](https://github.com/kubernetes/test-infra/pulls?q=is%3Apr+is%3Aclosed+label%3Asig%2Fnode+created%3A2020-05-01..2020-12-31+-author%3Ak8s-infra-ci-robot+) +- 2021 PRs: [264](https://github.com/kubernetes/test-infra/pulls?q=is%3Apr+is%3Aclosed+label%3Asig%2Fnode+created%3A2021-01-01..2021-12-31+-author%3Ak8s-infra-ci-robot+) + +Triaged issues and PRs on CI board (including triaging away from the subgroup scope): + +- 2020 (since May): [132](https://github.com/issues?q=project%3Akubernetes%2F43+created%3A2020-05-01..2020-12-31) +- 2021: [532](https://github.com/issues?q=project%3Akubernetes%2F43+created%3A2021-01-01..2021-12-31+) + +## Future + +Just "keeping the lights on" is a bold task and we are committed to improving this experience. +We are working to simplify the triage and review processes for SIG Node. + +Specifically, we are working on better test organization, naming, +and tracking: + +- https://github.com/kubernetes/enhancements/pull/3042 +- https://github.com/kubernetes/test-infra/issues/24641 +- [Kubernetes SIG-Node CI Testgrid Tracker](https://docs.google.com/spreadsheets/d/1IwONkeXSc2SG_EQMYGRSkfiSWNk8yWLpVhPm-LOTbGM/edit#gid=0) + +We are also constantly making progress on improved tests debuggability and de-flaking. + +If any of this interests you, we'd love for you to join us! +There's plenty to learn in debugging test failures, and it will help you gain +familiarity with the code that SIG Node maintains. + +You can always find information about the group on the +[SIG Node](https://github.com/kubernetes/community/tree/master/sig-node) page. +We give group updates at our maintainer track sessions, such as +[KubeCon + CloudNativeCon Europe 2021](https://kccnceu2021.sched.com/event/iE8E/kubernetes-sig-node-intro-and-deep-dive-elana-hashman-red-hat-sergey-kanzhelev-google) and +[KubeCon + CloudNative North America 2021](https://kccncna2021.sched.com/event/lV9D/kubenetes-sig-node-intro-and-deep-dive-elana-hashman-derek-carr-red-hat-sergey-kanzhelev-dawn-chen-google?iframe=no&w=100%&sidebar=yes&bg=no). +Join us in our mission to keep the kubelet and other SIG Node components reliable and ensure smooth and uneventful releases! diff --git a/content/en/blog/_posts/2022-02-16-sig-node-ci-subproject-celebrates/release-mostly-green.png b/content/en/blog/_posts/2022-02-16-sig-node-ci-subproject-celebrates/release-mostly-green.png new file mode 100644 index 0000000000..c88eb3b37e Binary files /dev/null and b/content/en/blog/_posts/2022-02-16-sig-node-ci-subproject-celebrates/release-mostly-green.png differ diff --git a/content/en/blog/_posts/2022-02-16-sig-node-ci-subproject-celebrates/serial-tests-green.png b/content/en/blog/_posts/2022-02-16-sig-node-ci-subproject-celebrates/serial-tests-green.png new file mode 100644 index 0000000000..4ea64fedb7 Binary files /dev/null and b/content/en/blog/_posts/2022-02-16-sig-node-ci-subproject-celebrates/serial-tests-green.png differ diff --git a/content/en/blog/_posts/2022-02-17-updated-dockershim-faq.md b/content/en/blog/_posts/2022-02-17-updated-dockershim-faq.md new file mode 100644 index 0000000000..c8c8b3600c --- /dev/null +++ b/content/en/blog/_posts/2022-02-17-updated-dockershim-faq.md @@ -0,0 +1,205 @@ +--- +layout: blog +title: "Updated: Dockershim Removal FAQ" +date: 2022-02-17 +slug: dockershim-faq +aliases: [ '/dockershim' ] +--- + +**This is an update to the original [Dockershim Deprecation FAQ](/blog/2020/12/02/dockershim-faq/) article, +published in late 2020.** + +This document goes over some frequently asked questions regarding the +deprecation and removal of _dockershim_, that was +[announced](/blog/2020/12/08/kubernetes-1-20-release-announcement/) +as a part of the Kubernetes v1.20 release. For more detail +on what that means, check out the blog post +[Don't Panic: Kubernetes and Docker](/blog/2020/12/02/dont-panic-kubernetes-and-docker/). + +Also, you can read [check whether dockershim removal affects you](/docs/tasks/administer-cluster/migrating-from-dockershim/check-if-dockershim-deprecation-affects-you/) +to determine how much impact the removal of dockershim would have for you +or for your organization. + +As the Kubernetes 1.24 release has become imminent, we've been working hard to try to make this a smooth transition. + +- We've written a blog post detailing our [commitment and next steps](/blog/2022/01/07/kubernetes-is-moving-on-from-dockershim/). +- We believe there are no major blockers to migration to [other container runtimes](/docs/setup/production-environment/container-runtimes/#container-runtimes). +- There is also a [Migrating from dockershim](/docs/tasks/administer-cluster/migrating-from-dockershim/) guide available. +- We've also created a page to list + [articles on dockershim removal and on using CRI-compatible runtimes](/docs/reference/node/topics-on-dockershim-and-cri-compatible-runtimes/). + That list includes some of the already mentioned docs, and also covers selected external sources + (including vendor guides). + +### Why is the dockershim being removed from Kubernetes? + +Early versions of Kubernetes only worked with a specific container runtime: +Docker Engine. Later, Kubernetes added support for working with other container runtimes. +The CRI standard was [created](/blog/2016/12/container-runtime-interface-cri-in-kubernetes/) to +enable interoperability between orchestrators (like Kubernetes) and many different container +runtimes. +Docker Engine doesn't implement that interface (CRI), so the Kubernetes project created +special code to help with the transition, and made that _dockershim_ code part of Kubernetes +itself. + +The dockershim code was always intended to be a temporary solution (hence the name: shim). +You can read more about the community discussion and planning in the +[Dockershim Removal Kubernetes Enhancement Proposal][drkep]. +In fact, maintaining dockershim had become a heavy burden on the Kubernetes maintainers. + +Additionally, features that were largely incompatible with the dockershim, such +as cgroups v2 and user namespaces are being implemented in these newer CRI +runtimes. Removing support for the dockershim will allow further development in +those areas. + +[drkep]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/2221-remove-dockershim + +### Can I still use Docker Engine in Kubernetes 1.23? + +Yes, the only thing changed in 1.20 is a single warning log printed at [kubelet] +startup if using Docker Engine as the runtime. You'll see this warning in all versions up to 1.23. The dockershim removal occurs in Kubernetes 1.24. + +[kubelet]: /docs/reference/command-line-tools-reference/kubelet/ + +### When will dockershim be removed? + +Given the impact of this change, we are using an extended deprecation timeline. +Removal of dockershim is scheduled for Kubernetes v1.24, see [Dockershim Removal Kubernetes Enhancement Proposal][drkep]. +The Kubernetes project will be working closely with vendors and other ecosystem groups to ensure +a smooth transition and will evaluate things as the situation evolves. + +### Can I still use Docker Engine as my container runtime? + +First off, if you use Docker on your own PC to develop or test containers: nothing changes. +You can still use Docker locally no matter what container runtime(s) you use for your +Kubernetes clusters. Containers make this kind of interoperability possible. + +Mirantis and Docker have [committed][mirantis] to maintaining a replacement adapter for +Docker Engine, and to maintain that adapter even after the in-tree dockershim is removed +from Kubernetes. The replacement adapter is named [`cri-dockerd`](https://github.com/Mirantis/cri-dockerd). + +[mirantis]: https://www.mirantis.com/blog/mirantis-to-take-over-support-of-kubernetes-dockershim-2/ + +### Will my existing container images still work? + +Yes, the images produced from `docker build` will work with all CRI implementations. +All your existing images will still work exactly the same. + +#### What about private images? + +Yes. All CRI runtimes support the same pull secrets configuration used in +Kubernetes, either via the PodSpec or ServiceAccount. + +### Are Docker and containers the same thing? + +Docker popularized the Linux containers pattern and has been instrumental in +developing the underlying technology, however containers in Linux have existed +for a long time. The container ecosystem has grown to be much broader than just +Docker. Standards like OCI and CRI have helped many tools grow and thrive in our +ecosystem, some replacing aspects of Docker while others enhance existing +functionality. + +### Are there examples of folks using other runtimes in production today? + +All Kubernetes project produced artifacts (Kubernetes binaries) are validated +with each release. + +Additionally, the [kind] project has been using containerd for some time and has +seen an improvement in stability for its use case. Kind and containerd are leveraged +multiple times every day to validate any changes to the Kubernetes codebase. Other +related projects follow a similar pattern as well, demonstrating the stability and +usability of other container runtimes. As an example, OpenShift 4.x has been +using the [CRI-O] runtime in production since June 2019. + +For other examples and references you can look at the adopters of containerd and +CRI-O, two container runtimes under the Cloud Native Computing Foundation ([CNCF]). + +- [containerd](https://github.com/containerd/containerd/blob/master/ADOPTERS.md) +- [CRI-O](https://github.com/cri-o/cri-o/blob/master/ADOPTERS.md) + +[CRI-O]: https://cri-o.io/ +[kind]: https://kind.sigs.k8s.io/ +[CNCF]: https://cncf.io + +### People keep referencing OCI, what is that? + +OCI stands for the [Open Container Initiative], which standardized many of the +interfaces between container tools and technologies. They maintain a standard +specification for packaging container images (OCI image-spec) and running containers +(OCI runtime-spec). They also maintain an actual implementation of the runtime-spec +in the form of [runc], which is the underlying default runtime for both +[containerd] and [CRI-O]. The CRI builds on these low-level specifications to +provide an end-to-end standard for managing containers. + +[Open Container Initiative]: https://opencontainers.org/about/overview/ +[runc]: https://github.com/opencontainers/runc +[containerd]: https://containerd.io/ + +### Which CRI implementation should I use? + +That’s a complex question and it depends on a lot of factors. If Docker is +working for you, moving to containerd should be a relatively easy swap and +will have strictly better performance and less overhead. However, we encourage you +to explore all the options from the [CNCF landscape] in case another would be an +even better fit for your environment. + +[CNCF landscape]: https://landscape.cncf.io/card-mode?category=container-runtime&grouping=category + +### What should I look out for when changing CRI implementations? + +While the underlying containerization code is the same between Docker and most +CRIs (including containerd), there are a few differences around the edges. Some +common things to consider when migrating are: + +- Logging configuration +- Runtime resource limitations +- Node provisioning scripts that call docker or use docker via it's control socket +- Kubectl plugins that require docker CLI or the control socket +- Tools from the Kubernetes project that require direct access to Docker Engine + (for example: the deprecated `kube-imagepuller` tool) +- Configuration of functionality like `registry-mirrors` and insecure registries +- Other support scripts or daemons that expect Docker Engine to be available and are run + outside of Kubernetes (for example, monitoring or security agents) +- GPUs or special hardware and how they integrate with your runtime and Kubernetes + +If you use Kubernetes resource requests/limits or file-based log collection +DaemonSets then they will continue to work the same, but if you’ve customized +your `dockerd` configuration, you’ll need to adapt that for your new container +runtime where possible. + +Another thing to look out for is anything expecting to run for system maintenance +or nested inside a container when building images will no longer work. For the +former, you can use the [`crictl`][cr] tool as a drop-in replacement (see [mapping from docker cli to crictl](https://kubernetes.io/docs/tasks/debug-application-cluster/crictl/#mapping-from-docker-cli-to-crictl)) and for the +latter you can use newer container build options like [img], [buildah], +[kaniko], or [buildkit-cli-for-kubectl] that don’t require Docker. + +[cr]: https://github.com/kubernetes-sigs/cri-tools +[img]: https://github.com/genuinetools/img +[buildah]: https://github.com/containers/buildah +[kaniko]: https://github.com/GoogleContainerTools/kaniko +[buildkit-cli-for-kubectl]: https://github.com/vmware-tanzu/buildkit-cli-for-kubectl + +For containerd, you can start with their [documentation] to see what configuration +options are available as you migrate things over. + +[documentation]: https://github.com/containerd/cri/blob/master/docs/registry.md + +For instructions on how to use containerd and CRI-O with Kubernetes, see the +Kubernetes documentation on [Container Runtimes] + +[Container Runtimes]: /docs/setup/production-environment/container-runtimes/ + +### What if I have more questions? + +If you use a vendor-supported Kubernetes distribution, you can ask them about +upgrade plans for their products. For end-user questions, please post them +to our end user community forum: https://discuss.kubernetes.io/. + +You can also check out the excellent blog post +[Wait, Docker is deprecated in Kubernetes now?][dep] a more in-depth technical +discussion of the changes. + +[dep]: https://dev.to/inductor/wait-docker-is-deprecated-in-kubernetes-now-what-do-i-do-e4m + +### Can I have a hug? + +Yes, we're still giving hugs as requested. 🤗🤗🤗 diff --git a/content/en/docs/concepts/architecture/nodes.md b/content/en/docs/concepts/architecture/nodes.md index 74e81092ae..6946a6d706 100644 --- a/content/en/docs/concepts/architecture/nodes.md +++ b/content/en/docs/concepts/architecture/nodes.md @@ -93,7 +93,7 @@ For self-registration, the kubelet is started with the following options: No-op if `register-node` is false. - `--node-ip` - IP address of the node. - `--node-labels` - {{< glossary_tooltip text="Labels" term_id="label" >}} to add when registering the node in the cluster (see label restrictions enforced by the [NodeRestriction admission plugin](/docs/reference/access-authn-authz/admission-controllers/#noderestriction)). - - `--node-status-update-frequency` - Specifies how often kubelet posts node status to master. + - `--node-status-update-frequency` - Specifies how often kubelet posts its node status to the API server. When the [Node authorization mode](/docs/reference/access-authn-authz/node/) and [NodeRestriction admission plugin](/docs/reference/access-authn-authz/admission-controllers/#noderestriction) are enabled, @@ -335,7 +335,7 @@ the same time: (default 0.01) per second. The reason these policies are implemented per availability zone is because one -availability zone might become partitioned from the master while the others remain +availability zone might become partitioned from the control plane while the others remain connected. If your cluster does not span multiple cloud provider availability zones, then the eviction mechanism does not take per-zone unavailability into account. diff --git a/content/en/docs/concepts/cluster-administration/addons.md b/content/en/docs/concepts/cluster-administration/addons.md index 81f57466a9..126272973f 100644 --- a/content/en/docs/concepts/cluster-administration/addons.md +++ b/content/en/docs/concepts/cluster-administration/addons.md @@ -21,7 +21,6 @@ This page lists some of the available add-ons and links to their respective inst * [Canal](https://github.com/tigera/canal/tree/master/k8s-install) unites Flannel and Calico, providing networking and network policy. * [Cilium](https://github.com/cilium/cilium) is a L3 network and network policy plugin that can enforce HTTP/API/L7 policies transparently. Both routing and overlay/encapsulation mode are supported, and it can work on top of other CNI plugins. * [CNI-Genie](https://github.com/Huawei-PaaS/CNI-Genie) enables Kubernetes to seamlessly connect to a choice of CNI plugins, such as Calico, Canal, Flannel, Romana, or Weave. -* [Contiv](https://contiv.github.io) provides configurable networking (native L3 using BGP, overlay using vxlan, classic L2, and Cisco-SDN/ACI) for various use cases and a rich policy framework. Contiv project is fully [open sourced](https://github.com/contiv). The [installer](https://github.com/contiv/install) provides both kubeadm and non-kubeadm based installation options. * [Contrail](https://www.juniper.net/us/en/products-services/sdn/contrail/contrail-networking/), based on [Tungsten Fabric](https://tungsten.io), is an open source, multi-cloud network virtualization and policy management platform. Contrail and Tungsten Fabric are integrated with orchestration systems such as Kubernetes, OpenShift, OpenStack and Mesos, and provide isolation modes for virtual machines, containers/pods and bare metal workloads. * [Flannel](https://github.com/flannel-io/flannel#deploying-flannel-manually) is an overlay network provider that can be used with Kubernetes. * [Knitter](https://github.com/ZTE/Knitter/) is a plugin to support multiple network interfaces in a Kubernetes pod. diff --git a/content/en/docs/concepts/cluster-administration/flow-control.md b/content/en/docs/concepts/cluster-administration/flow-control.md index 1ea3b4cf7b..9e8f2a7923 100644 --- a/content/en/docs/concepts/cluster-administration/flow-control.md +++ b/content/en/docs/concepts/cluster-administration/flow-control.md @@ -42,21 +42,21 @@ Fairness feature enabled. ## Enabling/Disabling API Priority and Fairness The API Priority and Fairness feature is controlled by a feature gate -and is enabled by default. See -[Feature Gates](/docs/reference/command-line-tools-reference/feature-gates/) +and is enabled by default. See [Feature +Gates](/docs/reference/command-line-tools-reference/feature-gates/) for a general explanation of feature gates and how to enable and disable them. The name of the feature gate for APF is "APIPriorityAndFairness". This feature also involves an {{< glossary_tooltip term_id="api-group" text="API Group" >}} with: (a) a -`v1alpha1` version, disabled by default, and (b) a `v1beta1` -version, enabled by default. You can disable the feature -gate and API group v1beta1 version by adding the following +`v1alpha1` version, disabled by default, and (b) `v1beta1` and +`v1beta2` versions, enabled by default. You can disable the feature +gate and API group beta versions by adding the following command-line flags to your `kube-apiserver` invocation: ```shell kube-apiserver \ --feature-gates=APIPriorityAndFairness=false \ ---runtime-config=flowcontrol.apiserver.k8s.io/v1beta1=false \ +--runtime-config=flowcontrol.apiserver.k8s.io/v1beta1=false,flowcontrol.apiserver.k8s.io/v1beta2=false \ # …and other flags as usual ``` @@ -127,86 +127,13 @@ any of the limitations imposed by this feature. These exemptions prevent an improperly-configured flow control configuration from totally disabling an API server. -## Defaults - -The Priority and Fairness feature ships with a suggested configuration that -should suffice for experimentation; if your cluster is likely to -experience heavy load then you should consider what configuration will work -best. The suggested configuration groups requests into five priority -classes: - -* The `system` priority level is for requests from the `system:nodes` group, - i.e. Kubelets, which must be able to contact the API server in order for - workloads to be able to schedule on them. - -* The `leader-election` priority level is for leader election requests from - built-in controllers (in particular, requests for `endpoints`, `configmaps`, - or `leases` coming from the `system:kube-controller-manager` or - `system:kube-scheduler` users and service accounts in the `kube-system` - namespace). These are important to isolate from other traffic because failures - in leader election cause their controllers to fail and restart, which in turn - causes more expensive traffic as the new controllers sync their informers. - -* The `workload-high` priority level is for other requests from built-in - controllers. - -* The `workload-low` priority level is for requests from any other service - account, which will typically include all requests from controllers running in - Pods. - -* The `global-default` priority level handles all other traffic, e.g. - interactive `kubectl` commands run by nonprivileged users. - -Additionally, there are two PriorityLevelConfigurations and two FlowSchemas that -are built in and may not be overwritten: - -* The special `exempt` priority level is used for requests that are not subject - to flow control at all: they will always be dispatched immediately. The - special `exempt` FlowSchema classifies all requests from the `system:masters` - group into this priority level. You may define other FlowSchemas that direct - other requests to this priority level, if appropriate. - -* The special `catch-all` priority level is used in combination with the special - `catch-all` FlowSchema to make sure that every request gets some kind of - classification. Typically you should not rely on this catch-all configuration, - and should create your own catch-all FlowSchema and PriorityLevelConfiguration - (or use the `global-default` configuration that is installed by default) as - appropriate. To help catch configuration errors that miss classifying some - requests, the mandatory `catch-all` priority level only allows one concurrency - share and does not queue requests, making it relatively likely that traffic - that only matches the `catch-all` FlowSchema will be rejected with an HTTP 429 - error. - -## Health check concurrency exemption - -The suggested configuration gives no special treatment to the health -check requests on kube-apiservers from their local kubelets --- which -tend to use the secured port but supply no credentials. With the -suggested config, these requests get assigned to the `global-default` -FlowSchema and the corresponding `global-default` priority level, -where other traffic can crowd them out. - -If you add the following additional FlowSchema, this exempts those -requests from rate limiting. - -{{< caution >}} -Making this change also allows any hostile party to then send -health-check requests that match this FlowSchema, at any volume they -like. If you have a web traffic filter or similar external security -mechanism to protect your cluster's API server from general internet -traffic, you can configure rules to block any health check requests -that originate from outside your cluster. -{{< /caution >}} - -{{< codenew file="priority-and-fairness/health-for-strangers.yaml" >}} - ## Resources The flow control API involves two kinds of resources. -[PriorityLevelConfigurations](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io) +[PriorityLevelConfigurations](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#prioritylevelconfiguration-v1beta2-flowcontrol-apiserver-k8s-io) define the available isolation classes, the share of the available concurrency budget that each can handle, and allow for fine-tuning queuing behavior. -[FlowSchemas](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#flowschema-v1beta1-flowcontrol-apiserver-k8s-io) +[FlowSchemas](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#flowschema-v1beta2-flowcontrol-apiserver-k8s-io) are used to classify individual inbound requests, matching each to a single PriorityLevelConfiguration. There is also a `v1alpha1` version of the same API group, and it has the same Kinds with the same syntax and @@ -329,6 +256,153 @@ omitted entirely), in which case all requests matched by this FlowSchema will be considered part of a single flow. The correct choice for a given FlowSchema depends on the resource and your particular environment. +## Defaults + +Each kube-apiserver maintains two sorts of APF configuration objects: +mandatory and suggested. + +### Mandatory Configuration Objects + +The four mandatory configuration objects reflect fixed built-in +guardrail behavior. This is behavior that the servers have before +those objects exist, and when those objects exist their specs reflect +this behavior. The four mandatory objects are as follows. + +* The mandatory `exempt` priority level is used for requests that are + not subject to flow control at all: they will always be dispatched + immediately. The mandatory `exempt` FlowSchema classifies all + requests from the `system:masters` group into this priority + level. You may define other FlowSchemas that direct other requests + to this priority level, if appropriate. + +* The mandatory `catch-all` priority level is used in combination with + the mandatory `catch-all` FlowSchema to make sure that every request + gets some kind of classification. Typically you should not rely on + this catch-all configuration, and should create your own catch-all + FlowSchema and PriorityLevelConfiguration (or use the suggested + `global-default` priority level that is installed by default) as + appropriate. Because it is not expected to be used normally, the + mandatory `catch-all` priority level has a very small concurrency + share and does not queue requests. + +### Suggested Configuration Objects + +The suggested FlowSchemas and PriorityLevelConfigurations constitute a +reasonable default configuration. You can modify these and/or create +additional configuration objects if you want. If your cluster is +likely to experience heavy load then you should consider what +configuration will work best. + +The suggested configuration groups requests into six priority levels: + +* The `node-high` priority level is for health updates from nodes. + +* The `system` priority level is for non-health requests from the + `system:nodes` group, i.e. Kubelets, which must be able to contact + the API server in order for workloads to be able to schedule on + them. + +* The `leader-election` priority level is for leader election requests from + built-in controllers (in particular, requests for `endpoints`, `configmaps`, + or `leases` coming from the `system:kube-controller-manager` or + `system:kube-scheduler` users and service accounts in the `kube-system` + namespace). These are important to isolate from other traffic because failures + in leader election cause their controllers to fail and restart, which in turn + causes more expensive traffic as the new controllers sync their informers. + +* The `workload-high` priority level is for other requests from built-in + controllers. + +* The `workload-low` priority level is for requests from any other service + account, which will typically include all requests from controllers running in + Pods. + +* The `global-default` priority level handles all other traffic, e.g. + interactive `kubectl` commands run by nonprivileged users. + +The suggested FlowSchemas serve to steer requests into the above +priority levels, and are not enumerated here. + +### Maintenance of the Mandatory and Suggested Configuration Objects + +Each `kube-apiserver` independently maintains the mandatory and +suggested configuration objects, using initial and periodic behavior. +Thus, in a situation with a mixture of servers of different versions +there may be thrashing as long as different servers have different +opinions of the proper content of these objects. + +Each `kube-apiserver` makes an inital maintenance pass over the +mandatory and suggested configuration objects, and after that does +periodic maintenance (once per minute) of those objects. + +For the mandatory configuration objects, maintenance consists of +ensuring that the object exists and, if it does, has the proper spec. +The server refuses to allow a creation or update with a spec that is +inconsistent with the server's guardrail behavior. + +Maintenance of suggested configuration objects is designed to allow +their specs to be overridden. Deletion, on the other hand, is not +respected: maintenance will restore the object. If you do not want a +suggested configuration object then you need to keep it around but set +its spec to have minimal consequences. Maintenance of suggested +objects is also designed to support automatic migration when a new +version of the `kube-apiserver` is rolled out, albeit potentially with +thrashing while there is a mixed population of servers. + +Maintenance of a suggested configuration object consists of creating +it --- with the server's suggested spec --- if the object does not +exist. OTOH, if the object already exists, maintenance behavior +depends on whether the `kube-apiservers` or the users control the +object. In the former case, the server ensures that the object's spec +is what the server suggests; in the latter case, the spec is left +alone. + +The question of who controls the object is answered by first looking +for an annotation with key `apf.kubernetes.io/autoupdate-spec`. If +there is such an annotation and its value is `true` then the +kube-apiservers control the object. If there is such an annotation +and its value is `false` then the users control the object. If +neither of those condtions holds then the `metadata.generation` of the +object is consulted. If that is 1 then the kube-apiservers control +the object. Otherwise the users control the object. These rules were +introduced in release 1.22 and their consideration of +`metadata.generation` is for the sake of migration from the simpler +earlier behavior. Users who wish to control a suggested configuration +object should set its `apf.kubernetes.io/autoupdate-spec` annotation +to `false`. + +Maintenance of a mandatory or suggested configuration object also +includes ensuring that it has an `apf.kubernetes.io/autoupdate-spec` +annotation that accurately reflects whether the kube-apiservers +control the object. + +Maintenance also includes deleting objects that are neither mandatory +nor suggested but are annotated +`apf.kubernetes.io/autoupdate-spec=true`. + +## Health check concurrency exemption + +The suggested configuration gives no special treatment to the health +check requests on kube-apiservers from their local kubelets --- which +tend to use the secured port but supply no credentials. With the +suggested config, these requests get assigned to the `global-default` +FlowSchema and the corresponding `global-default` priority level, +where other traffic can crowd them out. + +If you add the following additional FlowSchema, this exempts those +requests from rate limiting. + +{{< caution >}} +Making this change also allows any hostile party to then send +health-check requests that match this FlowSchema, at any volume they +like. If you have a web traffic filter or similar external security +mechanism to protect your cluster's API server from general internet +traffic, you can configure rules to block any health check requests +that originate from outside your cluster. +{{< /caution >}} + +{{< codenew file="priority-and-fairness/health-for-strangers.yaml" >}} + ## Diagnostics Every HTTP response from an API server with the priority and fairness feature diff --git a/content/en/docs/concepts/cluster-administration/logging.md b/content/en/docs/concepts/cluster-administration/logging.md index e0e6ef8d7d..4916548a73 100644 --- a/content/en/docs/concepts/cluster-administration/logging.md +++ b/content/en/docs/concepts/cluster-administration/logging.md @@ -12,7 +12,9 @@ weight: 60 Application logs can help you understand what is happening inside your application. The logs are particularly useful for debugging problems and monitoring cluster activity. Most modern applications have some kind of logging mechanism. Likewise, container engines are designed to support logging. The easiest and most adopted logging method for containerized applications is writing to standard output and standard error streams. However, the native functionality provided by a container engine or runtime is usually not enough for a complete logging solution. + For example, you may want to access your application's logs if a container crashes, a pod gets evicted, or a node dies. + In a cluster, logs should have a separate storage and lifecycle independent of nodes, pods, or containers. This concept is called _cluster-level logging_. @@ -55,7 +57,15 @@ The output is: ... ``` -You can use `kubectl logs --previous` to retrieve logs from a previous instantiation of a container. If your pod has multiple containers, specify which container's logs you want to access by appending a container name to the command. See the [`kubectl logs` documentation](/docs/reference/generated/kubectl/kubectl-commands#logs) for more details. +You can use `kubectl logs --previous` to retrieve logs from a previous instantiation of a container. +If your pod has multiple containers, specify which container's logs you want to access by +appending a container name to the command, with a `-c` flag, like so: + +```console +kubectl logs counter -c count +``` + +See the [`kubectl logs` documentation](/docs/reference/generated/kubectl/kubectl-commands#logs) for more details. ## Logging at the node level @@ -141,7 +151,7 @@ as a `DaemonSet`. Node-level logging creates only one agent per node and doesn't require any changes to the applications running on the node. -Containers write stdout and stderr, but with no agreed format. A node-level agent collects these logs and forwards them for aggregation. +Containers write to stdout and stderr, but with no agreed format. A node-level agent collects these logs and forwards them for aggregation. ### Using a sidecar container with the logging agent {#sidecar-container-with-logging-agent} diff --git a/content/en/docs/concepts/cluster-administration/networking.md b/content/en/docs/concepts/cluster-administration/networking.md index 4b94d933e2..9fed36c2fd 100644 --- a/content/en/docs/concepts/cluster-administration/networking.md +++ b/content/en/docs/concepts/cluster-administration/networking.md @@ -79,7 +79,7 @@ addressing, and it can be used in combination with other CNI plugins. ### CNI-Genie from Huawei -[CNI-Genie](https://github.com/cni-genie/CNI-Genie) is a CNI plugin that enables Kubernetes to [simultaneously have access to different implementations](https://github.com/cni-genie/CNI-Genie/blob/master/docs/multiple-cni-plugins/README.md#what-cni-genie-feature-1-multiple-cni-plugins-enables) of the [Kubernetes network model](/docs/concepts/cluster-administration/networking/#the-kubernetes-network-model) in runtime. This includes any implementation that runs as a [CNI plugin](https://github.com/containernetworking/cni#3rd-party-plugins), such as [Flannel](https://github.com/flannel-io/flannel#flannel), [Calico](https://projectcalico.docs.tigera.io/about/about-calico/), [Weave-net](https://www.weave.works/oss/net/). +[CNI-Genie](https://github.com/cni-genie/CNI-Genie) is a CNI plugin that enables Kubernetes to [simultaneously have access to different implementations](https://github.com/cni-genie/CNI-Genie/blob/master/docs/multiple-cni-plugins/README.md#what-cni-genie-feature-1-multiple-cni-plugins-enables) of the [Kubernetes network model](/docs/concepts/cluster-administration/networking/#how-to-implement-the-kubernetes-networking-model) in runtime. This includes any implementation that runs as a [CNI plugin](https://github.com/containernetworking/cni#3rd-party-plugins), such as [Flannel](https://github.com/flannel-io/flannel#flannel), [Calico](https://projectcalico.docs.tigera.io/about/about-calico/), [Weave-net](https://www.weave.works/oss/net/). CNI-Genie also supports [assigning multiple IP addresses to a pod](https://github.com/cni-genie/CNI-Genie/blob/master/docs/multiple-ips/README.md#feature-2-extension-cni-genie-multiple-ip-addresses-per-pod), each from a different CNI plugin. diff --git a/content/en/docs/concepts/cluster-administration/system-traces.md b/content/en/docs/concepts/cluster-administration/system-traces.md index 51428bad3e..f324604b16 100644 --- a/content/en/docs/concepts/cluster-administration/system-traces.md +++ b/content/en/docs/concepts/cluster-administration/system-traces.md @@ -66,7 +66,7 @@ with `--tracing-config-file=`. This is an example config that re spans for 1 in 10000 requests, and uses the default OpenTelemetry endpoint: ```yaml -apiVersion: apiserver.config.k8s.io/v1beta1 +apiVersion: apiserver.config.k8s.io/v1alpha1 kind: TracingConfiguration # default value #endpoint: localhost:4317 @@ -74,7 +74,7 @@ samplingRatePerMillion: 100 ``` For more information about the `TracingConfiguration` struct, see -[API server config API (v1beta1)](/docs/reference/config-api/apiserver-config.v1beta1/#apiserver-k8s-io-v1beta1-TracingConfiguration). +[API server config API (v1alpha1)](/docs/reference/config-api/apiserver-config.v1alpha1/#apiserver-k8s-io-v1alpha1-TracingConfiguration). ## Stability diff --git a/content/en/docs/concepts/configuration/manage-resources-containers.md b/content/en/docs/concepts/configuration/manage-resources-containers.md index 181dd4c6cb..18f2fc5cb5 100644 --- a/content/en/docs/concepts/configuration/manage-resources-containers.md +++ b/content/en/docs/concepts/configuration/manage-resources-containers.md @@ -231,7 +231,7 @@ The kubelet reports the resource usage of a Pod as part of the Pod If optional [tools for monitoring](/docs/tasks/debug-application-cluster/resource-usage-monitoring/) are available in your cluster, then Pod resource usage can be retrieved either -from the [Metrics API](/docs/tasks/debug-application-cluster/resource-metrics-pipeline/#the-metrics-api) +from the [Metrics API](/docs/tasks/debug-application-cluster/resource-metrics-pipeline/#metrics-api) directly or from your monitoring tools. ## Local ephemeral storage @@ -801,6 +801,6 @@ memory limit (and possibly request) for that container. * Get hands-on experience [assigning CPU resources to containers and Pods](/docs/tasks/configure-pod-container/assign-cpu-resource/). * Read how the API reference defines a [container](/docs/reference/kubernetes-api/workload-resources/pod-v1/#Container) and its [resource requirements](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources) -* Read about [project quotas](https://xfs.org/docs/xfsdocs-xml-dev/XFS_User_Guide/tmp/en-US/html/xfs-quotas.html) in XFS +* Read about [project quotas](https://xfs.org/index.php/XFS_FAQ#Q:_Quota:_Do_quotas_work_on_XFS.3F) in XFS * Read more about the [kube-scheduler configuration reference (v1beta3)](/docs/reference/config-api/kube-scheduler-config.v1beta3/) diff --git a/content/en/docs/concepts/configuration/secret.md b/content/en/docs/concepts/configuration/secret.md index 5f1b5e1f52..82e8a5737d 100644 --- a/content/en/docs/concepts/configuration/secret.md +++ b/content/en/docs/concepts/configuration/secret.md @@ -146,14 +146,6 @@ data: extra: YmFyCg== ``` -When creating a `Pod`, Kubernetes automatically creates a service account Secret -and automatically modifies your Pod to use this Secret. The service account token -Secret contains credentials for accessing the API. - -The automatic creation and use of API credentials can be disabled or -overridden if desired. However, if all you need to do is securely access the -API server, this is the recommended workflow. - See the [ServiceAccount](/docs/tasks/configure-pod-container/configure-service-account/) documentation for more information on how service accounts work. You can also check the `automountServiceAccountToken` field and the @@ -161,6 +153,20 @@ You can also check the `automountServiceAccountToken` field and the [`Pod`](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#pod-v1-core) for information on referencing service account from Pods. +{{< note >}} +Automatic creation of API credentials in secrets to mount into running pods +is no longer used in v1.22 and newer versions. Instead, API credentials are +obtained directly by using the [TokenRequest](/docs/reference/kubernetes-api/authentication-resources/token-request-v1/) API, +and are mounted into Pods using a [projected volume](/docs/reference/access-authn-authz/service-accounts-admin/#bound-service-account-token-volume). +The tokens obtained using this method have bounded lifetimes, and are automatically +invalidated when the Pod they are mounted into is deleted. + +Service account token secrets can still be [created manually](/docs/tasks/configure-pod-container/configure-service-account/#manually-create-a-service-account-api-token) +if you need a token that never expires. +However, using the [TokenRequest](/docs/reference/kubernetes-api/authentication-resources/token-request-v1/) +subresource to obtain a token to access the API is recommended instead. +{{< /note >}} + ### Docker config Secrets You can use one of the following `type` values to create a Secret to diff --git a/content/en/docs/concepts/containers/container-lifecycle-hooks.md b/content/en/docs/concepts/containers/container-lifecycle-hooks.md index 78c0a43b99..cb953eecbc 100644 --- a/content/en/docs/concepts/containers/container-lifecycle-hooks.md +++ b/content/en/docs/concepts/containers/container-lifecycle-hooks.md @@ -105,22 +105,22 @@ The logs for a Hook handler are not exposed in Pod events. If a handler fails for some reason, it broadcasts an event. For `PostStart`, this is the `FailedPostStartHook` event, and for `PreStop`, this is the `FailedPreStopHook` event. -You can see these events by running `kubectl describe pod `. -Here is some example output of events from running this command: +To generate a failed `FailedPreStopHook` event yourself, modify the [lifecycle-events.yaml](https://raw.githubusercontent.com/kubernetes/website/main/content/en/examples/pods/lifecycle-events.yaml) file to change the postStart command to "badcommand" and apply it. +Here is some example output of the resulting events you see from running `kubectl describe pod lifecycle-demo`: ``` Events: - FirstSeen LastSeen Count From SubObjectPath Type Reason Message - --------- -------- ----- ---- ------------- -------- ------ ------- - 1m 1m 1 {default-scheduler } Normal Scheduled Successfully assigned test-1730497541-cq1d2 to gke-test-cluster-default-pool-a07e5d30-siqd - 1m 1m 1 {kubelet gke-test-cluster-default-pool-a07e5d30-siqd} spec.containers{main} Normal Pulling pulling image "test:1.0" - 1m 1m 1 {kubelet gke-test-cluster-default-pool-a07e5d30-siqd} spec.containers{main} Normal Created Created container with docker id 5c6a256a2567; Security:[seccomp=unconfined] - 1m 1m 1 {kubelet gke-test-cluster-default-pool-a07e5d30-siqd} spec.containers{main} Normal Pulled Successfully pulled image "test:1.0" - 1m 1m 1 {kubelet gke-test-cluster-default-pool-a07e5d30-siqd} spec.containers{main} Normal Started Started container with docker id 5c6a256a2567 - 38s 38s 1 {kubelet gke-test-cluster-default-pool-a07e5d30-siqd} spec.containers{main} Normal Killing Killing container with docker id 5c6a256a2567: PostStart handler: Error executing in Docker Container: 1 - 37s 37s 1 {kubelet gke-test-cluster-default-pool-a07e5d30-siqd} spec.containers{main} Normal Killing Killing container with docker id 8df9fdfd7054: PostStart handler: Error executing in Docker Container: 1 - 38s 37s 2 {kubelet gke-test-cluster-default-pool-a07e5d30-siqd} Warning FailedSync Error syncing pod, skipping: failed to "StartContainer" for "main" with RunContainerError: "PostStart handler: Error executing in Docker Container: 1" - 1m 22s 2 {kubelet gke-test-cluster-default-pool-a07e5d30-siqd} spec.containers{main} Warning FailedPostStartHook + Type Reason Age From Message + ---- ------ ---- ---- ------- + Normal Scheduled 7s default-scheduler Successfully assigned default/lifecycle-demo to ip-XXX-XXX-XX-XX.us-east-2... + Normal Pulled 6s kubelet Successfully pulled image "nginx" in 229.604315ms + Normal Pulling 4s (x2 over 6s) kubelet Pulling image "nginx" + Normal Created 4s (x2 over 5s) kubelet Created container lifecycle-demo-container + Normal Started 4s (x2 over 5s) kubelet Started container lifecycle-demo-container + Warning FailedPostStartHook 4s (x2 over 5s) kubelet Exec lifecycle hook ([badcommand]) for Container "lifecycle-demo-container" in Pod "lifecycle-demo_default(30229739-9651-4e5a-9a32-a8f1688862db)" failed - error: command 'badcommand' exited with 126: , message: "OCI runtime exec failed: exec failed: container_linux.go:380: starting container process caused: exec: \"badcommand\": executable file not found in $PATH: unknown\r\n" + Normal Killing 4s (x2 over 5s) kubelet FailedPostStartHook + Normal Pulled 4s kubelet Successfully pulled image "nginx" in 215.66395ms + Warning BackOff 2s (x2 over 3s) kubelet Back-off restarting failed container ``` diff --git a/content/en/docs/concepts/extend-kubernetes/_index.md b/content/en/docs/concepts/extend-kubernetes/_index.md index 6f43b994a1..7686666b58 100644 --- a/content/en/docs/concepts/extend-kubernetes/_index.md +++ b/content/en/docs/concepts/extend-kubernetes/_index.md @@ -39,6 +39,7 @@ Customization approaches can be broadly divided into *configuration*, which only *Configuration files* and *flags* are documented in the Reference section of the online documentation, under each binary: * [kubelet](/docs/reference/command-line-tools-reference/kubelet/) +* [kube-proxy](/docs/reference/command-line-tools-reference/kube-proxy/) * [kube-apiserver](/docs/reference/command-line-tools-reference/kube-apiserver/) * [kube-controller-manager](/docs/reference/command-line-tools-reference/kube-controller-manager/) * [kube-scheduler](/docs/reference/command-line-tools-reference/kube-scheduler/). diff --git a/content/en/docs/concepts/extend-kubernetes/operator.md b/content/en/docs/concepts/extend-kubernetes/operator.md index 7245c45bfc..96a17ada96 100644 --- a/content/en/docs/concepts/extend-kubernetes/operator.md +++ b/content/en/docs/concepts/extend-kubernetes/operator.md @@ -111,6 +111,7 @@ Operator. {{% thirdparty-content %}} * [Charmed Operator Framework](https://juju.is/) +* [Kopf](https://github.com/nolar/kopf) (Kubernetes Operator Pythonic Framework) * [kubebuilder](https://book.kubebuilder.io/) * [KubeOps](https://buehler.github.io/dotnet-operator-sdk/) (.NET operator SDK) * [KUDO](https://kudo.dev/) (Kubernetes Universal Declarative Operator) diff --git a/content/en/docs/concepts/extend-kubernetes/service-catalog.md b/content/en/docs/concepts/extend-kubernetes/service-catalog.md index 26517de9c6..8c8b1aa238 100644 --- a/content/en/docs/concepts/extend-kubernetes/service-catalog.md +++ b/content/en/docs/concepts/extend-kubernetes/service-catalog.md @@ -230,7 +230,6 @@ The following example describes how to map secret values into application enviro * If you are familiar with {{< glossary_tooltip text="Helm Charts" term_id="helm-chart" >}}, [install Service Catalog using Helm](/docs/tasks/service-catalog/install-service-catalog-using-helm/) into your Kubernetes cluster. Alternatively, you can [install Service Catalog using the SC tool](/docs/tasks/service-catalog/install-service-catalog-using-sc/). * View [sample service brokers](https://github.com/openservicebrokerapi/servicebroker/blob/master/gettingStarted.md#sample-service-brokers). * Explore the [kubernetes-sigs/service-catalog](https://github.com/kubernetes-sigs/service-catalog) project. -* View [svc-cat.io](https://svc-cat.io/docs/). diff --git a/content/en/docs/concepts/overview/components.md b/content/en/docs/concepts/overview/components.md index fb3997b283..60433f63e5 100644 --- a/content/en/docs/concepts/overview/components.md +++ b/content/en/docs/concepts/overview/components.md @@ -30,7 +30,7 @@ Control plane components can be run on any machine in the cluster. However, for simplicity, set up scripts typically start all control plane components on the same machine, and do not run user containers on this machine. See [Creating Highly Available clusters with kubeadm](/docs/setup/production-environment/tools/kubeadm/high-availability/) -for an example control plane setup that runs across multiple VMs. +for an example control plane setup that runs across multiple machines. ### kube-apiserver diff --git a/content/en/docs/concepts/overview/working-with-objects/finalizers.md b/content/en/docs/concepts/overview/working-with-objects/finalizers.md index fdec67b220..9241ae7e2a 100644 --- a/content/en/docs/concepts/overview/working-with-objects/finalizers.md +++ b/content/en/docs/concepts/overview/working-with-objects/finalizers.md @@ -21,18 +21,21 @@ your own. When you create a resource using a manifest file, you can specify finalizers in the `metadata.finalizers` field. When you attempt to delete the resource, the -controller that manages it notices the values in the `finalizers` field and does -the following: +API server handling the delete request notices the values in the `finalizers` field +and does the following: * Modifies the object to add a `metadata.deletionTimestamp` field with the time you started the deletion. - * Marks the object as read-only until its `metadata.finalizers` field is empty. + * Prevents the object from being removed until its `metadata.finalizers` field is empty. + * Returns a `202` status code (HTTP "Accepted") +The controller managing that finalizer notices the update to the object setting the +`metadata.deletionTimestamp`, indicating deletion of the object has been requested. The controller then attempts to satisfy the requirements of the finalizers specified for that resource. Each time a finalizer condition is satisfied, the controller removes that key from the resource's `finalizers` field. When the -field is empty, garbage collection continues. You can also use finalizers to -prevent deletion of unmanaged resources. +`finalizers` field is emptied, an object with a `deletionTimestamp` field set +is automatically deleted. You can also use finalizers to prevent deletion of unmanaged resources. A common example of a finalizer is `kubernetes.io/pv-protection`, which prevents accidental deletion of `PersistentVolume` objects. When a `PersistentVolume` @@ -63,16 +66,18 @@ Kubernetes also processes finalizers when it identifies owner references on a resource targeted for deletion. In some situations, finalizers can block the deletion of dependent objects, -which can cause the targeted owner object to remain in a read-only state for +which can cause the targeted owner object to remain for longer than expected without being fully deleted. In these situations, you should check finalizers and owner references on the target owner and dependent objects to troubleshoot the cause. {{}} -In cases where objects are stuck in a deleting state, try to avoid manually +In cases where objects are stuck in a deleting state, avoid manually removing finalizers to allow deletion to continue. Finalizers are usually added to resources for a reason, so forcefully removing them can lead to issues in -your cluster. +your cluster. This should only be done when the purpose of the finalizer is +understood and is accomplished in another way (for example, manually cleaning +up some dependent object). {{}} ## {{% heading "whatsnext" %}} diff --git a/content/en/docs/concepts/overview/working-with-objects/kubernetes-objects.md b/content/en/docs/concepts/overview/working-with-objects/kubernetes-objects.md index c763b40e05..bcfd32ef7d 100644 --- a/content/en/docs/concepts/overview/working-with-objects/kubernetes-objects.md +++ b/content/en/docs/concepts/overview/working-with-objects/kubernetes-objects.md @@ -63,7 +63,7 @@ One way to create a Deployment using a `.yaml` file like the one above is to use in the `kubectl` command-line interface, passing the `.yaml` file as an argument. Here's an example: ```shell -kubectl apply -f https://k8s.io/examples/application/deployment.yaml --record +kubectl apply -f https://k8s.io/examples/application/deployment.yaml ``` The output is similar to this: @@ -83,10 +83,19 @@ In the `.yaml` file for the Kubernetes object you want to create, you'll need to The precise format of the object `spec` is different for every Kubernetes object, and contains nested fields specific to that object. The [Kubernetes API Reference](https://kubernetes.io/docs/reference/kubernetes-api/) can help you find the spec format for all of the objects you can create using Kubernetes. -For example, the reference for Pod details the [`spec` field](/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodSpec) -for a Pod in the API, and the reference for Deployment details the [`spec` field](/docs/reference/kubernetes-api/workload-resources/deployment-v1/#DeploymentSpec) for Deployments. -In those API reference pages you'll see mention of PodSpec and DeploymentSpec. These names are implementation details of the Golang code that Kubernetes uses to implement its API. - +For example, see the [`spec` field](/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodSpec) +for the Pod API reference. +For each Pod, the `.spec` field specifies the pod and its desired state (such as the container image name for +each container within that pod). +Another example of an object specification is the +[`spec` field](/docs/reference/kubernetes-api/workload-resources/stateful-set-v1/#StatefulSetSpec) +for the StatefulSet API. For StatefulSet, the `.spec` field specifies the StatefulSet and +its desired state. +Within the `.spec` of a StatefulSet is a [template](/docs/concepts/workloads/pods/#pod-templates) +for Pod objects. That template describes Pods that the StatefulSet controller will create in order to +satisfy the StatefulSet specification. +Different kinds of object can also have different `.status`; again, the API reference pages +detail the structure of that `.status` field, and its content for each different type of object. ## {{% heading "whatsnext" %}} diff --git a/content/en/docs/concepts/policy/pod-security-policy.md b/content/en/docs/concepts/policy/pod-security-policy.md index 34ea1ecf3f..ea16157fcb 100644 --- a/content/en/docs/concepts/policy/pod-security-policy.md +++ b/content/en/docs/concepts/policy/pod-security-policy.md @@ -11,9 +11,13 @@ weight: 30 {{< feature-state for_k8s_version="v1.21" state="deprecated" >}} -PodSecurityPolicy is deprecated as of Kubernetes v1.21, and will be removed in v1.25. It has been replaced by -[Pod Security Admission](/docs/concepts/security/pod-security-admission/). For more information on the deprecation, +{{< caution >}} +PodSecurityPolicy is deprecated as of Kubernetes v1.21, and **will be removed in v1.25**. We recommend migrating to +[Pod Security Admission](/docs/concepts/security/pod-security-admission/), or a 3rd party admission plugin. +For a migration guide, see [Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller](/docs/tasks/configure-pod-container/migrate-from-psp/). +For more information on the deprecation, see [PodSecurityPolicy Deprecation: Past, Present, and Future](/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/). +{{< /caution >}} Pod Security Policies enable fine-grained authorization of pod creation and updates. diff --git a/content/en/docs/concepts/scheduling-eviction/api-eviction.md b/content/en/docs/concepts/scheduling-eviction/api-eviction.md index e7f1942df2..b4e92c40bf 100644 --- a/content/en/docs/concepts/scheduling-eviction/api-eviction.md +++ b/content/en/docs/concepts/scheduling-eviction/api-eviction.md @@ -6,14 +6,117 @@ weight: 70 {{< glossary_definition term_id="api-eviction" length="short" >}}
-You can request eviction by directly calling the Eviction API -using a client of the kube-apiserver, like the `kubectl drain` command. -This creates an `Eviction` object, which causes the API server to terminate the Pod. +You can request eviction by calling the Eviction API directly, or programmatically +using a client of the {{}}, like the `kubectl drain` command. This +creates an `Eviction` object, which causes the API server to terminate the Pod. API-initiated evictions respect your configured [`PodDisruptionBudgets`](/docs/tasks/run-application/configure-pdb/) and [`terminationGracePeriodSeconds`](/docs/concepts/workloads/pods/pod-lifecycle#pod-termination). +Using the API to create an Eviction object for a Pod is like performing a +policy-controlled [`DELETE` operation](/docs/reference/kubernetes-api/workload-resources/pod-v1/#delete-delete-a-pod) +on the Pod. + +## Calling the Eviction API + +You can use a [Kubernetes language client](/docs/tasks/administer-cluster/access-cluster-api/#programmatic-access-to-the-api) +to access the Kubernetes API and create an `Eviction` object. To do this, you +POST the attempted operation, similar to the following example: + +{{< tabs name="Eviction_example" >}} +{{% tab name="policy/v1" %}} +{{< note >}} +`policy/v1` Eviction is available in v1.22+. Use `policy/v1beta1` with prior releases. +{{< /note >}} + +```json +{ + "apiVersion": "policy/v1", + "kind": "Eviction", + "metadata": { + "name": "quux", + "namespace": "default" + } +} +``` +{{% /tab %}} +{{% tab name="policy/v1beta1" %}} +{{< note >}} +Deprecated in v1.22 in favor of `policy/v1` +{{< /note >}} + +```json +{ + "apiVersion": "policy/v1beta1", + "kind": "Eviction", + "metadata": { + "name": "quux", + "namespace": "default" + } +} +``` +{{% /tab %}} +{{< /tabs >}} + +Alternatively, you can attempt an eviction operation by accessing the API using +`curl` or `wget`, similar to the following example: + +```bash +curl -v -H 'Content-type: application/json' https://your-cluster-api-endpoint.example/api/v1/namespaces/default/pods/quux/eviction -d @eviction.json +``` + +## How API-initiated eviction works + +When you request an eviction using the API, the API server performs admission +checks and responds in one of the following ways: + +* `200 OK`: the eviction is allowed, the `Eviction` subresource is created, and + the Pod is deleted, similar to sending a `DELETE` request to the Pod URL. +* `429 Too Many Requests`: the eviction is not currently allowed because of the + configured {{}}. + You may be able to attempt the eviction again later. You might also see this + response because of API rate limiting. +* `500 Internal Server Error`: the eviction is not allowed because there is a + misconfiguration, like if multiple PodDisruptionBudgets reference the same Pod. + +If the Pod you want to evict isn't part of a workload that has a +PodDisruptionBudget, the API server always returns `200 OK` and allows the +eviction. + +If the API server allows the eviction, the Pod is deleted as follows: + +1. The `Pod` resource in the API server is updated with a deletion timestamp, + after which the API server considers the `Pod` resource to be terminated. The + `Pod` resource is also marked with the configured grace period. +1. The {{}} on the node where the local Pod is running notices that the `Pod` + resource is marked for termination and starts to gracefully shut down the + local Pod. +1. While the kubelet is shutting the Pod down, the control plane removes the Pod + from {{}} and + {{}} + objects. As a result, controllers no longer consider the Pod as a valid object. +1. After the grace period for the Pod expires, the kubelet forcefully terminates + the local Pod. +1. The kubelet tells the API server to remove the `Pod` resource. +1. The API server deletes the `Pod` resource. + +## Troubleshooting stuck evictions + +In some cases, your applications may enter a broken state, where the Eviction +API will only return `429` or `500` responses until you intervene. This can +happen if, for example, a ReplicaSet creates pods for your application but new +pods do not enter a `Ready` state. You may also notice this behavior in cases +where the last evicted Pod had a long termination grace period. + +If you notice stuck evictions, try one of the following solutions: + +* Abort or pause the automated operation causing the issue. Investigate the stuck + application before you restart the operation. +* Wait a while, then directly delete the Pod from your cluster control plane + instead of using the Eviction API. + ## {{% heading "whatsnext" %}} -* Learn about [Node-pressure Eviction](/docs/concepts/scheduling-eviction/node-pressure-eviction/) -* Learn about [Pod Priority and Preemption](/docs/concepts/scheduling-eviction/pod-priority-preemption/) +* Learn how to protect your applications with a [Pod Disruption Budget](/docs/tasks/run-application/configure-pdb/). +* Learn about [Node-pressure Eviction](/docs/concepts/scheduling-eviction/node-pressure-eviction/). +* Learn about [Pod Priority and Preemption](/docs/concepts/scheduling-eviction/pod-priority-preemption/). diff --git a/content/en/docs/concepts/security/overview.md b/content/en/docs/concepts/security/overview.md index 9519ef1eaf..9373e78ea9 100644 --- a/content/en/docs/concepts/security/overview.md +++ b/content/en/docs/concepts/security/overview.md @@ -123,7 +123,7 @@ Area of Concern for Containers | Recommendation | Container Vulnerability Scanning and OS Dependency Security | As part of an image build step, you should scan your containers for known vulnerabilities. Image Signing and Enforcement | Sign container images to maintain a system of trust for the content of your containers. Disallow privileged users | When constructing containers, consult your documentation for how to create users inside of the containers that have the least level of operating system privilege necessary in order to carry out the goal of the container. -Use container runtime with stronger isolation | Select [container runtime classes](/docs/concepts/containers/runtime-class/) that provider stronger isolation +Use container runtime with stronger isolation | Select [container runtime classes](/docs/concepts/containers/runtime-class/) that provide stronger isolation ## Code diff --git a/content/en/docs/concepts/security/pod-security-admission.md b/content/en/docs/concepts/security/pod-security-admission.md index 5969d2bb5d..67b8770a84 100644 --- a/content/en/docs/concepts/security/pod-security-admission.md +++ b/content/en/docs/concepts/security/pod-security-admission.md @@ -19,7 +19,7 @@ The Kubernetes [Pod Security Standards](/docs/concepts/security/pod-security-sta different isolation levels for Pods. These standards let you define how you want to restrict the behavior of pods in a clear, consistent fashion. -As an Beta feature, Kubernetes offers a built-in _Pod Security_ {{< glossary_tooltip +As a Beta feature, Kubernetes offers a built-in _Pod Security_ {{< glossary_tooltip text="admission controller" term_id="admission-controller" >}}, the successor to [PodSecurityPolicies](/docs/concepts/policy/pod-security-policy/). Pod security restrictions are applied at the {{< glossary_tooltip text="namespace" term_id="namespace" >}} level when pods @@ -125,7 +125,7 @@ applied to workload resources, only to the resulting pod objects. ## Exemptions -You can define _exemptions_ from pod security enforcement in order allow the creation of pods that +You can define _exemptions_ from pod security enforcement in order to allow the creation of pods that would have otherwise been prohibited due to the policy associated with a given namespace. Exemptions can be statically configured in the [Admission Controller configuration](/docs/tasks/configure-pod-container/enforce-standards-admission-controller/#configure-the-admission-controller). diff --git a/content/en/docs/concepts/security/pod-security-standards.md b/content/en/docs/concepts/security/pod-security-standards.md index 73341e4c71..c4333c1542 100644 --- a/content/en/docs/concepts/security/pod-security-standards.md +++ b/content/en/docs/concepts/security/pod-security-standards.md @@ -52,8 +52,8 @@ fail validation. Baseline policy specification - Control - Policy + Control + Policy HostProcess diff --git a/content/en/docs/concepts/services-networking/endpoint-slices.md b/content/en/docs/concepts/services-networking/endpoint-slices.md index da8d09d9d5..cd90ecdcfd 100644 --- a/content/en/docs/concepts/services-networking/endpoint-slices.md +++ b/content/en/docs/concepts/services-networking/endpoint-slices.md @@ -147,9 +147,9 @@ In the v1 API, the per endpoint `topology` was effectively removed in favor of the dedicated fields `nodeName` and `zone`. Setting arbitrary topology fields on the `endpoint` field of an `EndpointSlice` -resource has been deprecated and is not be supported in the v1 API. Instead, -the v1 API supports setting individual `nodeName` and `zone` fields. These -fields are automatically translated between API versions. For example, the +resource has been deprecated and is not supported in the v1 API. +Instead, the v1 API supports setting individual `nodeName` and `zone` fields. +These fields are automatically translated between API versions. For example, the value of the `"topology.kubernetes.io/zone"` key in the `topology` field in the v1beta1 API is accessible as the `zone` field in the v1 API. {{< /note >}} diff --git a/content/en/docs/concepts/services-networking/ingress-controllers.md b/content/en/docs/concepts/services-networking/ingress-controllers.md index 3186b56748..08b715ac7b 100644 --- a/content/en/docs/concepts/services-networking/ingress-controllers.md +++ b/content/en/docs/concepts/services-networking/ingress-controllers.md @@ -48,6 +48,7 @@ Kubernetes as a project supports and maintains [AWS](https://github.com/kubernet is an ingress controller driving [Kong Gateway](https://konghq.com/kong/). * The [NGINX Ingress Controller for Kubernetes](https://www.nginx.com/products/nginx-ingress-controller/) works with the [NGINX](https://www.nginx.com/resources/glossary/nginx/) webserver (as a proxy). +* The [Pomerium Ingress Controller](https://www.pomerium.com/docs/k8s/ingress.html) is based on [Pomerium](https://pomerium.com/), which offers context-aware access policy. * [Skipper](https://opensource.zalando.com/skipper/kubernetes/ingress-controller/) HTTP router and reverse proxy for service composition, including use cases like Kubernetes Ingress, designed as a library to build your custom proxy. * The [Traefik Kubernetes Ingress provider](https://doc.traefik.io/traefik/providers/kubernetes-ingress/) is an ingress controller for the [Traefik](https://traefik.io/traefik/) proxy. diff --git a/content/en/docs/concepts/services-networking/topology-aware-hints.md b/content/en/docs/concepts/services-networking/topology-aware-hints.md index d07a75d923..4cc4f4aa5e 100644 --- a/content/en/docs/concepts/services-networking/topology-aware-hints.md +++ b/content/en/docs/concepts/services-networking/topology-aware-hints.md @@ -30,7 +30,7 @@ Routing". When calculating the endpoints for a {{< glossary_tooltip term_id="Ser the EndpointSlice controller considers the topology (region and zone) of each endpoint and populates the hints field to allocate it to a zone. Cluster components such as the {{< glossary_tooltip term_id="kube-proxy" text="kube-proxy" >}} -can then consume those hints, and use them to influence how traffic to is routed +can then consume those hints, and use them to influence how the traffic is routed (favoring topologically closer endpoints). ## Using Topology Aware Hints diff --git a/content/en/docs/concepts/storage/persistent-volumes.md b/content/en/docs/concepts/storage/persistent-volumes.md index 11a5611b36..7a11939507 100644 --- a/content/en/docs/concepts/storage/persistent-volumes.md +++ b/content/en/docs/concepts/storage/persistent-volumes.md @@ -339,7 +339,7 @@ If that has happened, or you suspect that it might have, you can retry expansion size that is within the capacity limits of underlying storage provider. You can monitor status of resize operation by watching `.status.resizeStatus` and events on the PVC. Note that, -although you can a specify a lower amount of storage than what was requested previously, +although you can specify a lower amount of storage than what was requested previously, the new value must still be higher than `.status.capacity`. Kubernetes does not support shrinking a PVC to less than its current size. {{% /tab %}} diff --git a/content/en/docs/concepts/storage/storage-classes.md b/content/en/docs/concepts/storage/storage-classes.md index cd9124b6a7..421a293737 100644 --- a/content/en/docs/concepts/storage/storage-classes.md +++ b/content/en/docs/concepts/storage/storage-classes.md @@ -49,7 +49,7 @@ metadata: name: standard provisioner: kubernetes.io/aws-ebs parameters: - type: gp2 + type: gp3 reclaimPolicy: Retain allowVolumeExpansion: true mountOptions: @@ -271,9 +271,9 @@ parameters: fsType: ext4 ``` -* `type`: `io1`, `gp2`, `sc1`, `st1`. See +* `type`: `io1`, `gp2`, `gp3`, `sc1`, `st1`. See [AWS docs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html) - for details. Default: `gp2`. + for details. Default: `gp3`. * `zone` (Deprecated): AWS zone. If neither `zone` nor `zones` is specified, volumes are generally round-robin-ed across all active zones where Kubernetes cluster has a node. `zone` and `zones` parameters must not be used at the same time. diff --git a/content/en/docs/concepts/workloads/controllers/job.md b/content/en/docs/concepts/workloads/controllers/job.md index 8ff46d4f50..6fb0a21ff6 100644 --- a/content/en/docs/concepts/workloads/controllers/job.md +++ b/content/en/docs/concepts/workloads/controllers/job.md @@ -308,7 +308,7 @@ cleaned up by CronJobs based on the specified capacity-based cleanup policy. ### TTL mechanism for finished Jobs -{{< feature-state for_k8s_version="v1.21" state="beta" >}} +{{< feature-state for_k8s_version="v1.23" state="stable" >}} Another way to clean up finished Jobs (either `Complete` or `Failed`) automatically is to use a TTL mechanism provided by a diff --git a/content/en/docs/contribute/advanced.md b/content/en/docs/contribute/advanced.md index a951a2cbf2..9c37906f3d 100644 --- a/content/en/docs/contribute/advanced.md +++ b/content/en/docs/contribute/advanced.md @@ -86,6 +86,7 @@ Responsibilities for New Contributor Ambassadors include: - Mentoring new contributors through their first few PRs to the docs repo. - Helping new contributors create the more complex PRs they need to become Kubernetes members. - [Sponsoring contributors](/docs/contribute/advanced/#sponsor-a-new-contributor) on their path to becoming Kubernetes members. +- Hosting a monthly meeting to help and mentor new contributors. Current New Contributor Ambassadors are announced at each SIG-Docs meeting and in the [Kubernetes #sig-docs channel](https://kubernetes.slack.com). diff --git a/content/en/docs/contribute/new-content/blogs-case-studies.md b/content/en/docs/contribute/new-content/blogs-case-studies.md index 0380bd7e2d..2b0d9f0cdd 100644 --- a/content/en/docs/contribute/new-content/blogs-case-studies.md +++ b/content/en/docs/contribute/new-content/blogs-case-studies.md @@ -83,6 +83,15 @@ To submit a blog post follow these directions: - _initial commit_ - _draft post_ - The blog team will then review your PR and give you comments on things you might need to fix. After that the bot will merge your PR and your blog post will be published. + - If the content of the blog post contains only content that is not expected to require updates to stay accurate for the reader, it can be marked as evergreen and exempted from the automatic warning about outdated content added to blog posts older than one year. + - To mark a blog post as evergreen, add this to the front matter: + + ```yaml + evergreen: true + ``` + - Examples of content that should not be marked evergreen: + - **Tutorials** that only apply to specific releases or versions and not all future versions + - References to pre-GA APIs or features ## Submit a case study diff --git a/content/en/docs/contribute/review/reviewing-prs.md b/content/en/docs/contribute/review/reviewing-prs.md index 77bdc85806..3e71e9c434 100644 --- a/content/en/docs/contribute/review/reviewing-prs.md +++ b/content/en/docs/contribute/review/reviewing-prs.md @@ -36,7 +36,7 @@ Before you start a review: ## Review process -In general, review pull requests for content and style in English. The figure below outlines the steps for the review process. The details for each step follow. +In general, review pull requests for content and style in English. Figure 1 outlines the steps for the review process. The details for each step follow. @@ -67,7 +67,7 @@ class S,T spacewhite class third,fourth white {{}} -***Figure - Review process steps*** +Figure 1. Review process steps. 1. Go to [https://github.com/kubernetes/website/pulls](https://github.com/kubernetes/website/pulls). diff --git a/content/en/docs/contribute/style/diagram-guide.md b/content/en/docs/contribute/style/diagram-guide.md index bc2cd926da..4024b44129 100644 --- a/content/en/docs/contribute/style/diagram-guide.md +++ b/content/en/docs/contribute/style/diagram-guide.md @@ -7,9 +7,13 @@ weight: 15 -This guide shows you how to create, edit and share diagrams using the Mermaid Javascript library. Mermaid.js allows you to generate diagrams using a simple markdown-like syntax inside Markdown files. You can also use Mermaid to generate `.svg` or `.png` image files that you can add to your documentation. +This guide shows you how to create, edit and share diagrams using the Mermaid +Javascript library. Mermaid.js allows you to generate diagrams using a simple +markdown-like syntax inside Markdown files. You can also use Mermaid to +generate `.svg` or `.png` image files that you can add to your documentation. -The target audience for this guide is anybody wishing to learn about Mermaid and/or how to create and add diagrams to Kubernetes documentation. +The target audience for this guide is anybody wishing to learn about Mermaid +and/or how to create and add diagrams to Kubernetes documentation. Figure 1 outlines the topics covered in this section. @@ -54,11 +58,12 @@ All you need to begin working with Mermaid is the following: * Using the Mermaid live editor. * Using [Hugo shortcodes](/docs/contribute/style/hugo-shortcodes/). * Using the [Hugo {{}} shortcode](https://gohugo.io/content-management/shortcodes/#figure). -* Performing [Hugo local previews](https://kubernetes.io/docs/contribute/new-content/open-a-pr/#preview-locally). +* Performing [Hugo local previews](/docs/contribute/new-content/open-a-pr/#preview-locally). * Familiar with the [Contributing new content](/docs/contribute/new-content/) process. {{< note >}} -You can click on each diagram in this section to view the code and rendered diagram in the Mermaid live editor. +You can click on each diagram in this section to view the code and rendered +diagram in the Mermaid live editor. {{< /note >}} @@ -69,21 +74,32 @@ Diagrams improve documentation clarity and comprehension. There are advantages f The user benefits include: -* __Friendly landing spot__. A detailed text-only greeting page could intimidate users, in particular, first-time Kubernetes users. -* __Faster grasp of concepts__. A diagram can help users understand the key points of a complex topic. Your diagram can serve as a visual learning guide to dive into the topic details. +* __Friendly landing spot__. A detailed text-only greeting page could + intimidate users, in particular, first-time Kubernetes users. +* __Faster grasp of concepts__. A diagram can help users understand the key + points of a complex topic. Your diagram can serve as a visual learning guide + to dive into the topic details. * __Better retention__. For some, it is easier to recall pictures rather than text. The contributor benefits include: -* __Assist in developing the structure and content__ of your contribution. For example, you can start with a simple diagram covering the high-level points and then dive into details. -* __Expand and grow the user community__. Easily consumed documentation augmented with diagrams attracts new users who might previously have been reluctant to engage due to perceived complexities. - -You should consider your target audience. In addition to experienced K8s users, you will have many who are new to Kubernetes. Even a simple diagram can assist new users in absorbing Kubernetes concepts. They become emboldened and more confident to further explore Kubernetes and the documentation. +* __Assist in developing the structure and content__ of your contribution. For + example, you can start with a simple diagram covering the high-level points + and then dive into details. +* __Expand and grow the user community__. Easily consumed documentation + augmented with diagrams attracts new users who might previously have been + reluctant to engage due to perceived complexities. +You should consider your target audience. In addition to experienced K8s +users, you will have many who are new to Kubernetes. Even a simple diagram can +assist new users in absorbing Kubernetes concepts. They become emboldened and +more confident to further explore Kubernetes and the documentation. ## Mermaid -[Mermaid](https://mermaid-js.github.io/mermaid/#/) is an open source JavaScript library that allows you to create, edit and easily share diagrams using a simple, markdown-like syntax configured inline in Markdown files. +[Mermaid](https://mermaid-js.github.io/mermaid/#/) is an open source +JavaScript library that allows you to create, edit and easily share diagrams +using a simple, markdown-like syntax configured inline in Markdown files. The following lists features of Mermaid: @@ -93,35 +109,40 @@ The following lists features of Mermaid: * Easy collaboration with colleagues by sharing a per-diagram URL. * Broad selection of shapes, lines, themes and styling. - The following lists advantages of using Mermaid: * No need for separate, non-Mermaid diagram tools. -* Adheres to existing PR workflow. You can think of Mermaid code as just Markdown text included in your PR. -* Simple tool builds simple diagrams. You don't want to get bogged down (re)crafting an overly complex and detailed picture. Keep it simple! +* Adheres to existing PR workflow. You can think of Mermaid code as just + Markdown text included in your PR. +* Simple tool builds simple diagrams. You don't want to get bogged down + (re)crafting an overly complex and detailed picture. Keep it simple! -Mermaid provides a simple, open and transparent method for the SIG communities to add, edit and collaborate on diagrams for new or existing documentation. +Mermaid provides a simple, open and transparent method for the SIG communities +to add, edit and collaborate on diagrams for new or existing documentation. {{< note >}} -You can still use Mermaid to create/edit diagrams even if it's not supported in your environment. This method is called __Mermaid+SVG__ and is explained below. +You can still use Mermaid to create/edit diagrams even if it's not supported +in your environment. This method is called __Mermaid+SVG__ and is explained +below. {{< /note >}} ### Live editor -The [Mermaid live editor](https://mermaid-js.github.io/mermaid-live-editor) is a web-based tool that enables you to create, edit and review diagrams. +The [Mermaid live editor](https://mermaid-js.github.io/mermaid-live-editor) is +a web-based tool that enables you to create, edit and review diagrams. The following lists live editor functions: * Displays Mermaid code and rendered diagram. -* Generates a URL for each saved diagram. The URL is displayed in the URL field of your browser. You can share the URL with colleagues who can access and modify the diagram. +* Generates a URL for each saved diagram. The URL is displayed in the URL + field of your browser. You can share the URL with colleagues who can access + and modify the diagram. * Option to download `.svg` or `.png` files. - {{< note >}} The live editor is the easiest and fastest way to create and edit Mermaid diagrams. {{< /note >}} - ## Methods for creating diagrams Figure 2 outlines the three methods to generate and add diagrams. @@ -157,7 +178,8 @@ Figure 2. Methods to create diagrams. ### Inline -Figure 3 outlines the steps to follow for adding a diagram using the Inline method. +Figure 3 outlines the steps to follow for adding a diagram using the Inline +method. {{< mermaid >}} graph LR @@ -182,7 +204,6 @@ click D "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3Jh - {{< /mermaid >}} Figure 3. Inline Method steps. @@ -196,8 +217,11 @@ The following lists the steps you should follow for adding a diagram using the I 4. Add a caption below the diagram using Markdown text. A Hugo build runs the Mermaid code and turns it into a diagram. + {{< note >}} -You may find keeping track of diagram URLs is cumbersome. If so, make a note in the `.md` file that the Mermaid code is self-documenting. Contributors can copy the Mermaid code to and from the live editor for diagram edits. +You may find keeping track of diagram URLs is cumbersome. If so, make a note +in the `.md` file that the Mermaid code is self-documenting. Contributors can +copy the Mermaid code to and from the live editor for diagram edits. {{< /note >}} Here is a sample code snippet contained in an `.md` file: @@ -218,7 +242,9 @@ Figure 17. A to B more text ``` {{< note >}} -You must include the `{{}}`, `{{}}` shortcode tags at the start and end of the Mermaid code block. You should add a diagram caption below the diagram. +You must include the `{{}}`, `{{}}` shortcode +tags at the start and end of the Mermaid code block. You should add a diagram +caption below the diagram. {{< /note >}} For more details on diagram captions, see [How to use captions](#how-to-use-captions). @@ -230,10 +256,13 @@ The following lists advantages of the Inline method: * No need for separate `.svg` image file handling. * Content text, diagram code and diagram caption contained in the same `.md` file. -You should use the [local](https://kubernetes.io/docs/contribute/new-content/open-a-pr/#preview-locally) and Netlify previews to verify the diagram is properly rendered. +You should use the [local](/docs/contribute/new-content/open-a-pr/#preview-locally) +and Netlify previews to verify the diagram is properly rendered. {{< caution >}} -The Mermaid live editor feature set may not support the K8s/website Mermaid feature set. You might see a syntax error or a blank screen after the Hugo build. If that is the case, consider using the Mermaid+SVG method. +The Mermaid live editor feature set may not support the K8s/website Mermaid feature set. +You might see a syntax error or a blank screen after the Hugo build. +If that is the case, consider using the Mermaid+SVG method. {{< /caution >}} ### Mermaid+SVG @@ -281,9 +310,13 @@ The following lists the steps you should follow for adding a diagram using the M 4. Use the `{{}}` shortcode to reference the diagram in the `.md` file. 5. Add a caption using the `{{}}` shortcode's `caption` parameter. -For example, use the live editor to create a diagram called `boxnet`. Store the diagram URL somewhere for later access. Generate and download a `boxnet.svg` file to the appropriate `../images/` folder. +For example, use the live editor to create a diagram called `boxnet`. +Store the diagram URL somewhere for later access. Generate and download a +`boxnet.svg` file to the appropriate `../images/` folder. + +Use the `{{}}` shortcode in your PR's `.md` file to reference +the `.svg` image file and add a caption. -Use the `{{}}` shortcode in your PR's `.md` file to reference the `.svg` image file and add a caption. ```json {{}} ``` @@ -291,10 +324,14 @@ Use the `{{}}` shortcode in your PR's `.md` file to reference the For more details on diagram captions, see [How to use captions](#how-to-use-captions). {{< note >}} -The `{{}}` shortcode is the preferred method for adding `.svg` image files to your documentation. You can also use the standard markdown image syntax like so: `![my boxnet diagram](static/images/boxnet.svg)`. And you will need to add a caption below the diagram. +The `{{}}` shortcode is the preferred method for adding `.svg` image files +to your documentation. You can also use the standard markdown image syntax like so: +`![my boxnet diagram](static/images/boxnet.svg)`. +And you will need to add a caption below the diagram. {{< /note >}} -You should add the live editor URL as a comment block in the `.svg` image file using a text editor. For example, you would include the following at the beginning of the `.svg` image file: +You should add the live editor URL as a comment block in the `.svg` image file using a text editor. +For example, you would include the following at the beginning of the `.svg` image file: ``` @@ -308,13 +345,17 @@ The following lists advantages of the Mermaid+SVG method: * Employ existing K8s/website methods for handling `.svg` image files. * Environment doesn't require Mermaid support. -Be sure to check that your diagram renders properly using the [local](https://kubernetes.io/docs/contribute/new-content/open-a-pr/#preview-locally) and Netlify previews. +Be sure to check that your diagram renders properly using the +[local](/docs/contribute/new-content/open-a-pr/#preview-locally) +and Netlify previews. ### External tool Figure 5 outlines the steps to follow for adding a diagram using the External Tool method. -First, use your external tool to create the diagram and save it as an `.svg` or `.png` image file. After that, use the same steps as the __Mermaid+SVG__ method for adding `.svg` image files. +First, use your external tool to create the diagram and save it as an `.svg` +or `.png` image file. After that, use the same steps as the __Mermaid+SVG__ +method for adding `.svg` image files. {{< mermaid >}} flowchart LR @@ -350,8 +391,11 @@ Figure 5. External Tool method steps The following lists the steps you should follow for adding a diagram using the External Tool method: 1. Use your external tool to create a diagram. -2. Save the diagram coordinates for contributor access. For example, your tool may offer a link to the diagram image, or you could place the source code file, such as an `.xml` file, in a public repository for later contributor access. -3. Generate and save the diagram as an `.svg` or `.png` image file. Download this file to the appropriate `../images/` folder. +2. Save the diagram coordinates for contributor access. For example, your tool + may offer a link to the diagram image, or you could place the source code + file, such as an `.xml` file, in a public repository for later contributor access. +3. Generate and save the diagram as an `.svg` or `.png` image file. + Download this file to the appropriate `../images/` folder. 4. Use the `{{}}` shortcode to reference the diagram in the `.md` file. 5. Add a caption using the `{{}}` shortcode's `caption` parameter. @@ -362,30 +406,40 @@ Here is the `{{}}` shortcode for the `images/apple.svg` diagram: If your external drawing tool permits: -* You can incorporate multiple `.svg` or `.png` logos, icons and images into your diagram. However, make sure you observe copyright and follow the Kubernetes documentation +* You can incorporate multiple `.svg` or `.png` logos, icons and images into your diagram. + However, make sure you observe copyright and follow the Kubernetes documentation [guidelines](/docs/contribute/style/content-guide/) on the use of third party content. -* You should save the diagram source coordinates for later contributor access. For example, your tool may offer a link to the diagram image, or you could place the source code file, such as an `.xml` file, somewhere for contributor access. +* You should save the diagram source coordinates for later contributor access. + For example, your tool may offer a link to the diagram image, or you could + place the source code file, such as an `.xml` file, somewhere for contributor access. -For more information on K8s and CNCF logos and images, check out [CNCF Artwork](https://github.com/cncf/artwork). +For more information on K8s and CNCF logos and images, check out +[CNCF Artwork](https://github.com/cncf/artwork). The following lists advantages of the External Tool method: * Contributor familiarity with external tool. * Diagrams require more detail than what Mermaid can offer. -Don't forget to check that your diagram renders correctly using the [local](https://kubernetes.io/docs/contribute/new-content/open-a-pr/#preview-locally) and Netlify previews. +Don't forget to check that your diagram renders correctly using the +[local](/docs/contribute/new-content/open-a-pr/#preview-locally) and Netlify previews. ## Examples This section shows several examples of Mermaid diagrams. {{< note >}} -The code block examples omit the Hugo `{{}}`, `{{}}` shortcode tags. This allows you to copy the code block into the live editor to experiment on your own. Note that the live editor doesn't recognize Hugo shortcodes. +The code block examples omit the Hugo `{{}}`, `{{}}` +shortcode tags. This allows you to copy the code block into the live editor +to experiment on your own. +Note that the live editor doesn't recognize Hugo shortcodes. {{< /note >}} ### Example 1 - Pod topology spread constraints -Figure 6 shows the diagram appearing in the [Pod Topology Spread Constraints](https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#node-labels) page. +Figure 6 shows the diagram appearing in the +[Pod topology pread constraints](/docs/concepts/workloads/pods/pod-topology-spread-constraints/#node-labels) +page. {{< mermaid >}} graph TB @@ -417,6 +471,7 @@ click n2 "https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3J Figure 6. Pod Topology Spread Constraints. Code block: + ``` graph TB subgraph "zoneB" @@ -437,7 +492,7 @@ graph TB ### Example 2 - Ingress -Figure 7 shows the diagram appearing in the [What is Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/#what-is-ingress) page. +Figure 7 shows the diagram appearing in the [What is Ingress](/docs/concepts/services-networking/ingress/#what-is-ingress) page. {{< mermaid >}} graph LR; @@ -491,13 +546,15 @@ graph LR; ### Example 3 - K8s system flow -Figure 8 depicts a Mermaid sequence diagram showing the system flow between K8s components to start a container. +Figure 8 depicts a Mermaid sequence diagram showing the system flow between +K8s components to start a container. {{< figure src="/docs/images/diagram-guide-example-3.svg" alt="K8s system flow diagram" class="diagram-large" caption="Figure 8. K8s system flow diagram" link="https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiJSV7aW5pdDp7XCJ0aGVtZVwiOlwibmV1dHJhbFwifX0lJVxuc2VxdWVuY2VEaWFncmFtXG4gICAgYWN0b3IgbWVcbiAgICBwYXJ0aWNpcGFudCBhcGlTcnYgYXMgY29udHJvbCBwbGFuZTxicj48YnI-YXBpLXNlcnZlclxuICAgIHBhcnRpY2lwYW50IGV0Y2QgYXMgY29udHJvbCBwbGFuZTxicj48YnI-ZXRjZCBkYXRhc3RvcmVcbiAgICBwYXJ0aWNpcGFudCBjbnRybE1nciBhcyBjb250cm9sIHBsYW5lPGJyPjxicj5jb250cm9sbGVyPGJyPm1hbmFnZXJcbiAgICBwYXJ0aWNpcGFudCBzY2hlZCBhcyBjb250cm9sIHBsYW5lPGJyPjxicj5zY2hlZHVsZXJcbiAgICBwYXJ0aWNpcGFudCBrdWJlbGV0IGFzIG5vZGU8YnI-PGJyPmt1YmVsZXRcbiAgICBwYXJ0aWNpcGFudCBjb250YWluZXIgYXMgbm9kZTxicj48YnI-Y29udGFpbmVyPGJyPnJ1bnRpbWVcbiAgICBtZS0-PmFwaVNydjogMS4ga3ViZWN0bCBjcmVhdGUgLWYgcG9kLnlhbWxcbiAgICBhcGlTcnYtLT4-ZXRjZDogMi4gc2F2ZSBuZXcgc3RhdGVcbiAgICBjbnRybE1nci0-PmFwaVNydjogMy4gY2hlY2sgZm9yIGNoYW5nZXNcbiAgICBzY2hlZC0-PmFwaVNydjogNC4gd2F0Y2ggZm9yIHVuYXNzaWduZWQgcG9kcyhzKVxuICAgIGFwaVNydi0-PnNjaGVkOiA1LiBub3RpZnkgYWJvdXQgcG9kIHcgbm9kZW5hbWU9XCIgXCJcbiAgICBzY2hlZC0-PmFwaVNydjogNi4gYXNzaWduIHBvZCB0byBub2RlXG4gICAgYXBpU3J2LS0-PmV0Y2Q6IDcuIHNhdmUgbmV3IHN0YXRlXG4gICAga3ViZWxldC0-PmFwaVNydjogOC4gbG9vayBmb3IgbmV3bHkgYXNzaWduZWQgcG9kKHMpXG4gICAgYXBpU3J2LT4-a3ViZWxldDogOS4gYmluZCBwb2QgdG8gbm9kZVxuICAgIGt1YmVsZXQtPj5jb250YWluZXI6IDEwLiBzdGFydCBjb250YWluZXJcbiAgICBrdWJlbGV0LT4-YXBpU3J2OiAxMS4gdXBkYXRlIHBvZCBzdGF0dXNcbiAgICBhcGlTcnYtLT4-ZXRjZDogMTIuIHNhdmUgbmV3IHN0YXRlIiwibWVybWFpZCI6IntcbiAgXCJ0aGVtZVwiOiBcImRlZmF1bHRcIlxufSIsInVwZGF0ZUVkaXRvciI6ZmFsc2UsImF1dG9TeW5jIjp0cnVlLCJ1cGRhdGVEaWFncmFtIjp0cnVlfQ" >}} Code block: + ``` %%{init:{"theme":"neutral"}}%% sequenceDiagram @@ -524,29 +581,43 @@ sequenceDiagram ## How to style diagrams -You can style one or more diagram elements using well-known CSS nomenclature. You accomplish this using two types of statements in the Mermaid code. +You can style one or more diagram elements using well-known CSS nomenclature. +You accomplish this using two types of statements in the Mermaid code. * `classDef` defines a class of style attributes. * `class` defines one or more elements to apply the class to. -In the code for [figure 7](https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggIExSXG4gIGNsaWVudChbY2xpZW50XSktLiBJbmdyZXNzLW1hbmFnZWQgPGJyPiBsb2FkIGJhbGFuY2VyIC4tPmluZ3Jlc3NbSW5ncmVzc107XG4gIGluZ3Jlc3MtLT58cm91dGluZyBydWxlfHNlcnZpY2VbU2VydmljZV07XG4gIHN1YmdyYXBoIGNsdXN0ZXJcbiAgaW5ncmVzcztcbiAgc2VydmljZS0tPnBvZDFbUG9kXTtcbiAgc2VydmljZS0tPnBvZDJbUG9kXTtcbiAgZW5kXG4gIGNsYXNzRGVmIHBsYWluIGZpbGw6I2RkZCxzdHJva2U6I2ZmZixzdHJva2Utd2lkdGg6NHB4LGNvbG9yOiMwMDA7XG4gIGNsYXNzRGVmIGs4cyBmaWxsOiMzMjZjZTUsc3Ryb2tlOiNmZmYsc3Ryb2tlLXdpZHRoOjRweCxjb2xvcjojZmZmO1xuICBjbGFzc0RlZiBjbHVzdGVyIGZpbGw6I2ZmZixzdHJva2U6I2JiYixzdHJva2Utd2lkdGg6MnB4LGNvbG9yOiMzMjZjZTU7XG4gIGNsYXNzIGluZ3Jlc3Msc2VydmljZSxwb2QxLHBvZDIgazhzO1xuICBjbGFzcyBjbGllbnQgcGxhaW47XG4gIGNsYXNzIGNsdXN0ZXIgY2x1c3RlcjtcbiIsIm1lcm1haWQiOiJ7XG4gIFwidGhlbWVcIjogXCJkZWZhdWx0XCJcbn0iLCJ1cGRhdGVFZGl0b3IiOmZhbHNlLCJhdXRvU3luYyI6dHJ1ZSwidXBkYXRlRGlhZ3JhbSI6dHJ1ZX0), you can see examples of both. +In the code for +[figure 7](https://mermaid-js.github.io/mermaid-live-editor/edit/#eyJjb2RlIjoiZ3JhcGggIExSXG4gIGNsaWVudChbY2xpZW50XSktLiBJbmdyZXNzLW1hbmFnZWQgPGJyPiBsb2FkIGJhbGFuY2VyIC4tPmluZ3Jlc3NbSW5ncmVzc107XG4gIGluZ3Jlc3MtLT58cm91dGluZyBydWxlfHNlcnZpY2VbU2VydmljZV07XG4gIHN1YmdyYXBoIGNsdXN0ZXJcbiAgaW5ncmVzcztcbiAgc2VydmljZS0tPnBvZDFbUG9kXTtcbiAgc2VydmljZS0tPnBvZDJbUG9kXTtcbiAgZW5kXG4gIGNsYXNzRGVmIHBsYWluIGZpbGw6I2RkZCxzdHJva2U6I2ZmZixzdHJva2Utd2lkdGg6NHB4LGNvbG9yOiMwMDA7XG4gIGNsYXNzRGVmIGs4cyBmaWxsOiMzMjZjZTUsc3Ryb2tlOiNmZmYsc3Ryb2tlLXdpZHRoOjRweCxjb2xvcjojZmZmO1xuICBjbGFzc0RlZiBjbHVzdGVyIGZpbGw6I2ZmZixzdHJva2U6I2JiYixzdHJva2Utd2lkdGg6MnB4LGNvbG9yOiMzMjZjZTU7XG4gIGNsYXNzIGluZ3Jlc3Msc2VydmljZSxwb2QxLHBvZDIgazhzO1xuICBjbGFzcyBjbGllbnQgcGxhaW47XG4gIGNsYXNzIGNsdXN0ZXIgY2x1c3RlcjtcbiIsIm1lcm1haWQiOiJ7XG4gIFwidGhlbWVcIjogXCJkZWZhdWx0XCJcbn0iLCJ1cGRhdGVFZGl0b3IiOmZhbHNlLCJhdXRvU3luYyI6dHJ1ZSwidXBkYXRlRGlhZ3JhbSI6dHJ1ZX0), +you can see examples of both. + ``` classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff; // defines style for the k8s class class ingress,service,pod1,pod2 k8s; // k8s class is applied to elements ingress, service, pod1 and pod2. ``` -You can include one or multiple `classDef` and `class` statements in your diagram. You can also use the official K8s `#326ce5` hex color code for K8s components in your diagram. -For more information on styling and classes, see [Mermaid Styling and classes docs](https://mermaid-js.github.io/mermaid/#/flowchart?id=styling-and-classes). +You can include one or multiple `classDef` and `class` statements in your diagram. +You can also use the official K8s `#326ce5` hex color code for K8s components in your diagram. + +For more information on styling and classes, see +[Mermaid Styling and classes docs](https://mermaid-js.github.io/mermaid/#/flowchart?id=styling-and-classes). ## How to use captions -A caption is a brief description of a diagram. A title or a short description of the diagram are examples of captions. Captions aren't meant to replace explanatory text you have in your documentation. Rather, they serve as a "context link" between that text and your diagram. +A caption is a brief description of a diagram. A title or a short description +of the diagram are examples of captions. Captions aren't meant to replace +explanatory text you have in your documentation. Rather, they serve as a +"context link" between that text and your diagram. -The combination of some text and a diagram tied together with a caption help provide a concise representation of the information you wish to convey to the user. +The combination of some text and a diagram tied together with a caption help +provide a concise representation of the information you wish to convey to the +user. -Without captions, you are asking the user to scan the text above or below the diagram to figure out a meaning. This can be frustrating for the user. +Without captions, you are asking the user to scan the text above or below the +diagram to figure out a meaning. This can be frustrating for the user. -Figure 9 lays out the three components for proper captioning: diagram, diagram caption and the diagram referral. +Figure 9 lays out the three components for proper captioning: diagram, diagram +caption and the diagram referral. {{< mermaid >}} flowchart @@ -574,94 +645,131 @@ You should always add a caption to each diagram in your documentation. The `Mermaid+SVG` and `External Tool` methods generate `.svg` image files. -Here is the `{{}}` shortcode for the diagram defined in an `.svg` image file saved to `/images/docs/components-of-kubernetes.svg`: -```text +Here is the `{{}}` shortcode for the diagram defined in an +`.svg` image file saved to `/images/docs/components-of-kubernetes.svg`: + +```none {{}} ``` -You should pass the `src`, `alt`, `class` and `caption` values into the `{{}}` shortcode. You can adjust the size of the diagram using `diagram-large`, `diagram-medium` and `diagram-small` classes. + +You should pass the `src`, `alt`, `class` and `caption` values into the +`{{}}` shortcode. You can adjust the size of the diagram using +`diagram-large`, `diagram-medium` and `diagram-small` classes. {{< note >}} -Diagrams created using the `Inline` method don't use the `{{}}` shortcode. The Mermaid code defines how the diagram will render on your page. +Diagrams created using the `Inline` method don't use the `{{}}` +shortcode. The Mermaid code defines how the diagram will render on your page. {{< /note >}} -See [Methods for creating diagrams](#methods-for-creating-diagrams) for more information on the different methods for creating diagrams. +See [Methods for creating diagrams](#methods-for-creating-diagrams) +for more information on the different methods for creating diagrams. **Diagram Caption** Next, add a diagram caption. -If you define your diagram in an `.svg` image file, then you should use the `{{}}` shortcode's `caption` parameter. +If you define your diagram in an `.svg` image file, then you should use the +`{{}}` shortcode's `caption` parameter. -```text +```none {{}} ``` + If you define your diagram using inline Mermaid code, then you should use Markdown text. -```text + +```none Figure 4. Kubernetes Architecture Components ``` The following lists several items to consider when adding diagram captions: -* Use the `{{}}` shortcode to add a diagram caption for `Mermaid+SVG` and `External Tool` diagrams. +* Use the `{{}}` shortcode to add a diagram caption for `Mermaid+SVG` + and `External Tool` diagrams. * Use simple Markdown text to add a diagram caption for the `Inline` method. -* Prepend your diagram caption with `Figure NUMBER.`. You must use `Figure` and the number must be unique for each diagram in your documentation page. Add a period after the number. -* Add your diagram caption text after the `Figure NUMBER.` on the same line. You must puncuate the caption with a period. Keep the caption text short. +* Prepend your diagram caption with `Figure NUMBER.`. You must use `Figure` + and the number must be unique for each diagram in your documentation page. + Add a period after the number. +* Add your diagram caption text after the `Figure NUMBER.` on the same line. + You must puncuate the caption with a period. Keep the caption text short. * Position your diagram caption __BELOW__ your diagram. **Diagram Referral** -Finally, you can add a diagram referral. This is used inside your text and should precede the diagram itself. It allows a user to connect your text with the associated diagram. The `Figure NUMBER` in your referral and caption must match. +Finally, you can add a diagram referral. This is used inside your text and +should precede the diagram itself. It allows a user to connect your text with +the associated diagram. The `Figure NUMBER` in your referral and caption must +match. -You should avoid using spatial references such as `..the image below..` or `..the following figure ..` +You should avoid using spatial references such as `..the image below..` or +`..the following figure ..` Here is an example of a diagram referral: + ```text -Figure 10 depicts the components of the Kubernetes architecture. The control plane ... +Figure 10 depicts the components of the Kubernetes architecture. +The control plane ... ``` -Diagram referrals are optional and there are cases where they might not be suitable. If you are not sure, add a diagram referral to your text to see if it looks and sounds okay. When in doubt, use a diagram referral. +Diagram referrals are optional and there are cases where they might not be +suitable. If you are not sure, add a diagram referral to your text to see if +it looks and sounds okay. When in doubt, use a diagram referral. **Complete picture** -Figure 10 shows the Kubernetes Architecture diagram that includes the diagram, diagram caption and diagram referral. The `{{}}` shortcode renders the diagram, adds the caption and includes the optional `link` parameter so you can hyperlink the diagram. The diagram referral is contained in this paragraph. +Figure 10 shows the Kubernetes Architecture diagram that includes the diagram, +diagram caption and diagram referral. The `{{}}` shortcode +renders the diagram, adds the caption and includes the optional `link` +parameter so you can hyperlink the diagram. The diagram referral is contained +in this paragraph. Here is the `{{}}` shortcode for this diagram: + ``` {{}} ``` {{< figure src="/images/docs/components-of-kubernetes.svg" alt="Kubernetes pod running inside a cluster" class="diagram-large" caption="Figure 10. Kubernetes Architecture." link="https://kubernetes.io/docs/concepts/overview/components/" >}} - ## Tips * Always use the live editor to create/edit your diagram. -* Always use Hugo local and Netlify previews to check out how the diagram appears in the documentation. +* Always use Hugo local and Netlify previews to check out how the diagram + appears in the documentation. -* Include diagram source pointers such as a URL, source code location, or indicate the code is self-documenting. +* Include diagram source pointers such as a URL, source code location, or + indicate the code is self-documenting. * Always use diagram captions. -* Very helpful to include the diagram `.svg` or `.png` image and/or Mermaid source code in issues and PRs. +* Very helpful to include the diagram `.svg` or `.png` image and/or Mermaid + source code in issues and PRs. -* With the `Mermaid+SVG` and `External Tool` methods, use `.svg` image files because they stay sharp when you zoom in on the diagram. +* With the `Mermaid+SVG` and `External Tool` methods, use `.svg` image files + because they stay sharp when you zoom in on the diagram. * Best practice for `.svg` files is to load it into an SVG editing tool and use the - “Convert text to paths” function. This ensures that the diagram renders the same on all systems, regardless of font availability and font rendering support. + "Convert text to paths" function. + This ensures that the diagram renders the same on all systems, regardless of font + availability and font rendering support. * No Mermaid support for additional icons or artwork. * Hugo Mermaid shortcodes don't work in the live editor. -* Any time you modify a diagram in the live editor, you __must save__ it to generate a new URL for the diagram. +* Any time you modify a diagram in the live editor, you __must__ save it + to generate a new URL for the diagram. -* Click on the diagrams in this section to view the code and diagram rendering in the live editor. +* Click on the diagrams in this section to view the code and diagram rendering + in the live editor. * Look over the source code of this page, `diagram-guide.md`, for more examples. -* Check out the [Mermaid docs](https://mermaid-js.github.io/mermaid/#/) for explanations and examples. +* Check out the [Mermaid docs](https://mermaid-js.github.io/mermaid/#/) + for explanations and examples. -Most important, __Keep Diagrams Simple__. This will save time for you and fellow contributors, and allow for easier reading by new and experienced users. +Most important, __Keep Diagrams Simple__. +This will save time for you and fellow contributors, and allow for easier reading +by new and experienced users. diff --git a/content/en/docs/contribute/style/hugo-shortcodes/index.md b/content/en/docs/contribute/style/hugo-shortcodes/index.md index a5807216a4..5463019ac0 100644 --- a/content/en/docs/contribute/style/hugo-shortcodes/index.md +++ b/content/en/docs/contribute/style/hugo-shortcodes/index.md @@ -12,11 +12,13 @@ Read more about shortcodes in the [Hugo documentation](https://gohugo.io/content ## Feature state -In a Markdown page (`.md` file) on this site, you can add a shortcode to display version and state of the documented feature. +In a Markdown page (`.md` file) on this site, you can add a shortcode to +display version and state of the documented feature. ### Feature state demo -Below is a demo of the feature state snippet, which displays the feature as stable in the latest Kubernetes version. +Below is a demo of the feature state snippet, which displays the feature as +stable in the latest Kubernetes version. ``` {{}} @@ -50,16 +52,22 @@ Renders to: There are two glossary shortcodes: `glossary_tooltip` and `glossary_definition`. -You can reference glossary terms with an inclusion that automatically updates and replaces content with the relevant links from [our glossary](/docs/reference/glossary/). When the glossary term is moused-over, the glossary entry displays a tooltip. The glossary term also displays as a link. +You can reference glossary terms with an inclusion that automatically updates +and replaces content with the relevant links from [our glossary](/docs/reference/glossary/). +When the glossary term is moused-over, the glossary entry displays a tooltip. +The glossary term also displays as a link. As well as inclusions with tooltips, you can reuse the definitions from the glossary in page content. -The raw data for glossary terms is stored at [https://github.com/kubernetes/website/tree/main/content/en/docs/reference/glossary](https://github.com/kubernetes/website/tree/main/content/en/docs/reference/glossary), with a content file for each glossary term. +The raw data for glossary terms is stored at +[the glossary directory](https://github.com/kubernetes/website/tree/main/content/en/docs/reference/glossary), +with a content file for each glossary term. ### Glossary demo -For example, the following include within the Markdown renders to {{< glossary_tooltip text="cluster" term_id="cluster" >}} with a tooltip: +For example, the following include within the Markdown renders to +{{< glossary_tooltip text="cluster" term_id="cluster" >}} with a tooltip: ``` {{}} @@ -85,7 +93,9 @@ which renders as: ## Links to API Reference -You can link to a page of the Kubernetes API reference using the `api-reference` shortcode, for example to the {{< api-reference page="workload-resources/pod-v1" >}} reference: +You can link to a page of the Kubernetes API reference using the +`api-reference` shortcode, for example to the +{{< api-reference page="workload-resources/pod-v1" >}} reference: ``` {{}} @@ -94,7 +104,10 @@ You can link to a page of the Kubernetes API reference using the `api-reference` The content of the `page` parameter is the suffix of the URL of the API reference page. -You can link to a specific place into a page by specifying an `anchor` parameter, for example to the {{< api-reference page="workload-resources/pod-v1" anchor="PodSpec" >}} reference or the {{< api-reference page="workload-resources/pod-v1" anchor="environment-variables" >}} section of the page: +You can link to a specific place into a page by specifying an `anchor` +parameter, for example to the {{< api-reference page="workload-resources/pod-v1" anchor="PodSpec" >}} +reference or the {{< api-reference page="workload-resources/pod-v1" anchor="environment-variables" >}} +section of the page: ``` {{}} @@ -102,17 +115,20 @@ You can link to a specific place into a page by specifying an `anchor` parameter ``` -You can change the text of the link by specifying a `text` parameter, for example by linking to the {{< api-reference page="workload-resources/pod-v1" anchor="environment-variables" text="Environment Variables">}} section of the page: +You can change the text of the link by specifying a `text` parameter, for +example by linking to the +{{< api-reference page="workload-resources/pod-v1" anchor="environment-variables" text="Environment Variables">}} +section of the page: ``` {{}} ``` - - ## Table captions -You can make tables more accessible to screen readers by adding a table caption. To add a [caption](https://www.w3schools.com/tags/tag_caption.asp) to a table, enclose the table with a `table` shortcode and specify the caption with the `caption` parameter. +You can make tables more accessible to screen readers by adding a table caption. To add a +[caption](https://www.w3schools.com/tags/tag_caption.asp) to a table, +enclose the table with a `table` shortcode and specify the caption with the `caption` parameter. {{< note >}} Table captions are visible to screen readers but invisible when viewed in standard HTML. @@ -138,7 +154,8 @@ Parameter | Description | Default `logLevel` | The log level for log output | `INFO` {{< /table >}} -If you inspect the HTML for the table, you should see this element immediately after the opening `` element: +If you inspect the HTML for the table, you should see this element immediately +after the opening `
` element: ```html @@ -146,14 +163,25 @@ If you inspect the HTML for the table, you should see this element immediately a ## Tabs -In a markdown page (`.md` file) on this site, you can add a tab set to display multiple flavors of a given solution. +In a markdown page (`.md` file) on this site, you can add a tab set to display +multiple flavors of a given solution. The `tabs` shortcode takes these parameters: * `name`: The name as shown on the tab. -* `codelang`: If you provide inner content to the `tab` shortcode, you can tell Hugo what code language to use for highlighting. -* `include`: The file to include in the tab. If the tab lives in a Hugo [leaf bundle](https://gohugo.io/content-management/page-bundles/#leaf-bundles), the file -- which can be any MIME type supported by Hugo -- is looked up in the bundle itself. If not, the content page that needs to be included is looked up relative to the current page. Note that with the `include`, you do not have any shortcode inner content and must use the self-closing syntax. For example, {{}}. The language needs to be specified under `codelang` or the language is taken based on the file name. Non-content files are code-highlighted by default. -* If your inner content is markdown, you must use the `%`-delimiter to surround the tab. For example, `{{%/* tab name="Tab 1" %}}This is **markdown**{{% /tab */%}}` +* `codelang`: If you provide inner content to the `tab` shortcode, you can tell Hugo + what code language to use for highlighting. +* `include`: The file to include in the tab. If the tab lives in a Hugo + [leaf bundle](https://gohugo.io/content-management/page-bundles/#leaf-bundles), + the file -- which can be any MIME type supported by Hugo -- is looked up in the bundle itself. + If not, the content page that needs to be included is looked up relative to the current page. + Note that with the `include`, you do not have any shortcode inner content and must use the + self-closing syntax. For example, + `{{}}`. The language needs to be specified + under `codelang` or the language is taken based on the file name. + Non-content files are code-highlighted by default. +* If your inner content is markdown, you must use the `%`-delimiter to surround the tab. + For example, `{{%/* tab name="Tab 1" %}}This is **markdown**{{% /tab */%}}` * You can combine the variations mentioned above inside a tab set. Below is a demo of the tabs shortcode. @@ -288,13 +316,17 @@ The two most commonly used version parameters are `latest` and `version`. ### `{{}}` -The `{{}}` shortcode generates the value of the current version of -the Kubernetes documentation from the `version` site parameter. The `param` shortcode accepts the name of one site parameter, in this case: `version`. +The `{{}}` shortcode generates the value of the current +version of the Kubernetes documentation from the `version` site parameter. The +`param` shortcode accepts the name of one site parameter, in this case: +`version`. {{< note >}} -In previously released documentation, `latest` and `version` parameter values are not equivalent. -After a new version is released, `latest` is incremented and the value of `version` for the documentation set remains unchanged. For example, a previously released version of the documentation displays `version` as -`v1.19` and `latest` as `v1.20`. +In previously released documentation, `latest` and `version` parameter values +are not equivalent. After a new version is released, `latest` is incremented +and the value of `version` for the documentation set remains unchanged. For +example, a previously released version of the documentation displays `version` +as `v1.19` and `latest` as `v1.20`. {{< /note >}} Renders to: @@ -313,7 +345,8 @@ Renders to: ### `{{}}` -The `{{}}` shortcode generates the value of `latest` without the "v" prefix. +The `{{}}` shortcode generates the value of `latest` +without the "v" prefix. Renders to: @@ -330,8 +363,9 @@ Renders to: ### `{{}}` -The `{{}}` shortcode generates a version string from `latest` and removes -the "v" prefix. The shortcode prints a new URL for the release note CHANGELOG page with the modified version string. +The `{{}}` shortcode generates a version string +from `latest` and removes the "v" prefix. The shortcode prints a new URL for +the release note CHANGELOG page with the modified version string. Renders to: @@ -344,3 +378,4 @@ Renders to: * Learn about [page content types](/docs/contribute/style/page-content-types/). * Learn about [opening a pull request](/docs/contribute/new-content/open-a-pr/). * Learn about [advanced contributing](/docs/contribute/advanced/). + diff --git a/content/en/docs/home/_index.md b/content/en/docs/home/_index.md index b2ebb004a7..7297da2806 100644 --- a/content/en/docs/home/_index.md +++ b/content/en/docs/home/_index.md @@ -60,7 +60,7 @@ cards: title: K8s Release Notes description: If you are installing Kubernetes or upgrading to the newest version, refer to the current release notes. button: "Download Kubernetes" - button_path: "/docs/setup/release/notes" + button_path: "/releases/download" - name: about title: About the documentation description: This website contains documentation for the current and previous 4 versions of Kubernetes. diff --git a/content/en/docs/reference/_index.md b/content/en/docs/reference/_index.md index dfeeb7d8b0..021d2f840d 100644 --- a/content/en/docs/reference/_index.md +++ b/content/en/docs/reference/_index.md @@ -66,6 +66,7 @@ client libraries: * List of [ports and protocols](/docs/reference/ports-and-protocols/) that should be open on control plane and worker nodes + ## Config APIs This section hosts the documentation for "unpublished" APIs which are used to @@ -73,10 +74,12 @@ configure kubernetes components or tools. Most of these APIs are not exposed by the API server in a RESTful way though they are essential for a user or an operator to use or manage a cluster. - +* [kube-apiserver configuration (v1alpha1)](/docs/reference/config-api/apiserver-config.v1alpha1/) * [kube-apiserver configuration (v1)](/docs/reference/config-api/apiserver-config.v1/) +* [kube-apiserver encryption (v1)](/docs/reference/config-api/apiserver-encryption.v1/) * [kubelet configuration (v1alpha1)](/docs/reference/config-api/kubelet-config.v1alpha1/) and [kubelet configuration (v1beta1)](/docs/reference/config-api/kubelet-config.v1beta1/) +* [kubelet credential providers (v1alpha1)](/docs/reference/config-api/kubelet-credentialprovider.v1alpha1/) * [kube-scheduler configuration (v1beta2)](/docs/reference/config-api/kube-scheduler-config.v1beta2/) and [kube-scheduler configuration (v1beta3)](/docs/reference/config-api/kube-scheduler-config.v1beta3/) * [kube-proxy configuration (v1alpha1)](/docs/reference/config-api/kube-proxy-config.v1alpha1/) diff --git a/content/en/docs/reference/access-authn-authz/authentication.md b/content/en/docs/reference/access-authn-authz/authentication.md index a7d5cd84d9..30e1725859 100644 --- a/content/en/docs/reference/access-authn-authz/authentication.md +++ b/content/en/docs/reference/access-authn-authz/authentication.md @@ -1144,7 +1144,9 @@ If specified, `clientKeyData` and `clientCertificateData` must both must be pres {{< /tabs >}} Optionally, the response can include the expiry of the credential formatted as a -RFC3339 timestamp. Presence or absence of an expiry has the following impact: +[RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339) timestamp. + +Presence or absence of an expiry has the following impact: - If an expiry is included, the bearer token and TLS credentials are cached until the expiry time is reached, or if the server responds with a 401 HTTP status code, diff --git a/content/en/docs/reference/access-authn-authz/node.md b/content/en/docs/reference/access-authn-authz/node.md index 141dc8bb61..6e7c538eb0 100644 --- a/content/en/docs/reference/access-authn-authz/node.md +++ b/content/en/docs/reference/access-authn-authz/node.md @@ -34,8 +34,8 @@ Write operations: Auth-related operations: -* read/write access to the certificationsigningrequests API for TLS bootstrapping -* the ability to create tokenreviews and subjectaccessreviews for delegated authentication/authorization checks +* read/write access to the [CertificateSigningRequests API](/docs/reference/access-authn-authz/certificate-signing-requests/) for TLS bootstrapping +* the ability to create TokenReviews and SubjectAccessReviews for delegated authentication/authorization checks In future releases, the node authorizer may add or remove permissions to ensure kubelets have the minimal set of permissions required to operate correctly. diff --git a/content/en/docs/reference/access-authn-authz/psp-to-pod-security-standards.md b/content/en/docs/reference/access-authn-authz/psp-to-pod-security-standards.md new file mode 100644 index 0000000000..468579f982 --- /dev/null +++ b/content/en/docs/reference/access-authn-authz/psp-to-pod-security-standards.md @@ -0,0 +1,275 @@ +--- +reviewers: +- tallclair +- liggitt +title: Mapping PodSecurityPolicies to Pod Security Standards +content_type: concept +weight: 95 +--- + + +The tables below enumerate the configuration parameters on +[PodSecurityPolicy](/docs/concepts/policy/pod-security-policy/) objects, whether the field mutates +and/or validates pods, and how the configuration values map to the +[Pod Security Standards](/docs/concepts/security/pod-security-standards/). + +For each applicable parameter, the allowed values for the +[Baseline](/docs/concepts/security/pod-security-standards/#baseline) and +[Restricted](/docs/concepts/security/pod-security-standards/#restricted) profiles are listed. +Anything outside the allowed values for those profiles would fall under the +[Privileged](/docs/concepts/security/pod-security-standards/#priveleged) profile. "No opinion" +means all values are allowed under all Pod Security Standards. + +For a step-by-step migration guide, see +[Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller](/docs/tasks/configure-pod-container/migrate-from-psp/). + + + +## PodSecurityPolicy Spec + +The fields enumerated in this table are part of the `PodSecurityPolicySpec`, which is specified +under the `.spec` field path. + +
Configuration parameters
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Mapping PodSecurityPolicySpec fields to Pod Security Standards
PodSecurityPolicySpecTypePod Security Standards Equivalent
privilegedValidatingBaseline & Restricted: false / undefined / nil
defaultAddCapabilitiesMutating & ValidatingRequirements match allowedCapabilities below.
allowedCapabilitiesValidating +

Baseline: subset of

+
    +
  • AUDIT_WRITE
    • +
  • CHOWN
    • +
  • DAC_OVERRIDE
    • +
  • FOWNER
    • +
  • FSETID
    • +
  • KILL
    • +
  • MKNOD
    • +
  • NET_BIND_SERVICE
    • +
  • SETFCAP
    • +
  • SETGID
    • +
  • SETPCAP
    • +
  • SETUID
    • +
  • SYS_CHROOT
    • +
+

Restricted: empty / undefined / nil OR a list containing only NET_BIND_SERVICE +

requiredDropCapabilitiesMutating & Validating +

Baseline: no opinion

+

Restricted: must include ALL

+
volumesValidating +

Baseline: anything except

+
    +
  • hostPath
    • +
  • *
    • +
+

Restricted: subset of

+
    +
  • configMap
    • +
  • csi
    • +
  • downwardAPI
    • +
  • emptyDir
    • +
  • ephemeral
    • +
  • persistentVolumeClaim
    • +
  • projected
    • +
  • secret
    • +
+
hostNetworkValidatingBaseline & Restricted: false / undefined / nil
hostPortsValidatingBaseline & Restricted: undefined / nil / empty
hostPIDValidatingBaseline & Restricted: false / undefined / nil
hostIPCValidatingBaseline & Restricted: false / undefined / nil
seLinuxMutating & Validating +

Baseline & Restricted: + seLinux.rule is MustRunAs, with the following options

+
    +
  • user is unset ("" / undefined / nil)
    • +
  • role is unset ("" / undefined / nil)
    • +
  • type is unset or one of: container_t, container_init_t, container_kvm_t
    • +
  • level is anything
    • +
+
runAsUserMutating & Validating +

Baseline: Anything

+

Restricted: rule is MustRunAsNonRoot

+
runAsGroupMutating (MustRunAs) & Validating + No opinion +
supplementalGroupsMutating & Validating + No opinion +
fsGroupMutating & Validating + No opinion +
readOnlyRootFilesystemMutating & Validating + No opinion +
defaultAllowPrivilegeEscalationMutating + No opinion (non-validating) +
allowPrivilegeEscalationMutating & Validating +

Only mutating if set to false

+

Baseline: No opinion

+

Restricted: false

+
allowedHostPathsValidatingNo opinion (volumes takes precedence)
allowedFlexVolumesValidatingNo opinion (volumes takes precedence)
allowedCSIDriversValidatingNo opinion (volumes takes precedence)
allowedUnsafeSysctlsValidatingBaseline & Restricted: undefined / nil / empty
forbiddenSysctlsValidatingNo opinion
allowedProcMountTypes
(alpha feature)		ValidatingBaseline & Restricted: ["Default"] OR undefined / nil / empty
runtimeClass
 .defaultRuntimeClassName		MutatingNo opinion
runtimeClass
 .allowedRuntimeClassNames		ValidatingNo opinion
+ +## PodSecurityPolicy annotations + +The [annotations](/docs/concepts/overview/working-with-objects/annotations/) enumerated in this +table can be specified under `.metadata.annotations` on the PodSecurityPolicy object. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Mapping PodSecurityPolicy annotations to Pod Security Standards
PSP AnnotationTypePod Security Standards Equivalent
seccomp.security.alpha.kubernetes.io
/defaultProfileName		MutatingNo opinion
seccomp.security.alpha.kubernetes.io
/allowedProfileNames		Validating +

Baseline: "runtime/default," (Trailing comma to allow unset)

+

Restricted: "runtime/default" (No trailing comma)

+

localhost/* values are also permitted for both Baseline & Restricted.

+
apparmor.security.beta.kubernetes.io
/defaultProfileName		MutatingNo opinion
apparmor.security.beta.kubernetes.io
/allowedProfileNames		Validating +

Baseline: "runtime/default," (Trailing comma to allow unset)

+

Restricted: "runtime/default" (No trailing comma)

+

localhost/* values are also permitted for both Baseline & Restricted.

+
diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 3235361574..0c8ee404c3 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -25,7 +25,8 @@ on each Kubernetes component. Each Kubernetes component lets you enable or disable a set of feature gates that are relevant to that component. Use `-h` flag to see a full set of feature gates for all components. -To set feature gates for a component, such as kubelet, use the `--feature-gates` flag assigned to a list of feature pairs: +To set feature gates for a component, such as kubelet, use the `--feature-gates` +flag assigned to a list of feature pairs: ```shell --feature-gates="...,GracefulNodeShutdown=true" @@ -399,7 +400,7 @@ different Kubernetes components. | `PodShareProcessNamespace` | `true` | Beta | 1.12 | 1.16 | | `PodShareProcessNamespace` | `true` | GA | 1.17 | - | | `RequestManagement` | `false` | Alpha | 1.15 | 1.16 | -| `RequestManagement` | - | Derecated | 1.17 | - | +| `RequestManagement` | - | Deprecated | 1.17 | - | | `ResourceLimitsPriorityFunction` | `false` | Alpha | 1.9 | 1.18 | | `ResourceLimitsPriorityFunction` | - | Deprecated | 1.19 | - | | `ResourceQuotaScopeSelectors` | `false` | Alpha | 1.11 | 1.11 | @@ -575,7 +576,7 @@ Each feature gate is designed for enabling/disabling a specific feature: - `AnyVolumeDataSource`: Enable use of any custom resource as the `DataSource` of a {{< glossary_tooltip text="PVC" term_id="persistent-volume-claim" >}}. - `AppArmor`: Enable use of AppArmor mandatory access control for Pods running on Linux nodes. - See [AppArmor Tutorial](/docs/tutorials/clusters/apparmor/) for more details. + See [AppArmor Tutorial](/docs/tutorials/security/apparmor/) for more details. - `AttachVolumeLimit`: Enable volume plugins to report limits on number of volumes that can be attached to a node. See [dynamic volume limits](/docs/concepts/storage/storage-limits/#dynamic-volume-limits) for more details. @@ -769,12 +770,12 @@ Each feature gate is designed for enabling/disabling a specific feature: - `EnableEquivalenceClassCache`: Enable the scheduler to cache equivalence of nodes when scheduling Pods. - `EndpointSlice`: Enables EndpointSlices for more scalable and extensible - network endpoints. See [Enabling EndpointSlices](/docs/tasks/administer-cluster/enabling-endpointslices/). + network endpoints. See [Enabling EndpointSlices](/docs/concepts/services-networking/endpoint-slices/). - `EndpointSliceNodeName`: Enables EndpointSlice `nodeName` field. - `EndpointSliceProxying`: When enabled, kube-proxy running on Linux will use EndpointSlices as the primary data source instead of Endpoints, enabling scalability and performance improvements. See - [Enabling Endpoint Slices](/docs/tasks/administer-cluster/enabling-endpointslices/). + [Enabling Endpoint Slices](/docs/concepts/services-networking/endpoint-slices/). - `EndpointSliceTerminatingCondition`: Enables EndpointSlice `terminating` and `serving` condition fields. - `EphemeralContainers`: Enable the ability to add @@ -814,7 +815,7 @@ Each feature gate is designed for enabling/disabling a specific feature: and gracefully terminate pods running on the node. See [Graceful Node Shutdown](/docs/concepts/architecture/nodes/#graceful-node-shutdown) for more details. -= `GracefulNodeShutdownBasedOnPodPriority`: Enables the kubelet to check Pod priorities +- `GracefulNodeShutdownBasedOnPodPriority`: Enables the kubelet to check Pod priorities when shutting down a node gracefully. - `GRPCContainerProbe`: Enables the gRPC probe method for {Liveness,Readiness,Startup}Probe. See [Configure Liveness, Readiness and Startup Probes](/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-a-grpc-liveness-probe). - `HonorPVReclaimPolicy`: Honor persistent volume reclaim policy when it is `Delete` irrespective of PV-PVC deletion ordering. @@ -1089,7 +1090,7 @@ Each feature gate is designed for enabling/disabling a specific feature: - `WindowsEndpointSliceProxying`: When enabled, kube-proxy running on Windows will use EndpointSlices as the primary data source instead of Endpoints, enabling scalability and performance improvements. See - [Enabling Endpoint Slices](/docs/tasks/administer-cluster/enabling-endpointslices/). + [Enabling Endpoint Slices](/docs/concepts/services-networking/endpoint-slices/). - `WindowsGMSA`: Enables passing of GMSA credential specs from pods to container runtimes. - `WindowsHostProcessContainers`: Enables support for Windows HostProcess containers. - `WindowsRunAsUserName` : Enable support for running applications in Windows containers diff --git a/content/en/docs/reference/command-line-tools-reference/kube-apiserver.md b/content/en/docs/reference/command-line-tools-reference/kube-apiserver.md index cf751f5d05..774c1efd0b 100644 --- a/content/en/docs/reference/command-line-tools-reference/kube-apiserver.md +++ b/content/en/docs/reference/command-line-tools-reference/kube-apiserver.md @@ -946,7 +946,7 @@ kube-apiserver [flags] --service-account-key-file strings -

File containing PEM-encoded x509 RSA or ECDSA private or public keys, used to verify ServiceAccount tokens. The specified file can contain multiple keys, and the flag can be specified multiple times with different files. If unspecified, --tls-private-key-file is used. Must be specified when --service-account-signing-key is provided

+

File containing PEM-encoded x509 RSA or ECDSA private or public keys, used to verify ServiceAccount tokens. The specified file can contain multiple keys, and the flag can be specified multiple times with different files. If unspecified, --tls-private-key-file is used. Must be specified when --service-account-signing-key-file is provided

diff --git a/content/en/docs/reference/config-api/apiserver-audit.v1.md b/content/en/docs/reference/config-api/apiserver-audit.v1.md index e817b838ae..3cca579663 100644 --- a/content/en/docs/reference/config-api/apiserver-audit.v1.md +++ b/content/en/docs/reference/config-api/apiserver-audit.v1.md @@ -19,13 +19,13 @@ auto_generated: true ## `Event` {#audit-k8s-io-v1-Event} - - **Appears in:** + - [EventList](#audit-k8s-io-v1-EventList) -Event captures all the information that can be included in an API audit log. +

Event captures all the information that can be included in an API audit log.

+ @@ -34,152 +34,134 @@ Event captures all the information that can be included in an API audit log. - - +

AuditLevel at which event was generated

+ - - +

Unique audit ID, generated for each request.

+ - - +

Stage of the request handling when this event instance was generated.

+ - - +

RequestURI is the request URI as sent by the client to a server.

+ - - +

Verb is the kubernetes verb associated with the request. +For non-resource requests, this is the lower-cased HTTP method.

+ - - +

Authenticated user information.

+ - - +

Impersonated user information.

+ - - +

Source IPs, from where the request originated and intermediate proxies.

+ - - +

UserAgent records the user agent string reported by the client. +Note that the UserAgent is provided by the client, and must not be trusted.

+ - - +

Object reference this request is targeted at. +Does not apply for List-type requests, or non-resource requests.

+ - - +For non-status type error responses, this will be auto-populated with the error Message.

+ - - +Omitted for non-resource requests. Only logged at Request Level and higher.

+ - - +at Response Level.

+ - - +

Time the request reached the apiserver.

+ - - +

Time the request reached current audit stage.

+ - - +should be short. Annotations are included in the Metadata level.

+ - -
FieldDescription
apiVersion
string		audit.k8s.io/v1
kind
string		Event
level [Required]
Level 		- AuditLevel at which event was generated
auditID [Required]
-k8s.io/apimachinery/pkg/types.UID +k8s.io/apimachinery/pkg/types.UID 		- Unique audit ID, generated for each request.
stage [Required]
Stage 		- Stage of the request handling when this event instance was generated.
requestURI [Required]
string 		- RequestURI is the request URI as sent by the client to a server.
verb [Required]
string 		- Verb is the kubernetes verb associated with the request. -For non-resource requests, this is the lower-cased HTTP method.
user [Required]
authentication/v1.UserInfo 		- Authenticated user information.
impersonatedUser
authentication/v1.UserInfo 		- Impersonated user information.
sourceIPs
[]string 		- Source IPs, from where the request originated and intermediate proxies.
userAgent
string 		- UserAgent records the user agent string reported by the client. -Note that the UserAgent is provided by the client, and must not be trusted.
objectRef
ObjectReference 		- Object reference this request is targeted at. -Does not apply for List-type requests, or non-resource requests.
responseStatus
meta/v1.Status 		- The response status, populated even when the ResponseObject is not a Status type. +

The response status, populated even when the ResponseObject is not a Status type. For successful responses, this will only include the Code and StatusSuccess. -For non-status type error responses, this will be auto-populated with the error Message.
requestObject
-k8s.io/apimachinery/pkg/runtime.Unknown +k8s.io/apimachinery/pkg/runtime.Unknown 		- API object from the request, in JSON format. The RequestObject is recorded as-is in the request +

API object from the request, in JSON format. The RequestObject is recorded as-is in the request (possibly re-encoded as JSON), prior to version conversion, defaulting, admission or merging. It is an external versioned object type, and may not be a valid object on its own. -Omitted for non-resource requests. Only logged at Request Level and higher.
responseObject
-k8s.io/apimachinery/pkg/runtime.Unknown +k8s.io/apimachinery/pkg/runtime.Unknown 		- API object returned in the response, in JSON. The ResponseObject is recorded after conversion +

API object returned in the response, in JSON. The ResponseObject is recorded after conversion to the external type, and serialized as JSON. Omitted for non-resource requests. Only logged -at Response Level.
requestReceivedTimestamp
meta/v1.MicroTime 		- Time the request reached the apiserver.
stageTimestamp
meta/v1.MicroTime 		- Time the request reached current audit stage.
annotations
map[string]string 		- Annotations is an unstructured key value map stored with an audit event that may be set by +

Annotations is an unstructured key value map stored with an audit event that may be set by plugins invoked in the request serving chain, including authentication, authorization and admission plugins. Note that these annotations are for the audit event, and do not correspond to the metadata.annotations of the submitted object. Keys should uniquely identify the informing component to avoid name collisions (e.g. podsecuritypolicy.admission.k8s.io/policy). Values -should be short. Annotations are included in the Metadata level.
@@ -187,10 +169,9 @@ should be short. Annotations are included in the Metadata level. +

EventList is a list of audit Events.

-EventList is a list of audit Events. - @@ -198,41 +179,33 @@ EventList is a list of audit Events. - - + No description provided. - - + No description provided. - -
FieldDescription
apiVersion
string		audit.k8s.io/v1
kind
string		EventList
metadata
meta/v1.ListMeta 		- No description provided. -
items [Required]
[]Event 		- No description provided. -
## `Policy` {#audit-k8s-io-v1-Policy} - - **Appears in:** + - [PolicyList](#audit-k8s-io-v1-PolicyList) -Policy defines the configuration of audit logging, and the rules for how different request -categories are logged. +

Policy defines the configuration of audit logging, and the rules for how different request +categories are logged.

+ @@ -241,50 +214,44 @@ categories are logged. - - +

ObjectMeta is included for interoperability with API infrastructure.

+Refer to the Kubernetes API documentation for the fields of the metadata field. - - +PolicyRules are strictly ordered.

+ - - +

OmitStages is a list of stages for which no events are created. Note that this can also +be specified per rule in which case the union of both are omitted.

+ - - +in a rule will override the global default.

+ - -
FieldDescription
apiVersion
string		audit.k8s.io/v1
kind
string		Policy
metadata
meta/v1.ObjectMeta 		- ObjectMeta is included for interoperability with API infrastructure.Refer to the Kubernetes API documentation for the fields of the metadata field.
rules [Required]
[]PolicyRule 		- Rules specify the audit Level a request should be recorded at. +

Rules specify the audit Level a request should be recorded at. A request may match multiple rules, in which case the FIRST matching rule is used. The default audit level is None, but can be overridden by a catch-all rule at the end of the list. -PolicyRules are strictly ordered.
omitStages
[]Stage 		- OmitStages is a list of stages for which no events are created. Note that this can also -be specified per rule in which case the union of both are omitted.
omitManagedFields
bool 		- OmitManagedFields indicates whether to omit the managed fields of the request +

OmitManagedFields indicates whether to omit the managed fields of the request and response bodies from being written to the API audit log. This is used as a global default - a value of 'true' will omit the managed fileds, otherwise the managed fields will be included in the API audit log. Note that this can also be specified per rule in which case the value specified -in a rule will override the global default.
@@ -292,10 +259,9 @@ in a rule will override the global default. +

PolicyList is a list of audit Policies.

-PolicyList is a list of audit Policies. - @@ -303,86 +269,71 @@ PolicyList is a list of audit Policies. - - + No description provided. - - + No description provided. - -
FieldDescription
apiVersion
string		audit.k8s.io/v1
kind
string		PolicyList
metadata
meta/v1.ListMeta 		- No description provided. -
items [Required]
[]Policy 		- No description provided. -
## `GroupResources` {#audit-k8s-io-v1-GroupResources} - - **Appears in:** + - [PolicyRule](#audit-k8s-io-v1-PolicyRule) -GroupResources represents resource kinds in an API group. +

GroupResources represents resource kinds in an API group.

+ - +

Group is the name of the API group that contains the resources. +The empty string represents the core API group.

+ - - +'' matches all resources and their subresources. +'pods/' matches all subresources of pods. +'*/scale' matches all scale subresources.

+

If wildcard is present, the validation rule will ensure resources do not +overlap with each other.

+

An empty list implies all resources and subresources in this API groups apply.

+ - - +An empty list implies that every instance of the resource is matched.

+ - -
FieldDescription
group
string 		- Group is the name of the API group that contains the resources. -The empty string represents the core API group.
resources
[]string 		- Resources is a list of resources this rule applies to. - -For example: +

Resources is a list of resources this rule applies to.

+

For example: 'pods' matches pods. 'pods/log' matches the log subresource of pods. -'∗' matches all resources and their subresources. -'pods/∗' matches all subresources of pods. -'∗/scale' matches all scale subresources. - -If wildcard is present, the validation rule will ensure resources do not -overlap with each other. - -An empty list implies all resources and subresources in this API groups apply.
resourceNames
[]string 		- ResourceNames is a list of resource instance names that the policy matches. +

ResourceNames is a list of resource instance names that the policy matches. Using this field requires Resources to be specified. -An empty list implies that every instance of the resource is matched.
@@ -390,216 +341,189 @@ An empty list implies that every instance of the resource is matched. (Alias of `string`) - **Appears in:** + - [Event](#audit-k8s-io-v1-Event) + - [PolicyRule](#audit-k8s-io-v1-PolicyRule) -Level defines the amount of information logged during auditing +

Level defines the amount of information logged during auditing

+ ## `ObjectReference` {#audit-k8s-io-v1-ObjectReference} - - **Appears in:** + - [Event](#audit-k8s-io-v1-Event) -ObjectReference contains enough information to let you inspect or modify the referred object. +

ObjectReference contains enough information to let you inspect or modify the referred object.

+ - + No description provided. - - + No description provided. - - + No description provided. - - + No description provided. - - +

APIGroup is the name of the API group that contains the referred object. +The empty string represents the core API group.

+ - - +

APIVersion is the version of the API group that contains the referred object.

+ - - + No description provided. - - + No description provided. - -
FieldDescription
resource
string 		- No description provided. -
namespace
string 		- No description provided. -
name
string 		- No description provided. -
uid
-k8s.io/apimachinery/pkg/types.UID +k8s.io/apimachinery/pkg/types.UID 		- No description provided. -
apiGroup
string 		- APIGroup is the name of the API group that contains the referred object. -The empty string represents the core API group.
apiVersion
string 		- APIVersion is the version of the API group that contains the referred object.
resourceVersion
string 		- No description provided. -
subresource
string 		- No description provided. -
## `PolicyRule` {#audit-k8s-io-v1-PolicyRule} - - **Appears in:** + - [Policy](#audit-k8s-io-v1-Policy) -PolicyRule maps requests based off metadata to an audit Level. -Requests must match the rules of every field (an intersection of rules). +

PolicyRule maps requests based off metadata to an audit Level. +Requests must match the rules of every field (an intersection of rules).

+ - +

The Level that requests matching this rule are recorded at.

+ - - +

The users (by authenticated user name) this rule applies to. +An empty list implies every user.

+ - - +An empty list implies every user group.

+ - - +

The verbs that match this rule. +An empty list implies every verb.

+ - - +

Resources that this rule matches. An empty list implies all kinds in all API groups.

+ - - +

Namespaces that this rule matches. +The empty string "" matches non-namespaced resources. +An empty list implies every namespace.

+ - - +"/metrics" - Log requests for apiserver metrics +"/healthz" - Log all health checks

+ - - +An empty list means no restrictions will apply.

+ - - +Policy.OmitManagedFields will stand. + + - -
FieldDescription
level [Required]
Level 		- The Level that requests matching this rule are recorded at.
users
[]string 		- The users (by authenticated user name) this rule applies to. -An empty list implies every user.
userGroups
[]string 		- The user groups this rule applies to. A user is considered matching +

The user groups this rule applies to. A user is considered matching if it is a member of any of the UserGroups. -An empty list implies every user group.
verbs
[]string 		- The verbs that match this rule. -An empty list implies every verb.
resources
[]GroupResources 		- Resources that this rule matches. An empty list implies all kinds in all API groups.
namespaces
[]string 		- Namespaces that this rule matches. -The empty string "" matches non-namespaced resources. -An empty list implies every namespace.
nonResourceURLs
[]string 		- NonResourceURLs is a set of URL paths that should be audited. -∗s are allowed, but only as the full, final step in the path. +

NonResourceURLs is a set of URL paths that should be audited. +s are allowed, but only as the full, final step in the path. Examples: - "/metrics" - Log requests for apiserver metrics - "/healthz∗" - Log all health checks
omitStages
[]Stage 		- OmitStages is a list of stages for which no events are created. Note that this can also +

OmitStages is a list of stages for which no events are created. Note that this can also be specified policy wide in which case the union of both are omitted. -An empty list means no restrictions will apply.
omitManagedFields
bool 		- OmitManagedFields indicates whether to omit the managed fields of the request -and response bodies from being written to the API audit log. -- a value of 'true' will drop the managed fields from the API audit log -- a value of 'false' indicates that the managed fileds should be included - in the API audit log +

OmitManagedFields indicates whether to omit the managed fields of the request +and response bodies from being written to the API audit log.

+
    +
  • a value of 'true' will drop the managed fields from the API audit log
    • +
  • a value of 'false' indicates that the managed fileds should be included +in the API audit log Note that the value, if specified, in this rule will override the global default If a value is not specified then the global default specified in -Policy.OmitManagedFields will stand.
@@ -607,14 +531,17 @@ Policy.OmitManagedFields will stand. (Alias of `string`) - **Appears in:** + - [Event](#audit-k8s-io-v1-Event) + - [Policy](#audit-k8s-io-v1-Policy) + - [PolicyRule](#audit-k8s-io-v1-PolicyRule) -Stage defines the stages in request handling that audit events may be generated. +

Stage defines the stages in request handling that audit events may be generated.

+ diff --git a/content/en/docs/reference/config-api/apiserver-config.v1.md b/content/en/docs/reference/config-api/apiserver-config.v1.md index 7767a4e406..dcb903e848 100644 --- a/content/en/docs/reference/config-api/apiserver-config.v1.md +++ b/content/en/docs/reference/config-api/apiserver-config.v1.md @@ -4,7 +4,8 @@ content_type: tool-reference package: apiserver.config.k8s.io/v1 auto_generated: true --- -Package v1 is the v1 version of the API. +

Package v1 is the v1 version of the API.

+ ## Resource Types @@ -17,10 +18,9 @@ Package v1 is the v1 version of the API. +

AdmissionConfiguration provides versioned configuration for admission controllers.

-AdmissionConfiguration provides versioned configuration for admission controllers. - @@ -28,64 +28,57 @@ AdmissionConfiguration provides versioned configuration for admission controller - - +

Plugins allows specifying a configuration per admission control plugin.

+ - -
FieldDescription
apiVersion
string		apiserver.config.k8s.io/v1
kind
string		AdmissionConfiguration
plugins
[]AdmissionPluginConfiguration 		- Plugins allows specifying a configuration per admission control plugin.
## `AdmissionPluginConfiguration` {#apiserver-config-k8s-io-v1-AdmissionPluginConfiguration} - - **Appears in:** + - [AdmissionConfiguration](#apiserver-config-k8s-io-v1-AdmissionConfiguration) -AdmissionPluginConfiguration provides the configuration for a single plug-in. +

AdmissionPluginConfiguration provides the configuration for a single plug-in.

+ - +

Name is the name of the admission controller. +It must match the registered admission plugin name.

+ - - +

Path is the path to a configuration file that contains the plugin's +configuration

+ - - +

Configuration is an embedded configuration object to be used as the plugin's +configuration. If present, it will be used instead of the path to the configuration file.

+ - -
FieldDescription
name [Required]
string 		- Name is the name of the admission controller. -It must match the registered admission plugin name.
path
string 		- Path is the path to a configuration file that contains the plugin's -configuration
configuration
-k8s.io/apimachinery/pkg/runtime.Unknown +k8s.io/apimachinery/pkg/runtime.Unknown 		- Configuration is an embedded configuration object to be used as the plugin's -configuration. If present, it will be used instead of the path to the configuration file.
diff --git a/content/en/docs/reference/config-api/apiserver-config.v1alpha1.md b/content/en/docs/reference/config-api/apiserver-config.v1alpha1.md new file mode 100644 index 0000000000..8b9bf972ca --- /dev/null +++ b/content/en/docs/reference/config-api/apiserver-config.v1alpha1.md @@ -0,0 +1,375 @@ +--- +title: kube-apiserver Configuration (v1alpha1) +content_type: tool-reference +package: apiserver.k8s.io/v1alpha1 +auto_generated: true +--- +

Package v1alpha1 is the v1alpha1 version of the API.

+ + +## Resource Types + + +- [AdmissionConfiguration](#apiserver-k8s-io-v1alpha1-AdmissionConfiguration) +- [EgressSelectorConfiguration](#apiserver-k8s-io-v1alpha1-EgressSelectorConfiguration) +- [TracingConfiguration](#apiserver-k8s-io-v1alpha1-TracingConfiguration) + + + +## `AdmissionConfiguration` {#apiserver-k8s-io-v1alpha1-AdmissionConfiguration} + + + +

AdmissionConfiguration provides versioned configuration for admission controllers.

+ + + + + + + + + + + + + + +
FieldDescription
apiVersion
string		apiserver.k8s.io/v1alpha1
kind
string		AdmissionConfiguration
plugins
+[]AdmissionPluginConfiguration +		 +

Plugins allows specifying a configuration per admission control plugin.

+
+ +## `EgressSelectorConfiguration` {#apiserver-k8s-io-v1alpha1-EgressSelectorConfiguration} + + + +

EgressSelectorConfiguration provides versioned configuration for egress selector clients.

+ + + + + + + + + + + + + + +
FieldDescription
apiVersion
string		apiserver.k8s.io/v1alpha1
kind
string		EgressSelectorConfiguration
egressSelections [Required]
+[]EgressSelection +		 +

connectionServices contains a list of egress selection client configurations

+
+ +## `TracingConfiguration` {#apiserver-k8s-io-v1alpha1-TracingConfiguration} + + + +

TracingConfiguration provides versioned configuration for tracing clients.

+ + + + + + + + + + + + + + + + + +
FieldDescription
apiVersion
string		apiserver.k8s.io/v1alpha1
kind
string		TracingConfiguration
endpoint
+string +		 +

Endpoint of the collector that's running on the control-plane node. +The APIServer uses the egressType ControlPlane when sending data to the collector. +The syntax is defined in https://github.com/grpc/grpc/blob/master/doc/naming.md. +Defaults to the otlpgrpc default, localhost:4317 +The connection is insecure, and does not support TLS.

+
samplingRatePerMillion
+int32 +		 +

SamplingRatePerMillion is the number of samples to collect per million spans. +Defaults to 0.

+
+ +## `AdmissionPluginConfiguration` {#apiserver-k8s-io-v1alpha1-AdmissionPluginConfiguration} + + +**Appears in:** + +- [AdmissionConfiguration](#apiserver-k8s-io-v1alpha1-AdmissionConfiguration) + + +

AdmissionPluginConfiguration provides the configuration for a single plug-in.

+ + + + + + + + + + + + + + + + + +
FieldDescription
name [Required]
+string +		 +

Name is the name of the admission controller. +It must match the registered admission plugin name.

+
path
+string +		 +

Path is the path to a configuration file that contains the plugin's +configuration

+
configuration
+k8s.io/apimachinery/pkg/runtime.Unknown +		 +

Configuration is an embedded configuration object to be used as the plugin's +configuration. If present, it will be used instead of the path to the configuration file.

+
+ +## `Connection` {#apiserver-k8s-io-v1alpha1-Connection} + + +**Appears in:** + +- [EgressSelection](#apiserver-k8s-io-v1alpha1-EgressSelection) + + +

Connection provides the configuration for a single egress selection client.

+ + + + + + + + + + + + + + +
FieldDescription
proxyProtocol [Required]
+ProtocolType +		 +

Protocol is the protocol used to connect from client to the konnectivity server.

+
transport
+Transport +		 +

Transport defines the transport configurations we use to dial to the konnectivity server. +This is required if ProxyProtocol is HTTPConnect or GRPC.

+
+ +## `EgressSelection` {#apiserver-k8s-io-v1alpha1-EgressSelection} + + +**Appears in:** + +- [EgressSelectorConfiguration](#apiserver-k8s-io-v1alpha1-EgressSelectorConfiguration) + + +

EgressSelection provides the configuration for a single egress selection client.

+ + + + + + + + + + + + + + +
FieldDescription
name [Required]
+string +		 +

name is the name of the egress selection. +Currently supported values are "controlplane", "master", "etcd" and "cluster" +The "master" egress selector is deprecated in favor of "controlplane"

+
connection [Required]
+Connection +		 +

connection is the exact information used to configure the egress selection

+
+ +## `ProtocolType` {#apiserver-k8s-io-v1alpha1-ProtocolType} + +(Alias of `string`) + +**Appears in:** + +- [Connection](#apiserver-k8s-io-v1alpha1-Connection) + + +

ProtocolType is a set of valid values for Connection.ProtocolType

+ + + + +## `TCPTransport` {#apiserver-k8s-io-v1alpha1-TCPTransport} + + +**Appears in:** + +- [Transport](#apiserver-k8s-io-v1alpha1-Transport) + + +

TCPTransport provides the information to connect to konnectivity server via TCP

+ + + + + + + + + + + + + + +
FieldDescription
url [Required]
+string +		 +

URL is the location of the konnectivity server to connect to. +As an example it might be "https://127.0.0.1:8131"

+
tlsConfig
+TLSConfig +		 +

TLSConfig is the config needed to use TLS when connecting to konnectivity server

+
+ +## `TLSConfig` {#apiserver-k8s-io-v1alpha1-TLSConfig} + + +**Appears in:** + +- [TCPTransport](#apiserver-k8s-io-v1alpha1-TCPTransport) + + +

TLSConfig provides the authentication information to connect to konnectivity server +Only used with TCPTransport

+ + + + + + + + + + + + + + + + + +
FieldDescription
caBundle
+string +		 +

caBundle is the file location of the CA to be used to determine trust with the konnectivity server. +Must be absent/empty if TCPTransport.URL is prefixed with http:// +If absent while TCPTransport.URL is prefixed with https://, default to system trust roots.

+
clientKey
+string +		 +

clientKey is the file location of the client key to be used in mtls handshakes with the konnectivity server. +Must be absent/empty if TCPTransport.URL is prefixed with http:// +Must be configured if TCPTransport.URL is prefixed with https://

+
clientCert
+string +		 +

clientCert is the file location of the client certificate to be used in mtls handshakes with the konnectivity server. +Must be absent/empty if TCPTransport.URL is prefixed with http:// +Must be configured if TCPTransport.URL is prefixed with https://

+
+ +## `Transport` {#apiserver-k8s-io-v1alpha1-Transport} + + +**Appears in:** + +- [Connection](#apiserver-k8s-io-v1alpha1-Connection) + + +

Transport defines the transport configurations we use to dial to the konnectivity server

+ + + + + + + + + + + + + + +
FieldDescription
tcp
+TCPTransport +		 +

TCP is the TCP configuration for communicating with the konnectivity server via TCP +ProxyProtocol of GRPC is not supported with TCP transport at the moment +Requires at least one of TCP or UDS to be set

+
uds
+UDSTransport +		 +

UDS is the UDS configuration for communicating with the konnectivity server via UDS +Requires at least one of TCP or UDS to be set

+
+ +## `UDSTransport` {#apiserver-k8s-io-v1alpha1-UDSTransport} + + +**Appears in:** + +- [Transport](#apiserver-k8s-io-v1alpha1-Transport) + + +

UDSTransport provides the information to connect to konnectivity server via UDS

+ + + + + + + + + + + +
FieldDescription
udsName [Required]
+string +		 +

UDSName is the name of the unix domain socket to connect to konnectivity server +This does not use a unix:// prefix. (Eg: /etc/srv/kubernetes/konnectivity-server/konnectivity-server.socket)

+
+ diff --git a/content/en/docs/reference/config-api/apiserver-encryption.v1.md b/content/en/docs/reference/config-api/apiserver-encryption.v1.md new file mode 100644 index 0000000000..3b09e817a5 --- /dev/null +++ b/content/en/docs/reference/config-api/apiserver-encryption.v1.md @@ -0,0 +1,279 @@ +--- +title: kube-apiserver Encryption Configuration (v1) +content_type: tool-reference +package: apiserver.config.k8s.io/v1 +auto_generated: true +--- +

Package v1 is the v1 version of the API.

+ + +## Resource Types + + +- [EncryptionConfiguration](#apiserver-config-k8s-io-v1-EncryptionConfiguration) + + + +## `EncryptionConfiguration` {#apiserver-config-k8s-io-v1-EncryptionConfiguration} + + + +

EncryptionConfiguration stores the complete configuration for encryption providers.

+ + + + + + + + + + + + + + +
FieldDescription
apiVersion
string		apiserver.config.k8s.io/v1
kind
string		EncryptionConfiguration
resources [Required]
+[]ResourceConfiguration +		 +

resources is a list containing resources, and their corresponding encryption providers.

+
+ +## `AESConfiguration` {#apiserver-config-k8s-io-v1-AESConfiguration} + + +**Appears in:** + +- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration) + + +

AESConfiguration contains the API configuration for an AES transformer.

+ + + + + + + + + + + +
FieldDescription
keys [Required]
+[]Key +		 +

keys is a list of keys to be used for creating the AES transformer. +Each key has to be 32 bytes long for AES-CBC and 16, 24 or 32 bytes for AES-GCM.

+
+ +## `IdentityConfiguration` {#apiserver-config-k8s-io-v1-IdentityConfiguration} + + +**Appears in:** + +- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration) + + +

IdentityConfiguration is an empty struct to allow identity transformer in provider configuration.

+ + + + +## `KMSConfiguration` {#apiserver-config-k8s-io-v1-KMSConfiguration} + + +**Appears in:** + +- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration) + + +

KMSConfiguration contains the name, cache size and path to configuration file for a KMS based envelope transformer.

+ + + + + + + + + + + + + + + + + + + + +
FieldDescription
name [Required]
+string +		 +

name is the name of the KMS plugin to be used.

+
cachesize
+int32 +		 +

cachesize is the maximum number of secrets which are cached in memory. The default value is 1000. +Set to a negative value to disable caching.

+
endpoint [Required]
+string +		 +

endpoint is the gRPC server listening address, for example "unix:///var/run/kms-provider.sock".

+
timeout
+meta/v1.Duration +		 +

timeout for gRPC calls to kms-plugin (ex. 5s). The default is 3 seconds.

+
+ +## `Key` {#apiserver-config-k8s-io-v1-Key} + + +**Appears in:** + +- [AESConfiguration](#apiserver-config-k8s-io-v1-AESConfiguration) + +- [SecretboxConfiguration](#apiserver-config-k8s-io-v1-SecretboxConfiguration) + + +

Key contains name and secret of the provided key for a transformer.

+ + + + + + + + + + + + + + +
FieldDescription
name [Required]
+string +		 +

name is the name of the key to be used while storing data to disk.

+
secret [Required]
+string +		 +

secret is the actual key, encoded in base64.

+
+ +## `ProviderConfiguration` {#apiserver-config-k8s-io-v1-ProviderConfiguration} + + +**Appears in:** + +- [ResourceConfiguration](#apiserver-config-k8s-io-v1-ResourceConfiguration) + + +

ProviderConfiguration stores the provided configuration for an encryption provider.

+ + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
aesgcm [Required]
+AESConfiguration +		 +

aesgcm is the configuration for the AES-GCM transformer.

+
aescbc [Required]
+AESConfiguration +		 +

aescbc is the configuration for the AES-CBC transformer.

+
secretbox [Required]
+SecretboxConfiguration +		 +

secretbox is the configuration for the Secretbox based transformer.

+
identity [Required]
+IdentityConfiguration +		 +

identity is the (empty) configuration for the identity transformer.

+
kms [Required]
+KMSConfiguration +		 +

kms contains the name, cache size and path to configuration file for a KMS based envelope transformer.

+
+ +## `ResourceConfiguration` {#apiserver-config-k8s-io-v1-ResourceConfiguration} + + +**Appears in:** + +- [EncryptionConfiguration](#apiserver-config-k8s-io-v1-EncryptionConfiguration) + + +

ResourceConfiguration stores per resource configuration.

+ + + + + + + + + + + + + + +
FieldDescription
resources [Required]
+[]string +		 +

resources is a list of kubernetes resources which have to be encrypted.

+
providers [Required]
+[]ProviderConfiguration +		 +

providers is a list of transformers to be used for reading and writing the resources to disk. +eg: aesgcm, aescbc, secretbox, identity.

+
+ +## `SecretboxConfiguration` {#apiserver-config-k8s-io-v1-SecretboxConfiguration} + + +**Appears in:** + +- [ProviderConfiguration](#apiserver-config-k8s-io-v1-ProviderConfiguration) + + +

SecretboxConfiguration contains the API configuration for an Secretbox transformer.

+ + + + + + + + + + + +
FieldDescription
keys [Required]
+[]Key +		 +

keys is a list of keys to be used for creating the Secretbox transformer. +Each key has to be 32 bytes long.

+
+ diff --git a/content/en/docs/reference/config-api/apiserver-webhookadmission.v1.md b/content/en/docs/reference/config-api/apiserver-webhookadmission.v1.md index cecebc3d10..f0c6a5b953 100644 --- a/content/en/docs/reference/config-api/apiserver-webhookadmission.v1.md +++ b/content/en/docs/reference/config-api/apiserver-webhookadmission.v1.md @@ -4,7 +4,8 @@ content_type: tool-reference package: apiserver.config.k8s.io/v1 auto_generated: true --- -Package v1 is the v1 version of the API. +

Package v1 is the v1 version of the API.

+ ## Resource Types @@ -17,10 +18,9 @@ Package v1 is the v1 version of the API. +

WebhookAdmission provides configuration for the webhook admission controller.

-WebhookAdmission provides configuration for the webhook admission controller. - @@ -28,17 +28,14 @@ WebhookAdmission provides configuration for the webhook admission controller. - - +

KubeConfigFile is the path to the kubeconfig file.

+ - -
FieldDescription
apiVersion
string		apiserver.config.k8s.io/v1
kind
string		WebhookAdmission
kubeConfigFile [Required]
string 		- KubeConfigFile is the path to the kubeconfig file.
diff --git a/content/en/docs/reference/config-api/client-authentication.v1.md b/content/en/docs/reference/config-api/client-authentication.v1.md index 20f7554854..f06c337fab 100644 --- a/content/en/docs/reference/config-api/client-authentication.v1.md +++ b/content/en/docs/reference/config-api/client-authentication.v1.md @@ -17,11 +17,10 @@ auto_generated: true +

ExecCredential is used by exec-based plugins to communicate credentials to +HTTP transports.

-ExecCredential is used by exec-based plugins to communicate credentials to -HTTP transports. - @@ -29,221 +28,202 @@ HTTP transports. - - +

Spec holds information passed to the plugin by the transport.

+ - - +

Status is filled in by the plugin and holds the credentials that the transport +should use to contact the API.

+ - -
FieldDescription
apiVersion
string		client.authentication.k8s.io/v1
kind
string		ExecCredential
spec [Required]
ExecCredentialSpec 		- Spec holds information passed to the plugin by the transport.
status
ExecCredentialStatus 		- Status is filled in by the plugin and holds the credentials that the transport -should use to contact the API.
## `Cluster` {#client-authentication-k8s-io-v1-Cluster} - - **Appears in:** + - [ExecCredentialSpec](#client-authentication-k8s-io-v1-ExecCredentialSpec) -Cluster contains information to allow an exec plugin to communicate -with the kubernetes cluster being authenticated to. - -To ensure that this struct contains everything someone would need to communicate +

Cluster contains information to allow an exec plugin to communicate +with the kubernetes cluster being authenticated to.

+

To ensure that this struct contains everything someone would need to communicate with a kubernetes cluster (just like they would via a kubeconfig), the fields -should shadow "k8s.io/client-go/tools/clientcmd/api/v1".Cluster, with the exception -of CertificateAuthority, since CA data will always be passed to the plugin as bytes. +should shadow "k8s.io/client-go/tools/clientcmd/api/v1".Cluster, with the exception +of CertificateAuthority, since CA data will always be passed to the plugin as bytes.

+ - +

Server is the address of the kubernetes cluster (https://hostname:port).

+ - - +used to contact the server is used.

+ - - +

InsecureSkipTLSVerify skips the validity check for the server's certificate. +This will make your HTTPS connections insecure.

+ - - +

CAData contains PEM-encoded certificate authority certificates. +If empty, system roots should be used.

+ - - +

ProxyURL is the URL to the proxy to be used for all requests to this +cluster.

+ - - +to be stored directly in the kubeconfig.

+ - -
FieldDescription
server [Required]
string 		- Server is the address of the kubernetes cluster (https://hostname:port).
tls-server-name
string 		- TLSServerName is passed to the server for SNI and is used in the client to +

TLSServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname -used to contact the server is used.
insecure-skip-tls-verify
bool 		- InsecureSkipTLSVerify skips the validity check for the server's certificate. -This will make your HTTPS connections insecure.
certificate-authority-data
[]byte 		- CAData contains PEM-encoded certificate authority certificates. -If empty, system roots should be used.
proxy-url
string 		- ProxyURL is the URL to the proxy to be used for all requests to this -cluster.
config
-k8s.io/apimachinery/pkg/runtime.RawExtension +k8s.io/apimachinery/pkg/runtime.RawExtension 		- Config holds additional config data that is specific to the exec -plugin with regards to the cluster being authenticated to. - -This data is sourced from the clientcmd Cluster object's -extensions[client.authentication.k8s.io/exec] field: - -clusters: -- name: my-cluster - cluster: - ... - extensions: - - name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config - extension: - audience: 06e3fbd18de8 # arbitrary config - -In some environments, the user config may be exactly the same across many clusters +

Config holds additional config data that is specific to the exec +plugin with regards to the cluster being authenticated to.

+

This data is sourced from the clientcmd Cluster object's +extensions[client.authentication.k8s.io/exec] field:

+

clusters:

+
    +
  • name: my-cluster +cluster: +... +extensions: +
      +
    • name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config +extension: +audience: 06e3fbd18de8 # arbitrary config
      • +
    +
    • +
+

In some environments, the user config may be exactly the same across many clusters (i.e. call this exec plugin) minus some details that are specific to each cluster such as the audience. This field allows the per cluster config to be directly specified with the cluster info. Using this field to store secret data is not recommended as one of the prime benefits of exec plugins is that no secrets need -to be stored directly in the kubeconfig.
## `ExecCredentialSpec` {#client-authentication-k8s-io-v1-ExecCredentialSpec} - - **Appears in:** + - [ExecCredential](#client-authentication-k8s-io-v1-ExecCredential) -ExecCredentialSpec holds request and runtime specific information provided by -the transport. +

ExecCredentialSpec holds request and runtime specific information provided by +the transport.

+ - +ExecConfig.ProvideClusterInfo).

+ - - +

Interactive declares whether stdin has been passed to this exec plugin.

+ - -
FieldDescription
cluster
Cluster 		- Cluster contains information to allow an exec plugin to communicate with the +

Cluster contains information to allow an exec plugin to communicate with the kubernetes cluster being authenticated to. Note that Cluster is non-nil only when provideClusterInfo is set to true in the exec provider config (i.e., -ExecConfig.ProvideClusterInfo).
interactive [Required]
bool 		- Interactive declares whether stdin has been passed to this exec plugin.
## `ExecCredentialStatus` {#client-authentication-k8s-io-v1-ExecCredentialStatus} - - **Appears in:** + - [ExecCredential](#client-authentication-k8s-io-v1-ExecCredential) -ExecCredentialStatus holds credentials for the transport to use. - -Token and ClientKeyData are sensitive fields. This data should only be +

ExecCredentialStatus holds credentials for the transport to use.

+

Token and ClientKeyData are sensitive fields. This data should only be transmitted in-memory between client and exec plugin process. Exec plugin -itself should at least be protected via file permissions. +itself should at least be protected via file permissions.

+ - +

ExpirationTimestamp indicates a time when the provided credentials expire.

+ - - +

Token is a bearer token used by the client for request authentication.

+ - - +

PEM-encoded client TLS certificates (including intermediates, if any).

+ - - +

PEM-encoded private key for the above certificate.

+ - -
FieldDescription
expirationTimestamp
meta/v1.Time 		- ExpirationTimestamp indicates a time when the provided credentials expire.
token [Required]
string 		- Token is a bearer token used by the client for request authentication.
clientCertificateData [Required]
string 		- PEM-encoded client TLS certificates (including intermediates, if any).
clientKeyData [Required]
string 		- PEM-encoded private key for the above certificate.
diff --git a/content/en/docs/reference/config-api/client-authentication.v1beta1.md b/content/en/docs/reference/config-api/client-authentication.v1beta1.md index 025e762274..2e840b5805 100644 --- a/content/en/docs/reference/config-api/client-authentication.v1beta1.md +++ b/content/en/docs/reference/config-api/client-authentication.v1beta1.md @@ -17,8 +17,9 @@ auto_generated: true -ExecCredential is used by exec-based plugins to communicate credentials to -HTTP transports. +

ExecCredential is used by exec-based plugins to communicate credentials to +HTTP transports.

+ @@ -32,15 +33,15 @@ HTTP transports. ExecCredentialSpec @@ -53,13 +54,14 @@ should use to contact the API. - [ExecCredentialSpec](#client-authentication-k8s-io-v1beta1-ExecCredentialSpec) -Cluster contains information to allow an exec plugin to communicate -with the kubernetes cluster being authenticated to. -To ensure that this struct contains everything someone would need to communicate +

Cluster contains information to allow an exec plugin to communicate +with the kubernetes cluster being authenticated to.

+

To ensure that this struct contains everything someone would need to communicate with a kubernetes cluster (just like they would via a kubeconfig), the fields -should shadow "k8s.io/client-go/tools/clientcmd/api/v1".Cluster, with the exception -of CertificateAuthority, since CA data will always be passed to the plugin as bytes. +should shadow "k8s.io/client-go/tools/clientcmd/api/v1".Cluster, with the exception +of CertificateAuthority, since CA data will always be passed to the plugin as bytes.

+
FieldDescription
- Spec holds information passed to the plugin by the transport. +

Spec holds information passed to the plugin by the transport.
status
ExecCredentialStatus 		- Status is filled in by the plugin and holds the credentials that the transport -should use to contact the API. +

Status is filled in by the plugin and holds the credentials that the transport +should use to contact the API.
@@ -70,67 +72,69 @@ of CertificateAuthority, since CA data will always be passed to the plugin as by string @@ -143,8 +147,10 @@ to be stored directly in the kubeconfig. - [ExecCredential](#client-authentication-k8s-io-v1beta1-ExecCredential) -ExecCredentialSpec holds request and runtime specific information provided by -the transport. + +

ExecCredentialSpec holds request and runtime specific information provided by +the transport.

+
FieldDescription
- Server is the address of the kubernetes cluster (https://hostname:port). +

Server is the address of the kubernetes cluster (https://hostname:port).
tls-server-name
string 		- TLSServerName is passed to the server for SNI and is used in the client to +

TLSServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname -used to contact the server is used. +used to contact the server is used.
insecure-skip-tls-verify
bool 		- InsecureSkipTLSVerify skips the validity check for the server's certificate. -This will make your HTTPS connections insecure. +

InsecureSkipTLSVerify skips the validity check for the server's certificate. +This will make your HTTPS connections insecure.
certificate-authority-data
[]byte 		- CAData contains PEM-encoded certificate authority certificates. -If empty, system roots should be used. +

CAData contains PEM-encoded certificate authority certificates. +If empty, system roots should be used.
proxy-url
string 		- ProxyURL is the URL to the proxy to be used for all requests to this -cluster. +

ProxyURL is the URL to the proxy to be used for all requests to this +cluster.
config
-k8s.io/apimachinery/pkg/runtime.RawExtension +k8s.io/apimachinery/pkg/runtime.RawExtension 		- Config holds additional config data that is specific to the exec -plugin with regards to the cluster being authenticated to. - -This data is sourced from the clientcmd Cluster object's -extensions[client.authentication.k8s.io/exec] field: - -clusters: -- name: my-cluster - cluster: - ... - extensions: - - name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config - extension: - audience: 06e3fbd18de8 # arbitrary config - -In some environments, the user config may be exactly the same across many clusters +

Config holds additional config data that is specific to the exec +plugin with regards to the cluster being authenticated to.

+

This data is sourced from the clientcmd Cluster object's +extensions[client.authentication.k8s.io/exec] field:

+

clusters:

+
    +
  • name: my-cluster +cluster: +... +extensions: +
      +
    • name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config +extension: +audience: 06e3fbd18de8 # arbitrary config
      • +
    +
    • +
+

In some environments, the user config may be exactly the same across many clusters (i.e. call this exec plugin) minus some details that are specific to each cluster such as the audience. This field allows the per cluster config to be directly specified with the cluster info. Using this field to store secret data is not recommended as one of the prime benefits of exec plugins is that no secrets need -to be stored directly in the kubeconfig. +to be stored directly in the kubeconfig.
@@ -155,17 +161,17 @@ the transport. Cluster @@ -178,11 +184,12 @@ ExecConfig.ProvideClusterInfo). - [ExecCredential](#client-authentication-k8s-io-v1beta1-ExecCredential) -ExecCredentialStatus holds credentials for the transport to use. -Token and ClientKeyData are sensitive fields. This data should only be +

ExecCredentialStatus holds credentials for the transport to use.

+

Token and ClientKeyData are sensitive fields. This data should only be transmitted in-memory between client and exec plugin process. Exec plugin -itself should at least be protected via file permissions. +itself should at least be protected via file permissions.

+
FieldDescription
- Cluster contains information to allow an exec plugin to communicate with the +

Cluster contains information to allow an exec plugin to communicate with the kubernetes cluster being authenticated to. Note that Cluster is non-nil only when provideClusterInfo is set to true in the exec provider config (i.e., -ExecConfig.ProvideClusterInfo). +ExecConfig.ProvideClusterInfo).
interactive [Required]
bool 		- Interactive declares whether stdin has been passed to this exec plugin. +

Interactive declares whether stdin has been passed to this exec plugin.
@@ -193,28 +200,28 @@ itself should at least be protected via file permissions. meta/v1.Time diff --git a/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md b/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md index 2dc445cd7e..b3d1fc98ff 100644 --- a/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md +++ b/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md @@ -17,8 +17,9 @@ auto_generated: true -KubeProxyConfiguration contains everything necessary to configure the -Kubernetes proxy server. +

KubeProxyConfiguration contains everything necessary to configure the +Kubernetes proxy server.

+
FieldDescription
- ExpirationTimestamp indicates a time when the provided credentials expire. +

ExpirationTimestamp indicates a time when the provided credentials expire.
token [Required]
string 		- Token is a bearer token used by the client for request authentication. +

Token is a bearer token used by the client for request authentication.
clientCertificateData [Required]
string 		- PEM-encoded client TLS certificates (including intermediates, if any). +

PEM-encoded client TLS certificates (including intermediates, if any).
clientKeyData [Required]
string 		- PEM-encoded private key for the above certificate. +

PEM-encoded private key for the above certificate.
@@ -32,164 +33,164 @@ Kubernetes proxy server. map[string]bool @@ -202,8 +203,10 @@ An empty string slice is meant to select all network interfaces. - [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration) -KubeProxyConntrackConfiguration contains conntrack settings for -the Kubernetes proxy server. + +

KubeProxyConntrackConfiguration contains conntrack settings for +the Kubernetes proxy server.

+
FieldDescription
- featureGates is a map of feature names to bools that enable or disable alpha/experimental features. +

featureGates is a map of feature names to bools that enable or disable alpha/experimental features.
bindAddress [Required]
string 		- bindAddress is the IP address for the proxy server to serve on (set to 0.0.0.0 -for all interfaces) +

bindAddress is the IP address for the proxy server to serve on (set to 0.0.0.0 +for all interfaces)
healthzBindAddress [Required]
string 		- healthzBindAddress is the IP address and port for the health check server to serve on, -defaulting to 0.0.0.0:10256 +

healthzBindAddress is the IP address and port for the health check server to serve on, +defaulting to 0.0.0.0:10256
metricsBindAddress [Required]
string 		- metricsBindAddress is the IP address and port for the metrics server to serve on, -defaulting to 127.0.0.1:10249 (set to 0.0.0.0 for all interfaces) +

metricsBindAddress is the IP address and port for the metrics server to serve on, +defaulting to 127.0.0.1:10249 (set to 0.0.0.0 for all interfaces)
bindAddressHardFail [Required]
bool 		- bindAddressHardFail, if true, kube-proxy will treat failure to bind to a port as fatal and exit +

bindAddressHardFail, if true, kube-proxy will treat failure to bind to a port as fatal and exit
enableProfiling [Required]
bool 		- enableProfiling enables profiling via web interface on /debug/pprof handler. -Profiling handlers will be handled by metrics server. +

enableProfiling enables profiling via web interface on /debug/pprof handler. +Profiling handlers will be handled by metrics server.
clusterCIDR [Required]
string 		- clusterCIDR is the CIDR range of the pods in the cluster. It is used to +

clusterCIDR is the CIDR range of the pods in the cluster. It is used to bridge traffic coming from outside of the cluster. If not provided, -no off-cluster bridging will be performed. +no off-cluster bridging will be performed.
hostnameOverride [Required]
string 		- hostnameOverride, if non-empty, will be used as the identity instead of the actual hostname. +

hostnameOverride, if non-empty, will be used as the identity instead of the actual hostname.
clientConnection [Required]
ClientConnectionConfiguration 		- clientConnection specifies the kubeconfig file and client connection settings for the proxy -server to use when communicating with the apiserver. +

clientConnection specifies the kubeconfig file and client connection settings for the proxy +server to use when communicating with the apiserver.
iptables [Required]
KubeProxyIPTablesConfiguration 		- iptables contains iptables-related configuration options. +

iptables contains iptables-related configuration options.
ipvs [Required]
KubeProxyIPVSConfiguration 		- ipvs contains ipvs-related configuration options. +

ipvs contains ipvs-related configuration options.
oomScoreAdj [Required]
int32 		- oomScoreAdj is the oom-score-adj value for kube-proxy process. Values must be within -the range [-1000, 1000] +

oomScoreAdj is the oom-score-adj value for kube-proxy process. Values must be within +the range [-1000, 1000]
mode [Required]
ProxyMode 		- mode specifies which proxy mode to use. +

mode specifies which proxy mode to use.
portRange [Required]
string 		- portRange is the range of host ports (beginPort-endPort, inclusive) that may be consumed -in order to proxy service traffic. If unspecified (0-0) then ports will be randomly chosen. +

portRange is the range of host ports (beginPort-endPort, inclusive) that may be consumed +in order to proxy service traffic. If unspecified (0-0) then ports will be randomly chosen.
udpIdleTimeout [Required]
-meta/v1.Duration +meta/v1.Duration 		- udpIdleTimeout is how long an idle UDP connection will be kept open (e.g. '250ms', '2s'). -Must be greater than 0. Only applicable for proxyMode=userspace. +

udpIdleTimeout is how long an idle UDP connection will be kept open (e.g. '250ms', '2s'). +Must be greater than 0. Only applicable for proxyMode=userspace.
conntrack [Required]
KubeProxyConntrackConfiguration 		- conntrack contains conntrack-related configuration options. +

conntrack contains conntrack-related configuration options.
configSyncPeriod [Required]
-meta/v1.Duration +meta/v1.Duration 		- configSyncPeriod is how often configuration from the apiserver is refreshed. Must be greater -than 0. +

configSyncPeriod is how often configuration from the apiserver is refreshed. Must be greater +than 0.
nodePortAddresses [Required]
[]string 		- nodePortAddresses is the --nodeport-addresses value for kube-proxy process. Values must be valid +

nodePortAddresses is the --nodeport-addresses value for kube-proxy process. Values must be valid IP blocks. These values are as a parameter to select the interfaces where nodeport works. In case someone would like to expose a service on localhost for local visit and some other interfaces for particular purpose, a list of IP blocks would do that. -If set it to "127.0.0.0/8", kube-proxy will only select the loopback interface for NodePort. +If set it to "127.0.0.0/8", kube-proxy will only select the loopback interface for NodePort. If set it to a non-zero IP block, kube-proxy will filter that down to just the IPs that applied to the node. -An empty string slice is meant to select all network interfaces. +An empty string slice is meant to select all network interfaces.
winkernel [Required]
KubeProxyWinkernelConfiguration 		- winkernel contains winkernel-related configuration options. +

winkernel contains winkernel-related configuration options.
showHiddenMetricsForVersion [Required]
string 		- ShowHiddenMetricsForVersion is the version for which you want to show hidden metrics. +

ShowHiddenMetricsForVersion is the version for which you want to show hidden metrics.
detectLocalMode [Required]
LocalMode 		- DetectLocalMode determines mode to use for detecting local traffic, defaults to LocalModeClusterCIDR +

DetectLocalMode determines mode to use for detecting local traffic, defaults to LocalModeClusterCIDR
@@ -214,33 +217,33 @@ the Kubernetes proxy server. int32 @@ -253,8 +256,10 @@ table. (e.g. '60s'). Must be greater than 0 to set. - [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration) -KubeProxyIPTablesConfiguration contains iptables-related configuration -details for the Kubernetes proxy server. + +

KubeProxyIPTablesConfiguration contains iptables-related configuration +details for the Kubernetes proxy server.

+
FieldDescription
- maxPerCore is the maximum number of NAT connections to track -per CPU core (0 to leave the limit as-is and ignore min). +

maxPerCore is the maximum number of NAT connections to track +per CPU core (0 to leave the limit as-is and ignore min).
min [Required]
int32 		- min is the minimum value of connect-tracking records to allocate, -regardless of conntrackMaxPerCore (set maxPerCore=0 to leave the limit as-is). +

min is the minimum value of connect-tracking records to allocate, +regardless of conntrackMaxPerCore (set maxPerCore=0 to leave the limit as-is).
tcpEstablishedTimeout [Required]
-meta/v1.Duration +meta/v1.Duration 		- tcpEstablishedTimeout is how long an idle TCP connection will be kept open -(e.g. '2s'). Must be greater than 0 to set. +

tcpEstablishedTimeout is how long an idle TCP connection will be kept open +(e.g. '2s'). Must be greater than 0 to set.
tcpCloseWaitTimeout [Required]
-meta/v1.Duration +meta/v1.Duration 		- tcpCloseWaitTimeout is how long an idle conntrack entry +

tcpCloseWaitTimeout is how long an idle conntrack entry in CLOSE_WAIT state will remain in the conntrack -table. (e.g. '60s'). Must be greater than 0 to set. +table. (e.g. '60s'). Must be greater than 0 to set.
@@ -265,31 +270,31 @@ details for the Kubernetes proxy server. int32 @@ -302,8 +307,10 @@ the pure iptables proxy mode. Values must be within the range [0, 31]. - [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration) -KubeProxyIPVSConfiguration contains ipvs-related configuration -details for the Kubernetes proxy server. + +

KubeProxyIPVSConfiguration contains ipvs-related configuration +details for the Kubernetes proxy server.

+
FieldDescription
- masqueradeBit is the bit of the iptables fwmark space to use for SNAT if using -the pure iptables proxy mode. Values must be within the range [0, 31]. +

masqueradeBit is the bit of the iptables fwmark space to use for SNAT if using +the pure iptables proxy mode. Values must be within the range [0, 31].
masqueradeAll [Required]
bool 		- masqueradeAll tells kube-proxy to SNAT everything if using the pure iptables proxy mode. +

masqueradeAll tells kube-proxy to SNAT everything if using the pure iptables proxy mode.
syncPeriod [Required]
-meta/v1.Duration +meta/v1.Duration 		- syncPeriod is the period that iptables rules are refreshed (e.g. '5s', '1m', -'2h22m'). Must be greater than 0. +

syncPeriod is the period that iptables rules are refreshed (e.g. '5s', '1m', +'2h22m'). Must be greater than 0.
minSyncPeriod [Required]
-meta/v1.Duration +meta/v1.Duration 		- minSyncPeriod is the minimum period that iptables rules are refreshed (e.g. '5s', '1m', -'2h22m'). +

minSyncPeriod is the minimum period that iptables rules are refreshed (e.g. '5s', '1m', +'2h22m').
@@ -311,66 +318,66 @@ details for the Kubernetes proxy server. @@ -383,8 +390,10 @@ The default value is 0, which preserves the current timeout value on the system. - [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration) -KubeProxyWinkernelConfiguration contains Windows/HNS settings for -the Kubernetes proxy server. + +

KubeProxyWinkernelConfiguration contains Windows/HNS settings for +the Kubernetes proxy server.

+
FieldDescription
syncPeriod [Required]
-meta/v1.Duration +meta/v1.Duration 		- syncPeriod is the period that ipvs rules are refreshed (e.g. '5s', '1m', -'2h22m'). Must be greater than 0. +

syncPeriod is the period that ipvs rules are refreshed (e.g. '5s', '1m', +'2h22m'). Must be greater than 0.
minSyncPeriod [Required]
-meta/v1.Duration +meta/v1.Duration 		- minSyncPeriod is the minimum period that ipvs rules are refreshed (e.g. '5s', '1m', -'2h22m'). +

minSyncPeriod is the minimum period that ipvs rules are refreshed (e.g. '5s', '1m', +'2h22m').
scheduler [Required]
string 		- ipvs scheduler +

ipvs scheduler
excludeCIDRs [Required]
[]string 		- excludeCIDRs is a list of CIDR's which the ipvs proxier should not touch -when cleaning up ipvs services. +

excludeCIDRs is a list of CIDR's which the ipvs proxier should not touch +when cleaning up ipvs services.
strictARP [Required]
bool 		- strict ARP configure arp_ignore and arp_announce to avoid answering ARP queries -from kube-ipvs0 interface +

strict ARP configure arp_ignore and arp_announce to avoid answering ARP queries +from kube-ipvs0 interface
tcpTimeout [Required]
-meta/v1.Duration +meta/v1.Duration 		- tcpTimeout is the timeout value used for idle IPVS TCP sessions. -The default value is 0, which preserves the current timeout value on the system. +

tcpTimeout is the timeout value used for idle IPVS TCP sessions. +The default value is 0, which preserves the current timeout value on the system.
tcpFinTimeout [Required]
-meta/v1.Duration +meta/v1.Duration 		- tcpFinTimeout is the timeout value used for IPVS TCP sessions after receiving a FIN. -The default value is 0, which preserves the current timeout value on the system. +

tcpFinTimeout is the timeout value used for IPVS TCP sessions after receiving a FIN. +The default value is 0, which preserves the current timeout value on the system.
udpTimeout [Required]
-meta/v1.Duration +meta/v1.Duration 		- udpTimeout is the timeout value used for IPVS UDP packets. -The default value is 0, which preserves the current timeout value on the system. +

udpTimeout is the timeout value used for IPVS UDP packets. +The default value is 0, which preserves the current timeout value on the system.
@@ -395,24 +404,24 @@ the Kubernetes proxy server. string @@ -421,36 +430,38 @@ with DSR ## `LocalMode` {#kubeproxy-config-k8s-io-v1alpha1-LocalMode} (Alias of `string`) + **Appears in:** - [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration) -LocalMode represents modes to detect local traffic from the node + +

LocalMode represents modes to detect local traffic from the node

+ ## `ProxyMode` {#kubeproxy-config-k8s-io-v1alpha1-ProxyMode} (Alias of `string`) + **Appears in:** - [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration) -ProxyMode represents modes used by the Kubernetes proxy server. -Currently, three modes of proxy are available in Linux platform: 'userspace' (older, going to be EOL), 'iptables' -(newer, faster), 'ipvs'(newest, better in performance and scalability). - -Two modes of proxy are available in Windows platform: 'userspace'(older, stable) and 'kernelspace' (newer, faster). - -In Linux platform, if proxy mode is blank, use the best-available proxy (currently iptables, but may change in the +

ProxyMode represents modes used by the Kubernetes proxy server.

+

Currently, three modes of proxy are available in Linux platform: 'userspace' (older, going to be EOL), 'iptables' +(newer, faster), 'ipvs'(newest, better in performance and scalability).

+

Two modes of proxy are available in Windows platform: 'userspace'(older, stable) and 'kernelspace' (newer, faster).

+

In Linux platform, if proxy mode is blank, use the best-available proxy (currently iptables, but may change in the future). If the iptables proxy is selected, regardless of how, but the system's kernel or iptables versions are insufficient, this always falls back to the userspace proxy. IPVS mode will be enabled when proxy mode is set to 'ipvs', -and the fall back path is firstly iptables and then userspace. - -In Windows platform, if proxy mode is blank, use the best-available proxy (currently userspace, but may change in the +and the fall back path is firstly iptables and then userspace.

+

In Windows platform, if proxy mode is blank, use the best-available proxy (currently userspace, but may change in the future). If winkernel proxy is selected, regardless of how, but the Windows kernel can't support this mode of proxy, -this always falls back to the userspace proxy. +this always falls back to the userspace proxy.

+ @@ -464,7 +475,15 @@ this always falls back to the userspace proxy. - [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration) -ClientConnectionConfiguration contains details for constructing a client. +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) + +- [GenericControllerManagerConfiguration](#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration) + + +

ClientConnectionConfiguration contains details for constructing a client.

+
FieldDescription
- networkName is the name of the network kube-proxy will use -to create endpoints and policies +

networkName is the name of the network kube-proxy will use +to create endpoints and policies
sourceVip [Required]
string 		- sourceVip is the IP address of the source VIP endoint used for -NAT when loadbalancing +

sourceVip is the IP address of the source VIP endoint used for +NAT when loadbalancing
enableDSR [Required]
bool 		- enableDSR tells kube-proxy whether HNS policies should be created -with DSR +

enableDSR tells kube-proxy whether HNS policies should be created +with DSR
@@ -475,37 +494,75 @@ ClientConnectionConfiguration contains details for constructing a client. string + + +
FieldDescription
- kubeconfig is the path to a KubeConfig file. +

kubeconfig is the path to a KubeConfig file.
acceptContentTypes [Required]
string 		- acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the +

acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the default value of 'application/json'. This field will control all connections to the server used by a particular -client. +client.
contentType [Required]
string 		- contentType is the content type used when sending data to the server from this client. +

contentType is the content type used when sending data to the server from this client.
qps [Required]
float32 		- qps controls the number of queries per second allowed for this connection. +

qps controls the number of queries per second allowed for this connection.
burst [Required]
int32 		- burst allows extra queries to accumulate when a client is exceeding its rate. +

burst allows extra queries to accumulate when a client is exceeding its rate.

+
+ +## `DebuggingConfiguration` {#DebuggingConfiguration} + + +**Appears in:** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) + +- [GenericControllerManagerConfiguration](#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration) + + +

DebuggingConfiguration holds configuration for Debugging related features.

+ + + + + + + + + + + + @@ -516,9 +573,11 @@ client. **Appears in:** +- [LoggingConfiguration](#LoggingConfiguration) -FormatOptions contains options for the different logging formats. +

FormatOptions contains options for the different logging formats.

+
FieldDescription
enableProfiling [Required]
+bool +		 +

enableProfiling enables profiling via web interface host:port/debug/pprof/

+
enableContentionProfiling [Required]
+bool +		 +

enableContentionProfiling enables lock contention profiling, if +enableProfiling is true.
@@ -529,7 +588,7 @@ FormatOptions contains options for the different logging formats. JSONOptions @@ -542,7 +601,9 @@ FormatOptions contains options for the different logging formats. - [FormatOptions](#FormatOptions) -JSONOptions contains options for logging format "json". + +

JSONOptions contains options for logging format "json".

+
FieldDescription
- [Experimental] JSON contains options for logging format "json". +

[Experimental] JSON contains options for logging format "json".
@@ -553,17 +614,176 @@ JSONOptions contains options for logging format "json". bool + + +
FieldDescription
- [Experimental] SplitStream redirects error messages to stderr while +

[Experimental] SplitStream redirects error messages to stderr while info messages go to stdout, with buffering. The default is to write -both to stdout, without buffering. +both to stdout, without buffering.
infoBufferSize [Required]
k8s.io/apimachinery/pkg/api/resource.QuantityValue 		- [Experimental] InfoBufferSize sets the size of the info stream when -using split streams. The default is zero, which disables buffering. +

[Experimental] InfoBufferSize sets the size of the info stream when +using split streams. The default is zero, which disables buffering.

+
+ +## `LeaderElectionConfiguration` {#LeaderElectionConfiguration} + + +**Appears in:** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) + +- [GenericControllerManagerConfiguration](#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration) + + +

LeaderElectionConfiguration defines the configuration of leader election +clients for components that can run with leader election enabled.

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
leaderElect [Required]
+bool +		 +

leaderElect enables a leader election client to gain leadership +before executing the main loop. Enable this when running replicated +components for high availability.

+
leaseDuration [Required]
+meta/v1.Duration +		 +

leaseDuration is the duration that non-leader candidates will wait +after observing a leadership renewal until attempting to acquire +leadership of a led but unrenewed leader slot. This is effectively the +maximum duration that a leader can be stopped before it is replaced +by another candidate. This is only applicable if leader election is +enabled.

+
renewDeadline [Required]
+meta/v1.Duration +		 +

renewDeadline is the interval between attempts by the acting master to +renew a leadership slot before it stops leading. This must be less +than or equal to the lease duration. This is only applicable if leader +election is enabled.

+
retryPeriod [Required]
+meta/v1.Duration +		 +

retryPeriod is the duration the clients should wait between attempting +acquisition and renewal of a leadership. This is only applicable if +leader election is enabled.

+
resourceLock [Required]
+string +		 +

resourceLock indicates the resource object type that will be used to lock +during leader election cycles.

+
resourceName [Required]
+string +		 +

resourceName indicates the name of resource object that will be used to lock +during leader election cycles.

+
resourceNamespace [Required]
+string +		 +

resourceName indicates the namespace of resource object that will be used to lock +during leader election cycles.

+
+ +## `LoggingConfiguration` {#LoggingConfiguration} + + +**Appears in:** + +- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) + + +

LoggingConfiguration contains logging options +Refer Logs Options for more information.

+ + + + + + + + + + + + + + + + + + + + + + + + @@ -572,11 +792,14 @@ using split streams. The default is zero, which disables buffering. ## `VModuleConfiguration` {#VModuleConfiguration} (Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`) + **Appears in:** +- [LoggingConfiguration](#LoggingConfiguration) -VModuleConfiguration is a collection of individual file names or patterns -and the corresponding verbosity threshold. +

VModuleConfiguration is a collection of individual file names or patterns +and the corresponding verbosity threshold.

+ diff --git a/content/en/docs/reference/config-api/kube-scheduler-config.v1beta2.md b/content/en/docs/reference/config-api/kube-scheduler-config.v1beta2.md index 6e04ce3879..8c5f981659 100644 --- a/content/en/docs/reference/config-api/kube-scheduler-config.v1beta2.md +++ b/content/en/docs/reference/config-api/kube-scheduler-config.v1beta2.md @@ -20,15 +20,338 @@ auto_generated: true +## `ClientConnectionConfiguration` {#ClientConnectionConfiguration} + + +**Appears in:** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + + +

ClientConnectionConfiguration contains details for constructing a client.

+ + +
FieldDescription
format [Required]
+string +		 +

Format Flag specifies the structure of log messages. +default value of format is text

+
flushFrequency [Required]
+time.Duration +		 +

Maximum number of seconds between log flushes. Ignored if the +selected logging backend writes log messages without buffering.

+
verbosity [Required]
+uint32 +		 +

Verbosity is the threshold that determines which log messages are +logged. Default is zero which logs only the most important +messages. Higher values enable additional messages. Error messages +are always logged.

+
vmodule [Required]
+VModuleConfiguration +		 +

VModule overrides the verbosity threshold for individual files. +Only supported for "text" log format.

+
sanitization [Required]
+bool +		 +

[Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). +Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)

+
options [Required]
+FormatOptions +		 +

[Experimental] Options holds additional parameters that are specific +to the different logging formats. Only the options for the selected +format get used, but all of them get validated.
+ + + + + + + + + + + + + + + + + + + + +
FieldDescription
kubeconfig [Required]
+string +		 +

kubeconfig is the path to a KubeConfig file.

+
acceptContentTypes [Required]
+string +		 +

acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the +default value of 'application/json'. This field will control all connections to the server used by a particular +client.

+
contentType [Required]
+string +		 +

contentType is the content type used when sending data to the server from this client.

+
qps [Required]
+float32 +		 +

qps controls the number of queries per second allowed for this connection.

+
burst [Required]
+int32 +		 +

burst allows extra queries to accumulate when a client is exceeding its rate.

+
+ +## `DebuggingConfiguration` {#DebuggingConfiguration} + + +**Appears in:** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + + +

DebuggingConfiguration holds configuration for Debugging related features.

+ + + + + + + + + + + + + + +
FieldDescription
enableProfiling [Required]
+bool +		 +

enableProfiling enables profiling via web interface host:port/debug/pprof/

+
enableContentionProfiling [Required]
+bool +		 +

enableContentionProfiling enables lock contention profiling, if +enableProfiling is true.

+
+ +## `FormatOptions` {#FormatOptions} + + +**Appears in:** + +- [LoggingConfiguration](#LoggingConfiguration) + + +

FormatOptions contains options for the different logging formats.

+ + + + + + + + + + + +
FieldDescription
json [Required]
+JSONOptions +		 +

[Experimental] JSON contains options for logging format "json".

+
+ +## `JSONOptions` {#JSONOptions} + + +**Appears in:** + +- [FormatOptions](#FormatOptions) + + +

JSONOptions contains options for logging format "json".

+ + + + + + + + + + + + + + +
FieldDescription
splitStream [Required]
+bool +		 +

[Experimental] SplitStream redirects error messages to stderr while +info messages go to stdout, with buffering. The default is to write +both to stdout, without buffering.

+
infoBufferSize [Required]
+k8s.io/apimachinery/pkg/api/resource.QuantityValue +		 +

[Experimental] InfoBufferSize sets the size of the info stream when +using split streams. The default is zero, which disables buffering.

+
+ +## `LeaderElectionConfiguration` {#LeaderElectionConfiguration} + + +**Appears in:** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + + +

LeaderElectionConfiguration defines the configuration of leader election +clients for components that can run with leader election enabled.

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
leaderElect [Required]
+bool +		 +

leaderElect enables a leader election client to gain leadership +before executing the main loop. Enable this when running replicated +components for high availability.

+
leaseDuration [Required]
+meta/v1.Duration +		 +

leaseDuration is the duration that non-leader candidates will wait +after observing a leadership renewal until attempting to acquire +leadership of a led but unrenewed leader slot. This is effectively the +maximum duration that a leader can be stopped before it is replaced +by another candidate. This is only applicable if leader election is +enabled.

+
renewDeadline [Required]
+meta/v1.Duration +		 +

renewDeadline is the interval between attempts by the acting master to +renew a leadership slot before it stops leading. This must be less +than or equal to the lease duration. This is only applicable if leader +election is enabled.

+
retryPeriod [Required]
+meta/v1.Duration +		 +

retryPeriod is the duration the clients should wait between attempting +acquisition and renewal of a leadership. This is only applicable if +leader election is enabled.

+
resourceLock [Required]
+string +		 +

resourceLock indicates the resource object type that will be used to lock +during leader election cycles.

+
resourceName [Required]
+string +		 +

resourceName indicates the name of resource object that will be used to lock +during leader election cycles.

+
resourceNamespace [Required]
+string +		 +

resourceName indicates the namespace of resource object that will be used to lock +during leader election cycles.

+
+ +## `LoggingConfiguration` {#LoggingConfiguration} + + +**Appears in:** + +- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) + + +

LoggingConfiguration contains logging options +Refer Logs Options for more information.

+ + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
format [Required]
+string +		 +

Format Flag specifies the structure of log messages. +default value of format is text

+
flushFrequency [Required]
+time.Duration +		 +

Maximum number of seconds between log flushes. Ignored if the +selected logging backend writes log messages without buffering.

+
verbosity [Required]
+uint32 +		 +

Verbosity is the threshold that determines which log messages are +logged. Default is zero which logs only the most important +messages. Higher values enable additional messages. Error messages +are always logged.

+
vmodule [Required]
+VModuleConfiguration +		 +

VModule overrides the verbosity threshold for individual files. +Only supported for "text" log format.

+
sanitization [Required]
+bool +		 +

[Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). +Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)

+
options [Required]
+FormatOptions +		 +

[Experimental] Options holds additional parameters that are specific +to the different logging formats. Only the options for the selected +format get used, but all of them get validated.

+
+ +## `VModuleConfiguration` {#VModuleConfiguration} + +(Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`) + +**Appears in:** + +- [LoggingConfiguration](#LoggingConfiguration) + + +

VModuleConfiguration is a collection of individual file names or patterns +and the corresponding verbosity threshold.

+ + + + + + ## `DefaultPreemptionArgs` {#kubescheduler-config-k8s-io-v1beta2-DefaultPreemptionArgs} +

DefaultPreemptionArgs holds arguments used to configure the +DefaultPreemption plugin.

-DefaultPreemptionArgs holds arguments used to configure the -DefaultPreemption plugin. - @@ -36,34 +359,30 @@ DefaultPreemption plugin. - - +unspecified.

+ - - +0 nodes. Defaults to 100 nodes if unspecified.

+ - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta2
kind
string		DefaultPreemptionArgs
minCandidateNodesPercentage [Required]
int32 		- MinCandidateNodesPercentage is the minimum number of candidates to +

MinCandidateNodesPercentage is the minimum number of candidates to shortlist when dry running preemption as a percentage of number of nodes. Must be in the range [0, 100]. Defaults to 10% of the cluster size if -unspecified.
minCandidateNodesAbsolute [Required]
int32 		- MinCandidateNodesAbsolute is the absolute minimum number of candidates to +

MinCandidateNodesAbsolute is the absolute minimum number of candidates to shortlist. The likely number of candidates enumerated for dry running preemption is given by the formula: -numCandidates = max(numNodes ∗ minCandidateNodesPercentage, minCandidateNodesAbsolute) -We say "likely" because there are other factors such as PDB violations +numCandidates = max(numNodes * minCandidateNodesPercentage, minCandidateNodesAbsolute) +We say "likely" because there are other factors such as PDB violations that play a role in the number of candidates shortlisted. Must be at least -0 nodes. Defaults to 100 nodes if unspecified.
@@ -71,10 +390,9 @@ that play a role in the number of candidates shortlisted. Must be at least +

InterPodAffinityArgs holds arguments used to configure the InterPodAffinity plugin.

-InterPodAffinityArgs holds arguments used to configure the InterPodAffinity plugin. - @@ -82,18 +400,15 @@ InterPodAffinityArgs holds arguments used to configure the InterPodAffinity plug - - +

HardPodAffinityWeight is the scoring weight for existing pods with a +matching hard affinity to the incoming pod.

+ - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta2
kind
string		InterPodAffinityArgs
hardPodAffinityWeight [Required]
int32 		- HardPodAffinityWeight is the scoring weight for existing pods with a -matching hard affinity to the incoming pod.
@@ -101,10 +416,9 @@ matching hard affinity to the incoming pod. +

KubeSchedulerConfiguration configures a scheduler

-KubeSchedulerConfiguration configures a scheduler - @@ -112,116 +426,103 @@ KubeSchedulerConfiguration configures a scheduler - - +

Parallelism defines the amount of parallelism in algorithms for scheduling a Pods. Must be greater than 0. Defaults to 16

+ - - +

LeaderElection defines the configuration of leader election client.

+ - - +

ClientConnection specifies the kubeconfig file and client connection +settings for the proxy server to use when communicating with the apiserver.

+ - - +HealthzBindAddress is the IP address and port for the health check server to serve on.

+ - - +

MetricsBindAddress is the IP address and port for the metrics server to serve on.

+ - - +

DebuggingConfiguration holds configuration for Debugging related features +TODO: We might wanna make this a substruct like Debugging componentbaseconfigv1alpha1.DebuggingConfiguration

+ - - +nodes will be scored.

+ - - +will be used.

+ - - +the default value (10s) will be used.

+ - - +with the "default-scheduler" profile, if present here.

+ - - +

Extenders are the list of scheduler extenders, each holding the values of how to communicate +with the extender. These extenders are shared by all scheduler profiles.

+ - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta2
kind
string		KubeSchedulerConfiguration
parallelism [Required]
int32 		- Parallelism defines the amount of parallelism in algorithms for scheduling a Pods. Must be greater than 0. Defaults to 16
leaderElection [Required]
LeaderElectionConfiguration 		- LeaderElection defines the configuration of leader election client.
clientConnection [Required]
ClientConnectionConfiguration 		- ClientConnection specifies the kubeconfig file and client connection -settings for the proxy server to use when communicating with the apiserver.
healthzBindAddress [Required]
string 		- Note: Both HealthzBindAddress and MetricsBindAddress fields are deprecated. +

Note: Both HealthzBindAddress and MetricsBindAddress fields are deprecated. Only empty address or port 0 is allowed. Anything else will fail validation. -HealthzBindAddress is the IP address and port for the health check server to serve on.
metricsBindAddress [Required]
string 		- MetricsBindAddress is the IP address and port for the metrics server to serve on.
DebuggingConfiguration [Required]
DebuggingConfiguration 		(Members of DebuggingConfiguration are embedded into this type.) - DebuggingConfiguration holds configuration for Debugging related features -TODO: We might wanna make this a substruct like Debugging componentbaseconfigv1alpha1.DebuggingConfiguration
percentageOfNodesToScore [Required]
int32 		- PercentageOfNodesToScore is the percentage of all nodes that once found feasible +

PercentageOfNodesToScore is the percentage of all nodes that once found feasible for running a pod, the scheduler stops its search for more feasible nodes in the cluster. This helps improve scheduler's performance. Scheduler always tries to find -at least "minFeasibleNodesToFind" feasible nodes no matter what the value of this flag is. +at least "minFeasibleNodesToFind" feasible nodes no matter what the value of this flag is. Example: if the cluster size is 500 nodes and the value of this flag is 30, then scheduler stops finding further feasible nodes once it finds 150 feasible ones. When the value is 0, default percentage (5%--50% based on the size of the cluster) of the -nodes will be scored.
podInitialBackoffSeconds [Required]
int64 		- PodInitialBackoffSeconds is the initial backoff for unschedulable pods. +

PodInitialBackoffSeconds is the initial backoff for unschedulable pods. If specified, it must be greater than 0. If this value is null, the default value (1s) -will be used.
podMaxBackoffSeconds [Required]
int64 		- PodMaxBackoffSeconds is the max backoff for unschedulable pods. +

PodMaxBackoffSeconds is the max backoff for unschedulable pods. If specified, it must be greater than podInitialBackoffSeconds. If this value is null, -the default value (10s) will be used.
profiles [Required]
[]KubeSchedulerProfile 		- Profiles are scheduling profiles that kube-scheduler supports. Pods can +

Profiles are scheduling profiles that kube-scheduler supports. Pods can choose to be scheduled under a particular profile by setting its associated scheduler name. Pods that don't specify any scheduler name are scheduled -with the "default-scheduler" profile, if present here.
extenders [Required]
[]Extender 		- Extenders are the list of scheduler extenders, each holding the values of how to communicate -with the extender. These extenders are shared by all scheduler profiles.
@@ -229,10 +530,9 @@ with the extender. These extenders are shared by all scheduler profiles. +

NodeAffinityArgs holds arguments to configure the NodeAffinity plugin.

-NodeAffinityArgs holds arguments to configure the NodeAffinity plugin. - @@ -240,22 +540,19 @@ NodeAffinityArgs holds arguments to configure the NodeAffinity plugin. - - +a specific Node (such as Daemonset Pods) might remain unschedulable.

+ - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta2
kind
string		NodeAffinityArgs
addedAffinity
core/v1.NodeAffinity 		- AddedAffinity is applied to all Pods additionally to the NodeAffinity +

AddedAffinity is applied to all Pods additionally to the NodeAffinity specified in the PodSpec. That is, Nodes need to satisfy AddedAffinity AND .spec.NodeAffinity. AddedAffinity is empty by default (all Nodes match). When AddedAffinity is used, some Pods with affinity requirements that match -a specific Node (such as Daemonset Pods) might remain unschedulable.
@@ -263,10 +560,9 @@ a specific Node (such as Daemonset Pods) might remain unschedulable. +

NodeResourcesBalancedAllocationArgs holds arguments used to configure NodeResourcesBalancedAllocation plugin.

-NodeResourcesBalancedAllocationArgs holds arguments used to configure NodeResourcesBalancedAllocation plugin. - @@ -274,17 +570,14 @@ NodeResourcesBalancedAllocationArgs holds arguments used to configure NodeResour - - +

Resources to be managed, the default is "cpu" and "memory" if not specified.

+ - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta2
kind
string		NodeResourcesBalancedAllocationArgs
resources [Required]
[]ResourceSpec 		- Resources to be managed, the default is "cpu" and "memory" if not specified.
@@ -292,10 +585,9 @@ NodeResourcesBalancedAllocationArgs holds arguments used to configure NodeResour +

NodeResourcesFitArgs holds arguments used to configure the NodeResourcesFit plugin.

-NodeResourcesFitArgs holds arguments used to configure the NodeResourcesFit plugin. - @@ -303,38 +595,33 @@ NodeResourcesFitArgs holds arguments used to configure the NodeResourcesFit plug - - +

IgnoredResources is the list of resources that NodeResources fit filter +should ignore. This doesn't apply to scoring.

+ - - +

IgnoredResourceGroups defines the list of resource groups that NodeResources fit filter should ignore. +e.g. if group is ["example.com"], it will ignore all resource names that begin +with "example.com", such as "example.com/aaa" and "example.com/bbb". +A resource group name can't contain '/'. This doesn't apply to scoring.

+ - - +

ScoringStrategy selects the node resource scoring strategy. +The default strategy is LeastAllocated with an equal "cpu" and "memory" weight.

+ - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta2
kind
string		NodeResourcesFitArgs
ignoredResources [Required]
[]string 		- IgnoredResources is the list of resources that NodeResources fit filter -should ignore. This doesn't apply to scoring.
ignoredResourceGroups [Required]
[]string 		- IgnoredResourceGroups defines the list of resource groups that NodeResources fit filter should ignore. -e.g. if group is ["example.com"], it will ignore all resource names that begin -with "example.com", such as "example.com/aaa" and "example.com/bbb". -A resource group name can't contain '/'. This doesn't apply to scoring.
scoringStrategy [Required]
ScoringStrategy 		- ScoringStrategy selects the node resource scoring strategy. -The default strategy is LeastAllocated with an equal "cpu" and "memory" weight.
@@ -342,10 +629,9 @@ The default strategy is LeastAllocated with an equal "cpu" and "memory" weight.< +

PodTopologySpreadArgs holds arguments used to configure the PodTopologySpread plugin.

-PodTopologySpreadArgs holds arguments used to configure the PodTopologySpread plugin. - @@ -353,38 +639,34 @@ PodTopologySpreadArgs holds arguments used to configure the PodTopologySpread pl - - +When not empty, .defaultingType must be "List".

+ - - +

DefaultingType determines how .defaultConstraints are deduced. Can be one +of "System" or "List".

+
    +
  • "System": Use kubernetes defined constraints that spread Pods among +Nodes and Zones.
    • +
  • "List": Use constraints defined in .defaultConstraints.
    • +
+

Defaults to "List" if feature gate DefaultPodTopologySpread is disabled +and to "System" if enabled.

+ - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta2
kind
string		PodTopologySpreadArgs
defaultConstraints
[]core/v1.TopologySpreadConstraint 		- DefaultConstraints defines topology spread constraints to be applied to -Pods that don't define any in `pod.spec.topologySpreadConstraints`. -`.defaultConstraints[∗].labelSelectors` must be empty, as they are +

DefaultConstraints defines topology spread constraints to be applied to +Pods that don't define any in pod.spec.topologySpreadConstraints. +.defaultConstraints[*].labelSelectors must be empty, as they are deduced from the Pod's membership to Services, ReplicationControllers, ReplicaSets or StatefulSets. -When not empty, .defaultingType must be "List".
defaultingType
PodTopologySpreadConstraintsDefaulting 		- DefaultingType determines how .defaultConstraints are deduced. Can be one -of "System" or "List". - -- "System": Use kubernetes defined constraints that spread Pods among - Nodes and Zones. -- "List": Use constraints defined in .defaultConstraints. - -Defaults to "List" if feature gate DefaultPodTopologySpread is disabled -and to "System" if enabled.
@@ -392,10 +674,9 @@ and to "System" if enabled. +

VolumeBindingArgs holds arguments used to configure the VolumeBinding plugin.

-VolumeBindingArgs holds arguments used to configure the VolumeBinding plugin. - @@ -403,587 +684,536 @@ VolumeBindingArgs holds arguments used to configure the VolumeBinding plugin. - - +If this value is nil, the default value (600) will be used.

+ - - +The default shape points are:

+
    +
  1. 0 for 0 utilization
    2. +
  2. 10 for 100 utilization +All points must be sorted in increasing order by utilization.
    3. +
+ - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta2
kind
string		VolumeBindingArgs
bindTimeoutSeconds [Required]
int64 		- BindTimeoutSeconds is the timeout in seconds in volume binding operation. +

BindTimeoutSeconds is the timeout in seconds in volume binding operation. Value must be non-negative integer. The value zero indicates no waiting. -If this value is nil, the default value (600) will be used.
shape
[]UtilizationShapePoint 		- Shape specifies the points defining the score function shape, which is +

Shape specifies the points defining the score function shape, which is used to score nodes based on the utilization of statically provisioned PVs. The utilization is calculated by dividing the total requested storage of the pod by the total capacity of feasible PVs on each node. Each point contains utilization (ranges from 0 to 100) and its associated score (ranges from 0 to 10). You can turn the priority by specifying different scores for different utilization numbers. -The default shape points are: -1) 0 for 0 utilization -2) 10 for 100 utilization -All points must be sorted in increasing order by utilization.
## `Extender` {#kubescheduler-config-k8s-io-v1beta2-Extender} - - **Appears in:** + - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) -Extender holds the parameters used to communicate with the extender. If a verb is unspecified/empty, -it is assumed that the extender chose not to provide that extension. +

Extender holds the parameters used to communicate with the extender. If a verb is unspecified/empty, +it is assumed that the extender chose not to provide that extension.

+ - +

URLPrefix at which the extender is available

+ - - +

Verb for the filter call, empty if not supported. This verb is appended to the URLPrefix when issuing the filter call to extender.

+ - - +

Verb for the preempt call, empty if not supported. This verb is appended to the URLPrefix when issuing the preempt call to extender.

+ - - +

Verb for the prioritize call, empty if not supported. This verb is appended to the URLPrefix when issuing the prioritize call to extender.

+ - - +

The numeric multiplier for the node scores that the prioritize call generates. +The weight should be a positive integer

+ - - +can implement this function.

+ - - +

EnableHTTPS specifies whether https should be used to communicate with the extender

+ - - +

TLSConfig specifies the transport layer security config

+ - - +

HTTPTimeout specifies the timeout duration for a call to the extender. Filter timeout fails the scheduling of the pod. Prioritize +timeout is ignored, k8s/other extenders priorities are used to select the node.

+ - - +assuming that the extender already cached full details of all nodes in the cluster

+ - - +

ManagedResources is a list of extended resources that are managed by +this extender.

+
    +
  • A pod will be sent to the extender on the Filter, Prioritize and Bind +(if the extender is the binder) phases iff the pod requests at least +one of the extended resources in this list. If empty or unspecified, +all pods will be sent to this extender.
    • +
  • If IgnoredByScheduler is set to true for a resource, kube-scheduler +will skip checking the resource in predicates.
    • +
+ - - +

Ignorable specifies if the extender is ignorable, i.e. scheduling should not +fail when the extender returns an error or is not reachable.

+ - -
FieldDescription
urlPrefix [Required]
string 		- URLPrefix at which the extender is available
filterVerb [Required]
string 		- Verb for the filter call, empty if not supported. This verb is appended to the URLPrefix when issuing the filter call to extender.
preemptVerb [Required]
string 		- Verb for the preempt call, empty if not supported. This verb is appended to the URLPrefix when issuing the preempt call to extender.
prioritizeVerb [Required]
string 		- Verb for the prioritize call, empty if not supported. This verb is appended to the URLPrefix when issuing the prioritize call to extender.
weight [Required]
int64 		- The numeric multiplier for the node scores that the prioritize call generates. -The weight should be a positive integer
bindVerb [Required]
string 		- Verb for the bind call, empty if not supported. This verb is appended to the URLPrefix when issuing the bind call to extender. +

Verb for the bind call, empty if not supported. This verb is appended to the URLPrefix when issuing the bind call to extender. If this method is implemented by the extender, it is the extender's responsibility to bind the pod to apiserver. Only one extender -can implement this function.
enableHTTPS [Required]
bool 		- EnableHTTPS specifies whether https should be used to communicate with the extender
tlsConfig [Required]
ExtenderTLSConfig 		- TLSConfig specifies the transport layer security config
httpTimeout [Required]
-meta/v1.Duration +meta/v1.Duration 		- HTTPTimeout specifies the timeout duration for a call to the extender. Filter timeout fails the scheduling of the pod. Prioritize -timeout is ignored, k8s/other extenders priorities are used to select the node.
nodeCacheCapable [Required]
bool 		- NodeCacheCapable specifies that the extender is capable of caching node information, +

NodeCacheCapable specifies that the extender is capable of caching node information, so the scheduler should only send minimal information about the eligible nodes -assuming that the extender already cached full details of all nodes in the cluster
managedResources
[]ExtenderManagedResource 		- ManagedResources is a list of extended resources that are managed by -this extender. -- A pod will be sent to the extender on the Filter, Prioritize and Bind - (if the extender is the binder) phases iff the pod requests at least - one of the extended resources in this list. If empty or unspecified, - all pods will be sent to this extender. -- If IgnoredByScheduler is set to true for a resource, kube-scheduler - will skip checking the resource in predicates.
ignorable [Required]
bool 		- Ignorable specifies if the extender is ignorable, i.e. scheduling should not -fail when the extender returns an error or is not reachable.
## `ExtenderManagedResource` {#kubescheduler-config-k8s-io-v1beta2-ExtenderManagedResource} - - **Appears in:** + - [Extender](#kubescheduler-config-k8s-io-v1beta2-Extender) -ExtenderManagedResource describes the arguments of extended resources -managed by an extender. +

ExtenderManagedResource describes the arguments of extended resources +managed by an extender.

+ - +

Name is the extended resource name.

+ - - +

IgnoredByScheduler indicates whether kube-scheduler should ignore this +resource when applying predicates.

+ - -
FieldDescription
name [Required]
string 		- Name is the extended resource name.
ignoredByScheduler [Required]
bool 		- IgnoredByScheduler indicates whether kube-scheduler should ignore this -resource when applying predicates.
## `ExtenderTLSConfig` {#kubescheduler-config-k8s-io-v1beta2-ExtenderTLSConfig} - - **Appears in:** + - [Extender](#kubescheduler-config-k8s-io-v1beta2-Extender) -ExtenderTLSConfig contains settings to enable TLS with extender +

ExtenderTLSConfig contains settings to enable TLS with extender

+ - +

Server should be accessed without verifying the TLS certificate. For testing only.

+ - - +server is used.

+ - - +

Server requires TLS client certificate authentication

+ - - +

Server requires TLS client certificate authentication

+ - - +

Trusted root certificates for server

+ - - +

CertData holds PEM-encoded bytes (typically read from a client certificate file). +CertData takes precedence over CertFile

+ - - +

KeyData holds PEM-encoded bytes (typically read from a client certificate key file). +KeyData takes precedence over KeyFile

+ - - +

CAData holds PEM-encoded bytes (typically read from a root certificates bundle). +CAData takes precedence over CAFile

+ - -
FieldDescription
insecure [Required]
bool 		- Server should be accessed without verifying the TLS certificate. For testing only.
serverName [Required]
string 		- ServerName is passed to the server for SNI and is used in the client to check server +

ServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname used to contact the -server is used.
certFile [Required]
string 		- Server requires TLS client certificate authentication
keyFile [Required]
string 		- Server requires TLS client certificate authentication
caFile [Required]
string 		- Trusted root certificates for server
certData [Required]
[]byte 		- CertData holds PEM-encoded bytes (typically read from a client certificate file). -CertData takes precedence over CertFile
keyData [Required]
[]byte 		- KeyData holds PEM-encoded bytes (typically read from a client certificate key file). -KeyData takes precedence over KeyFile
caData [Required]
[]byte 		- CAData holds PEM-encoded bytes (typically read from a root certificates bundle). -CAData takes precedence over CAFile
## `KubeSchedulerProfile` {#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerProfile} - - **Appears in:** + - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) -KubeSchedulerProfile is a scheduling profile. +

KubeSchedulerProfile is a scheduling profile.

+ - +

SchedulerName is the name of the scheduler associated to this profile. +If SchedulerName matches with the pod's "spec.schedulerName", then the pod +is scheduled with this profile.

+ - - +PluginConfig must be specified for all profiles.

+ - - +for that plugin.

+ - -
FieldDescription
schedulerName [Required]
string 		- SchedulerName is the name of the scheduler associated to this profile. -If SchedulerName matches with the pod's "spec.schedulerName", then the pod -is scheduled with this profile.
plugins [Required]
Plugins 		- Plugins specify the set of plugins that should be enabled or disabled. +

Plugins specify the set of plugins that should be enabled or disabled. Enabled plugins are the ones that should be enabled in addition to the default plugins. Disabled plugins are any of the default plugins that should be disabled. When no enabled or disabled plugin is specified for an extension point, default plugins for that extension point will be used if there is any. If a QueueSort plugin is specified, the same QueueSort Plugin and -PluginConfig must be specified for all profiles.
pluginConfig [Required]
[]PluginConfig 		- PluginConfig is an optional set of custom plugin arguments for each plugin. +

PluginConfig is an optional set of custom plugin arguments for each plugin. Omitting config args for a plugin is equivalent to using the default config -for that plugin.
## `Plugin` {#kubescheduler-config-k8s-io-v1beta2-Plugin} - - **Appears in:** + - [PluginSet](#kubescheduler-config-k8s-io-v1beta2-PluginSet) -Plugin specifies a plugin name and its weight when applicable. Weight is used only for Score plugins. +

Plugin specifies a plugin name and its weight when applicable. Weight is used only for Score plugins.

+ - +

Name defines the name of plugin

+ - - +

Weight defines the weight of plugin, only used for Score plugins.

+ - -
FieldDescription
name [Required]
string 		- Name defines the name of plugin
weight [Required]
int32 		- Weight defines the weight of plugin, only used for Score plugins.
## `PluginConfig` {#kubescheduler-config-k8s-io-v1beta2-PluginConfig} - - **Appears in:** + - [KubeSchedulerProfile](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerProfile) -PluginConfig specifies arguments that should be passed to a plugin at the time of initialization. +

PluginConfig specifies arguments that should be passed to a plugin at the time of initialization. A plugin that is invoked at multiple extension points is initialized once. Args can have arbitrary structure. -It is up to the plugin to process these Args. +It is up to the plugin to process these Args.

+ - +

Name defines the name of plugin being configured

+ - - +

Args defines the arguments passed to the plugins at the time of initialization. Args can have arbitrary structure.

+ - -
FieldDescription
name [Required]
string 		- Name defines the name of plugin being configured
args [Required]
-k8s.io/apimachinery/pkg/runtime.RawExtension +k8s.io/apimachinery/pkg/runtime.RawExtension 		- Args defines the arguments passed to the plugins at the time of initialization. Args can have arbitrary structure.
## `PluginSet` {#kubescheduler-config-k8s-io-v1beta2-PluginSet} - - **Appears in:** + - [Plugins](#kubescheduler-config-k8s-io-v1beta2-Plugins) -PluginSet specifies enabled and disabled plugins for an extension point. -If an array is empty, missing, or nil, default plugins at that extension point will be used. +

PluginSet specifies enabled and disabled plugins for an extension point. +If an array is empty, missing, or nil, default plugins at that extension point will be used.

+ - +These are called after default plugins and in the same order specified here.

+ - - +

Disabled specifies default plugins that should be disabled. +When all default plugins need to be disabled, an array containing only one "*" should be provided.

+ - -
FieldDescription
enabled [Required]
[]Plugin 		- Enabled specifies plugins that should be enabled in addition to default plugins. +

Enabled specifies plugins that should be enabled in addition to default plugins. If the default plugin is also configured in the scheduler config file, the weight of plugin will be overridden accordingly. -These are called after default plugins and in the same order specified here.
disabled [Required]
[]Plugin 		- Disabled specifies default plugins that should be disabled. -When all default plugins need to be disabled, an array containing only one "∗" should be provided.
## `Plugins` {#kubescheduler-config-k8s-io-v1beta2-Plugins} - - **Appears in:** + - [KubeSchedulerProfile](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerProfile) -Plugins include multiple extension points. When specified, the list of plugins for +

Plugins include multiple extension points. When specified, the list of plugins for a particular extension point are the only ones enabled. If an extension point is omitted from the config, then the default set of plugins is used for that extension point. Enabled plugins are called in the order specified here, after default plugins. If they need to -be invoked before default plugins, default plugins must be disabled and re-enabled here in desired order. +be invoked before default plugins, default plugins must be disabled and re-enabled here in desired order.

+ - +

QueueSort is a list of plugins that should be invoked when sorting pods in the scheduling queue.

+ - - +

PreFilter is a list of plugins that should be invoked at "PreFilter" extension point of the scheduling framework.

+ - - +

Filter is a list of plugins that should be invoked when filtering out nodes that cannot run the Pod.

+ - - +

PostFilter is a list of plugins that are invoked after filtering phase, but only when no feasible nodes were found for the pod.

+ - - +

PreScore is a list of plugins that are invoked before scoring.

+ - - +

Score is a list of plugins that should be invoked when ranking nodes that have passed the filtering phase.

+ - - +

Reserve is a list of plugins invoked when reserving/unreserving resources +after a node is assigned to run the pod.

+ - - +

Permit is a list of plugins that control binding of a Pod. These plugins can prevent or delay binding of a Pod.

+ - - +

PreBind is a list of plugins that should be invoked before a pod is bound.

+ - - +

Bind is a list of plugins that should be invoked at "Bind" extension point of the scheduling framework. +The scheduler call these plugins in order. Scheduler skips the rest of these plugins as soon as one returns success.

+ - - +

PostBind is a list of plugins that should be invoked after a pod is successfully bound.

+ - - +

MultiPoint is a simplified config section to enable plugins for all valid extension points.

+ - -
FieldDescription
queueSort [Required]
PluginSet 		- QueueSort is a list of plugins that should be invoked when sorting pods in the scheduling queue.
preFilter [Required]
PluginSet 		- PreFilter is a list of plugins that should be invoked at "PreFilter" extension point of the scheduling framework.
filter [Required]
PluginSet 		- Filter is a list of plugins that should be invoked when filtering out nodes that cannot run the Pod.
postFilter [Required]
PluginSet 		- PostFilter is a list of plugins that are invoked after filtering phase, but only when no feasible nodes were found for the pod.
preScore [Required]
PluginSet 		- PreScore is a list of plugins that are invoked before scoring.
score [Required]
PluginSet 		- Score is a list of plugins that should be invoked when ranking nodes that have passed the filtering phase.
reserve [Required]
PluginSet 		- Reserve is a list of plugins invoked when reserving/unreserving resources -after a node is assigned to run the pod.
permit [Required]
PluginSet 		- Permit is a list of plugins that control binding of a Pod. These plugins can prevent or delay binding of a Pod.
preBind [Required]
PluginSet 		- PreBind is a list of plugins that should be invoked before a pod is bound.
bind [Required]
PluginSet 		- Bind is a list of plugins that should be invoked at "Bind" extension point of the scheduling framework. -The scheduler call these plugins in order. Scheduler skips the rest of these plugins as soon as one returns success.
postBind [Required]
PluginSet 		- PostBind is a list of plugins that should be invoked after a pod is successfully bound.
multiPoint [Required]
PluginSet 		- MultiPoint is a simplified config section to enable plugins for all valid extension points.
@@ -991,125 +1221,118 @@ The scheduler call these plugins in order. Scheduler skips the rest of these plu (Alias of `string`) - **Appears in:** + - [PodTopologySpreadArgs](#kubescheduler-config-k8s-io-v1beta2-PodTopologySpreadArgs) -PodTopologySpreadConstraintsDefaulting defines how to set default constraints -for the PodTopologySpread plugin. +

PodTopologySpreadConstraintsDefaulting defines how to set default constraints +for the PodTopologySpread plugin.

+ ## `RequestedToCapacityRatioParam` {#kubescheduler-config-k8s-io-v1beta2-RequestedToCapacityRatioParam} - - **Appears in:** + - [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta2-ScoringStrategy) -RequestedToCapacityRatioParam define RequestedToCapacityRatio parameters +

RequestedToCapacityRatioParam define RequestedToCapacityRatio parameters

+ - +

Shape is a list of points defining the scoring function shape.

+ - -
FieldDescription
shape [Required]
[]UtilizationShapePoint 		- Shape is a list of points defining the scoring function shape.
## `ResourceSpec` {#kubescheduler-config-k8s-io-v1beta2-ResourceSpec} - - **Appears in:** + - [NodeResourcesBalancedAllocationArgs](#kubescheduler-config-k8s-io-v1beta2-NodeResourcesBalancedAllocationArgs) + - [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta2-ScoringStrategy) -ResourceSpec represents a single resource. +

ResourceSpec represents a single resource.

+ - +

Name of the resource.

+ - - +

Weight of the resource.

+ - -
FieldDescription
name [Required]
string 		- Name of the resource.
weight [Required]
int64 		- Weight of the resource.
## `ScoringStrategy` {#kubescheduler-config-k8s-io-v1beta2-ScoringStrategy} - - **Appears in:** + - [NodeResourcesFitArgs](#kubescheduler-config-k8s-io-v1beta2-NodeResourcesFitArgs) -ScoringStrategy define ScoringStrategyType for node resource plugin +

ScoringStrategy define ScoringStrategyType for node resource plugin

+ - +

Type selects which strategy to run.

+ - - +Weight defaults to 1 if not specified or explicitly set to 0.

+ - - +

Arguments specific to RequestedToCapacityRatio strategy.

+ - -
FieldDescription
type [Required]
ScoringStrategyType 		- Type selects which strategy to run.
resources [Required]
[]ResourceSpec 		- Resources to consider when scoring. -The default resource set includes "cpu" and "memory" with an equal weight. +

Resources to consider when scoring. +The default resource set includes "cpu" and "memory" with an equal weight. Allowed weights go from 1 to 100. -Weight defaults to 1 if not specified or explicitly set to 0.
requestedToCapacityRatio [Required]
RequestedToCapacityRatioParam 		- Arguments specific to RequestedToCapacityRatio strategy.
@@ -1117,401 +1340,48 @@ Weight defaults to 1 if not specified or explicitly set to 0. (Alias of `string`) - **Appears in:** + - [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta2-ScoringStrategy) -ScoringStrategyType the type of scoring strategy used in NodeResourcesFit plugin. +

ScoringStrategyType the type of scoring strategy used in NodeResourcesFit plugin.

+ ## `UtilizationShapePoint` {#kubescheduler-config-k8s-io-v1beta2-UtilizationShapePoint} - - **Appears in:** + - [VolumeBindingArgs](#kubescheduler-config-k8s-io-v1beta2-VolumeBindingArgs) + - [RequestedToCapacityRatioParam](#kubescheduler-config-k8s-io-v1beta2-RequestedToCapacityRatioParam) -UtilizationShapePoint represents single point of priority function shape. +

UtilizationShapePoint represents single point of priority function shape.

+ - +

Utilization (x axis). Valid values are 0 to 100. Fully utilized node maps to 100.

+ - - +

Score assigned to given utilization (y axis). Valid values are 0 to 10.

+ - -
FieldDescription
utilization [Required]
int32 		- Utilization (x axis). Valid values are 0 to 100. Fully utilized node maps to 100.
score [Required]
int32 		- Score assigned to given utilization (y axis). Valid values are 0 to 10.
- - - -## `ClientConnectionConfiguration` {#ClientConnectionConfiguration} - - - - -**Appears in:** -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - - -ClientConnectionConfiguration contains details for constructing a client. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
kubeconfig [Required]
-string -		 - kubeconfig is the path to a KubeConfig file.
acceptContentTypes [Required]
-string -		 - acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the -default value of 'application/json'. This field will control all connections to the server used by a particular -client.
contentType [Required]
-string -		 - contentType is the content type used when sending data to the server from this client.
qps [Required]
-float32 -		 - qps controls the number of queries per second allowed for this connection.
burst [Required]
-int32 -		 - burst allows extra queries to accumulate when a client is exceeding its rate.
- -## `DebuggingConfiguration` {#DebuggingConfiguration} - - - - -**Appears in:** -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - - -DebuggingConfiguration holds configuration for Debugging related features. - - - - - - - - - - - - - - - - - - -
FieldDescription
enableProfiling [Required]
-bool -		 - enableProfiling enables profiling via web interface host:port/debug/pprof/
enableContentionProfiling [Required]
-bool -		 - enableContentionProfiling enables lock contention profiling, if -enableProfiling is true.
- -## `FormatOptions` {#FormatOptions} - - - - -**Appears in:** -- [LoggingConfiguration](#LoggingConfiguration) - - -FormatOptions contains options for the different logging formats. - - - - - - - - - - - - - -
FieldDescription
json [Required]
-JSONOptions -		 - [Experimental] JSON contains options for logging format "json".
- -## `JSONOptions` {#JSONOptions} - - - - -**Appears in:** -- [FormatOptions](#FormatOptions) - - -JSONOptions contains options for logging format "json". - - - - - - - - - - - - - - - - - - -
FieldDescription
splitStream [Required]
-bool -		 - [Experimental] SplitStream redirects error messages to stderr while -info messages go to stdout, with buffering. The default is to write -both to stdout, without buffering.
infoBufferSize [Required]
-k8s.io/apimachinery/pkg/api/resource.QuantityValue -		 - [Experimental] InfoBufferSize sets the size of the info stream when -using split streams. The default is zero, which disables buffering.
- -## `LeaderElectionConfiguration` {#LeaderElectionConfiguration} - - - - -**Appears in:** -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - - -LeaderElectionConfiguration defines the configuration of leader election -clients for components that can run with leader election enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
leaderElect [Required]
-bool -		 - leaderElect enables a leader election client to gain leadership -before executing the main loop. Enable this when running replicated -components for high availability.
leaseDuration [Required]
-meta/v1.Duration -		 - leaseDuration is the duration that non-leader candidates will wait -after observing a leadership renewal until attempting to acquire -leadership of a led but unrenewed leader slot. This is effectively the -maximum duration that a leader can be stopped before it is replaced -by another candidate. This is only applicable if leader election is -enabled.
renewDeadline [Required]
-meta/v1.Duration -		 - renewDeadline is the interval between attempts by the acting master to -renew a leadership slot before it stops leading. This must be less -than or equal to the lease duration. This is only applicable if leader -election is enabled.
retryPeriod [Required]
-meta/v1.Duration -		 - retryPeriod is the duration the clients should wait between attempting -acquisition and renewal of a leadership. This is only applicable if -leader election is enabled.
resourceLock [Required]
-string -		 - resourceLock indicates the resource object type that will be used to lock -during leader election cycles.
resourceName [Required]
-string -		 - resourceName indicates the name of resource object that will be used to lock -during leader election cycles.
resourceNamespace [Required]
-string -		 - resourceName indicates the namespace of resource object that will be used to lock -during leader election cycles.
- -## `LoggingConfiguration` {#LoggingConfiguration} - - - - -**Appears in:** -- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) - - -LoggingConfiguration contains logging options -Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
format [Required]
-string -		 - Format Flag specifies the structure of log messages. -default value of format is `text`
flushFrequency [Required]
-time.Duration -		 - Maximum number of seconds between log flushes. Ignored if the -selected logging backend writes log messages without buffering.
verbosity [Required]
-uint32 -		 - Verbosity is the threshold that determines which log messages are -logged. Default is zero which logs only the most important -messages. Higher values enable additional messages. Error messages -are always logged.
vmodule [Required]
-VModuleConfiguration -		 - VModule overrides the verbosity threshold for individual files. -Only supported for "text" log format.
sanitization [Required]
-bool -		 - [Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). -Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)
options [Required]
-FormatOptions -		 - [Experimental] Options holds additional parameters that are specific -to the different logging formats. Only the options for the selected -format get used, but all of them get validated.
- -## `VModuleConfiguration` {#VModuleConfiguration} - -(Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`) - - -**Appears in:** -- [LoggingConfiguration](#LoggingConfiguration) - - -VModuleConfiguration is a collection of individual file names or patterns -and the corresponding verbosity threshold. - - diff --git a/content/en/docs/reference/config-api/kube-scheduler-config.v1beta3.md b/content/en/docs/reference/config-api/kube-scheduler-config.v1beta3.md index 55ae376feb..6c8635415e 100644 --- a/content/en/docs/reference/config-api/kube-scheduler-config.v1beta3.md +++ b/content/en/docs/reference/config-api/kube-scheduler-config.v1beta3.md @@ -24,11 +24,10 @@ auto_generated: true +

DefaultPreemptionArgs holds arguments used to configure the +DefaultPreemption plugin.

-DefaultPreemptionArgs holds arguments used to configure the -DefaultPreemption plugin. - @@ -36,34 +35,30 @@ DefaultPreemption plugin. - - +unspecified.

+ - - +0 nodes. Defaults to 100 nodes if unspecified.

+ - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta3
kind
string		DefaultPreemptionArgs
minCandidateNodesPercentage [Required]
int32 		- MinCandidateNodesPercentage is the minimum number of candidates to +

MinCandidateNodesPercentage is the minimum number of candidates to shortlist when dry running preemption as a percentage of number of nodes. Must be in the range [0, 100]. Defaults to 10% of the cluster size if -unspecified.
minCandidateNodesAbsolute [Required]
int32 		- MinCandidateNodesAbsolute is the absolute minimum number of candidates to +

MinCandidateNodesAbsolute is the absolute minimum number of candidates to shortlist. The likely number of candidates enumerated for dry running preemption is given by the formula: -numCandidates = max(numNodes ∗ minCandidateNodesPercentage, minCandidateNodesAbsolute) -We say "likely" because there are other factors such as PDB violations +numCandidates = max(numNodes * minCandidateNodesPercentage, minCandidateNodesAbsolute) +We say "likely" because there are other factors such as PDB violations that play a role in the number of candidates shortlisted. Must be at least -0 nodes. Defaults to 100 nodes if unspecified.
@@ -71,10 +66,9 @@ that play a role in the number of candidates shortlisted. Must be at least +

InterPodAffinityArgs holds arguments used to configure the InterPodAffinity plugin.

-InterPodAffinityArgs holds arguments used to configure the InterPodAffinity plugin. - @@ -82,18 +76,15 @@ InterPodAffinityArgs holds arguments used to configure the InterPodAffinity plug - - +

HardPodAffinityWeight is the scoring weight for existing pods with a +matching hard affinity to the incoming pod.

+ - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta3
kind
string		InterPodAffinityArgs
hardPodAffinityWeight [Required]
int32 		- HardPodAffinityWeight is the scoring weight for existing pods with a -matching hard affinity to the incoming pod.
@@ -101,10 +92,9 @@ matching hard affinity to the incoming pod. +

KubeSchedulerConfiguration configures a scheduler

-KubeSchedulerConfiguration configures a scheduler - @@ -112,98 +102,87 @@ KubeSchedulerConfiguration configures a scheduler - - +

Parallelism defines the amount of parallelism in algorithms for scheduling a Pods. Must be greater than 0. Defaults to 16

+ - - +

LeaderElection defines the configuration of leader election client.

+ - - +

ClientConnection specifies the kubeconfig file and client connection +settings for the proxy server to use when communicating with the apiserver.

+ - - +

DebuggingConfiguration holds configuration for Debugging related features +TODO: We might wanna make this a substruct like Debugging componentbaseconfigv1alpha1.DebuggingConfiguration

+ - - +nodes will be scored.

+ - - +will be used.

+ - - +the default value (10s) will be used.

+ - - +with the "default-scheduler" profile, if present here.

+ - - +

Extenders are the list of scheduler extenders, each holding the values of how to communicate +with the extender. These extenders are shared by all scheduler profiles.

+ - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta3
kind
string		KubeSchedulerConfiguration
parallelism [Required]
int32 		- Parallelism defines the amount of parallelism in algorithms for scheduling a Pods. Must be greater than 0. Defaults to 16
leaderElection [Required]
LeaderElectionConfiguration 		- LeaderElection defines the configuration of leader election client.
clientConnection [Required]
ClientConnectionConfiguration 		- ClientConnection specifies the kubeconfig file and client connection -settings for the proxy server to use when communicating with the apiserver.
DebuggingConfiguration [Required]
DebuggingConfiguration 		(Members of DebuggingConfiguration are embedded into this type.) - DebuggingConfiguration holds configuration for Debugging related features -TODO: We might wanna make this a substruct like Debugging componentbaseconfigv1alpha1.DebuggingConfiguration
percentageOfNodesToScore [Required]
int32 		- PercentageOfNodesToScore is the percentage of all nodes that once found feasible +

PercentageOfNodesToScore is the percentage of all nodes that once found feasible for running a pod, the scheduler stops its search for more feasible nodes in the cluster. This helps improve scheduler's performance. Scheduler always tries to find -at least "minFeasibleNodesToFind" feasible nodes no matter what the value of this flag is. +at least "minFeasibleNodesToFind" feasible nodes no matter what the value of this flag is. Example: if the cluster size is 500 nodes and the value of this flag is 30, then scheduler stops finding further feasible nodes once it finds 150 feasible ones. When the value is 0, default percentage (5%--50% based on the size of the cluster) of the -nodes will be scored.
podInitialBackoffSeconds [Required]
int64 		- PodInitialBackoffSeconds is the initial backoff for unschedulable pods. +

PodInitialBackoffSeconds is the initial backoff for unschedulable pods. If specified, it must be greater than 0. If this value is null, the default value (1s) -will be used.
podMaxBackoffSeconds [Required]
int64 		- PodMaxBackoffSeconds is the max backoff for unschedulable pods. +

PodMaxBackoffSeconds is the max backoff for unschedulable pods. If specified, it must be greater than podInitialBackoffSeconds. If this value is null, -the default value (10s) will be used.
profiles [Required]
[]KubeSchedulerProfile 		- Profiles are scheduling profiles that kube-scheduler supports. Pods can +

Profiles are scheduling profiles that kube-scheduler supports. Pods can choose to be scheduled under a particular profile by setting its associated scheduler name. Pods that don't specify any scheduler name are scheduled -with the "default-scheduler" profile, if present here.
extenders [Required]
[]Extender 		- Extenders are the list of scheduler extenders, each holding the values of how to communicate -with the extender. These extenders are shared by all scheduler profiles.
@@ -211,10 +190,9 @@ with the extender. These extenders are shared by all scheduler profiles. +

NodeAffinityArgs holds arguments to configure the NodeAffinity plugin.

-NodeAffinityArgs holds arguments to configure the NodeAffinity plugin. - @@ -222,22 +200,19 @@ NodeAffinityArgs holds arguments to configure the NodeAffinity plugin. - - +a specific Node (such as Daemonset Pods) might remain unschedulable.

+ - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta3
kind
string		NodeAffinityArgs
addedAffinity
core/v1.NodeAffinity 		- AddedAffinity is applied to all Pods additionally to the NodeAffinity +

AddedAffinity is applied to all Pods additionally to the NodeAffinity specified in the PodSpec. That is, Nodes need to satisfy AddedAffinity AND .spec.NodeAffinity. AddedAffinity is empty by default (all Nodes match). When AddedAffinity is used, some Pods with affinity requirements that match -a specific Node (such as Daemonset Pods) might remain unschedulable.
@@ -245,10 +220,9 @@ a specific Node (such as Daemonset Pods) might remain unschedulable. +

NodeResourcesBalancedAllocationArgs holds arguments used to configure NodeResourcesBalancedAllocation plugin.

-NodeResourcesBalancedAllocationArgs holds arguments used to configure NodeResourcesBalancedAllocation plugin. - @@ -256,17 +230,14 @@ NodeResourcesBalancedAllocationArgs holds arguments used to configure NodeResour - - +

Resources to be managed, the default is "cpu" and "memory" if not specified.

+ - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta3
kind
string		NodeResourcesBalancedAllocationArgs
resources [Required]
[]ResourceSpec 		- Resources to be managed, the default is "cpu" and "memory" if not specified.
@@ -274,10 +245,9 @@ NodeResourcesBalancedAllocationArgs holds arguments used to configure NodeResour +

NodeResourcesFitArgs holds arguments used to configure the NodeResourcesFit plugin.

-NodeResourcesFitArgs holds arguments used to configure the NodeResourcesFit plugin. - @@ -285,38 +255,33 @@ NodeResourcesFitArgs holds arguments used to configure the NodeResourcesFit plug - - +

IgnoredResources is the list of resources that NodeResources fit filter +should ignore. This doesn't apply to scoring.

+ - - +

IgnoredResourceGroups defines the list of resource groups that NodeResources fit filter should ignore. +e.g. if group is ["example.com"], it will ignore all resource names that begin +with "example.com", such as "example.com/aaa" and "example.com/bbb". +A resource group name can't contain '/'. This doesn't apply to scoring.

+ - - +

ScoringStrategy selects the node resource scoring strategy. +The default strategy is LeastAllocated with an equal "cpu" and "memory" weight.

+ - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta3
kind
string		NodeResourcesFitArgs
ignoredResources [Required]
[]string 		- IgnoredResources is the list of resources that NodeResources fit filter -should ignore. This doesn't apply to scoring.
ignoredResourceGroups [Required]
[]string 		- IgnoredResourceGroups defines the list of resource groups that NodeResources fit filter should ignore. -e.g. if group is ["example.com"], it will ignore all resource names that begin -with "example.com", such as "example.com/aaa" and "example.com/bbb". -A resource group name can't contain '/'. This doesn't apply to scoring.
scoringStrategy [Required]
ScoringStrategy 		- ScoringStrategy selects the node resource scoring strategy. -The default strategy is LeastAllocated with an equal "cpu" and "memory" weight.
@@ -324,10 +289,9 @@ The default strategy is LeastAllocated with an equal "cpu" and "memory" weight.< +

PodTopologySpreadArgs holds arguments used to configure the PodTopologySpread plugin.

-PodTopologySpreadArgs holds arguments used to configure the PodTopologySpread plugin. - @@ -335,38 +299,34 @@ PodTopologySpreadArgs holds arguments used to configure the PodTopologySpread pl - - +When not empty, .defaultingType must be "List".

+ - - +

DefaultingType determines how .defaultConstraints are deduced. Can be one +of "System" or "List".

+
    +
  • "System": Use kubernetes defined constraints that spread Pods among +Nodes and Zones.
    • +
  • "List": Use constraints defined in .defaultConstraints.
    • +
+

Defaults to "List" if feature gate DefaultPodTopologySpread is disabled +and to "System" if enabled.

+ - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta3
kind
string		PodTopologySpreadArgs
defaultConstraints
[]core/v1.TopologySpreadConstraint 		- DefaultConstraints defines topology spread constraints to be applied to -Pods that don't define any in `pod.spec.topologySpreadConstraints`. -`.defaultConstraints[∗].labelSelectors` must be empty, as they are +

DefaultConstraints defines topology spread constraints to be applied to +Pods that don't define any in pod.spec.topologySpreadConstraints. +.defaultConstraints[*].labelSelectors must be empty, as they are deduced from the Pod's membership to Services, ReplicationControllers, ReplicaSets or StatefulSets. -When not empty, .defaultingType must be "List".
defaultingType
PodTopologySpreadConstraintsDefaulting 		- DefaultingType determines how .defaultConstraints are deduced. Can be one -of "System" or "List". - -- "System": Use kubernetes defined constraints that spread Pods among - Nodes and Zones. -- "List": Use constraints defined in .defaultConstraints. - -Defaults to "List" if feature gate DefaultPodTopologySpread is disabled -and to "System" if enabled.
@@ -374,10 +334,9 @@ and to "System" if enabled. +

VolumeBindingArgs holds arguments used to configure the VolumeBinding plugin.

-VolumeBindingArgs holds arguments used to configure the VolumeBinding plugin. - @@ -385,602 +344,552 @@ VolumeBindingArgs holds arguments used to configure the VolumeBinding plugin. - - +If this value is nil, the default value (600) will be used.

+ - - +The default shape points are:

+
    +
  1. 0 for 0 utilization
    2. +
  2. 10 for 100 utilization +All points must be sorted in increasing order by utilization.
    3. +
+ - -
FieldDescription
apiVersion
string		kubescheduler.config.k8s.io/v1beta3
kind
string		VolumeBindingArgs
bindTimeoutSeconds [Required]
int64 		- BindTimeoutSeconds is the timeout in seconds in volume binding operation. +

BindTimeoutSeconds is the timeout in seconds in volume binding operation. Value must be non-negative integer. The value zero indicates no waiting. -If this value is nil, the default value (600) will be used.
shape
[]UtilizationShapePoint 		- Shape specifies the points defining the score function shape, which is +

Shape specifies the points defining the score function shape, which is used to score nodes based on the utilization of statically provisioned PVs. The utilization is calculated by dividing the total requested storage of the pod by the total capacity of feasible PVs on each node. Each point contains utilization (ranges from 0 to 100) and its associated score (ranges from 0 to 10). You can turn the priority by specifying different scores for different utilization numbers. -The default shape points are: -1) 0 for 0 utilization -2) 10 for 100 utilization -All points must be sorted in increasing order by utilization.
## `Extender` {#kubescheduler-config-k8s-io-v1beta3-Extender} - - **Appears in:** + - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) -Extender holds the parameters used to communicate with the extender. If a verb is unspecified/empty, -it is assumed that the extender chose not to provide that extension. +

Extender holds the parameters used to communicate with the extender. If a verb is unspecified/empty, +it is assumed that the extender chose not to provide that extension.

+ - +

URLPrefix at which the extender is available

+ - - +

Verb for the filter call, empty if not supported. This verb is appended to the URLPrefix when issuing the filter call to extender.

+ - - +

Verb for the preempt call, empty if not supported. This verb is appended to the URLPrefix when issuing the preempt call to extender.

+ - - +

Verb for the prioritize call, empty if not supported. This verb is appended to the URLPrefix when issuing the prioritize call to extender.

+ - - +

The numeric multiplier for the node scores that the prioritize call generates. +The weight should be a positive integer

+ - - +can implement this function.

+ - - +

EnableHTTPS specifies whether https should be used to communicate with the extender

+ - - +

TLSConfig specifies the transport layer security config

+ - - +

HTTPTimeout specifies the timeout duration for a call to the extender. Filter timeout fails the scheduling of the pod. Prioritize +timeout is ignored, k8s/other extenders priorities are used to select the node.

+ - - +assuming that the extender already cached full details of all nodes in the cluster

+ - - +

ManagedResources is a list of extended resources that are managed by +this extender.

+
    +
  • A pod will be sent to the extender on the Filter, Prioritize and Bind +(if the extender is the binder) phases iff the pod requests at least +one of the extended resources in this list. If empty or unspecified, +all pods will be sent to this extender.
    • +
  • If IgnoredByScheduler is set to true for a resource, kube-scheduler +will skip checking the resource in predicates.
    • +
+ - - +

Ignorable specifies if the extender is ignorable, i.e. scheduling should not +fail when the extender returns an error or is not reachable.

+ - -
FieldDescription
urlPrefix [Required]
string 		- URLPrefix at which the extender is available
filterVerb [Required]
string 		- Verb for the filter call, empty if not supported. This verb is appended to the URLPrefix when issuing the filter call to extender.
preemptVerb [Required]
string 		- Verb for the preempt call, empty if not supported. This verb is appended to the URLPrefix when issuing the preempt call to extender.
prioritizeVerb [Required]
string 		- Verb for the prioritize call, empty if not supported. This verb is appended to the URLPrefix when issuing the prioritize call to extender.
weight [Required]
int64 		- The numeric multiplier for the node scores that the prioritize call generates. -The weight should be a positive integer
bindVerb [Required]
string 		- Verb for the bind call, empty if not supported. This verb is appended to the URLPrefix when issuing the bind call to extender. +

Verb for the bind call, empty if not supported. This verb is appended to the URLPrefix when issuing the bind call to extender. If this method is implemented by the extender, it is the extender's responsibility to bind the pod to apiserver. Only one extender -can implement this function.
enableHTTPS [Required]
bool 		- EnableHTTPS specifies whether https should be used to communicate with the extender
tlsConfig [Required]
ExtenderTLSConfig 		- TLSConfig specifies the transport layer security config
httpTimeout [Required]
-meta/v1.Duration +meta/v1.Duration 		- HTTPTimeout specifies the timeout duration for a call to the extender. Filter timeout fails the scheduling of the pod. Prioritize -timeout is ignored, k8s/other extenders priorities are used to select the node.
nodeCacheCapable [Required]
bool 		- NodeCacheCapable specifies that the extender is capable of caching node information, +

NodeCacheCapable specifies that the extender is capable of caching node information, so the scheduler should only send minimal information about the eligible nodes -assuming that the extender already cached full details of all nodes in the cluster
managedResources
[]ExtenderManagedResource 		- ManagedResources is a list of extended resources that are managed by -this extender. -- A pod will be sent to the extender on the Filter, Prioritize and Bind - (if the extender is the binder) phases iff the pod requests at least - one of the extended resources in this list. If empty or unspecified, - all pods will be sent to this extender. -- If IgnoredByScheduler is set to true for a resource, kube-scheduler - will skip checking the resource in predicates.
ignorable [Required]
bool 		- Ignorable specifies if the extender is ignorable, i.e. scheduling should not -fail when the extender returns an error or is not reachable.
## `ExtenderManagedResource` {#kubescheduler-config-k8s-io-v1beta3-ExtenderManagedResource} - - **Appears in:** + - [Extender](#kubescheduler-config-k8s-io-v1beta3-Extender) -ExtenderManagedResource describes the arguments of extended resources -managed by an extender. +

ExtenderManagedResource describes the arguments of extended resources +managed by an extender.

+ - +

Name is the extended resource name.

+ - - +

IgnoredByScheduler indicates whether kube-scheduler should ignore this +resource when applying predicates.

+ - -
FieldDescription
name [Required]
string 		- Name is the extended resource name.
ignoredByScheduler [Required]
bool 		- IgnoredByScheduler indicates whether kube-scheduler should ignore this -resource when applying predicates.
## `ExtenderTLSConfig` {#kubescheduler-config-k8s-io-v1beta3-ExtenderTLSConfig} - - **Appears in:** + - [Extender](#kubescheduler-config-k8s-io-v1beta3-Extender) -ExtenderTLSConfig contains settings to enable TLS with extender +

ExtenderTLSConfig contains settings to enable TLS with extender

+ - +

Server should be accessed without verifying the TLS certificate. For testing only.

+ - - +server is used.

+ - - +

Server requires TLS client certificate authentication

+ - - +

Server requires TLS client certificate authentication

+ - - +

Trusted root certificates for server

+ - - +

CertData holds PEM-encoded bytes (typically read from a client certificate file). +CertData takes precedence over CertFile

+ - - +

KeyData holds PEM-encoded bytes (typically read from a client certificate key file). +KeyData takes precedence over KeyFile

+ - - +

CAData holds PEM-encoded bytes (typically read from a root certificates bundle). +CAData takes precedence over CAFile

+ - -
FieldDescription
insecure [Required]
bool 		- Server should be accessed without verifying the TLS certificate. For testing only.
serverName [Required]
string 		- ServerName is passed to the server for SNI and is used in the client to check server +

ServerName is passed to the server for SNI and is used in the client to check server certificates against. If ServerName is empty, the hostname used to contact the -server is used.
certFile [Required]
string 		- Server requires TLS client certificate authentication
keyFile [Required]
string 		- Server requires TLS client certificate authentication
caFile [Required]
string 		- Trusted root certificates for server
certData [Required]
[]byte 		- CertData holds PEM-encoded bytes (typically read from a client certificate file). -CertData takes precedence over CertFile
keyData [Required]
[]byte 		- KeyData holds PEM-encoded bytes (typically read from a client certificate key file). -KeyData takes precedence over KeyFile
caData [Required]
[]byte 		- CAData holds PEM-encoded bytes (typically read from a root certificates bundle). -CAData takes precedence over CAFile
## `KubeSchedulerProfile` {#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerProfile} - - **Appears in:** + - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) -KubeSchedulerProfile is a scheduling profile. +

KubeSchedulerProfile is a scheduling profile.

+ - +

SchedulerName is the name of the scheduler associated to this profile. +If SchedulerName matches with the pod's "spec.schedulerName", then the pod +is scheduled with this profile.

+ - - +PluginConfig must be specified for all profiles.

+ - - +for that plugin.

+ - -
FieldDescription
schedulerName [Required]
string 		- SchedulerName is the name of the scheduler associated to this profile. -If SchedulerName matches with the pod's "spec.schedulerName", then the pod -is scheduled with this profile.
plugins [Required]
Plugins 		- Plugins specify the set of plugins that should be enabled or disabled. +

Plugins specify the set of plugins that should be enabled or disabled. Enabled plugins are the ones that should be enabled in addition to the default plugins. Disabled plugins are any of the default plugins that should be disabled. When no enabled or disabled plugin is specified for an extension point, default plugins for that extension point will be used if there is any. If a QueueSort plugin is specified, the same QueueSort Plugin and -PluginConfig must be specified for all profiles.
pluginConfig [Required]
[]PluginConfig 		- PluginConfig is an optional set of custom plugin arguments for each plugin. +

PluginConfig is an optional set of custom plugin arguments for each plugin. Omitting config args for a plugin is equivalent to using the default config -for that plugin.
## `Plugin` {#kubescheduler-config-k8s-io-v1beta3-Plugin} - - **Appears in:** + - [PluginSet](#kubescheduler-config-k8s-io-v1beta3-PluginSet) -Plugin specifies a plugin name and its weight when applicable. Weight is used only for Score plugins. +

Plugin specifies a plugin name and its weight when applicable. Weight is used only for Score plugins.

+ - +

Name defines the name of plugin

+ - - +

Weight defines the weight of plugin, only used for Score plugins.

+ - -
FieldDescription
name [Required]
string 		- Name defines the name of plugin
weight [Required]
int32 		- Weight defines the weight of plugin, only used for Score plugins.
## `PluginConfig` {#kubescheduler-config-k8s-io-v1beta3-PluginConfig} - - **Appears in:** + - [KubeSchedulerProfile](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerProfile) -PluginConfig specifies arguments that should be passed to a plugin at the time of initialization. +

PluginConfig specifies arguments that should be passed to a plugin at the time of initialization. A plugin that is invoked at multiple extension points is initialized once. Args can have arbitrary structure. -It is up to the plugin to process these Args. +It is up to the plugin to process these Args.

+ - +

Name defines the name of plugin being configured

+ - - +

Args defines the arguments passed to the plugins at the time of initialization. Args can have arbitrary structure.

+ - -
FieldDescription
name [Required]
string 		- Name defines the name of plugin being configured
args [Required]
-k8s.io/apimachinery/pkg/runtime.RawExtension +k8s.io/apimachinery/pkg/runtime.RawExtension 		- Args defines the arguments passed to the plugins at the time of initialization. Args can have arbitrary structure.
## `PluginSet` {#kubescheduler-config-k8s-io-v1beta3-PluginSet} - - **Appears in:** + - [Plugins](#kubescheduler-config-k8s-io-v1beta3-Plugins) -PluginSet specifies enabled and disabled plugins for an extension point. -If an array is empty, missing, or nil, default plugins at that extension point will be used. +

PluginSet specifies enabled and disabled plugins for an extension point. +If an array is empty, missing, or nil, default plugins at that extension point will be used.

+ - +These are called after default plugins and in the same order specified here.

+ - - +

Disabled specifies default plugins that should be disabled. +When all default plugins need to be disabled, an array containing only one "*" should be provided.

+ - -
FieldDescription
enabled [Required]
[]Plugin 		- Enabled specifies plugins that should be enabled in addition to default plugins. +

Enabled specifies plugins that should be enabled in addition to default plugins. If the default plugin is also configured in the scheduler config file, the weight of plugin will be overridden accordingly. -These are called after default plugins and in the same order specified here.
disabled [Required]
[]Plugin 		- Disabled specifies default plugins that should be disabled. -When all default plugins need to be disabled, an array containing only one "∗" should be provided.
## `Plugins` {#kubescheduler-config-k8s-io-v1beta3-Plugins} - - **Appears in:** + - [KubeSchedulerProfile](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerProfile) -Plugins include multiple extension points. When specified, the list of plugins for +

Plugins include multiple extension points. When specified, the list of plugins for a particular extension point are the only ones enabled. If an extension point is omitted from the config, then the default set of plugins is used for that extension point. Enabled plugins are called in the order specified here, after default plugins. If they need to -be invoked before default plugins, default plugins must be disabled and re-enabled here in desired order. +be invoked before default plugins, default plugins must be disabled and re-enabled here in desired order.

+ - +

QueueSort is a list of plugins that should be invoked when sorting pods in the scheduling queue.

+ - - +

PreFilter is a list of plugins that should be invoked at "PreFilter" extension point of the scheduling framework.

+ - - +

Filter is a list of plugins that should be invoked when filtering out nodes that cannot run the Pod.

+ - - +

PostFilter is a list of plugins that are invoked after filtering phase, but only when no feasible nodes were found for the pod.

+ - - +

PreScore is a list of plugins that are invoked before scoring.

+ - - +

Score is a list of plugins that should be invoked when ranking nodes that have passed the filtering phase.

+ - - +

Reserve is a list of plugins invoked when reserving/unreserving resources +after a node is assigned to run the pod.

+ - - +

Permit is a list of plugins that control binding of a Pod. These plugins can prevent or delay binding of a Pod.

+ - - +

PreBind is a list of plugins that should be invoked before a pod is bound.

+ - - +

Bind is a list of plugins that should be invoked at "Bind" extension point of the scheduling framework. +The scheduler call these plugins in order. Scheduler skips the rest of these plugins as soon as one returns success.

+ - - +

PostBind is a list of plugins that should be invoked after a pod is successfully bound.

+ - - +set in both multiPoint.Enabled and multiPoint.Disabled, the plugin will be enabled. Similarly, +including multiPoint.Disabled = '*' and multiPoint.Enabled = pluginA will still register that specific +plugin through MultiPoint. This follows the same behavior as all other extension point configurations. + + - -
FieldDescription
queueSort [Required]
PluginSet 		- QueueSort is a list of plugins that should be invoked when sorting pods in the scheduling queue.
preFilter [Required]
PluginSet 		- PreFilter is a list of plugins that should be invoked at "PreFilter" extension point of the scheduling framework.
filter [Required]
PluginSet 		- Filter is a list of plugins that should be invoked when filtering out nodes that cannot run the Pod.
postFilter [Required]
PluginSet 		- PostFilter is a list of plugins that are invoked after filtering phase, but only when no feasible nodes were found for the pod.
preScore [Required]
PluginSet 		- PreScore is a list of plugins that are invoked before scoring.
score [Required]
PluginSet 		- Score is a list of plugins that should be invoked when ranking nodes that have passed the filtering phase.
reserve [Required]
PluginSet 		- Reserve is a list of plugins invoked when reserving/unreserving resources -after a node is assigned to run the pod.
permit [Required]
PluginSet 		- Permit is a list of plugins that control binding of a Pod. These plugins can prevent or delay binding of a Pod.
preBind [Required]
PluginSet 		- PreBind is a list of plugins that should be invoked before a pod is bound.
bind [Required]
PluginSet 		- Bind is a list of plugins that should be invoked at "Bind" extension point of the scheduling framework. -The scheduler call these plugins in order. Scheduler skips the rest of these plugins as soon as one returns success.
postBind [Required]
PluginSet 		- PostBind is a list of plugins that should be invoked after a pod is successfully bound.
multiPoint [Required]
PluginSet 		- MultiPoint is a simplified config section to enable plugins for all valid extension points. +

MultiPoint is a simplified config section to enable plugins for all valid extension points. Plugins enabled through MultiPoint will automatically register for every individual extension point the plugin has implemented. Disabling a plugin through MultiPoint disables that behavior. -The same is true for disabling "∗" through MultiPoint (no default plugins will be automatically registered). -Plugins can still be disabled through their individual extension points. - -In terms of precedence, plugin config follows this basic hierarchy - 1. Specific extension points - 2. Explicitly configured MultiPoint plugins - 3. The set of default plugins, as MultiPoint plugins +The same is true for disabling "*" through MultiPoint (no default plugins will be automatically registered). +Plugins can still be disabled through their individual extension points.

+

In terms of precedence, plugin config follows this basic hierarchy

+
    +
  1. Specific extension points
    2. +
  2. Explicitly configured MultiPoint plugins
    3. +
  3. The set of default plugins, as MultiPoint plugins This implies that a higher precedence plugin will run first and overwrite any settings within MultiPoint. Explicitly user-configured plugins also take a higher precedence over default plugins. Within this hierarchy, an Enabled setting takes precedence over Disabled. For example, if a plugin is -set in both `multiPoint.Enabled` and `multiPoint.Disabled`, the plugin will be enabled. Similarly, -including `multiPoint.Disabled = '∗'` and `multiPoint.Enabled = pluginA` will still register that specific -plugin through MultiPoint. This follows the same behavior as all other extension point configurations.
@@ -988,125 +897,118 @@ plugin through MultiPoint. This follows the same behavior as all other extension (Alias of `string`) - **Appears in:** + - [PodTopologySpreadArgs](#kubescheduler-config-k8s-io-v1beta3-PodTopologySpreadArgs) -PodTopologySpreadConstraintsDefaulting defines how to set default constraints -for the PodTopologySpread plugin. +

PodTopologySpreadConstraintsDefaulting defines how to set default constraints +for the PodTopologySpread plugin.

+ ## `RequestedToCapacityRatioParam` {#kubescheduler-config-k8s-io-v1beta3-RequestedToCapacityRatioParam} - - **Appears in:** + - [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta3-ScoringStrategy) -RequestedToCapacityRatioParam define RequestedToCapacityRatio parameters +

RequestedToCapacityRatioParam define RequestedToCapacityRatio parameters

+ - +

Shape is a list of points defining the scoring function shape.

+ - -
FieldDescription
shape [Required]
[]UtilizationShapePoint 		- Shape is a list of points defining the scoring function shape.
## `ResourceSpec` {#kubescheduler-config-k8s-io-v1beta3-ResourceSpec} - - **Appears in:** + - [NodeResourcesBalancedAllocationArgs](#kubescheduler-config-k8s-io-v1beta3-NodeResourcesBalancedAllocationArgs) + - [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta3-ScoringStrategy) -ResourceSpec represents a single resource. +

ResourceSpec represents a single resource.

+ - +

Name of the resource.

+ - - +

Weight of the resource.

+ - -
FieldDescription
name [Required]
string 		- Name of the resource.
weight [Required]
int64 		- Weight of the resource.
## `ScoringStrategy` {#kubescheduler-config-k8s-io-v1beta3-ScoringStrategy} - - **Appears in:** + - [NodeResourcesFitArgs](#kubescheduler-config-k8s-io-v1beta3-NodeResourcesFitArgs) -ScoringStrategy define ScoringStrategyType for node resource plugin +

ScoringStrategy define ScoringStrategyType for node resource plugin

+ - +

Type selects which strategy to run.

+ - - +Weight defaults to 1 if not specified or explicitly set to 0.

+ - - +

Arguments specific to RequestedToCapacityRatio strategy.

+ - -
FieldDescription
type [Required]
ScoringStrategyType 		- Type selects which strategy to run.
resources [Required]
[]ResourceSpec 		- Resources to consider when scoring. -The default resource set includes "cpu" and "memory" with an equal weight. +

Resources to consider when scoring. +The default resource set includes "cpu" and "memory" with an equal weight. Allowed weights go from 1 to 100. -Weight defaults to 1 if not specified or explicitly set to 0.
requestedToCapacityRatio [Required]
RequestedToCapacityRatioParam 		- Arguments specific to RequestedToCapacityRatio strategy.
@@ -1114,49 +1016,48 @@ Weight defaults to 1 if not specified or explicitly set to 0. (Alias of `string`) - **Appears in:** + - [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta3-ScoringStrategy) -ScoringStrategyType the type of scoring strategy used in NodeResourcesFit plugin. +

ScoringStrategyType the type of scoring strategy used in NodeResourcesFit plugin.

+ ## `UtilizationShapePoint` {#kubescheduler-config-k8s-io-v1beta3-UtilizationShapePoint} - - **Appears in:** + - [VolumeBindingArgs](#kubescheduler-config-k8s-io-v1beta3-VolumeBindingArgs) + - [RequestedToCapacityRatioParam](#kubescheduler-config-k8s-io-v1beta3-RequestedToCapacityRatioParam) -UtilizationShapePoint represents single point of priority function shape. +

UtilizationShapePoint represents single point of priority function shape.

+ - +

Utilization (x axis). Valid values are 0 to 100. Fully utilized node maps to 100.

+ - - +

Score assigned to given utilization (y axis). Valid values are 0 to 10.

+ - -
FieldDescription
utilization [Required]
int32 		- Utilization (x axis). Valid values are 0 to 100. Fully utilized node maps to 100.
score [Required]
int32 		- Score assigned to given utilization (y axis). Valid values are 0 to 10.
@@ -1166,339 +1067,313 @@ UtilizationShapePoint represents single point of priority function shape. ## `ClientConnectionConfiguration` {#ClientConnectionConfiguration} - - **Appears in:** + - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) -ClientConnectionConfiguration contains details for constructing a client. +

ClientConnectionConfiguration contains details for constructing a client.

+ - +

kubeconfig is the path to a KubeConfig file.

+ - - +client.

+ - - +

contentType is the content type used when sending data to the server from this client.

+ - - +

qps controls the number of queries per second allowed for this connection.

+ - - +

burst allows extra queries to accumulate when a client is exceeding its rate.

+ - -
FieldDescription
kubeconfig [Required]
string 		- kubeconfig is the path to a KubeConfig file.
acceptContentTypes [Required]
string 		- acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the +

acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the default value of 'application/json'. This field will control all connections to the server used by a particular -client.
contentType [Required]
string 		- contentType is the content type used when sending data to the server from this client.
qps [Required]
float32 		- qps controls the number of queries per second allowed for this connection.
burst [Required]
int32 		- burst allows extra queries to accumulate when a client is exceeding its rate.
## `DebuggingConfiguration` {#DebuggingConfiguration} - - **Appears in:** -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) + - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) + + +

DebuggingConfiguration holds configuration for Debugging related features.

-DebuggingConfiguration holds configuration for Debugging related features. - +

enableProfiling enables profiling via web interface host:port/debug/pprof/

+ - - +

enableContentionProfiling enables lock contention profiling, if +enableProfiling is true.

+ - -
FieldDescription
enableProfiling [Required]
bool 		- enableProfiling enables profiling via web interface host:port/debug/pprof/
enableContentionProfiling [Required]
bool 		- enableContentionProfiling enables lock contention profiling, if -enableProfiling is true.
## `FormatOptions` {#FormatOptions} - - **Appears in:** + - [LoggingConfiguration](#LoggingConfiguration) -FormatOptions contains options for the different logging formats. +

FormatOptions contains options for the different logging formats.

+ - +

[Experimental] JSON contains options for logging format "json".

+ - -
FieldDescription
json [Required]
JSONOptions 		- [Experimental] JSON contains options for logging format "json".
## `JSONOptions` {#JSONOptions} - - **Appears in:** + - [FormatOptions](#FormatOptions) -JSONOptions contains options for logging format "json". +

JSONOptions contains options for logging format "json".

+ - +both to stdout, without buffering.

+ - - +

[Experimental] InfoBufferSize sets the size of the info stream when +using split streams. The default is zero, which disables buffering.

+ - -
FieldDescription
splitStream [Required]
bool 		- [Experimental] SplitStream redirects error messages to stderr while +

[Experimental] SplitStream redirects error messages to stderr while info messages go to stdout, with buffering. The default is to write -both to stdout, without buffering.
infoBufferSize [Required]
k8s.io/apimachinery/pkg/api/resource.QuantityValue 		- [Experimental] InfoBufferSize sets the size of the info stream when -using split streams. The default is zero, which disables buffering.
## `LeaderElectionConfiguration` {#LeaderElectionConfiguration} - - **Appears in:** + - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) -LeaderElectionConfiguration defines the configuration of leader election -clients for components that can run with leader election enabled. +

LeaderElectionConfiguration defines the configuration of leader election +clients for components that can run with leader election enabled.

+ - +components for high availability.

+ - - +enabled.

+ - - +election is enabled.

+ - - +leader election is enabled.

+ - - +

resourceLock indicates the resource object type that will be used to lock +during leader election cycles.

+ - - +

resourceName indicates the name of resource object that will be used to lock +during leader election cycles.

+ - - +

resourceName indicates the namespace of resource object that will be used to lock +during leader election cycles.

+ - -
FieldDescription
leaderElect [Required]
bool 		- leaderElect enables a leader election client to gain leadership +

leaderElect enables a leader election client to gain leadership before executing the main loop. Enable this when running replicated -components for high availability.
leaseDuration [Required]
-meta/v1.Duration +meta/v1.Duration 		- leaseDuration is the duration that non-leader candidates will wait +

leaseDuration is the duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate. This is only applicable if leader election is -enabled.
renewDeadline [Required]
-meta/v1.Duration +meta/v1.Duration 		- renewDeadline is the interval between attempts by the acting master to +

renewDeadline is the interval between attempts by the acting master to renew a leadership slot before it stops leading. This must be less than or equal to the lease duration. This is only applicable if leader -election is enabled.
retryPeriod [Required]
-meta/v1.Duration +meta/v1.Duration 		- retryPeriod is the duration the clients should wait between attempting +

retryPeriod is the duration the clients should wait between attempting acquisition and renewal of a leadership. This is only applicable if -leader election is enabled.
resourceLock [Required]
string 		- resourceLock indicates the resource object type that will be used to lock -during leader election cycles.
resourceName [Required]
string 		- resourceName indicates the name of resource object that will be used to lock -during leader election cycles.
resourceNamespace [Required]
string 		- resourceName indicates the namespace of resource object that will be used to lock -during leader election cycles.
## `LoggingConfiguration` {#LoggingConfiguration} - - **Appears in:** + - [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) -LoggingConfiguration contains logging options -Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. +

LoggingConfiguration contains logging options +Refer Logs Options for more information.

+ - +

Format Flag specifies the structure of log messages. +default value of format is text

+ - - +

Maximum number of seconds between log flushes. Ignored if the +selected logging backend writes log messages without buffering.

+ - - +are always logged.

+ - - +

VModule overrides the verbosity threshold for individual files. +Only supported for "text" log format.

+ - - +

[Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). +Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)

+ - - +format get used, but all of them get validated.

+ - -
FieldDescription
format [Required]
string 		- Format Flag specifies the structure of log messages. -default value of format is `text`
flushFrequency [Required]
-time.Duration +time.Duration 		- Maximum number of seconds between log flushes. Ignored if the -selected logging backend writes log messages without buffering.
verbosity [Required]
uint32 		- Verbosity is the threshold that determines which log messages are +

Verbosity is the threshold that determines which log messages are logged. Default is zero which logs only the most important messages. Higher values enable additional messages. Error messages -are always logged.
vmodule [Required]
VModuleConfiguration 		- VModule overrides the verbosity threshold for individual files. -Only supported for "text" log format.
sanitization [Required]
bool 		- [Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). -Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)
options [Required]
FormatOptions 		- [Experimental] Options holds additional parameters that are specific +

[Experimental] Options holds additional parameters that are specific to the different logging formats. Only the options for the selected -format get used, but all of them get validated.
@@ -1506,12 +1381,13 @@ format get used, but all of them get validated. (Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`) - **Appears in:** + - [LoggingConfiguration](#LoggingConfiguration) -VModuleConfiguration is a collection of individual file names or patterns -and the corresponding verbosity threshold. +

VModuleConfiguration is a collection of individual file names or patterns +and the corresponding verbosity threshold.

+ diff --git a/content/en/docs/reference/config-api/kubeadm-config.v1beta2.md b/content/en/docs/reference/config-api/kubeadm-config.v1beta2.md index f3c5b521ab..8874cf6a36 100644 --- a/content/en/docs/reference/config-api/kubeadm-config.v1beta2.md +++ b/content/en/docs/reference/config-api/kubeadm-config.v1beta2.md @@ -4,280 +4,245 @@ content_type: tool-reference package: kubeadm.k8s.io/v1beta2 auto_generated: true --- -## Overview - -Package v1beta2 defines the v1beta2 version of the kubeadm configuration file format. -This version improves on the v1beta1 format by fixing some minor issues and adding a few new fields. - -A list of changes since v1beta1: - -- "certificateKey" field is added to InitConfiguration and JoinConfiguration. -- "ignorePreflightErrors" field is added to the NodeRegistrationOptions. -- The JSON "omitempty" tag is used in a more places where appropriate. -- The JSON "omitempty" tag of the "taints" field (inside NodeRegistrationOptions) is removed. - -See the Kubernetes 1.15 changelog for further details. - -Migration from old kubeadm config versions - -Please convert your v1beta1 configuration files to v1beta2 using the "kubeadm config migrate" command of kubeadm v1.15.x -(conversion from older releases of kubeadm config files requires older release of kubeadm as well e.g. - -- kubeadm v1.11 should be used to migrate v1alpha1 to v1alpha2; kubeadm v1.12 should be used to translate v1alpha2 to v1alpha3; -- kubeadm v1.13 or v1.14 should be used to translate v1alpha3 to v1beta1) - -Nevertheless, kubeadm v1.15.x will support reading from v1beta1 version of the kubeadm config file format. - -## Basics - -The preferred way to configure kubeadm is to pass an YAML configuration file with the `--config` option. Some of the +

Overview

+

Package v1beta2 defines the v1beta2 version of the kubeadm configuration file format. +This version improves on the v1beta1 format by fixing some minor issues and adding a few new fields.

+

A list of changes since v1beta1:

+
    +
  • "certificateKey" field is added to InitConfiguration and JoinConfiguration.
    • +
  • "ignorePreflightErrors" field is added to the NodeRegistrationOptions.
    • +
  • The JSON "omitempty" tag is used in a more places where appropriate.
    • +
  • The JSON "omitempty" tag of the "taints" field (inside NodeRegistrationOptions) is removed.
    • +
+

See the Kubernetes 1.15 changelog for further details.

+

Migration from old kubeadm config versions

+

Please convert your v1beta1 configuration files to v1beta2 using the "kubeadm config migrate" command of kubeadm v1.15.x +(conversion from older releases of kubeadm config files requires older release of kubeadm as well e.g.

+
    +
  • kubeadm v1.11 should be used to migrate v1alpha1 to v1alpha2; kubeadm v1.12 should be used to translate v1alpha2 to v1alpha3;
    • +
  • kubeadm v1.13 or v1.14 should be used to translate v1alpha3 to v1beta1)
    • +
+

Nevertheless, kubeadm v1.15.x will support reading from v1beta1 version of the kubeadm config file format.

+

Basics

+

The preferred way to configure kubeadm is to pass an YAML configuration file with the --config option. Some of the configuration options defined in the kubeadm config file are also available as command line flags, but only -the most common/simple use case are supported with this approach. - -A kubeadm config file could contain multiple configuration types separated using three dashes (`---`). - -kubeadm supports the following configuration types: - -```yaml -apiVersion: kubeadm.k8s.io/v1beta2 -kind: InitConfiguration - -apiVersion: kubeadm.k8s.io/v1beta2 -kind: ClusterConfiguration - -apiVersion: kubelet.config.k8s.io/v1beta1 -kind: KubeletConfiguration - -apiVersion: kubeproxy.config.k8s.io/v1alpha1 -kind: KubeProxyConfiguration - -apiVersion: kubeadm.k8s.io/v1beta2 -kind: JoinConfiguration -``` - -To print the defaults for "init" and "join" actions use the following commands: - -```shell -kubeadm config print init-defaults +the most common/simple use case are supported with this approach.

+

A kubeadm config file could contain multiple configuration types separated using three dashes (---).

+

kubeadm supports the following configuration types:

+
apiVersion: kubeadm.k8s.io/v1beta2
+kind: InitConfiguration
+
+apiVersion: kubeadm.k8s.io/v1beta2
+kind: ClusterConfiguration
+
+apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+
+apiVersion: kubeproxy.config.k8s.io/v1alpha1
+kind: KubeProxyConfiguration
+
+apiVersion: kubeadm.k8s.io/v1beta2
+kind: JoinConfiguration
+

To print the defaults for "init" and "join" actions use the following commands:

+
kubeadm config print init-defaults
 kubeadm config print join-defaults
-```
-
-The list of configuration types that must be included in a configuration file depends by the action you are
-performing (`init` or `join`) and by the configuration options you are going to use (defaults or advanced customization).
-
-If some configuration types are not provided, or provided only partially, kubeadm will use default values; defaults
+

The list of configuration types that must be included in a configuration file depends by the action you are +performing (init or join) and by the configuration options you are going to use (defaults or advanced customization).

+

If some configuration types are not provided, or provided only partially, kubeadm will use default values; defaults provided by kubeadm includes also enforcing consistency of values across components when required (e.g. -`--cluster-cidr` flag on controller manager and `clusterCIDR` on kube-proxy). - -Users are always allowed to override default values, with the only exception of a small subset of setting with -relevance for security (e.g. enforce authorization-mode Node and RBAC on API server) - -If the user provides a configuration types that is not expected for the action you are performing, kubeadm will -ignore those types and print a warning. - -## Kubeadm init configuration types - -When executing kubeadm init with the `--config` option, the following configuration types could be used: +--cluster-cidr flag on controller manager and clusterCIDR on kube-proxy).

+

Users are always allowed to override default values, with the only exception of a small subset of setting with +relevance for security (e.g. enforce authorization-mode Node and RBAC on API server)

+

If the user provides a configuration types that is not expected for the action you are performing, kubeadm will +ignore those types and print a warning.

+

Kubeadm init configuration types

+

When executing kubeadm init with the --config option, the following configuration types could be used: InitConfiguration, ClusterConfiguration, KubeProxyConfiguration, KubeletConfiguration, but only one -between InitConfiguration and ClusterConfiguration is mandatory. - -```yaml -apiVersion: kubeadm.k8s.io/v1beta2 -kind: InitConfiguration -bootstrapTokens: - ... -nodeRegistration: - ... -``` - -The InitConfiguration type should be used to configure runtime settings, that in case of `kubeadm init` +between InitConfiguration and ClusterConfiguration is mandatory.

+
apiVersion: kubeadm.k8s.io/v1beta2
+kind: InitConfiguration
+bootstrapTokens:
+  ...
+nodeRegistration:
+  ...
+

The InitConfiguration type should be used to configure runtime settings, that in case of kubeadm init are the configuration of the bootstrap token and all the setting which are specific to the node where kubeadm -is executed, including: - -- `nodeRegistration`, that holds fields that relate to registering the new node to the cluster; - use it to customize the node name, the CRI socket to use or any other settings that should apply to this - node only (e.g. the node ip). - -- `apiServer`, that represents the endpoint of the instance of the API server to be deployed on this node; - use it e.g. to customize the API server advertise address. - - ```yaml - apiVersion: kubeadm.k8s.io/v1beta2 - kind: ClusterConfiguration - networking: - ... - etcd: - ... - apiServer: - extraArgs: - ... - extraVolumes: - ... - ... - ``` - -The ClusterConfiguration type should be used to configure cluster-wide settings, -including settings for: - -- Networking, that holds configuration for the networking topology of the cluster; use it e.g. to customize - pod subnet or services subnet. - -- Etcd configurations; use it e.g. to customize the local etcd or to configure the API server - for using an external etcd cluster. - -- kube-apiserver, kube-scheduler, kube-controller-manager configurations; use it to customize control-plane - components by adding customized setting or overriding kubeadm default settings. - - ```yaml - apiVersion: kubeproxy.config.k8s.io/v1alpha1 - kind: KubeProxyConfiguration - ... - ``` - -The KubeProxyConfiguration type should be used to change the configuration passed to kube-proxy instances deployed -in the cluster. If this object is not provided or provided only partially, kubeadm applies defaults. - -See https://kubernetes.io/docs/reference/command-line-tools-reference/kube-proxy/ or +is executed, including:

+
    +
  • +

    nodeRegistration, that holds fields that relate to registering the new node to the cluster; +use it to customize the node name, the CRI socket to use or any other settings that should apply to this +node only (e.g. the node ip).

    +
    • +
  • +

    apiServer, that represents the endpoint of the instance of the API server to be deployed on this node; +use it e.g. to customize the API server advertise address.

    +
    • +
+
apiVersion: kubeadm.k8s.io/v1beta2
+kind: ClusterConfiguration
+networking:
+    ...
+etcd:
+    ...
+apiServer:
+  extraArgs:
+    ...
+  extraVolumes:
+    ...
+...
+

The ClusterConfiguration type should be used to configure cluster-wide settings, +including settings for:

+
    +
  • +

    Networking, that holds configuration for the networking topology of the cluster; use it e.g. to customize +pod subnet or services subnet.

    +
    • +
  • +

    Etcd configurations; use it e.g. to customize the local etcd or to configure the API server +for using an external etcd cluster.

    +
    • +
  • +

    kube-apiserver, kube-scheduler, kube-controller-manager configurations; use it to customize control-plane +components by adding customized setting or overriding kubeadm default settings.

    +
    • +
+
apiVersion: kubeproxy.config.k8s.io/v1alpha1
+kind: KubeProxyConfiguration
+  ...
+

The KubeProxyConfiguration type should be used to change the configuration passed to kube-proxy instances deployed +in the cluster. If this object is not provided or provided only partially, kubeadm applies defaults.

+

See https://kubernetes.io/docs/reference/command-line-tools-reference/kube-proxy/ or https://godoc.org/k8s.io/kube-proxy/config/v1alpha1#KubeProxyConfiguration -for kube proxy official documentation. - -```yaml -apiVersion: kubelet.config.k8s.io/v1beta1 -kind: KubeletConfiguration - ... -``` - -The KubeletConfiguration type should be used to change the configurations that will be passed to all kubelet instances -deployed in the cluster. If this object is not provided or provided only partially, kubeadm applies defaults. - -See https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/ or +for kube proxy official documentation.

+
apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+  ...
+

The KubeletConfiguration type should be used to change the configurations that will be passed to all kubelet instances +deployed in the cluster. If this object is not provided or provided only partially, kubeadm applies defaults.

+

See https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/ or https://godoc.org/k8s.io/kubelet/config/v1beta1#KubeletConfiguration -for kubelet official documentation. - -Here is a fully populated example of a single YAML file containing multiple -configuration types to be used during a `kubeadm init` run. - -```yaml -apiVersion: kubeadm.k8s.io/v1beta2 -kind: InitConfiguration -bootstrapTokens: - - token: "9a08jv.c0izixklcxtmnze7" - description: "kubeadm bootstrap token" - ttl: "24h" - - token: "783bde.3f89s0fje9f38fhf" - description: "another bootstrap token" - usages: - - authentication - - signing - groups: - - system:bootstrappers:kubeadm:default-node-token -nodeRegistration: - name: "ec2-10-100-0-1" - criSocket: "/var/run/dockershim.sock" - taints: - - key: "kubeadmNode" - value: "master" - effect: "NoSchedule" - kubeletExtraArgs: - v: 4 - ignorePreflightErrors: - - IsPrivilegedUser -localAPIEndpoint: - advertiseAddress: "10.100.0.1" - bindPort: 6443 -certificateKey: "e6a2eb8581237ab72a4f494f30285ec12a9694d750b9785706a83bfcbbbd2204" ---- -apiVersion: kubeadm.k8s.io/v1beta2 -kind: ClusterConfiguration -etcd: - # one of local or external -local: - imageRepository: "k8s.gcr.io" - imageTag: "3.2.24" - dataDir: "/var/lib/etcd" - extraArgs: - listen-client-urls: "http://10.100.0.1:2379" - serverCertSANs: - - "ec2-10-100-0-1.compute-1.amazonaws.com" - peerCertSANs: - - "10.100.0.1" -# external: -# endpoints: -# - "10.100.0.1:2379" -# - "10.100.0.2:2379" -# caFile: "/etcd/kubernetes/pki/etcd/etcd-ca.crt" -# certFile: "/etcd/kubernetes/pki/etcd/etcd.crt" -# keyFile: "/etcd/kubernetes/pki/etcd/etcd.key" -networking: - serviceSubnet: "10.96.0.0/16" - podSubnet: "10.244.0.0/24" - dnsDomain: "cluster.local" -kubernetesVersion: "v1.12.0" -controlPlaneEndpoint: "10.100.0.1:6443" -apiServer: - extraArgs: - authorization-mode: "Node,RBAC" - extraVolumes: - - name: "some-volume" - hostPath: "/etc/some-path" - mountPath: "/etc/some-pod-path" - readOnly: false - pathType: File - certSANs: - - "10.100.1.1" - - "ec2-10-100-0-1.compute-1.amazonaws.com" - timeoutForControlPlane: 4m0s -controllerManager: - extraArgs: - "node-cidr-mask-size": "20" - extraVolumes: - - name: "some-volume" - hostPath: "/etc/some-path" - mountPath: "/etc/some-pod-path" - readOnly: false - pathType: File -scheduler: - extraArgs: - address: "10.100.0.1" - extraVolumes: - - name: "some-volume" - hostPath: "/etc/some-path" - mountPath: "/etc/some-pod-path" - readOnly: false - pathType: File -certificatesDir: "/etc/kubernetes/pki" -imageRepository: "k8s.gcr.io" -useHyperKubeImage: false -clusterName: "example-cluster" ---- -apiVersion: kubelet.config.k8s.io/v1beta1 -kind: KubeletConfiguration -# kubelet specific options here ---- -apiVersion: kubeproxy.config.k8s.io/v1alpha1 -kind: KubeProxyConfiguration -# kube-proxy specific options here -``` - -## Kubeadm join configuration types - -When executing kubeadm join with the `--config` option, the JoinConfiguration type should be provided. - -```yaml -apiVersion: kubeadm.k8s.io/v1beta2 -kind: JoinConfiguration - ... -``` - -The JoinConfiguration type should be used to configure runtime settings, that in case of `kubeadm join` +for kubelet official documentation.

+

Here is a fully populated example of a single YAML file containing multiple +configuration types to be used during a kubeadm init run.

+
apiVersion: kubeadm.k8s.io/v1beta2
+kind: InitConfiguration
+bootstrapTokens:
+  - token: "9a08jv.c0izixklcxtmnze7"
+    description: "kubeadm bootstrap token"
+    ttl: "24h"
+  - token: "783bde.3f89s0fje9f38fhf"
+    description: "another bootstrap token"
+    usages:
+      - authentication
+      - signing
+    groups:
+      - system:bootstrappers:kubeadm:default-node-token
+nodeRegistration:
+  name: "ec2-10-100-0-1"
+  criSocket: "/var/run/dockershim.sock"
+  taints:
+    - key: "kubeadmNode"
+      value: "master"
+      effect: "NoSchedule"
+  kubeletExtraArgs:
+    v: 4
+  ignorePreflightErrors:
+    - IsPrivilegedUser
+localAPIEndpoint:
+  advertiseAddress: "10.100.0.1"
+  bindPort: 6443
+certificateKey: "e6a2eb8581237ab72a4f494f30285ec12a9694d750b9785706a83bfcbbbd2204"
+---
+apiVersion: kubeadm.k8s.io/v1beta2
+kind: ClusterConfiguration
+etcd:
+  # one of local or external
+  local:
+    imageRepository: "k8s.gcr.io"
+    imageTag: "3.2.24"
+    dataDir: "/var/lib/etcd"
+    extraArgs:
+      listen-client-urls: "http://10.100.0.1:2379"
+    serverCertSANs:
+      -  "ec2-10-100-0-1.compute-1.amazonaws.com"
+    peerCertSANs:
+      - "10.100.0.1"
+  # external:
+  #   endpoints:
+  #     - "10.100.0.1:2379"
+  #     - "10.100.0.2:2379"
+  #   caFile: "/etcd/kubernetes/pki/etcd/etcd-ca.crt"
+  #   certFile: "/etcd/kubernetes/pki/etcd/etcd.crt"
+  #   keyFile: "/etcd/kubernetes/pki/etcd/etcd.key"
+networking:
+  serviceSubnet: "10.96.0.0/16"
+  podSubnet: "10.244.0.0/24"
+  dnsDomain: "cluster.local"
+kubernetesVersion: "v1.12.0"
+controlPlaneEndpoint: "10.100.0.1:6443"
+apiServer:
+  extraArgs:
+    authorization-mode: "Node,RBAC"
+  extraVolumes:
+    - name: "some-volume"
+      hostPath: "/etc/some-path"
+      mountPath: "/etc/some-pod-path"
+      readOnly: false
+      pathType: File
+  certSANs:
+    - "10.100.1.1"
+    - "ec2-10-100-0-1.compute-1.amazonaws.com"
+  timeoutForControlPlane: 4m0s
+controllerManager:
+  extraArgs:
+    "node-cidr-mask-size": "20"
+  extraVolumes:
+    - name: "some-volume"
+      hostPath: "/etc/some-path"
+      mountPath: "/etc/some-pod-path"
+      readOnly: false
+      pathType: File
+scheduler:
+  extraArgs:
+    address: "10.100.0.1"
+  extraVolumes:
+    - name: "some-volume"
+      hostPath: "/etc/some-path"
+      mountPath: "/etc/some-pod-path"
+      readOnly: false
+      pathType: File
+certificatesDir: "/etc/kubernetes/pki"
+imageRepository: "k8s.gcr.io"
+useHyperKubeImage: false
+clusterName: "example-cluster"
+---
+apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+# kubelet specific options here
+---
+apiVersion: kubeproxy.config.k8s.io/v1alpha1
+kind: KubeProxyConfiguration
+# kube-proxy specific options here
+

Kubeadm join configuration types

+

When executing kubeadm join with the --config option, the JoinConfiguration type should be provided.

+
apiVersion: kubeadm.k8s.io/v1beta2
+kind: JoinConfiguration
+  ...
+

The JoinConfiguration type should be used to configure runtime settings, that in case of kubeadm join are the discovery method used for accessing the cluster info and all the setting which are specific -to the node where kubeadm is executed, including: +to the node where kubeadm is executed, including:

+
    +
  • +

    NodeRegistration, that holds fields that relate to registering the new node to the cluster; +use it to customize the node name, the CRI socket to use or any other settings that should apply to this +node only (e.g. the node IP).

    +
    • +
  • +

    APIEndpoint, that represents the endpoint of the instance of the API server to be eventually deployed on this node.

    +
    • +
-- `NodeRegistration`, that holds fields that relate to registering the new node to the cluster; - use it to customize the node name, the CRI socket to use or any other settings that should apply to this - node only (e.g. the node IP). - -- `APIEndpoint`, that represents the endpoint of the instance of the API server to be eventually deployed on this node. ## Resource Types @@ -293,10 +258,9 @@ to the node where kubeadm is executed, including: +

ClusterConfiguration contains cluster-wide configuration for a kubeadm cluster

-ClusterConfiguration contains cluster-wide configuration for a kubeadm cluster - @@ -304,132 +268,118 @@ ClusterConfiguration contains cluster-wide configuration for a kubeadm cluster - - +

etcd holds configuration for etcd.

+ - - +

networking holds configuration for the networking topology of the cluster.

+ - - +

kubernetesVersion is the target version of the control plane.

+ - - +In case the controlPlaneEndpoint is not specified, the advertiseAddress + bindPort +are used; in case the controlPlaneEndpoint is specified but without a TCP port, +the bindPort is used. +Possible usages are:

+
    +
  • In a cluster with more than one control plane instances, this field should be +assigned the address of the external load balancer in front of the +control plane instances.
    • +
  • In environments with enforced node recycling, the controlPlaneEndpoint +could be used for assigning a stable DNS to the control plane.
    • +
+ - - +

apiServer contains extra settings for the API server.

+ - - +

controllerManager contains extra settings for the controller manager.

+ - - +

scheduler contains extra settings for the scheduler.

+ - - +

dns defines the options for the DNS add-on installed in the cluster.

+ - - +

certificatesDir specifies where to store or look for all required certificates.

+ - - +k8s.gcr.io will be used for all the other images.

+ - - +when this set to true, and at some point it may become ignored.

+ - - +

featureGates contains the feature gates enabled by the user.

+ - - +

The cluster name.

+ - -
FieldDescription
apiVersion
string		kubeadm.k8s.io/v1beta2
kind
string		ClusterConfiguration
etcd [Required]
Etcd 		- `etcd` holds configuration for etcd.
networking [Required]
Networking 		- `networking` holds configuration for the networking topology of the cluster.
kubernetesVersion [Required]
string 		- `kubernetesVersion` is the target version of the control plane.
controlPlaneEndpoint [Required]
string 		- `controlPlaneEndpoint` sets a stable IP address or DNS name for the control plane; it +

controlPlaneEndpoint sets a stable IP address or DNS name for the control plane; it can be a valid IP address or a RFC-1123 DNS subdomain, both with optional TCP port. -In case the `controlPlaneEndpoint` is not specified, the `advertiseAddress` + `bindPort` -are used; in case the `controlPlaneEndpoint` is specified but without a TCP port, -the `bindPort` is used. -Possible usages are: - -- In a cluster with more than one control plane instances, this field should be - assigned the address of the external load balancer in front of the - control plane instances. -- In environments with enforced node recycling, the `controlPlaneEndpoint` - could be used for assigning a stable DNS to the control plane.
apiServer [Required]
APIServer 		- `apiServer` contains extra settings for the API server.
controllerManager [Required]
ControlPlaneComponent 		- `controllerManager` contains extra settings for the controller manager.
scheduler [Required]
ControlPlaneComponent 		- `scheduler` contains extra settings for the scheduler.
dns [Required]
DNS 		- `dns` defines the options for the DNS add-on installed in the cluster.
certificatesDir [Required]
string 		- `certificatesDir` specifies where to store or look for all required certificates.
imageRepository [Required]
string 		- `mageRepository` sets the container registry to pull images from. -If empty, `k8s.gcr.io` will be used by default; in case of kubernetes version is -a CI build (kubernetes version starts with `ci/`) `gcr.io/k8s-staging-ci-images` +

mageRepository sets the container registry to pull images from. +If empty, k8s.gcr.io will be used by default; in case of kubernetes version is +a CI build (kubernetes version starts with ci/) gcr.io/k8s-staging-ci-images is used as a default for control plane components and for kube-proxy, while -`k8s.gcr.io` will be used for all the other images.
useHyperKubeImage [Required]
bool 		- `useHyperKubeImage` controls if hyperkube should be used for Kubernetes components +

useHyperKubeImage controls if hyperkube should be used for Kubernetes components instead of their respective separate images. -DEPRECATED: As `hyperkube` is itself deprecated, this fields is too. It will be +DEPRECATED: As hyperkube is itself deprecated, this fields is too. It will be removed in future kubeadm config versions, kubeadm will print multiple warnings -when this set to true, and at some point it may become ignored.
featureGates [Required]
map[string]bool 		- `featureGates` contains the feature gates enabled by the user.
clusterName [Required]
string 		- The cluster name.
@@ -437,11 +387,10 @@ when this set to true, and at some point it may become ignored. - - -ClusterStatus contains the cluster status. The ClusterStatus will be stored in +

ClusterStatus contains the cluster status. The ClusterStatus will be stored in the kubeadm-config ConfigMap in the cluster, and then updated by kubeadm when -additional control plane instance joins or leaves the cluster. +additional control plane instance joins or leaves the cluster.

+ @@ -450,19 +399,16 @@ additional control plane instance joins or leaves the cluster. - - +The key of the map is the IP of the host's default interface.

+ - -
FieldDescription
apiVersion
string		kubeadm.k8s.io/v1beta2
kind
string		ClusterStatus
apiEndpoints [Required]
map[string]github.com/tengqm/kubeconfig/config/kubeadm/v1beta2.APIEndpoint 		- `apiEndpoints` currently available in the cluster, one for each control +

apiEndpoints currently available in the cluster, one for each control plane/API server instance. -The key of the map is the IP of the host's default interface.
@@ -470,11 +416,10 @@ The key of the map is the IP of the host's default interface. +

InitConfiguration contains a list of elements that is specific "kubeadm init"-only runtime +information.

-InitConfiguration contains a list of elements that is specific "kubeadm init"-only runtime -information. - @@ -482,48 +427,42 @@ information. - - +

bootstrapTokens is respected at kubeadm init time and describes a set of bootstrap tokens to create. +This information IS NOT uploaded to the kubeadm cluster ConfigMap, partly because of its sensitive nature.

+ - - +

nodeRegistration holds fields that relate to registering the new control-plane node to the cluster.

+ - - +fails you may set the desired value here.

+ - - +

certificateKey sets the key with which certificates and keys are encrypted prior to being uploaded in +a secret in the cluster during the uploadcerts init phase.

+ - -
FieldDescription
apiVersion
string		kubeadm.k8s.io/v1beta2
kind
string		InitConfiguration
bootstrapTokens [Required]
[]BootstrapToken 		- `bootstrapTokens` is respected at `kubeadm init` time and describes a set of bootstrap tokens to create. -This information IS NOT uploaded to the kubeadm cluster ConfigMap, partly because of its sensitive nature.
nodeRegistration [Required]
NodeRegistrationOptions 		- `nodeRegistration` holds fields that relate to registering the new control-plane node to the cluster.
localAPIEndpoint [Required]
APIEndpoint 		- `localAPIEndpoint` represents the endpoint of the API server instance that's deployed on this control plane node. -In HA setups, this differs from `ClusterConfiguration.controlPlaneEndpoint` in the sense that ControlPlaneEndpoint +

localAPIEndpoint represents the endpoint of the API server instance that's deployed on this control plane node. +In HA setups, this differs from ClusterConfiguration.controlPlaneEndpoint in the sense that ControlPlaneEndpoint is the global endpoint for the cluster, which then load-balances the requests to each individual API server. This configuration object lets you customize what IP/DNS name and port the local API server advertises it's accessible on. By default, kubeadm tries to auto-detect the IP of the default interface and use that, but in case that process -fails you may set the desired value here.
certificateKey [Required]
string 		- `certificateKey` sets the key with which certificates and keys are encrypted prior to being uploaded in -a secret in the cluster during the `uploadcerts init` phase.
@@ -531,10 +470,9 @@ a secret in the cluster during the `uploadcerts init` phase. +

JoinConfiguration contains elements describing a particular node.

-JoinConfiguration contains elements describing a particular node. - @@ -542,384 +480,347 @@ JoinConfiguration contains elements describing a particular node. - - +

nodeRegistration holds fields that relate to registering the new +control-plane node to the cluster

+ - - +Defaults to "/etc/kubernetes/pki/ca.crt".

+ - - +

discovery specifies the options for the kubelet to use during the TLS +bootstrap process.

+ - - +

controlPlane defines the additional control plane instance to be deployed +on the joining node. If nil, no additional control plane instance will be deployed.

+ - -
FieldDescription
apiVersion
string		kubeadm.k8s.io/v1beta2
kind
string		JoinConfiguration
nodeRegistration [Required]
NodeRegistrationOptions 		- `nodeRegistration` holds fields that relate to registering the new -control-plane node to the cluster
caCertPath [Required]
string 		- `caCertPath` is the path to the SSL certificate authority used to +

caCertPath is the path to the SSL certificate authority used to secure comunications between a node and the control-plane. -Defaults to "/etc/kubernetes/pki/ca.crt".
discovery [Required]
Discovery 		- `discovery` specifies the options for the kubelet to use during the TLS -bootstrap process.
controlPlane [Required]
JoinControlPlane 		- `controlPlane` defines the additional control plane instance to be deployed -on the joining node. If nil, no additional control plane instance will be deployed.
## `APIEndpoint` {#kubeadm-k8s-io-v1beta2-APIEndpoint} - - **Appears in:** + - [ClusterStatus](#kubeadm-k8s-io-v1beta2-ClusterStatus) + - [InitConfiguration](#kubeadm-k8s-io-v1beta2-InitConfiguration) + - [JoinControlPlane](#kubeadm-k8s-io-v1beta2-JoinControlPlane) -APIEndpoint struct contains elements of API server instance deployed on a node. +

APIEndpoint struct contains elements of API server instance deployed on a node.

+ - +

advertiseAddress sets the IP address for the API server to advertise.

+ - - +

bindPort sets the secure port for the API Server to bind to. +Defaults to 6443.

+ - -
FieldDescription
advertiseAddress [Required]
string 		- `advertiseAddress` sets the IP address for the API server to advertise.
bindPort [Required]
int32 		- `bindPort` sets the secure port for the API Server to bind to. -Defaults to 6443.
## `APIServer` {#kubeadm-k8s-io-v1beta2-APIServer} - - **Appears in:** + - [ClusterConfiguration](#kubeadm-k8s-io-v1beta2-ClusterConfiguration) -APIServer holds settings necessary for API server deployments in the cluster. +

APIServer holds settings necessary for API server deployments in the cluster.

+ - + No description provided. - - +

certSANs sets extra Subject Alternative Names (SANs) for the API Server +signing certificate.

+ - - +

timeoutForControlPlane controls the timeout that we wait for the API server +to appear.

+ - -
FieldDescription
ControlPlaneComponent [Required]
ControlPlaneComponent 		(Members of ControlPlaneComponent are embedded into this type.) - No description provided. -
certSANs [Required]
[]string 		- `certSANs` sets extra Subject Alternative Names (SANs) for the API Server -signing certificate.
timeoutForControlPlane [Required]
-meta/v1.Duration +meta/v1.Duration 		- `timeoutForControlPlane` controls the timeout that we wait for the API server -to appear.
## `BootstrapToken` {#kubeadm-k8s-io-v1beta2-BootstrapToken} - - **Appears in:** + - [InitConfiguration](#kubeadm-k8s-io-v1beta2-InitConfiguration) -BootstrapToken describes one bootstrap token, stored as a Secret in the cluster +

BootstrapToken describes one bootstrap token, stored as a Secret in the cluster

+ - +

token is used for establishing bidirectional trust between nodes and control-planes. +Used for joining nodes in the cluster.

+ - - +

description sets a human-friendly message why this token exists and what it's used +for, so other administrators can know its purpose.

+ - - +

ttl defines the time to live for this token. Defaults to '24h'. +expires and ttl are mutually exclusive.

+ - - +

expires specifies the timestamp when this token expires. Defaults to being set +dynamically at runtime based on the ttl. expires and ttl are mutually exclusive.

+ - - +

usages describes the ways in which this token can be used. Can by default be used +for establishing bidirectional trust, but that can be changed here.

+ - - +

groups specifies the extra groups that this token will authenticate as when/if +used for authentication.

+ - -
FieldDescription
token [Required]
BootstrapTokenString 		- `token` is used for establishing bidirectional trust between nodes and control-planes. -Used for joining nodes in the cluster.
description [Required]
string 		- `description` sets a human-friendly message why this token exists and what it's used -for, so other administrators can know its purpose.
ttl [Required]
-meta/v1.Duration +meta/v1.Duration 		- `ttl` defines the time to live for this token. Defaults to '24h'. -`expires` and `ttl` are mutually exclusive.
expires [Required]
meta/v1.Time 		- `expires` specifies the timestamp when this token expires. Defaults to being set -dynamically at runtime based on the `ttl`. `expires` and `ttl` are mutually exclusive.
usages [Required]
[]string 		- `usages` describes the ways in which this token can be used. Can by default be used -for establishing bidirectional trust, but that can be changed here.
groups [Required]
[]string 		- `groups` specifies the extra groups that this token will authenticate as when/if -used for authentication.
## `BootstrapTokenDiscovery` {#kubeadm-k8s-io-v1beta2-BootstrapTokenDiscovery} - - **Appears in:** + - [Discovery](#kubeadm-k8s-io-v1beta2-Discovery) -BootstrapTokenDiscovery is used to set the options for bootstrap token based discovery +

BootstrapTokenDiscovery is used to set the options for bootstrap token based discovery

+ - +

token is a token used to validate cluster information fetched from +the control-plane.

+ - - +

apiServerEndpoint is an IP or domain name to the API server from which information +will be fetched.

+ - - +DER-encoded ASN.1. These hashes can be calculated using, for example, OpenSSL.

+ - - +

unsafeSkipCAVerification allows token-based discovery without CA verification via +caCertHashes. This can weaken the security of kubeadm since other nodes can +impersonate the control-plane.

+ - -
FieldDescription
token [Required]
string 		- `token` is a token used to validate cluster information fetched from -the control-plane.
apiServerEndpoint [Required]
string 		- `apiServerEndpoint` is an IP or domain name to the API server from which information -will be fetched.
caCertHashes [Required]
[]string 		- `caCertHashes` specifies a set of public key pins to verify when token-based discovery +

caCertHashes specifies a set of public key pins to verify when token-based discovery is used. The root CA found during discovery must match one of these values. Specifying an empty set disables root CA pinning, which can be unsafe. -Each hash is specified as ":", where the only currently supported type is "sha256". +Each hash is specified as ":", where the only currently supported type is "sha256". This is a hex-encoded SHA-256 hash of the Subject Public Key Info (SPKI) object in -DER-encoded ASN.1. These hashes can be calculated using, for example, OpenSSL.
unsafeSkipCAVerification [Required]
bool 		- `unsafeSkipCAVerification` allows token-based discovery without CA verification via -`caCertHashes`. This can weaken the security of kubeadm since other nodes can -impersonate the control-plane.
## `BootstrapTokenString` {#kubeadm-k8s-io-v1beta2-BootstrapTokenString} - - **Appears in:** + - [BootstrapToken](#kubeadm-k8s-io-v1beta2-BootstrapToken) -BootstrapTokenString is a token of the format abcdef.abcdef0123456789 that is used +

BootstrapTokenString is a token of the format abcdef.abcdef0123456789 that is used for both validation of the practically of the API server from a joining node's point of view and as an authentication method for the node in the bootstrap phase of -"kubeadm join". This token is and should be short-lived +"kubeadm join". This token is and should be short-lived

+ - + No description provided. - - + No description provided. - -
FieldDescription
- [Required]
string 		- No description provided. -
- [Required]
string 		- No description provided. -
## `ControlPlaneComponent` {#kubeadm-k8s-io-v1beta2-ControlPlaneComponent} - - **Appears in:** + - [ClusterConfiguration](#kubeadm-k8s-io-v1beta2-ClusterConfiguration) + - [APIServer](#kubeadm-k8s-io-v1beta2-APIServer) -ControlPlaneComponent holds settings common to control plane component of the cluster +

ControlPlaneComponent holds settings common to control plane component of the cluster

+ - +without leading dash(es).

+ - - +

extraVolumes is an extra set of host volumes mounted to the control plane +component.

+ - -
FieldDescription
extraArgs [Required]
map[string]string 		- `extraArgs` is an extra set of flags to pass to a control plane component. +

extraArgs is an extra set of flags to pass to a control plane component. A key in this map is the flag name as it appears on the command line except -without leading dash(es).
extraVolumes [Required]
[]HostPathMount 		- `extraVolumes` is an extra set of host volumes mounted to the control plane -component.
## `DNS` {#kubeadm-k8s-io-v1beta2-DNS} - - **Appears in:** + - [ClusterConfiguration](#kubeadm-k8s-io-v1beta2-ClusterConfiguration) -DNS defines the DNS addon that should be used in the cluster +

DNS defines the DNS addon that should be used in the cluster

+ - +

type defines the DNS add-on to be used.

+ - - +

ImageMeta allows to customize the image used for the DNS component

+ - -
FieldDescription
type [Required]
DNSAddOnType 		- `type` defines the DNS add-on to be used.
ImageMeta [Required]
ImageMeta 		(Members of ImageMeta are embedded into this type.) - ImageMeta allows to customize the image used for the DNS component
@@ -927,523 +828,481 @@ DNS defines the DNS addon that should be used in the cluster (Alias of `string`) - **Appears in:** + - [DNS](#kubeadm-k8s-io-v1beta2-DNS) -DNSAddOnType defines string identifying DNS add-on types. +

DNSAddOnType defines string identifying DNS add-on types.

+ ## `Discovery` {#kubeadm-k8s-io-v1beta2-Discovery} - - **Appears in:** + - [JoinConfiguration](#kubeadm-k8s-io-v1beta2-JoinConfiguration) -Discovery specifies the options for the kubelet to use during the TLS Bootstrap process +

Discovery specifies the options for the kubelet to use during the TLS Bootstrap process

+ - +

bootstrapToken is used to set the options for bootstrap token based discovery. +bootstrapToken and file are mutually exclusive.

+ - - +bootstrapToken and file are mutually exclusive.

+ - - +

tlsBootstrapToken is a token used for TLS bootstrapping. +If bootstrapToken is set, this field is defaulted to .bootstrapToken.token, but can be overridden. If file` is set, this field must be set in case the KubeConfigFile does not +contain any other authentication information.

+ - - +

timeout modifies the discovery timeout.

+ - -
FieldDescription
bootstrapToken [Required]
BootstrapTokenDiscovery 		- `bootstrapToken` is used to set the options for bootstrap token based discovery. -`bootstrapToken` and `file` are mutually exclusive.
file [Required]
FileDiscovery 		- `file` is used to specify a file or URL to a kubeconfig file from which to load +

file is used to specify a file or URL to a kubeconfig file from which to load cluster information. -`bootstrapToken` and `file` are mutually exclusive.
tlsBootstrapToken [Required]
string 		- `tlsBootstrapToken` is a token used for TLS bootstrapping. -If `bootstrapToken` is set, this field is defaulted to `.bootstrapToken.token, -but can be overridden. -If `file` is set, this field ∗∗must be set∗∗ in case the KubeConfigFile does not -contain any other authentication information.
timeout [Required]
-meta/v1.Duration +meta/v1.Duration 		- `timeout` modifies the discovery timeout.
## `Etcd` {#kubeadm-k8s-io-v1beta2-Etcd} - - **Appears in:** + - [ClusterConfiguration](#kubeadm-k8s-io-v1beta2-ClusterConfiguration) -Etcd contains elements describing Etcd configuration. +

Etcd contains elements describing Etcd configuration.

+ - +

local provides configuration knobs for configuring the local etcd instance. +local and external are mutually exclusive.

+ - - +

external describes how to connect to an external etcd cluster. +local and external are mutually exclusive.

+ - -
FieldDescription
local [Required]
LocalEtcd 		- `local` provides configuration knobs for configuring the local etcd instance. -`local` and `external` are mutually exclusive.
external [Required]
ExternalEtcd 		- `external` describes how to connect to an external etcd cluster. -`local` and `external` are mutually exclusive.
## `ExternalEtcd` {#kubeadm-k8s-io-v1beta2-ExternalEtcd} - - **Appears in:** + - [Etcd](#kubeadm-k8s-io-v1beta2-Etcd) -ExternalEtcd describes an external etcd cluster. -Kubeadm has no knowledge of where certificate files live and they must be supplied. +

ExternalEtcd describes an external etcd cluster. +Kubeadm has no knowledge of where certificate files live and they must be supplied.

+ - +

endpoints of etcd members.

+ - - +

caFile is an SSL Certificate Authority (CA) file used to secure etcd communication. +Required if using a TLS connection.

+ - - +

certFile is an SSL certification file used to secure etcd communication. +Required if using a TLS connection.

+ - - +

keyFile is an SSL key file used to secure etcd communication. +Required if using a TLS connection.

+ - -
FieldDescription
endpoints [Required]
[]string 		- `endpoints` of etcd members.
caFile [Required]
string 		- `caFile` is an SSL Certificate Authority (CA) file used to secure etcd communication. -Required if using a TLS connection.
certFile [Required]
string 		- `certFile` is an SSL certification file used to secure etcd communication. -Required if using a TLS connection.
keyFile [Required]
string 		- `keyFile` is an SSL key file used to secure etcd communication. -Required if using a TLS connection.
## `FileDiscovery` {#kubeadm-k8s-io-v1beta2-FileDiscovery} - - **Appears in:** + - [Discovery](#kubeadm-k8s-io-v1beta2-Discovery) -FileDiscovery is used to specify a file or URL to a kubeconfig file from which to load cluster information +

FileDiscovery is used to specify a file or URL to a kubeconfig file from which to load cluster information

+ - +

kubeConfigPath is used to specify the actual file path or URL to the kubeconfig file +from which to load cluster information.

+ - -
FieldDescription
kubeConfigPath [Required]
string 		- `kubeConfigPath` is used to specify the actual file path or URL to the kubeconfig file -from which to load cluster information.
## `HostPathMount` {#kubeadm-k8s-io-v1beta2-HostPathMount} - - **Appears in:** + - [ControlPlaneComponent](#kubeadm-k8s-io-v1beta2-ControlPlaneComponent) -HostPathMount contains elements describing volumes that are mounted from the host. +

HostPathMount contains elements describing volumes that are mounted from the host.

+ - +

name of the volume inside the Pod template.

+ - - +

hostPath is the path in the host that will be mounted inside the Pod.

+ - - +

mountPathis the path inside the Pod where hostPath volume will be mounted.

+ - - +

readOnly controls write access to the volume.

+ - - +

pathType is the type of the HostPath.

+ - -
FieldDescription
name [Required]
string 		- `name` of the volume inside the Pod template.
hostPath [Required]
string 		- `hostPath` is the path in the host that will be mounted inside the Pod.
mountPath [Required]
string 		- `mountPath`is the path inside the Pod where hostPath volume will be mounted.
readOnly [Required]
bool 		- `readOnly` controls write access to the volume.
pathType [Required]
core/v1.HostPathType 		- `pathType` is the type of the HostPath.
## `ImageMeta` {#kubeadm-k8s-io-v1beta2-ImageMeta} - - **Appears in:** + - [DNS](#kubeadm-k8s-io-v1beta2-DNS) + - [LocalEtcd](#kubeadm-k8s-io-v1beta2-LocalEtcd) -ImageMeta allows to customize the image used for components that are not -originated from the Kubernetes/Kubernetes release process +

ImageMeta allows to customize the image used for components that are not +originated from the Kubernetes/Kubernetes release process

+ - +

mageRepository sets the container registry to pull images from. +If not set, the imageRepository defined in ClusterConfiguration will be used.

+ - - +version of the above components during upgrades.

+ - -
FieldDescription
imageRepository [Required]
string 		- `mageRepository` sets the container registry to pull images from. -If not set, the `imageRepository` defined in ClusterConfiguration will be used.
imageTag [Required]
string 		- `imageTag` allows for specifying a tag for the image. +

imageTag allows for specifying a tag for the image. In case this value is set, kubeadm does not change automatically the -version of the above components during upgrades.
## `JoinControlPlane` {#kubeadm-k8s-io-v1beta2-JoinControlPlane} - - **Appears in:** + - [JoinConfiguration](#kubeadm-k8s-io-v1beta2-JoinConfiguration) -JoinControlPlane contains elements describing an additional control plane instance -to be deployed on the joining node. +

JoinControlPlane contains elements describing an additional control plane instance +to be deployed on the joining node.

+ - +

localAPIEndpoint represents the endpoint of the API server instance +to be deployed on this node.

+ - - +The corresponding encryption key is in the InitConfiguration.

+ - -
FieldDescription
localAPIEndpoint [Required]
APIEndpoint 		- `localAPIEndpoint` represents the endpoint of the API server instance -to be deployed on this node.
certificateKey [Required]
string 		- `certificateKey` is the key that is used for decryption of certificates after +

certificateKey is the key that is used for decryption of certificates after they are downloaded from the secret upon joining a new control plane node. -The corresponding encryption key is in the InitConfiguration.
## `LocalEtcd` {#kubeadm-k8s-io-v1beta2-LocalEtcd} - - **Appears in:** + - [Etcd](#kubeadm-k8s-io-v1beta2-Etcd) -LocalEtcd describes that kubeadm should run an etcd cluster locally. +

LocalEtcd describes that kubeadm should run an etcd cluster locally.

+ - +

ImageMeta allows to customize the container used for etcd.

+ - - +

dataDir is the directory etcd will place its data. +Defaults to "/var/lib/etcd".

+ - - +command line except without leading dash(es).

+ - - +

serverCertSANs sets extra Subject Alternative Names (SANs) for the +etcd server signing certificate.

+ - - +

peerCertSANs sets extra Subject Alternative Names (SANs) for the +etcd peer signing certificate.

+ - -
FieldDescription
ImageMeta [Required]
ImageMeta 		(Members of ImageMeta are embedded into this type.) - ImageMeta allows to customize the container used for etcd.
dataDir [Required]
string 		- `dataDir` is the directory etcd will place its data. -Defaults to "/var/lib/etcd".
extraArgs [Required]
map[string]string 		- `extraArgs` are extra arguments provided to the etcd binary when run +

extraArgs are extra arguments provided to the etcd binary when run inside a static pod. A key in this map is the flag name as it appears on the -command line except without leading dash(es).
serverCertSANs [Required]
[]string 		- `serverCertSANs` sets extra Subject Alternative Names (SANs) for the -etcd server signing certificate.
peerCertSANs [Required]
[]string 		- `peerCertSANs` sets extra Subject Alternative Names (SANs) for the -etcd peer signing certificate.
## `Networking` {#kubeadm-k8s-io-v1beta2-Networking} - - **Appears in:** + - [ClusterConfiguration](#kubeadm-k8s-io-v1beta2-ClusterConfiguration) -Networking contains elements describing cluster's networking configuration +

Networking contains elements describing cluster's networking configuration

+ - +

serviceSubnet is the subnet used by kubernetes Services. Defaults to "10.96.0.0/12".

+ - - +

podSubnet is the subnet used by Pods.

+ - - +

dnsDomain is the DNS domain used by kubernetes Services. Defaults to "cluster.local".

+ - -
FieldDescription
serviceSubnet [Required]
string 		- `serviceSubnet` is the subnet used by kubernetes Services. Defaults to "10.96.0.0/12".
podSubnet [Required]
string 		- `podSubnet` is the subnet used by Pods.
dnsDomain [Required]
string 		- `dnsDomain` is the DNS domain used by kubernetes Services. Defaults to "cluster.local".
## `NodeRegistrationOptions` {#kubeadm-k8s-io-v1beta2-NodeRegistrationOptions} - - **Appears in:** + - [InitConfiguration](#kubeadm-k8s-io-v1beta2-InitConfiguration) + - [JoinConfiguration](#kubeadm-k8s-io-v1beta2-JoinConfiguration) -NodeRegistrationOptions holds fields that relate to registering a new control-plane -or node to the cluster, either via "kubeadm init" or "kubeadm join". +

NodeRegistrationOptions holds fields that relate to registering a new control-plane +or node to the cluster, either via "kubeadm init" or "kubeadm join".

+ - +Defaults to the hostname of the node if not provided.

+ - - +

`criSocket is used to retrieve container runtime information. This information will +be annotated to the Node API object, for later re-use.

+ - - +

taints specifies the taints the Node API object should be registered with. +If this field is unset, i.e. nil, in the kubeadm init process it will be defaulted to +'node-role.kubernetes.io/master=""'. If you don't want to taint your control-plane node, +set this field to an empty list, i.e. taints: [] in the YAML file. This field is +solely used for Node registration.

+ - - +A key in this map is the flag name as it appears on the command line except without leading dash(es).

+ - - +

ignorePreflightErrors provides a list of pre-flight errors to be ignored when the +current node is registered.

+ - -
FieldDescription
name [Required]
string 		- `name` is the `.Metadata.Name` field of the Node API object that will be created -in this `kubeadm init` or `kubeadm join` operation. -This field is also used in the `CommonName` field of the kubelet's client certificate +

name is the .Metadata.Name field of the Node API object that will be created +in this kubeadm init or kubeadm join operation. +This field is also used in the CommonName field of the kubelet's client certificate to the API server. -Defaults to the hostname of the node if not provided.
criSocket [Required]
string 		- `criSocket is used to retrieve container runtime information. This information will -be annotated to the Node API object, for later re-use.
taints [Required]
[]core/v1.Taint 		- `taints` specifies the taints the Node API object should be registered with. -If this field is unset, i.e. nil, in the `kubeadm init` process it will be defaulted to -`'node-role.kubernetes.io/master=""'`. If you don't want to taint your control-plane node, -set this field to an empty list, i.e. `taints: []` in the YAML file. This field is -solely used for Node registration.
kubeletExtraArgs [Required]
map[string]string 		- `kubeletExtraArgs` passes through extra arguments to the kubelet. The arguments here are +

kubeletExtraArgs passes through extra arguments to the kubelet. The arguments here are passed to the kubelet command line via the environment file kubeadm writes at runtime for the kubelet to source. This overrides the generic base-level configuration in the 'kubelet-config-1.X' ConfigMap. Flags have higher priority when parsing. These values are local and specific to the node kubeadm is executing on. -A key in this map is the flag name as it appears on the command line except without leading dash(es).
ignorePreflightErrors [Required]
[]string 		- `ignorePreflightErrors` provides a list of pre-flight errors to be ignored when the -current node is registered.
diff --git a/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md b/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md index 024a4a6f0a..10c1ff80dd 100644 --- a/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md +++ b/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md @@ -4,293 +4,262 @@ content_type: tool-reference package: kubeadm.k8s.io/v1beta3 auto_generated: true --- -## Overview - -Package v1beta3 defines the v1beta3 version of the kubeadm configuration file format. -This version improves on the v1beta2 format by fixing some minor issues and adding a few new fields. - -A list of changes since v1beta2: - -- The deprecated "ClusterConfiguration.useHyperKubeImage" field has been removed. - Kubeadm no longer supports the hyperkube image. -- The "ClusterConfiguration.DNS.Type" field has been removed since CoreDNS is the only supported - DNS server type by kubeadm. -- Include "datapolicy" tags on the fields that hold secrets. - This would result in the field values to be omitted when API structures are printed with klog. -- Add "InitConfiguration.SkipPhases", "JoinConfiguration.SkipPhases" to allow skipping - a list of phases during kubeadm init/join command execution. -- Add "InitConfiguration.NodeRegistration.ImagePullPolicy" and "JoinConfiguration.NodeRegistration.ImagePullPolicy" - to allow specifying the images pull policy during kubeadm "init" and "join". - The value must be one of "Always", "Never" or "IfNotPresent". - "IfNotPresent" is the default, which has been the existing behavior prior to this addition. -- Add "InitConfiguration.Patches.Directory", "JoinConfiguration.Patches.Directory" to allow - the user to configure a directory from which to take patches for components deployed by kubeadm. -- Move the BootstrapToken∗ API and related utilities out of the "kubeadm" API group to a new group - "bootstraptoken". The kubeadm API version v1beta3 no longer contains the BootstrapToken∗ structures. - -Migration from old kubeadm config versions - -- kubeadm v1.15.x and newer can be used to migrate from v1beta1 to v1beta2. -- kubeadm v1.22.x and newer no longer support v1beta1 and older APIs, but can be used to migrate v1beta2 to v1beta3. - -## Basics - -The preferred way to configure kubeadm is to pass an YAML configuration file with the `--config` option. Some of the +

Overview

+

Package v1beta3 defines the v1beta3 version of the kubeadm configuration file format. +This version improves on the v1beta2 format by fixing some minor issues and adding a few new fields.

+

A list of changes since v1beta2:

+
    +
  • The deprecated "ClusterConfiguration.useHyperKubeImage" field has been removed. +Kubeadm no longer supports the hyperkube image.
    • +
  • The "ClusterConfiguration.DNS.Type" field has been removed since CoreDNS is the only supported +DNS server type by kubeadm.
    • +
  • Include "datapolicy" tags on the fields that hold secrets. +This would result in the field values to be omitted when API structures are printed with klog.
    • +
  • Add "InitConfiguration.SkipPhases", "JoinConfiguration.SkipPhases" to allow skipping +a list of phases during kubeadm init/join command execution.
    • +
  • Add "InitConfiguration.NodeRegistration.ImagePullPolicy" and "JoinConfiguration.NodeRegistration.ImagePullPolicy" +to allow specifying the images pull policy during kubeadm "init" and "join". +The value must be one of "Always", "Never" or "IfNotPresent". +"IfNotPresent" is the default, which has been the existing behavior prior to this addition.
    • +
  • Add "InitConfiguration.Patches.Directory", "JoinConfiguration.Patches.Directory" to allow +the user to configure a directory from which to take patches for components deployed by kubeadm.
    • +
  • Move the BootstrapToken* API and related utilities out of the "kubeadm" API group to a new group +"bootstraptoken". The kubeadm API version v1beta3 no longer contains the BootstrapToken* structures.
    • +
+

Migration from old kubeadm config versions

+
    +
  • kubeadm v1.15.x and newer can be used to migrate from v1beta1 to v1beta2.
    • +
  • kubeadm v1.22.x and newer no longer support v1beta1 and older APIs, but can be used to migrate v1beta2 to v1beta3.
    • +
+

Basics

+

The preferred way to configure kubeadm is to pass an YAML configuration file with the --config option. Some of the configuration options defined in the kubeadm config file are also available as command line flags, but only -the most common/simple use case are supported with this approach. - -A kubeadm config file could contain multiple configuration types separated using three dashes (`---`). - -kubeadm supports the following configuration types: - -```yaml -apiVersion: kubeadm.k8s.io/v1beta3 -kind: InitConfiguration - -apiVersion: kubeadm.k8s.io/v1beta3 -kind: ClusterConfiguration - -apiVersion: kubelet.config.k8s.io/v1beta1 -kind: KubeletConfiguration - -apiVersion: kubeproxy.config.k8s.io/v1alpha1 -kind: KubeProxyConfiguration - -apiVersion: kubeadm.k8s.io/v1beta3 -kind: JoinConfiguration -``` - -To print the defaults for "init" and "join" actions use the following commands: - -```shell -kubeadm config print init-defaults +the most common/simple use case are supported with this approach.

+

A kubeadm config file could contain multiple configuration types separated using three dashes (---).

+

kubeadm supports the following configuration types:

+
apiVersion: kubeadm.k8s.io/v1beta3
+kind: InitConfiguration
+
+apiVersion: kubeadm.k8s.io/v1beta3
+kind: ClusterConfiguration
+
+apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+
+apiVersion: kubeproxy.config.k8s.io/v1alpha1
+kind: KubeProxyConfiguration
+
+apiVersion: kubeadm.k8s.io/v1beta3
+kind: JoinConfiguration
+

To print the defaults for "init" and "join" actions use the following commands:

+
kubeadm config print init-defaults
 kubeadm config print join-defaults
-```
-
-The list of configuration types that must be included in a configuration file depends by the action you are
-performing (`init` or `join`) and by the configuration options you are going to use (defaults or advanced
-customization).
-
-If some configuration types are not provided, or provided only partially, kubeadm will use default values; defaults
+

The list of configuration types that must be included in a configuration file depends by the action you are +performing (init or join) and by the configuration options you are going to use (defaults or advanced +customization).

+

If some configuration types are not provided, or provided only partially, kubeadm will use default values; defaults provided by kubeadm includes also enforcing consistency of values across components when required (e.g. -`--cluster-cidr` flag on controller manager and `clusterCIDR` on kube-proxy). - -Users are always allowed to override default values, with the only exception of a small subset of setting with -relevance for security (e.g. enforce authorization-mode Node and RBAC on api server) - -If the user provides a configuration types that is not expected for the action you are performing, kubeadm will -ignore those types and print a warning. - -## Kubeadm init configuration types - -When executing kubeadm init with the `--config` option, the following configuration types could be used: +--cluster-cidr flag on controller manager and clusterCIDR on kube-proxy).

+

Users are always allowed to override default values, with the only exception of a small subset of setting with +relevance for security (e.g. enforce authorization-mode Node and RBAC on api server)

+

If the user provides a configuration types that is not expected for the action you are performing, kubeadm will +ignore those types and print a warning.

+

Kubeadm init configuration types

+

When executing kubeadm init with the --config option, the following configuration types could be used: InitConfiguration, ClusterConfiguration, KubeProxyConfiguration, KubeletConfiguration, but only one -between InitConfiguration and ClusterConfiguration is mandatory. - -```yaml -apiVersion: kubeadm.k8s.io/v1beta3 -kind: InitConfiguration -bootstrapTokens: - ... -nodeRegistration: - ... -``` - -The InitConfiguration type should be used to configure runtime settings, that in case of kubeadm init +between InitConfiguration and ClusterConfiguration is mandatory.

+
apiVersion: kubeadm.k8s.io/v1beta3
+kind: InitConfiguration
+bootstrapTokens:
+  ...
+nodeRegistration:
+  ...
+

The InitConfiguration type should be used to configure runtime settings, that in case of kubeadm init are the configuration of the bootstrap token and all the setting which are specific to the node where -kubeadm is executed, including: - -- NodeRegistration, that holds fields that relate to registering the new node to the cluster; - use it to customize the node name, the CRI socket to use or any other settings that should apply to this - node only (e.g. the node ip). - -- LocalAPIEndpoint, that represents the endpoint of the instance of the API server to be deployed on this node; - use it e.g. to customize the API server advertise address. - - ``` - apiVersion: kubeadm.k8s.io/v1beta3 - kind: ClusterConfiguration - networking: - ... - etcd: - ... - apiServer: - extraArgs: - ... - extraVolumes: - ... - ... - ``` - -The ClusterConfiguration type should be used to configure cluster-wide settings, -including settings for: - -- Networking, that holds configuration for the networking topology of the cluster; use it e.g. to customize - Pod subnet or services subnet. - -- Etcd configurations; use it e.g. to customize the local etcd or to configure the API server - for using an external etcd cluster. - -- kube-apiserver, kube-scheduler, kube-controller-manager configurations; use it to customize control-plane - components by adding customized setting or overriding kubeadm default settings. - - ```yaml - apiVersion: kubeproxy.config.k8s.io/v1alpha1 - kind: KubeProxyConfiguration - ... - ``` - -The KubeProxyConfiguration type should be used to change the configuration passed to kube-proxy instances -deployed in the cluster. If this object is not provided or provided only partially, kubeadm applies defaults. - -See https://kubernetes.io/docs/reference/command-line-tools-reference/kube-proxy/ or +kubeadm is executed, including:

+
    +
  • +

    NodeRegistration, that holds fields that relate to registering the new node to the cluster; +use it to customize the node name, the CRI socket to use or any other settings that should apply to this +node only (e.g. the node ip).

    +
    • +
  • +

    LocalAPIEndpoint, that represents the endpoint of the instance of the API server to be deployed on this node; +use it e.g. to customize the API server advertise address.

    +
    • +
+
apiVersion: kubeadm.k8s.io/v1beta3
+kind: ClusterConfiguration
+networking:
+  ...
+etcd:
+  ...
+apiServer:
+  extraArgs:
+    ...
+  extraVolumes:
+    ...
+...
+

The ClusterConfiguration type should be used to configure cluster-wide settings, +including settings for:

+
    +
  • +

    networking that holds configuration for the networking topology of the cluster; use it e.g. to customize +Pod subnet or services subnet.

    +
    • +
  • +

    etcd: use it e.g. to customize the local etcd or to configure the API server +for using an external etcd cluster.

    +
    • +
  • +

    kube-apiserver, kube-scheduler, kube-controller-manager configurations; use it to customize control-plane +components by adding customized setting or overriding kubeadm default settings.

    +
    • +
+
apiVersion: kubeproxy.config.k8s.io/v1alpha1
+kind: KubeProxyConfiguration
+  ...
+

The KubeProxyConfiguration type should be used to change the configuration passed to kube-proxy instances +deployed in the cluster. If this object is not provided or provided only partially, kubeadm applies defaults.

+

See https://kubernetes.io/docs/reference/command-line-tools-reference/kube-proxy/ or https://godoc.org/k8s.io/kube-proxy/config/v1alpha1#KubeProxyConfiguration -for kube-proxy official documentation. - -```yaml -apiVersion: kubelet.config.k8s.io/v1beta1 -kind: KubeletConfiguration - ... -``` - -The KubeletConfiguration type should be used to change the configurations that will be passed to all kubelet instances -deployed in the cluster. If this object is not provided or provided only partially, kubeadm applies defaults. - -See https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/ or +for kube-proxy official documentation.

+
apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+  ...
+

The KubeletConfiguration type should be used to change the configurations that will be passed to all kubelet instances +deployed in the cluster. If this object is not provided or provided only partially, kubeadm applies defaults.

+

See https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/ or https://godoc.org/k8s.io/kubelet/config/v1beta1#KubeletConfiguration -for kubelet official documentation. - -Here is a fully populated example of a single YAML file containing multiple -configuration types to be used during a `kubeadm init` run. - -```yaml -apiVersion: kubeadm.k8s.io/v1beta3 -kind: InitConfiguration -bootstrapTokens: -- token: "9a08jv.c0izixklcxtmnze7" - description: "kubeadm bootstrap token" - ttl: "24h" -- token: "783bde.3f89s0fje9f38fhf" - description: "another bootstrap token" - usages: - - authentication - - signing - groups: - - system:bootstrappers:kubeadm:default-node-token -nodeRegistration: - name: "ec2-10-100-0-1" - criSocket: "/var/run/dockershim.sock" - taints: - - key: "kubeadmNode" - value: "master" - effect: "NoSchedule" - kubeletExtraArgs: - v: 4 -ignorePreflightErrors: -- IsPrivilegedUser - imagePullPolicy: "IfNotPresent" -localAPIEndpoint: - advertiseAddress: "10.100.0.1" - bindPort: 6443 -certificateKey: "e6a2eb8581237ab72a4f494f30285ec12a9694d750b9785706a83bfcbbbd2204" - skipPhases: - - addon/kube-proxy ---- -apiVersion: kubeadm.k8s.io/v1beta3 -kind: ClusterConfiguration -etcd: - # one of local or external - local: - imageRepository: "k8s.gcr.io" - imageTag: "3.2.24" - dataDir: "/var/lib/etcd" - extraArgs: - listen-client-urls: "http://10.100.0.1:2379" - serverCertSANs: - - "ec2-10-100-0-1.compute-1.amazonaws.com" - peerCertSANs: - - "10.100.0.1" - # external: - # endpoints: - # - "10.100.0.1:2379" - # - "10.100.0.2:2379" - # caFile: "/etcd/kubernetes/pki/etcd/etcd-ca.crt" - # certFile: "/etcd/kubernetes/pki/etcd/etcd.crt" - # keyFile: "/etcd/kubernetes/pki/etcd/etcd.key" -networking: - serviceSubnet: "10.96.0.0/16" - podSubnet: "10.244.0.0/24" - dnsDomain: "cluster.local" -kubernetesVersion: "v1.21.0" -controlPlaneEndpoint: "10.100.0.1:6443" -apiServer: - extraArgs: - authorization-mode: "Node,RBAC" - extraVolumes: - - name: "some-volume" - hostPath: "/etc/some-path" - mountPath: "/etc/some-pod-path" - readOnly: false - pathType: File - certSANs: - - "10.100.1.1" - - "ec2-10-100-0-1.compute-1.amazonaws.com" - timeoutForControlPlane: 4m0s -controllerManager: - extraArgs: - "node-cidr-mask-size": "20" - extraVolumes: - - name: "some-volume" - hostPath: "/etc/some-path" - mountPath: "/etc/some-pod-path" - readOnly: false - pathType: File -scheduler: - extraArgs: - address: "10.100.0.1" - extraVolumes: - - name: "some-volume" - hostPath: "/etc/some-path" - mountPath: "/etc/some-pod-path" - readOnly: false - pathType: File -certificatesDir: "/etc/kubernetes/pki" -imageRepository: "k8s.gcr.io" -clusterName: "example-cluster" ---- -apiVersion: kubelet.config.k8s.io/v1beta1 -kind: KubeletConfiguration -# kubelet specific options here ---- -apiVersion: kubeproxy.config.k8s.io/v1alpha1 -kind: KubeProxyConfiguration -# kube-proxy specific options here -``` - -## Kubeadm join configuration types - -When executing `kubeadm join` with the `--config` option, the JoinConfiguration type should be provided. - -```yaml -apiVersion: kubeadm.k8s.io/v1beta3 -kind: JoinConfiguration - ... -``` - -The JoinConfiguration type should be used to configure runtime settings, that in case of `kubeadm join` +for kubelet official documentation.

+

Here is a fully populated example of a single YAML file containing multiple +configuration types to be used during a kubeadm init run.

+
apiVersion: kubeadm.k8s.io/v1beta3
+kind: InitConfiguration
+bootstrapTokens:
+- token: "9a08jv.c0izixklcxtmnze7"
+  description: "kubeadm bootstrap token"
+  ttl: "24h"
+- token: "783bde.3f89s0fje9f38fhf"
+  description: "another bootstrap token"
+  usages:
+  - authentication
+  - signing
+  groups:
+  - system:bootstrappers:kubeadm:default-node-token
+nodeRegistration:
+  name: "ec2-10-100-0-1"
+  criSocket: "/var/run/dockershim.sock"
+  taints:
+  - key: "kubeadmNode"
+    value: "master"
+    effect: "NoSchedule"
+  kubeletExtraArgs:
+    v: 4
+ignorePreflightErrors:
+- IsPrivilegedUser
+   imagePullPolicy: "IfNotPresent"
+localAPIEndpoint:
+  advertiseAddress: "10.100.0.1"
+  bindPort: 6443
+certificateKey: "e6a2eb8581237ab72a4f494f30285ec12a9694d750b9785706a83bfcbbbd2204"
+ skipPhases:
+ - addon/kube-proxy
+---
+apiVersion: kubeadm.k8s.io/v1beta3
+kind: ClusterConfiguration
+etcd:
+  # one of local or external
+  local:
+    imageRepository: "k8s.gcr.io"
+    imageTag: "3.2.24"
+    dataDir: "/var/lib/etcd"
+    extraArgs:
+      listen-client-urls: "http://10.100.0.1:2379"
+    serverCertSANs:
+    -  "ec2-10-100-0-1.compute-1.amazonaws.com"
+    peerCertSANs:
+    - "10.100.0.1"
+  # external:
+    # endpoints:
+    # - "10.100.0.1:2379"
+    # - "10.100.0.2:2379"
+    # caFile: "/etcd/kubernetes/pki/etcd/etcd-ca.crt"
+    # certFile: "/etcd/kubernetes/pki/etcd/etcd.crt"
+    # keyFile: "/etcd/kubernetes/pki/etcd/etcd.key"
+networking:
+  serviceSubnet: "10.96.0.0/16"
+  podSubnet: "10.244.0.0/24"
+  dnsDomain: "cluster.local"
+kubernetesVersion: "v1.21.0"
+controlPlaneEndpoint: "10.100.0.1:6443"
+apiServer:
+  extraArgs:
+    authorization-mode: "Node,RBAC"
+  extraVolumes:
+  - name: "some-volume"
+    hostPath: "/etc/some-path"
+    mountPath: "/etc/some-pod-path"
+    readOnly: false
+    pathType: File
+  certSANs:
+  - "10.100.1.1"
+  - "ec2-10-100-0-1.compute-1.amazonaws.com"
+  timeoutForControlPlane: 4m0s
+controllerManager:
+  extraArgs:
+    "node-cidr-mask-size": "20"
+  extraVolumes:
+  - name: "some-volume"
+    hostPath: "/etc/some-path"
+    mountPath: "/etc/some-pod-path"
+    readOnly: false
+    pathType: File
+scheduler:
+  extraArgs:
+    address: "10.100.0.1"
+  extraVolumes:
+  - name: "some-volume"
+    hostPath: "/etc/some-path"
+    mountPath: "/etc/some-pod-path"
+    readOnly: false
+    pathType: File
+certificatesDir: "/etc/kubernetes/pki"
+imageRepository: "k8s.gcr.io"
+clusterName: "example-cluster"
+---
+apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+# kubelet specific options here
+---
+apiVersion: kubeproxy.config.k8s.io/v1alpha1
+kind: KubeProxyConfiguration
+# kube-proxy specific options here
+

Kubeadm join configuration types

+

When executing kubeadm join with the --config option, the JoinConfiguration type should be provided.

+
apiVersion: kubeadm.k8s.io/v1beta3
+kind: JoinConfiguration
+  ...
+

The JoinConfiguration type should be used to configure runtime settings, that in case of kubeadm join are the discovery method used for accessing the cluster info and all the setting which are specific -to the node where kubeadm is executed, including: +to the node where kubeadm is executed, including:

+
    +
  • +

    nodeRegistration, that holds fields that relate to registering the new node to the cluster; +use it to customize the node name, the CRI socket to use or any other settings that should apply to this +node only (e.g. the node ip).

    +
    • +
  • +

    apiEndpoint, that represents the endpoint of the instance of the API server to be eventually deployed on this node.

    +
    • +
-- NodeRegistration, that holds fields that relate to registering the new node to the cluster; - use it to customize the node name, the CRI socket to use or any other settings that should apply to this - node only (e.g. the node ip). - -- APIEndpoint, that represents the endpoint of the instance of the API server to be eventually deployed on this node. ## Resource Types - [ClusterConfiguration](#kubeadm-k8s-io-v1beta3-ClusterConfiguration) +- [InitConfiguration](#kubeadm-k8s-io-v1beta3-InitConfiguration) - [JoinConfiguration](#kubeadm-k8s-io-v1beta3-JoinConfiguration) @@ -299,10 +268,9 @@ to the node where kubeadm is executed, including: +

ClusterConfiguration contains cluster-wide configuration for a kubeadm cluster

-ClusterConfiguration contains cluster-wide configuration for a kubeadm cluster - @@ -310,120 +278,183 @@ ClusterConfiguration contains cluster-wide configuration for a kubeadm cluster - - +

etcd holds the configuration for etcd.

+ - - +

networking holds configuration for the networking topology of the cluster.

+ - - +

kubernetesVersion is the target version of the control plane.

+ - - +In case the controlPlaneEndpoint is not specified, the advertiseAddress + bindPort +are used; in case the controlPlaneEndpoint is specified but without a TCP port, +the bindPort is used. +Possible usages are:

+
    +
  • In a cluster with more than one control plane instances, this field should be +assigned the address of the external load balancer in front of the +control plane instances.
    • +
  • In environments with enforced node recycling, the controlPlaneEndpoint could +be used for assigning a stable DNS to the control plane.
    • +
+ - - +

apiServer contains extra settings for the API server.

+ - - +

controllerManager contains extra settings for the controller manager.

+ - - +

scheduler contains extra settings for the scheduler.

+ - - +

dns defines the options for the DNS add-on installed in the cluster.

+ - - +

certificatesDir specifies where to store or look for all required certificates.

+ - - +

imageRepository sets the container registry to pull images from. +If empty, k8s.gcr.io will be used by default. +In case of kubernetes version is a CI build (kubernetes version starts with ci/) +gcr.io/k8s-staging-ci-images will be used as a default for control plane components +and for kube-proxy, while k8s.gcr.io will be used for all the other images.

+ - - +

featureGates contains the feature gates enabled by the user.

+ - - +

The cluster name.

+ + +
FieldDescription
apiVersion
string		kubeadm.k8s.io/v1beta3
kind
string		ClusterConfiguration
etcd
Etcd 		- `etcd` holds the configuration for etcd.
networking
Networking 		- `networking` holds configuration for the networking topology of the cluster.
kubernetesVersion
string 		- `kubernetesVersion` is the target version of the control plane.
controlPlaneEndpoint
string 		- `controlPlaneEndpoint` sets a stable IP address or DNS name for the control plane. +

controlPlaneEndpoint sets a stable IP address or DNS name for the control plane. It can be a valid IP address or a RFC-1123 DNS subdomain, both with optional TCP port. -In case the `controlPlaneEndpoint` is not specified, the `advertiseAddress` + `bindPort` -are used; in case the `controlPlaneEndpoint` is specified but without a TCP port, -the `bindPort` is used. -Possible usages are: - -- In a cluster with more than one control plane instances, this field should be - assigned the address of the external load balancer in front of the - control plane instances. -- In environments with enforced node recycling, the `controlPlaneEndpoint` could - be used for assigning a stable DNS to the control plane.
apiServer
APIServer 		- `apiServer` contains extra settings for the API server.
controllerManager
ControlPlaneComponent 		- `controllerManager` contains extra settings for the controller manager.
scheduler
ControlPlaneComponent 		- `scheduler` contains extra settings for the scheduler.
dns
DNS 		- `dns` defines the options for the DNS add-on installed in the cluster.
certificatesDir
string 		- `certificatesDir` specifies where to store or look for all required certificates.
imageRepository
string 		- `imageRepository` sets the container registry to pull images from. -If empty, `k8s.gcr.io` will be used by default. -In case of kubernetes version is a CI build (kubernetes version starts with `ci/`) -`gcr.io/k8s-staging-ci-images` will be used as a default for control plane components -and for kube-proxy, while `k8s.gcr.io` will be used for all the other images.
featureGates
map[string]bool 		- `featureGates` contains the feature gates enabled by the user.
clusterName
string 		- The cluster name.
+ +## `InitConfiguration` {#kubeadm-k8s-io-v1beta3-InitConfiguration} + + + +

InitConfiguration contains a list of elements that is specific "kubeadm init"-only runtime +information. +kubeadm init-only information. These fields are solely used the first time kubeadm init runs. +After that, the information in the fields IS NOT uploaded to the kubeadm-config ConfigMap +that is used by kubeadm upgrade for instance. These fields must be omitempty.

+ + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
apiVersion
string		kubeadm.k8s.io/v1beta3
kind
string		InitConfiguration
bootstrapTokens
+[]BootstrapToken +		 +

bootstrapTokens is respected at kubeadm init time and describes a set of Bootstrap Tokens to create. +This information IS NOT uploaded to the kubeadm cluster configmap, partly because of its sensitive nature

+
nodeRegistration
+NodeRegistrationOptions +		 +

nodeRegistration holds fields that relate to registering the new control-plane node +to the cluster.

+
localAPIEndpoint
+APIEndpoint +		 +

localAPIEndpoint represents the endpoint of the API server instance that's deployed on this +control plane node. In HA setups, this differs from ClusterConfiguration.controlPlaneEndpoint +in the sense that controlPlaneEndpoint is the global endpoint for the cluster, which then +load-balances the requests to each individual API server. +This configuration object lets you customize what IP/DNS name and port the local API server +advertises it's accessible on. By default, kubeadm tries to auto-detect the IP of the default +interface and use that, but in case that process fails you may set the desired value here.

+
certificateKey
+string +		 +

certificateKey sets the key with which certificates and keys are encrypted prior to being +uploaded in a Secret in the cluster during the uploadcerts init phase.

+
skipPhases
+[]string +		 +

skipPhases is a list of phases to skip during command execution. +The list of phases can be obtained with the kubeadm init --help command. +The flag "--skip-phases" takes precedence over this field.

+
patches
+Patches +		 +

patches contains options related to applying patches to components deployed by kubeadm during +kubeadm init.

+
@@ -431,10 +462,9 @@ and for kube-proxy, while `k8s.gcr.io` will be used for all the other images.JoinConfiguration contains elements describing a particular node.

-JoinConfiguration contains elements describing a particular node. - @@ -442,833 +472,768 @@ JoinConfiguration contains elements describing a particular node. - - +

nodeRegistration holds fields that relate to registering the new +control-plane node to the cluster.

+ - - +Defaults to "/etc/kubernetes/pki/ca.crt".

+ - - +

discovery specifies the options for the kubelet to use during the TLS +bootstrap process.

+ - - +

controlPlane defines the additional control plane instance to be deployed +on the joining node. If nil, no additional control plane instance will be deployed.

+ - - +

skipPhases is a list of phases to skip during command execution. +The list of phases can be obtained with the kubeadm join --help command. +The flag --skip-phases takes precedence over this field.

+ - - +

patches contains options related to applying patches to components deployed +by kubeadm during kubeadm join.

+ - -
FieldDescription
apiVersion
string		kubeadm.k8s.io/v1beta3
kind
string		JoinConfiguration
nodeRegistration
NodeRegistrationOptions 		- `nodeRegistration` holds fields that relate to registering the new -control-plane node to the cluster.
caCertPath
string 		- `caCertPath` is the path to the SSL certificate authority used to secure +

caCertPath is the path to the SSL certificate authority used to secure comunications between a node and the control-plane. -Defaults to "/etc/kubernetes/pki/ca.crt".
discovery [Required]
Discovery 		- `discovery` specifies the options for the kubelet to use during the TLS -bootstrap process.
controlPlane
JoinControlPlane 		- `controlPlane` defines the additional control plane instance to be deployed -on the joining node. If nil, no additional control plane instance will be deployed.
skipPhases
[]string 		- `skipPhases` is a list of phases to skip during command execution. -The list of phases can be obtained with the `kubeadm join --help` command. -The flag `--skip-phases` takes precedence over this field.
patches
Patches 		- `patches` contains options related to applying patches to components deployed -by kubeadm during `kubeadm join`.
## `APIEndpoint` {#kubeadm-k8s-io-v1beta3-APIEndpoint} - - **Appears in:** + +- [InitConfiguration](#kubeadm-k8s-io-v1beta3-InitConfiguration) + - [JoinControlPlane](#kubeadm-k8s-io-v1beta3-JoinControlPlane) -APIEndpoint struct contains elements of API server instance deployed on a node. +

APIEndpoint struct contains elements of API server instance deployed on a node.

+ - +

advertiseAddress sets the IP address for the API server to advertise.

+ - - +

bindPorti sets the secure port for the API Server to bind to. +Defaults to 6443.

+ - -
FieldDescription
advertiseAddress
string 		- `advertiseAddress` sets the IP address for the API server to advertise.
bindPort
int32 		- `bindPorti` sets the secure port for the API Server to bind to. -Defaults to 6443.
## `APIServer` {#kubeadm-k8s-io-v1beta3-APIServer} - - **Appears in:** + - [ClusterConfiguration](#kubeadm-k8s-io-v1beta3-ClusterConfiguration) -APIServer holds settings necessary for API server deployments in the cluster +

APIServer holds settings necessary for API server deployments in the cluster

+ - + No description provided. - - +

certSANs sets extra Subject Alternative Names (SANs) for the API Server signing +certificate.

+ - - +

timeoutForControlPlane controls the timeout that we wait for API server to appear.

+ - -
FieldDescription
ControlPlaneComponent [Required]
ControlPlaneComponent 		(Members of ControlPlaneComponent are embedded into this type.) - No description provided. -
certSANs
[]string 		- `certSANs` sets extra Subject Alternative Names (SANs) for the API Server signing -certificate.
timeoutForControlPlane
-meta/v1.Duration +meta/v1.Duration 		- `timeoutForControlPlane` controls the timeout that we wait for API server to appear.
## `BootstrapTokenDiscovery` {#kubeadm-k8s-io-v1beta3-BootstrapTokenDiscovery} - - **Appears in:** + - [Discovery](#kubeadm-k8s-io-v1beta3-Discovery) -BootstrapTokenDiscovery is used to set the options for bootstrap token based discovery +

BootstrapTokenDiscovery is used to set the options for bootstrap token based discovery

+ - +

token is a token used to validate cluster information fetched from the +control-plane.

+ - - +

apiServerEndpoint is an IP or domain name to the API server from which +information will be fetched.

+ - - +Each hash is specified as ":", where the only currently supported type is +"sha256". This is a hex-encoded SHA-256 hash of the Subject Public Key Info (SPKI) +object in DER-encoded ASN.1. These hashes can be calculated using, for example, OpenSSL.

+ - - +

unsafeSkipCAVerification allows token-based discovery without CA verification +via caCertHashes. This can weaken the security of kubeadm since other nodes can +impersonate the control-plane.

+ - -
FieldDescription
token [Required]
string 		- `token` is a token used to validate cluster information fetched from the -control-plane.
apiServerEndpoint
string 		- `apiServerEndpoint` is an IP or domain name to the API server from which -information will be fetched.
caCertHashes
[]string 		- `caCertHashes` specifies a set of public key pins to verify when token-based discovery +

caCertHashes specifies a set of public key pins to verify when token-based discovery is used. The root CA found during discovery must match one of these values. Specifying an empty set disables root CA pinning, which can be unsafe. -Each hash is specified as ":", where the only currently supported type is -"sha256". This is a hex-encoded SHA-256 hash of the Subject Public Key Info (SPKI) -object in DER-encoded ASN.1. These hashes can be calculated using, for example, OpenSSL.
unsafeSkipCAVerification
bool 		- `unsafeSkipCAVerification` allows token-based discovery without CA verification -via `caCertHashes`. This can weaken the security of kubeadm since other nodes can -impersonate the control-plane.
## `ControlPlaneComponent` {#kubeadm-k8s-io-v1beta3-ControlPlaneComponent} - - **Appears in:** + - [ClusterConfiguration](#kubeadm-k8s-io-v1beta3-ClusterConfiguration) + - [APIServer](#kubeadm-k8s-io-v1beta3-APIServer) -ControlPlaneComponent holds settings common to control plane component of the cluster +

ControlPlaneComponent holds settings common to control plane component of the cluster

+ - +without leading dash(es).

+ - - +

extraVolumes is an extra set of host volumes, mounted to the control plane component.

+ - -
FieldDescription
extraArgs
map[string]string 		- `extraArgs` is an extra set of flags to pass to the control plane component. +

extraArgs is an extra set of flags to pass to the control plane component. A key in this map is the flag name as it appears on the command line except -without leading dash(es).
extraVolumes
[]HostPathMount 		- `extraVolumes` is an extra set of host volumes, mounted to the control plane component.
## `DNS` {#kubeadm-k8s-io-v1beta3-DNS} - - **Appears in:** + - [ClusterConfiguration](#kubeadm-k8s-io-v1beta3-ClusterConfiguration) -DNS defines the DNS addon that should be used in the cluster +

DNS defines the DNS addon that should be used in the cluster

+ - +

imageMeta allows to customize the image used for the DNS component.

+ - -
FieldDescription
ImageMeta [Required]
ImageMeta 		(Members of ImageMeta are embedded into this type.) - `imageMeta` allows to customize the image used for the DNS component.
## `Discovery` {#kubeadm-k8s-io-v1beta3-Discovery} - - **Appears in:** + - [JoinConfiguration](#kubeadm-k8s-io-v1beta3-JoinConfiguration) -Discovery specifies the options for the kubelet to use during the TLS Bootstrap process. +

Discovery specifies the options for the kubelet to use during the TLS Bootstrap process.

+ - +

bootstrapToken is used to set the options for bootstrap token based discovery. +bootstrapToken and file are mutually exclusive.

+ - - +bootstrapToken and file are mutually exclusive.

+ - - +

tlsBootstrapToken is a token used for TLS bootstrapping. +If bootstrapToken is set, this field is defaulted to .bootstrapToken.token, but +can be overridden. If file is set, this field must be set in case the KubeConfigFile +does not contain any other authentication information

+ - - +

timeout modifies the discovery timeout.

+ - -
FieldDescription
bootstrapToken
BootstrapTokenDiscovery 		- `bootstrapToken` is used to set the options for bootstrap token based discovery. -`bootstrapToken` and `file` are mutually exclusive.
file
FileDiscovery 		- `file` is used to specify a file or URL to a kubeconfig file from which to load +

file is used to specify a file or URL to a kubeconfig file from which to load cluster information. -`bootstrapToken` and `file` are mutually exclusive.
tlsBootstrapToken
string 		- `tlsBootstrapToken` is a token used for TLS bootstrapping. -If `bootstrapToken` is set, this field is defaulted to `.bootstrapToken.token`, but -can be overridden. If `file` is set, this field ∗∗must be set∗∗ in case the KubeConfigFile -does not contain any other authentication information
timeout
-meta/v1.Duration +meta/v1.Duration 		- `timeout` modifies the discovery timeout.
## `Etcd` {#kubeadm-k8s-io-v1beta3-Etcd} - - **Appears in:** + - [ClusterConfiguration](#kubeadm-k8s-io-v1beta3-ClusterConfiguration) -Etcd contains elements describing Etcd configuration. +

Etcd contains elements describing Etcd configuration.

+ - +

local provides configuration knobs for configuring the local etcd instance. +local and external are mutually exclusive.

+ - - +

external describes how to connect to an external etcd cluster. +local and external are mutually exclusive.

+ - -
FieldDescription
local
LocalEtcd 		- `local` provides configuration knobs for configuring the local etcd instance. -`local` and `external` are mutually exclusive.
external
ExternalEtcd 		- `external` describes how to connect to an external etcd cluster. -`local` and `external` are mutually exclusive.
## `ExternalEtcd` {#kubeadm-k8s-io-v1beta3-ExternalEtcd} - - **Appears in:** + - [Etcd](#kubeadm-k8s-io-v1beta3-Etcd) -ExternalEtcd describes an external etcd cluster. -Kubeadm has no knowledge of where certificate files live and they must be supplied. +

ExternalEtcd describes an external etcd cluster. +Kubeadm has no knowledge of where certificate files live and they must be supplied.

+ - +

endpoints contains the list of etcd members.

+ - - +

caFile is an SSL Certificate Authority (CA) file used to secure etcd communication. +Required if using a TLS connection.

+ - - +

certFile is an SSL certification file used to secure etcd communication. +Required if using a TLS connection.

+ - - +

keyFile is an SSL key file used to secure etcd communication. +Required if using a TLS connection.

+ - -
FieldDescription
endpoints [Required]
[]string 		- `endpoints` contains the list of etcd members.
caFile [Required]
string 		- `caFile` is an SSL Certificate Authority (CA) file used to secure etcd communication. -Required if using a TLS connection.
certFile [Required]
string 		- `certFile` is an SSL certification file used to secure etcd communication. -Required if using a TLS connection.
keyFile [Required]
string 		- `keyFile` is an SSL key file used to secure etcd communication. -Required if using a TLS connection.
## `FileDiscovery` {#kubeadm-k8s-io-v1beta3-FileDiscovery} - - **Appears in:** + - [Discovery](#kubeadm-k8s-io-v1beta3-Discovery) -FileDiscovery is used to specify a file or URL to a kubeconfig file from which to load -cluster information. +

FileDiscovery is used to specify a file or URL to a kubeconfig file from which to load +cluster information.

+ - +

kubeConfigPath is used to specify the actual file path or URL to the kubeconfig +file from which to load cluster information.

+ - -
FieldDescription
kubeConfigPath [Required]
string 		- `kubeConfigPath` is used to specify the actual file path or URL to the kubeconfig -file from which to load cluster information.
## `HostPathMount` {#kubeadm-k8s-io-v1beta3-HostPathMount} - - **Appears in:** + - [ControlPlaneComponent](#kubeadm-k8s-io-v1beta3-ControlPlaneComponent) -HostPathMount contains elements describing volumes that are mounted from the host. +

HostPathMount contains elements describing volumes that are mounted from the host.

+ - +

name is the name of the volume inside the Pod template.

+ - - +

hostPath is the path in the host that will be mounted inside the Pod.

+ - - +

mountPath is the path inside the Pod where hostPath will be mounted.

+ - - +

readOnly controls write access to the volume.

+ - - +

pathType is the type of the hostPath.

+ - -
FieldDescription
name [Required]
string 		- `name` is the name of the volume inside the Pod template.
hostPath [Required]
string 		- `hostPath` is the path in the host that will be mounted inside the Pod.
mountPath [Required]
string 		- `mountPath` is the path inside the Pod where `hostPath` will be mounted.
readOnly
bool 		- `readOnly` controls write access to the volume.
pathType
core/v1.HostPathType 		- `pathType` is the type of the `hostPath`.
## `ImageMeta` {#kubeadm-k8s-io-v1beta3-ImageMeta} - - **Appears in:** + - [DNS](#kubeadm-k8s-io-v1beta3-DNS) + - [LocalEtcd](#kubeadm-k8s-io-v1beta3-LocalEtcd) -ImageMeta allows to customize the image used for components that are not -originated from the Kubernetes/Kubernetes release process +

ImageMeta allows to customize the image used for components that are not +originated from the Kubernetes/Kubernetes release process

+ - +

imageRepository sets the container registry to pull images from. +If not set, the imageRepository defined in ClusterConfiguration will be used instead.

+ - - +the above components during upgrades.

+ - -
FieldDescription
imageRepository
string 		- `imageRepository` sets the container registry to pull images from. -If not set, the `imageRepository` defined in ClusterConfiguration will be used instead.
imageTag
string 		- `imageTag` allows to specify a tag for the image. +

imageTag allows to specify a tag for the image. In case this value is set, kubeadm does not change automatically the version of -the above components during upgrades.
## `JoinControlPlane` {#kubeadm-k8s-io-v1beta3-JoinControlPlane} - - **Appears in:** + - [JoinConfiguration](#kubeadm-k8s-io-v1beta3-JoinConfiguration) -JoinControlPlane contains elements describing an additional control plane instance -to be deployed on the joining node. +

JoinControlPlane contains elements describing an additional control plane instance +to be deployed on the joining node.

+ - +

localAPIEndpoint represents the endpoint of the API server instance to be +deployed on this node.

+ - - +The corresponding encryption key is in the InitConfiguration.

+ - -
FieldDescription
localAPIEndpoint
APIEndpoint 		- `localAPIEndpoint` represents the endpoint of the API server instance to be -deployed on this node.
certificateKey
string 		- `certificateKey` is the key that is used for decryption of certificates after +

certificateKey is the key that is used for decryption of certificates after they are downloaded from the secret upon joining a new control plane node. -The corresponding encryption key is in the InitConfiguration.
## `LocalEtcd` {#kubeadm-k8s-io-v1beta3-LocalEtcd} - - **Appears in:** + - [Etcd](#kubeadm-k8s-io-v1beta3-Etcd) -LocalEtcd describes that kubeadm should run an etcd cluster locally +

LocalEtcd describes that kubeadm should run an etcd cluster locally

+ - +

ImageMeta allows to customize the container used for etcd.

+ - - +

dataDir is the directory etcd will place its data. +Defaults to "/var/lib/etcd".

+ - - +command line except without leading dash(es).

+ - - +

serverCertSANs sets extra Subject Alternative Names (SANs) for the etcd +server signing certificate.

+ - - +

peerCertSANs sets extra Subject Alternative Names (SANs) for the etcd peer +signing certificate.

+ - -
FieldDescription
ImageMeta [Required]
ImageMeta 		(Members of ImageMeta are embedded into this type.) - ImageMeta allows to customize the container used for etcd.
dataDir [Required]
string 		- `dataDir` is the directory etcd will place its data. -Defaults to "/var/lib/etcd".
extraArgs
map[string]string 		- `extraArgs` are extra arguments provided to the etcd binary when run +

extraArgs are extra arguments provided to the etcd binary when run inside a static Pod. A key in this map is the flag name as it appears on the -command line except without leading dash(es).
serverCertSANs
[]string 		- `serverCertSANs` sets extra Subject Alternative Names (SANs) for the etcd -server signing certificate.
peerCertSANs
[]string 		- `peerCertSANs` sets extra Subject Alternative Names (SANs) for the etcd peer -signing certificate.
## `Networking` {#kubeadm-k8s-io-v1beta3-Networking} - - **Appears in:** + - [ClusterConfiguration](#kubeadm-k8s-io-v1beta3-ClusterConfiguration) -Networking contains elements describing cluster's networking configuration +

Networking contains elements describing cluster's networking configuration

+ - +

serviceSubnet is the subnet used by Kubernetes Services. Defaults to "10.96.0.0/12".

+ - - +

podSubnet is the subnet used by Pods.

+ - - +

dnsDomain is the DNS domain used by Kubernetes Services. Defaults to "cluster.local".

+ - -
FieldDescription
serviceSubnet
string 		- `serviceSubnet` is the subnet used by Kubernetes Services. Defaults to "10.96.0.0/12".
podSubnet
string 		- `podSubnet` is the subnet used by Pods.
dnsDomain
string 		- `dnsDomain` is the DNS domain used by Kubernetes Services. Defaults to "cluster.local".
## `NodeRegistrationOptions` {#kubeadm-k8s-io-v1beta3-NodeRegistrationOptions} - - **Appears in:** + +- [InitConfiguration](#kubeadm-k8s-io-v1beta3-InitConfiguration) + - [JoinConfiguration](#kubeadm-k8s-io-v1beta3-JoinConfiguration) -NodeRegistrationOptions holds fields that relate to registering a new control-plane or -node to the cluster, either via "kubeadm init" or "kubeadm join" +

NodeRegistrationOptions holds fields that relate to registering a new control-plane or +node to the cluster, either via "kubeadm init" or "kubeadm join"

+ - +Defaults to the hostname of the node if not provided.

+ - - +

criSocket is used to retrieve container runtime info. +This information will be annotated to the Node API object, for later re-use

+ - - +i.e. taints: [] in the YAML file. This field is solely used for Node registration.

+ - - +command line except without leading dash(es).

+ - - +

ignorePreflightErrors provides a list of pre-flight errors to be ignored when +the current node is registered.

+ - - +

imagePullPolicy specifies the policy for image pulling during kubeadm "init" and +"join" operations. +The value of this field must be one of "Always", "IfNotPresent" or "Never". +If this field is unset kubeadm will default it to "IfNotPresent", or pull the required +images if not present on the host.

+ - -
FieldDescription
name
string 		- `name` is the `.metadata.name` field of the Node API object that will be created in this -`kubeadm init` or `kubeadm join` operation. -This field is also used in the `CommonName` field of the kubelet's client certificate to +

name is the .metadata.name field of the Node API object that will be created in this +kubeadm init or kubeadm join operation. +This field is also used in the CommonName field of the kubelet's client certificate to the API server. -Defaults to the hostname of the node if not provided.
criSocket
string 		- `criSocket` is used to retrieve container runtime info. -This information will be annotated to the Node API object, for later re-use
taints [Required]
[]core/v1.Taint 		- `tains` specifies the taints the Node API object should be registered with. -If this field is unset, i.e. nil, in the `kubeadm init` process it will be defaulted to -`taints: ["node-role.kubernetes.io/master:""]`. +

tains specifies the taints the Node API object should be registered with. +If this field is unset, i.e. nil, in the kubeadm init process it will be defaulted to +taints: ["node-role.kubernetes.io/master:""]. If you don't want to taint your control-plane node, set this field to an empty slice, -i.e. `taints: []` in the YAML file. This field is solely used for Node registration.
kubeletExtraArgs
map[string]string 		- `kubeletExtraArgs` passes through extra arguments to the kubelet. +

kubeletExtraArgs passes through extra arguments to the kubelet. The arguments here are passed to the kubelet command line via the environment file kubeadm writes at runtime for the kubelet to source. This overrides the generic base-level configuration in the 'kubelet-config-1.X' ConfigMap. Flags have higher priority when parsing. These values are local and specific to the node kubeadm is executing on. A key in this map is the flag name as it appears on the -command line except without leading dash(es).
ignorePreflightErrors
[]string 		- `ignorePreflightErrors` provides a list of pre-flight errors to be ignored when -the current node is registered.
imagePullPolicy
core/v1.PullPolicy 		- `imagePullPolicy` specifies the policy for image pulling during kubeadm "init" and -"join" operations. -The value of this field must be one of "Always", "IfNotPresent" or "Never". -If this field is unset kubeadm will default it to "IfNotPresent", or pull the required -images if not present on the host.
## `Patches` {#kubeadm-k8s-io-v1beta3-Patches} - - **Appears in:** + +- [InitConfiguration](#kubeadm-k8s-io-v1beta3-InitConfiguration) + - [JoinConfiguration](#kubeadm-k8s-io-v1beta3-JoinConfiguration) -Patches contains options related to applying patches to components deployed by kubeadm. +

Patches contains options related to applying patches to components deployed by kubeadm.

+ - +The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". +"suffix" is an optional string that can be used to determine which patches are applied +first alpha-numerically.

+ - -
FieldDescription
directory
string 		- `directory` is a path to a directory that contains files named -"target[suffix][+patchtype].extension". -For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of -"kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can -be one of "strategic" "merge" or "json" and they match the patch formats supported by +

directory is a path to a directory that contains files named +"target[suffix][+patchtype].extension". +For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of +"kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can +be one of "strategic" "merge" or "json" and they match the patch formats supported by kubectl. -The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". -"suffix" is an optional string that can be used to determine which patches are applied -first alpha-numerically.
@@ -1278,113 +1243,100 @@ first alpha-numerically. ## `BootstrapToken` {#BootstrapToken} - - **Appears in:** +- [InitConfiguration](#kubeadm-k8s-io-v1beta3-InitConfiguration) + + +

BootstrapToken describes one bootstrap token, stored as a Secret in the cluster

-BootstrapToken describes one bootstrap token, stored as a Secret in the cluster - +

token is used for establishing bidirectional trust between nodes and control-planes. +Used for joining nodes in the cluster.

+ - - +

description sets a human-friendly message why this token exists and what it's used +for, so other administrators can know its purpose.

+ - - +

ttl defines the time to live for this token. Defaults to 24h. +expires and ttl are mutually exclusive.

+ - - +

expires specifies the timestamp when this token expires. Defaults to being set +dynamically at runtime based on the ttl. expires and ttl are mutually exclusive.

+ - - +

usages describes the ways in which this token can be used. Can by default be used +for establishing bidirectional trust, but that can be changed here.

+ - - +

groups specifies the extra groups that this token will authenticate as when/if +used for authentication

+ - -
FieldDescription
token [Required]
BootstrapTokenString 		- `token` is used for establishing bidirectional trust between nodes and control-planes. -Used for joining nodes in the cluster.
description
string 		- `description` sets a human-friendly message why this token exists and what it's used -for, so other administrators can know its purpose.
ttl
-meta/v1.Duration +meta/v1.Duration 		- `ttl` defines the time to live for this token. Defaults to `24h`. -`expires` and `ttl` are mutually exclusive.
expires
meta/v1.Time 		- `expires` specifies the timestamp when this token expires. Defaults to being set -dynamically at runtime based on the `ttl`. `expires` and `ttl` are mutually exclusive.
usages
[]string 		- `usages` describes the ways in which this token can be used. Can by default be used -for establishing bidirectional trust, but that can be changed here.
groups
[]string 		- `groups` specifies the extra groups that this token will authenticate as when/if -used for authentication
## `BootstrapTokenString` {#BootstrapTokenString} - - **Appears in:** + - [BootstrapToken](#BootstrapToken) -BootstrapTokenString is a token of the format `abcdef.abcdef0123456789` that is used +

BootstrapTokenString is a token of the format abcdef.abcdef0123456789 that is used for both validation of the practically of the API server from a joining node's point of view and as an authentication method for the node in the bootstrap phase of -"kubeadm join". This token is and should be short-lived. +"kubeadm join". This token is and should be short-lived.

+ - + No description provided. - - + No description provided. - -
FieldDescription
- [Required]
string 		- No description provided. -
- [Required]
string 		- No description provided. -
diff --git a/content/en/docs/reference/config-api/kubelet-config.v1alpha1.md b/content/en/docs/reference/config-api/kubelet-config.v1alpha1.md index ffb3d85ac2..ccdec28e8d 100644 --- a/content/en/docs/reference/config-api/kubelet-config.v1alpha1.md +++ b/content/en/docs/reference/config-api/kubelet-config.v1alpha1.md @@ -13,102 +13,14 @@ auto_generated: true -## `FormatOptions` {#FormatOptions} - - - - -**Appears in:** - -- [LoggingConfiguration](#LoggingConfiguration) - - -FormatOptions contains options for the different logging formats. - - - - - - - - - - - - - -
FieldDescription
json [Required]
-JSONOptions -		 - [Experimental] JSON contains options for logging format "json".
- -## `JSONOptions` {#JSONOptions} - - - - -**Appears in:** - -- [FormatOptions](#FormatOptions) - - -JSONOptions contains options for logging format "json". - - - - - - - - - - - - - - - - - - -
FieldDescription
splitStream [Required]
-bool -		 - [Experimental] SplitStream redirects error messages to stderr while -info messages go to stdout, with buffering. The default is to write -both to stdout, without buffering.
infoBufferSize [Required]
-k8s.io/apimachinery/pkg/api/resource.QuantityValue -		 - [Experimental] InfoBufferSize sets the size of the info stream when -using split streams. The default is zero, which disables buffering.
- -## `VModuleConfiguration` {#VModuleConfiguration} - -(Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`) - - -**Appears in:** - -- [LoggingConfiguration](#LoggingConfiguration) - - -VModuleConfiguration is a collection of individual file names or patterns -and the corresponding verbosity threshold. - - - - - - ## `CredentialProviderConfig` {#kubelet-config-k8s-io-v1alpha1-CredentialProviderConfig} - - -CredentialProviderConfig is the configuration containing information about +

CredentialProviderConfig is the configuration containing information about each exec credential provider. Kubelet reads this configuration from disk and enables -each provider as specified by the CredentialProvider type. +each provider as specified by the CredentialProvider type.

+ @@ -117,165 +29,221 @@ each provider as specified by the CredentialProvider type. - - +auth keys, the value from the provider earlier in this list is used.

+ - -
FieldDescription
apiVersion
string		kubelet.config.k8s.io/v1alpha1
kind
string		CredentialProviderConfig
providers [Required]
[]CredentialProvider 		- providers is a list of credential provider plugins that will be enabled by the kubelet. +

providers is a list of credential provider plugins that will be enabled by the kubelet. Multiple providers may match against a single image, in which case credentials from all providers will be returned to the kubelet. If multiple providers are called for a single image, the results are combined. If providers return overlapping -auth keys, the value from the provider earlier in this list is used.
- - ## `CredentialProvider` {#kubelet-config-k8s-io-v1alpha1-CredentialProvider} - - **Appears in:** - [CredentialProviderConfig](#kubelet-config-k8s-io-v1alpha1-CredentialProviderConfig) -CredentialProvider represents an exec plugin to be invoked by the kubelet. The plugin is only -invoked when an image being pulled matches the images handled by the plugin (see matchImages). +

CredentialProvider represents an exec plugin to be invoked by the kubelet. The plugin is only +invoked when an image being pulled matches the images handled by the plugin (see matchImages).

+ - +bin directory (set by the --image-credential-provider-bin-dir flag).

+ - - +as subdomains like '.k8s.io' or 'k8s..io', and top-level-domains such as 'k8s.'. +Matching partial subdomains like 'app.k8s.io' is also supported. Each glob can only match +a single subdomain segment, so *.io does not match *.k8s.io.

+

A match exists between an image and a matchImage when all of the below are true:

+
    +
  • Both contain the same number of domain parts and each part matches.
    • +
  • The URL path of an imageMatch must be a prefix of the target image URL path.
    • +
  • If the imageMatch contains a port, then the port must match in the image as well.
    • +
+

Example values of matchImages:

+
    +
  • 123456789.dkr.ecr.us-east-1.amazonaws.com
    • +
  • *.azurecr.io
    • +
  • gcr.io
    • +
  • ..registry.io
    • +
  • registry.io:8080/path
    • +
+ - - +

defaultCacheDuration is the default duration the plugin will cache credentials in-memory +if a cache duration is not provided in the plugin response. This field is required.

+ - - +

Required input version of the exec CredentialProviderRequest. The returned CredentialProviderResponse +MUST use the same encoding version as the input. Current supported values are:

+
    +
  • credentialprovider.kubelet.k8s.io/v1alpha1
    • +
+ - - +

Arguments to pass to the command when executing it.

+ - - +to pass argument to the plugin.

+ - -
FieldDescription
name [Required]
string 		- name is the required name of the credential provider. It must match the name of the +

name is the required name of the credential provider. It must match the name of the provider executable as seen by the kubelet. The executable must be in the kubelet's -bin directory (set by the --image-credential-provider-bin-dir flag).
matchImages [Required]
[]string 		- matchImages is a required list of strings used to match against images in order to +

matchImages is a required list of strings used to match against images in order to determine if this provider should be invoked. If one of the strings matches the requested image from the kubelet, the plugin will be invoked and given a chance to provide credentials. Images are expected to contain the registry domain -and URL path. - -Each entry in matchImages is a pattern which can optionally contain a port and a path. +and URL path.

+

Each entry in matchImages is a pattern which can optionally contain a port and a path. Globs can be used in the domain, but not in the port or the path. Globs are supported -as subdomains like '∗.k8s.io' or 'k8s.∗.io', and top-level-domains such as 'k8s.∗'. -Matching partial subdomains like 'app∗.k8s.io' is also supported. Each glob can only match -a single subdomain segment, so ∗.io does not match ∗.k8s.io. - -A match exists between an image and a matchImage when all of the below are true: -- Both contain the same number of domain parts and each part matches. -- The URL path of an imageMatch must be a prefix of the target image URL path. -- If the imageMatch contains a port, then the port must match in the image as well. - -Example values of matchImages: - - 123456789.dkr.ecr.us-east-1.amazonaws.com - - ∗.azurecr.io - - gcr.io - - ∗.∗.registry.io - - registry.io:8080/path
defaultCacheDuration [Required]
-meta/v1.Duration +meta/v1.Duration 		- defaultCacheDuration is the default duration the plugin will cache credentials in-memory -if a cache duration is not provided in the plugin response. This field is required.
apiVersion [Required]
string 		- Required input version of the exec CredentialProviderRequest. The returned CredentialProviderResponse -MUST use the same encoding version as the input. Current supported values are: -- credentialprovider.kubelet.k8s.io/v1alpha1
args
[]string 		- Arguments to pass to the command when executing it.
env
[]ExecEnvVar 		- Env defines additional environment variables to expose to the process. These +

Env defines additional environment variables to expose to the process. These are unioned with the host's environment, as well as variables client-go uses -to pass argument to the plugin.
- - ## `ExecEnvVar` {#kubelet-config-k8s-io-v1alpha1-ExecEnvVar} - - **Appears in:** - [CredentialProvider](#kubelet-config-k8s-io-v1alpha1-CredentialProvider) -ExecEnvVar is used for setting environment variables when executing an exec-based -credential plugin. +

ExecEnvVar is used for setting environment variables when executing an exec-based +credential plugin.

+ - + No description provided. - - + No description provided. - -
FieldDescription
name [Required]
string 		- No description provided. -
value [Required]
string 		- No description provided. -
+ + + + +## `FormatOptions` {#FormatOptions} + + +**Appears in:** + + + +

FormatOptions contains options for the different logging formats.

+ + + + + + + + + +
FieldDescription
json [Required]
+JSONOptions +		 +

[Experimental] JSON contains options for logging format "json".

+
+ +## `JSONOptions` {#JSONOptions} + + +**Appears in:** + +- [FormatOptions](#FormatOptions) + + +

JSONOptions contains options for logging format "json".

+ + + + + + + + + + + + + + +
FieldDescription
splitStream [Required]
+bool +		 +

[Experimental] SplitStream redirects error messages to stderr while +info messages go to stdout, with buffering. The default is to write +both to stdout, without buffering.

+
infoBufferSize [Required]
+k8s.io/apimachinery/pkg/api/resource.QuantityValue +		 +

[Experimental] InfoBufferSize sets the size of the info stream when +using split streams. The default is zero, which disables buffering.

+
+ +## `VModuleConfiguration` {#VModuleConfiguration} + +(Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`) + +**Appears in:** + + + +

VModuleConfiguration is a collection of individual file names or patterns +and the corresponding verbosity threshold.

+ + + diff --git a/content/en/docs/reference/config-api/kubelet-config.v1beta1.md b/content/en/docs/reference/config-api/kubelet-config.v1beta1.md index c299c56470..9fc2bbfde0 100644 --- a/content/en/docs/reference/config-api/kubelet-config.v1beta1.md +++ b/content/en/docs/reference/config-api/kubelet-config.v1beta1.md @@ -14,175 +14,13 @@ auto_generated: true -## `FormatOptions` {#FormatOptions} - - - - -**Appears in:** -- [LoggingConfiguration](#LoggingConfiguration) - - -FormatOptions contains options for the different logging formats. - - - - - - - - - - - - - -
FieldDescription
json [Required]
-JSONOptions -		 - [Experimental] JSON contains options for logging format "json".
- -## `JSONOptions` {#JSONOptions} - - - - -**Appears in:** -- [FormatOptions](#FormatOptions) - - -JSONOptions contains options for logging format "json". - - - - - - - - - - - - - - - - - - -
FieldDescription
splitStream [Required]
-bool -		 - [Experimental] SplitStream redirects error messages to stderr while -info messages go to stdout, with buffering. The default is to write -both to stdout, without buffering.
infoBufferSize [Required]
-k8s.io/apimachinery/pkg/api/resource.QuantityValue -		 - [Experimental] InfoBufferSize sets the size of the info stream when -using split streams. The default is zero, which disables buffering.
- -## `LoggingConfiguration` {#LoggingConfiguration} - - - - -**Appears in:** -- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) - - -LoggingConfiguration contains logging options -Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
format [Required]
-string -		 - Format Flag specifies the structure of log messages. -default value of format is `text`
flushFrequency [Required]
-time.Duration -		 - Maximum number of seconds between log flushes. Ignored if the -selected logging backend writes log messages without buffering.
verbosity [Required]
-uint32 -		 - Verbosity is the threshold that determines which log messages are -logged. Default is zero which logs only the most important -messages. Higher values enable additional messages. Error messages -are always logged.
vmodule [Required]
-VModuleConfiguration -		 - VModule overrides the verbosity threshold for individual files. -Only supported for "text" log format.
sanitization [Required]
-bool -		 - [Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). -Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)
options [Required]
-FormatOptions -		 - [Experimental] Options holds additional parameters that are specific -to the different logging formats. Only the options for the selected -format get used, but all of them get validated.
- -## `VModuleConfiguration` {#VModuleConfiguration} - -(Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`) - - -**Appears in:** -- [LoggingConfiguration](#LoggingConfiguration) - - -VModuleConfiguration is a collection of individual file names or patterns -and the corresponding verbosity threshold. - - - - - ## `KubeletConfiguration` {#kubelet-config-k8s-io-v1beta1-KubeletConfiguration} +

KubeletConfiguration contains the configuration for the Kubelet

-KubeletConfiguration contains the configuration for the Kubelet - @@ -190,149 +28,137 @@ KubeletConfiguration contains the configuration for the Kubelet - - +Default: true

+ - - +Default: ""

+ - - +Default: "1m"

+ - - +Default: "20s"

+ - - +Default: "20s"

+ - - +Default: ""

+ - - +Default: nil

+ - - +Default: "0.0.0.0"

+ - - +Default: 10250

+ - - +Default: 0 (disabled)

+ - - +Default: ""

+ - - +Default: ""

+ - - +Default: nil

+ - - +Default: ""

+ - - +Default: false

+ - - +Default: false

+ - - +anonymous: +enabled: false +webhook: +enabled: true +cacheTTL: "2m"

+ - - +mode: Webhook +webhook: +cacheAuthorizedTTL: "5m" +cacheUnauthorizedTTL: "30s"

+ - - +Default: 5

+ - - +Default: 10

+ - - +Default: 5

+ - - +Default: 10

+ - - +Default: true

+ - - +Default: false

+ - - +Default: 10248

+ - - +Default: "127.0.0.1"

+ - - +Default: -999

+ - - +Default: ""

+ - - +Default: nil

+ - - +Default: "4h"

+ - - +Default: "10s"

+ - - +Default: "5m"

+ - - +Default: 40

+ - - +Default: "2m"

+ - - +Default: 85

+ - - +Default: 80

+ - - +Default: "1m"

+ - - +Default: ""

+ - - +Default: ""

+ - - +Default: ""

+ - - +Default: true

+ - - +Default: "cgroupfs"

+ - - +Default: "None"

+ - - +Default: nil

+ - - +Default: "10s"

+ - - +Default: "none"

+ - - +Default: "none"

+ - - +

topologyManagerScope represents the scope of topology hint generation +that topology manager requests and hint providers generate. Valid values include:

+
    +
  • container: topology policy is applied on a per-container basis.
    • +
  • pod: topology policy is applied on a per-pod basis.
    • +
+

"pod" scope requires the TopologyManager feature gate to be enabled. +Default: "container"

+ - - +Default: nil

+ - - +Default: "2m"

+ - - +Default: "promiscuous-bridge"

+ - - +Default: 110

+ - - +Default: ""

+ - - +Default: -1

+ - - +Default: "/etc/resolv.conf"

+ - - +Default: false

+ - - +Default: true

+ - - +Default: "100ms"

+ - - +Default: 50

+ - - +Default: 1000000

+ - - +Default: "application/vnd.kubernetes.protobuf"

+ - - +Default: 5

+ - - +Default: 10

+ - - +Default: true

+ - - +memory.available: "100Mi" +nodefs.available: "10%" +nodefs.inodesFree: "5%" +imagefs.available: "15%"

+ - - +Default: nil

+ - - +Default: nil

+ - - +Default: "5m"

+ - - +Default: 0

+ - - +Default: nil

+ - - +Default: 0

+ - - +Default: true

+ - - +Default: false

+ - - +Default: true

+ - - +Default: 14

+ - - +Default: 15

+ - - +Default: nil

+ - - +Default: true

+ - - +

memorySwap configures swap memory available to container workloads.

+ - - +Default: "10Mi"

+ - - +Default: 5

+ - - +

configMapAndSecretChangeDetectionStrategy is a mode in which ConfigMap and Secret +managers are running. Valid values include:

+
    +
  • Get: kubelet fetches necessary objects directly from the API server;
    • +
  • Cache: kubelet uses TTL cache for object fetched from the API server;
    • +
  • Watch: kubelet uses watches to observe changes to objects that are in its interest.
    • +
+

Default: "Watch"

+ - - +Default: nil

+ - - +Default: nil

+ - - +

The reservedSystemCPUs option specifies the CPU list reserved for the host +level system threads and kubernetes related threads. This provide a "static" +CPU list rather than the "dynamic" list by systemReserved and kubeReserved. +This option does not support systemReservedCgroup or kubeReservedCgroup.

+ - - +Default: ""

+ - - +Default: ""

+ - - +Default: ""

+ - - +Default: ["pods"]

+ - - +

A comma separated whitelist of unsafe sysctls or sysctl patterns (ending in *). +Unsafe sysctl groups are kernel.shm*, kernel.msg*, kernel.sem, fs.mqueue.*, +and net.*. For example: "kernel.msg*,net.ipv4.route.min_pmtu" +Default: []

+ - - +Default: "/usr/libexec/kubernetes/kubelet-plugins/volume/exec/"

+ - - +Default: ""

+ - - +Default: false

+ - - +Format: text

+ - - +

enableSystemLogHandler enables system logs via web interface host:port/logs/ +Default: true

+ - - +Default: "0s"

+ - - +Default: "0s"

+ - - +Default: nil

+ - - +Also, avoid specifying:

+
    +
  1. Duplicates, the same NUMA node, and memory type, but with a different value.
    2. +
  2. zero limits for any memory type.
    3. +
  3. NUMAs nodes IDs that do not exist under the machine.
    4. +
  4. memory types except for memory and hugepages-
    5. +
+

Default: nil

+ - - +

enableProfilingHandler enables profiling via web interface host:port/debug/pprof/ +Default: true

+ - - +

enableDebugFlagsHandler enables flags endpoint via web interface host:port/debug/flags/v +Default: true

+ - - +Default: false

+ - - +Default: 0.8

+ - - +Default: nil

+ - - +

registerNode enables automatic registration with the apiserver. +Default: true

+ - -
FieldDescription
apiVersion
string		kubelet.config.k8s.io/v1beta1
kind
string		KubeletConfiguration
enableServer [Required]
bool 		- enableServer enables Kubelet's secured server. +

enableServer enables Kubelet's secured server. Note: Kubelet's insecure port is controlled by the readOnlyPort option. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. -Default: true
staticPodPath
string 		- staticPodPath is the path to the directory containing local (static) pods to +

staticPodPath is the path to the directory containing local (static) pods to run, or the path to a single static pod file. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that the set of static pods specified at the new path may be different than the ones the Kubelet initially started with, and this may disrupt your node. -Default: ""
syncFrequency
-meta/v1.Duration +meta/v1.Duration 		- syncFrequency is the max period between synchronizing running +

syncFrequency is the max period between synchronizing running containers and config. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that shortening this duration may have a negative performance impact, especially as the number of Pods on the node increases. Alternatively, increasing this duration will result in longer refresh times for ConfigMaps and Secrets. -Default: "1m"
fileCheckFrequency
-meta/v1.Duration +meta/v1.Duration 		- fileCheckFrequency is the duration between checking config files for +

fileCheckFrequency is the duration between checking config files for new data. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that shortening the duration will cause the Kubelet to reload local Static Pod configurations more frequently, which may have a negative performance impact. -Default: "20s"
httpCheckFrequency
-meta/v1.Duration +meta/v1.Duration 		- httpCheckFrequency is the duration between checking http for new data. +

httpCheckFrequency is the duration between checking http for new data. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that shortening the duration will cause the Kubelet to poll staticPodURL more frequently, which may have a negative performance impact. -Default: "20s"
staticPodURL
string 		- staticPodURL is the URL for accessing static pods to run. +

staticPodURL is the URL for accessing static pods to run. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that the set of static pods specified at the new URL may be different than the ones the Kubelet initially started with, and this may disrupt your node. -Default: ""
staticPodURLHeader
map[string][]string 		- staticPodURLHeader is a map of slices with HTTP headers to use when accessing the podURL. +

staticPodURLHeader is a map of slices with HTTP headers to use when accessing the podURL. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may disrupt the ability to read the latest set of static pods from StaticPodURL. -Default: nil
address
string 		- address is the IP address for the Kubelet to serve on (set to 0.0.0.0 +

address is the IP address for the Kubelet to serve on (set to 0.0.0.0 for all interfaces). If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. -Default: "0.0.0.0"
port
int32 		- port is the port for the Kubelet to serve on. +

port is the port for the Kubelet to serve on. The port number must be between 1 and 65535, inclusive. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. -Default: 10250
readOnlyPort
int32 		- readOnlyPort is the read-only port for the Kubelet to serve on with +

readOnlyPort is the read-only port for the Kubelet to serve on with no authentication/authorization. The port number must be between 1 and 65535, inclusive. Setting this field to 0 disables the read-only service. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. -Default: 0 (disabled)
tlsCertFile
string 		- tlsCertFile is the file containing x509 Certificate for HTTPS. (CA cert, +

tlsCertFile is the file containing x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If tlsCertFile and tlsPrivateKeyFile are not provided, a self-signed certificate and key are generated for the public address and saved to the directory @@ -340,68 +166,63 @@ passed to the Kubelet's --cert-dir flag. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. -Default: ""
tlsPrivateKeyFile
string 		- tlsPrivateKeyFile is the file containing x509 private key matching tlsCertFile. +

tlsPrivateKeyFile is the file containing x509 private key matching tlsCertFile. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. -Default: ""
tlsCipherSuites
[]string 		- tlsCipherSuites is the list of allowed cipher suites for the server. +

tlsCipherSuites is the list of allowed cipher suites for the server. Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. -Default: nil
tlsMinVersion
string 		- tlsMinVersion is the minimum TLS version supported. +

tlsMinVersion is the minimum TLS version supported. Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. -Default: ""
rotateCertificates
bool 		- rotateCertificates enables client certificate rotation. The Kubelet will request a +

rotateCertificates enables client certificate rotation. The Kubelet will request a new certificate from the certificates.k8s.io API. This requires an approver to approve the certificate signing requests. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that disabling it may disrupt the Kubelet's ability to authenticate with the API server after the current certificate expires. -Default: false
serverTLSBootstrap
bool 		- serverTLSBootstrap enables server certificate bootstrap. Instead of self +

serverTLSBootstrap enables server certificate bootstrap. Instead of self signing a serving certificate, the Kubelet will request a certificate from the 'certificates.k8s.io' API. This requires an approver to approve the certificate signing requests (CSR). The RotateKubeletServerCertificate feature @@ -411,63 +232,59 @@ dynamically updating this field, consider that disabling it will stop the renewal of Kubelet server certificates, which can disrupt components that interact with the Kubelet server in the long term, due to certificate expiration. -Default: false
authentication
KubeletAuthentication 		- authentication specifies how requests to the Kubelet's server are authenticated. +

authentication specifies how requests to the Kubelet's server are authenticated. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Defaults: - anonymous: - enabled: false - webhook: - enabled: true - cacheTTL: "2m"
authorization
KubeletAuthorization 		- authorization specifies how requests to the Kubelet's server are authorized. +

authorization specifies how requests to the Kubelet's server are authorized. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. Defaults: - mode: Webhook - webhook: - cacheAuthorizedTTL: "5m" - cacheUnauthorizedTTL: "30s"
registryPullQPS
int32 		- registryPullQPS is the limit of registry pulls per second. +

registryPullQPS is the limit of registry pulls per second. The value must not be a negative number. Setting it to 0 means no limit. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may impact scalability by changing the amount of traffic produced by image pulls. -Default: 5
registryBurst
int32 		- registryBurst is the maximum size of bursty pulls, temporarily allows +

registryBurst is the maximum size of bursty pulls, temporarily allows pulls to burst to this number, while still not exceeding registryPullQPS. The value must not be a negative number. Only used if registryPullQPS is greater than 0. @@ -475,151 +292,140 @@ If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may impact scalability by changing the amount of traffic produced by image pulls. -Default: 10
eventRecordQPS
int32 		- eventRecordQPS is the maximum event creations per second. If 0, there +

eventRecordQPS is the maximum event creations per second. If 0, there is no limit enforced. The value cannot be a negative number. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may impact scalability by changing the amount of traffic produced by event creations. -Default: 5
eventBurst
int32 		- eventBurst is the maximum size of a burst of event creations, temporarily +

eventBurst is the maximum size of a burst of event creations, temporarily allows event creations to burst to this number, while still not exceeding eventRecordQPS. This field canot be a negative number and it is only used -when eventRecordQPS > 0. +when eventRecordQPS > 0. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may impact scalability by changing the amount of traffic produced by event creations. -Default: 10
enableDebuggingHandlers
bool 		- enableDebuggingHandlers enables server endpoints for log access +

enableDebuggingHandlers enables server endpoints for log access and local running of containers and commands, including the exec, attach, logs, and portforward features. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that disabling it may disrupt components that interact with the Kubelet server. -Default: true
enableContentionProfiling
bool 		- enableContentionProfiling enables lock contention profiling, if enableDebuggingHandlers is true. +

enableContentionProfiling enables lock contention profiling, if enableDebuggingHandlers is true. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that enabling it may carry a performance impact. -Default: false
healthzPort
int32 		- healthzPort is the port of the localhost healthz endpoint (set to 0 to disable). +

healthzPort is the port of the localhost healthz endpoint (set to 0 to disable). A valid number is between 1 and 65535. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may disrupt components that monitor Kubelet health. -Default: 10248
healthzBindAddress
string 		- healthzBindAddress is the IP address for the healthz server to serve on. +

healthzBindAddress is the IP address for the healthz server to serve on. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may disrupt components that monitor Kubelet health. -Default: "127.0.0.1"
oomScoreAdj
int32 		- oomScoreAdj is The oom-score-adj value for kubelet process. Values +

oomScoreAdj is The oom-score-adj value for kubelet process. Values must be within the range [-1000, 1000]. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may impact the stability of nodes under memory pressure. -Default: -999
clusterDomain
string 		- clusterDomain is the DNS domain for this cluster. If set, kubelet will +

clusterDomain is the DNS domain for this cluster. If set, kubelet will configure all containers to search this domain in addition to the host's search domains. Dynamic Kubelet Config (deprecated): Dynamically updating this field is not recommended, as it should be kept in sync with the rest of the cluster. -Default: ""
clusterDNS
[]string 		- clusterDNS is a list of IP addresses for the cluster DNS server. If set, +

clusterDNS is a list of IP addresses for the cluster DNS server. If set, kubelet will configure all containers to use this for DNS resolution instead of the host's DNS servers. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that changes will only take effect on Pods created after the update. Draining the node is recommended before changing this field. -Default: nil
streamingConnectionIdleTimeout
-meta/v1.Duration +meta/v1.Duration 		- streamingConnectionIdleTimeout is the maximum time a streaming connection +

streamingConnectionIdleTimeout is the maximum time a streaming connection can be idle before the connection is automatically closed. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may impact components that rely on infrequent updates over streaming connections to the Kubelet server. -Default: "4h"
nodeStatusUpdateFrequency
-meta/v1.Duration +meta/v1.Duration 		- nodeStatusUpdateFrequency is the frequency that kubelet computes node +

nodeStatusUpdateFrequency is the frequency that kubelet computes node status. If node lease feature is not enabled, it is also the frequency that kubelet posts node status to master. Note: When node lease feature is not enabled, be cautious when changing the @@ -627,33 +433,31 @@ constant, it must work with nodeMonitorGracePeriod in nodecontroller. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may impact node scalability, and also that the node controller's -nodeMonitorGracePeriod must be set to N∗NodeStatusUpdateFrequency, +nodeMonitorGracePeriod must be set to N*NodeStatusUpdateFrequency, where N is the number of retries before the node controller marks the node unhealthy. -Default: "10s"
nodeStatusReportFrequency
-meta/v1.Duration +meta/v1.Duration 		- nodeStatusReportFrequency is the frequency that kubelet posts node +

nodeStatusReportFrequency is the frequency that kubelet posts node status to master if node status does not change. Kubelet will ignore this frequency and post node status immediately if any change is detected. It is only used when node lease feature is enabled. nodeStatusReportFrequency's default value is 5m. But if nodeStatusUpdateFrequency is set explicitly, nodeStatusReportFrequency's default value will be set to nodeStatusUpdateFrequency for backward compatibility. -Default: "5m"
nodeLeaseDurationSeconds
int32 		- nodeLeaseDurationSeconds is the duration the Kubelet will set on its corresponding Lease. +

nodeLeaseDurationSeconds is the duration the Kubelet will set on its corresponding Lease. NodeLease provides an indicator of node health by having the Kubelet create and periodically renew a lease, named after the node, in the kube-node-lease namespace. If the lease expires, the node can be considered unhealthy. @@ -664,27 +468,25 @@ If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that decreasing the duration may reduce tolerance for issues that temporarily prevent the Kubelet from renewing the lease (e.g. a short-lived network issue). -Default: 40
imageMinimumGCAge
-meta/v1.Duration +meta/v1.Duration 		- imageMinimumGCAge is the minimum age for an unused image before it is +

imageMinimumGCAge is the minimum age for an unused image before it is garbage collected. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may trigger or delay garbage collection, and may change the image overhead on the node. -Default: "2m"
imageGCHighThresholdPercent
int32 		- imageGCHighThresholdPercent is the percent of disk usage after which +

imageGCHighThresholdPercent is the percent of disk usage after which image garbage collection is always run. The percent is calculated by dividing this field value by 100, so this field must be between 0 and 100, inclusive. When specified, the value must be greater than @@ -693,15 +495,14 @@ If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may trigger or delay garbage collection, and may change the image overhead on the node. -Default: 85
imageGCLowThresholdPercent
int32 		- imageGCLowThresholdPercent is the percent of disk usage before which +

imageGCLowThresholdPercent is the percent of disk usage before which image garbage collection is never run. Lowest disk usage to garbage collect to. The percent is calculated by dividing this field value by 100, so the field value must be between 0 and 100, inclusive. When specified, the @@ -710,227 +511,211 @@ If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may trigger or delay garbage collection, and may change the image overhead on the node. -Default: 80
volumeStatsAggPeriod
-meta/v1.Duration +meta/v1.Duration 		- volumeStatsAggPeriod is the frequency for calculating and caching volume +

volumeStatsAggPeriod is the frequency for calculating and caching volume disk usage for all pods. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that shortening the period may carry a performance impact. -Default: "1m"
kubeletCgroups
string 		- kubeletCgroups is the absolute name of cgroups to isolate the kubelet in +

kubeletCgroups is the absolute name of cgroups to isolate the kubelet in Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. -Default: ""
systemCgroups
string 		- systemCgroups is absolute name of cgroups in which to place +

systemCgroups is absolute name of cgroups in which to place all non-kernel processes that are not already in a container. Empty for no container. Rolling back the flag requires a reboot. The cgroupRoot must be specified if this field is not empty. Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. -Default: ""
cgroupRoot
string 		- cgroupRoot is the root cgroup to use for pods. This is handled by the +

cgroupRoot is the root cgroup to use for pods. This is handled by the container runtime on a best effort basis. Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. -Default: ""
cgroupsPerQOS
bool 		- cgroupsPerQOS enable QoS based CGroup hierarchy: top level CGroups for QoS classes +

cgroupsPerQOS enable QoS based CGroup hierarchy: top level CGroups for QoS classes and all Burstable and BestEffort Pods are brought up under their specific top level QoS CGroup. Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. -Default: true
cgroupDriver
string 		- cgroupDriver is the driver kubelet uses to manipulate CGroups on the host (cgroupfs +

cgroupDriver is the driver kubelet uses to manipulate CGroups on the host (cgroupfs or systemd). Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. -Default: "cgroupfs"
cpuManagerPolicy
string 		- cpuManagerPolicy is the name of the policy to use. +

cpuManagerPolicy is the name of the policy to use. Requires the CPUManager feature gate to be enabled. Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. -Default: "None"
cpuManagerPolicyOptions
map[string]string 		- cpuManagerPolicyOptions is a set of key=value which allows to set extra options +

cpuManagerPolicyOptions is a set of key=value which allows to set extra options to fine tune the behaviour of the cpu manager policies. -Requires both the "CPUManager" and "CPUManagerPolicyOptions" feature gates to be enabled. +Requires both the "CPUManager" and "CPUManagerPolicyOptions" feature gates to be enabled. Dynamic Kubelet Config (beta): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. -Default: nil
cpuManagerReconcilePeriod
-meta/v1.Duration +meta/v1.Duration 		- cpuManagerReconcilePeriod is the reconciliation period for the CPU Manager. +

cpuManagerReconcilePeriod is the reconciliation period for the CPU Manager. Requires the CPUManager feature gate to be enabled. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that shortening the period may carry a performance impact. -Default: "10s"
memoryManagerPolicy
string 		- memoryManagerPolicy is the name of the policy to use by memory manager. +

memoryManagerPolicy is the name of the policy to use by memory manager. Requires the MemoryManager feature gate to be enabled. Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. -Default: "none"
topologyManagerPolicy
string 		- topologyManagerPolicy is the name of the topology manager policy to use. -Valid values include: - -- `restricted`: kubelet only allows pods with optimal NUMA node alignment for - requested resources; -- `best-effort`: kubelet will favor pods with NUMA alignment of CPU and device - resources; -- `none`: kubelet has no knowledge of NUMA alignment of a pod's CPU and device resources. -- `single-numa-node`: kubelet only allows pods with a single NUMA alignment - of CPU and device resources. - -Policies other than "none" require the TopologyManager feature gate to be enabled. +

topologyManagerPolicy is the name of the topology manager policy to use. +Valid values include:

+
    +
  • restricted: kubelet only allows pods with optimal NUMA node alignment for +requested resources;
    • +
  • best-effort: kubelet will favor pods with NUMA alignment of CPU and device +resources;
    • +
  • none: kubelet has no knowledge of NUMA alignment of a pod's CPU and device resources.
    • +
  • single-numa-node: kubelet only allows pods with a single NUMA alignment +of CPU and device resources.
    • +
+

Policies other than "none" require the TopologyManager feature gate to be enabled. Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. -Default: "none"
topologyManagerScope
string 		- topologyManagerScope represents the scope of topology hint generation -that topology manager requests and hint providers generate. Valid values include: - -- `container`: topology policy is applied on a per-container basis. -- `pod`: topology policy is applied on a per-pod basis. - -"pod" scope requires the TopologyManager feature gate to be enabled. -Default: "container"
qosReserved
map[string]string 		- qosReserved is a set of resource name to percentage pairs that specify +

qosReserved is a set of resource name to percentage pairs that specify the minimum percentage of a resource reserved for exclusive use by the guaranteed QoS tier. -Currently supported resources: "memory" +Currently supported resources: "memory" Requires the QOSReserved feature gate to be enabled. Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. -Default: nil
runtimeRequestTimeout
-meta/v1.Duration +meta/v1.Duration 		- runtimeRequestTimeout is the timeout for all runtime requests except long running +

runtimeRequestTimeout is the timeout for all runtime requests except long running requests - pull, logs, exec and attach. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may disrupt components that interact with the Kubelet server. -Default: "2m"
hairpinMode
string 		- hairpinMode specifies how the Kubelet should configure the container +

hairpinMode specifies how the Kubelet should configure the container bridge for hairpin packets. Setting this flag allows endpoints in a Service to loadbalance back to -themselves if they should try to access their own Service. Values: - -- "promiscuous-bridge": make the container bridge promiscuous. -- "hairpin-veth": set the hairpin flag on container veth interfaces. -- "none": do nothing. - -Generally, one must set `--hairpin-mode=hairpin-veth to` achieve hairpin NAT, +themselves if they should try to access their own Service. Values:

+
    +
  • "promiscuous-bridge": make the container bridge promiscuous.
    • +
  • "hairpin-veth": set the hairpin flag on container veth interfaces.
    • +
  • "none": do nothing.
    • +
+

Generally, one must set --hairpin-mode=hairpin-veth to achieve hairpin NAT, because promiscuous-bridge assumes the existence of a container bridge named cbr0. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may require a node reboot, depending on the network plugin. -Default: "promiscuous-bridge"
maxPods
int32 		- maxPods is the maximum number of Pods that can run on this Kubelet. +

maxPods is the maximum number of Pods that can run on this Kubelet. The value must be a non-negative integer. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that @@ -938,233 +723,216 @@ changes may cause Pods to fail admission on Kubelet restart, and may change the value reported in Node.Status.Capacity[v1.ResourcePods], thus affecting future scheduling decisions. Increasing this value may also decrease performance, as more Pods can be packed into a single node. -Default: 110
podCIDR
string 		- podCIDR is the CIDR to use for pod IP addresses, only used in standalone mode. +

podCIDR is the CIDR to use for pod IP addresses, only used in standalone mode. In cluster mode, this is obtained from the control plane. Dynamic Kubelet Config (deprecated): This field should always be set to the empty default. It should only set for standalone Kubelets, which cannot use Dynamic Kubelet Config. -Default: ""
podPidsLimit
int64 		- podPidsLimit is the maximum number of PIDs in any pod. +

podPidsLimit is the maximum number of PIDs in any pod. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that lowering it may prevent container processes from forking after the change. -Default: -1
resolvConf
string 		- resolvConf is the resolver configuration file used as the basis +

resolvConf is the resolver configuration file used as the basis for the container DNS resolution configuration. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that changes will only take effect on Pods created after the update. Draining the node is recommended before changing this field. If set to the empty string, will override the default and effectively disable DNS lookups. -Default: "/etc/resolv.conf"
runOnce
bool 		- runOnce causes the Kubelet to check the API server once for pods, +

runOnce causes the Kubelet to check the API server once for pods, run those in addition to the pods specified by static pod files, and exit. -Default: false
cpuCFSQuota
bool 		- cpuCFSQuota enables CPU CFS quota enforcement for containers that +

cpuCFSQuota enables CPU CFS quota enforcement for containers that specify CPU limits. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that disabling it may reduce node stability. -Default: true
cpuCFSQuotaPeriod
-meta/v1.Duration +meta/v1.Duration 		- cpuCFSQuotaPeriod is the CPU CFS quota period value, `cpu.cfs_period_us`. +

cpuCFSQuotaPeriod is the CPU CFS quota period value, cpu.cfs_period_us. The value must be between 1 us and 1 second, inclusive. Requires the CustomCPUCFSQuotaPeriod feature gate to be enabled. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that limits set for containers will result in different cpu.cfs_quota settings. This will trigger container restarts on the node being reconfigured. -Default: "100ms"
nodeStatusMaxImages
int32 		- nodeStatusMaxImages caps the number of images reported in Node.status.images. +

nodeStatusMaxImages caps the number of images reported in Node.status.images. The value must be greater than -2. Note: If -1 is specified, no cap will be applied. If 0 is specified, no image is returned. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that different values can be reported on node status. -Default: 50
maxOpenFiles
int64 		- maxOpenFiles is Number of files that can be opened by Kubelet process. +

maxOpenFiles is Number of files that can be opened by Kubelet process. The value must be a non-negative number. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may impact the ability of the Kubelet to interact with the node's filesystem. -Default: 1000000
contentType
string 		- contentType is contentType of requests sent to apiserver. +

contentType is contentType of requests sent to apiserver. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may impact the ability for the Kubelet to communicate with the API server. If the Kubelet loses contact with the API server due to a change to this field, the change cannot be reverted via dynamic Kubelet config. -Default: "application/vnd.kubernetes.protobuf"
kubeAPIQPS
int32 		- kubeAPIQPS is the QPS to use while talking with kubernetes apiserver. +

kubeAPIQPS is the QPS to use while talking with kubernetes apiserver. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may impact scalability by changing the amount of traffic the Kubelet sends to the API server. -Default: 5
kubeAPIBurst
int32 		- kubeAPIBurst is the burst to allow while talking with kubernetes API server. +

kubeAPIBurst is the burst to allow while talking with kubernetes API server. This field cannot be a negative number. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may impact scalability by changing the amount of traffic the Kubelet sends to the API server. -Default: 10
serializeImagePulls
bool 		- serializeImagePulls when enabled, tells the Kubelet to pull images one -at a time. We recommend ∗not∗ changing the default value on nodes that -run docker daemon with version < 1.9 or an Aufs storage backend. +

serializeImagePulls when enabled, tells the Kubelet to pull images one +at a time. We recommend not changing the default value on nodes that +run docker daemon with version < 1.9 or an Aufs storage backend. Issue #10959 has more details. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may impact the performance of image pulls. -Default: true
evictionHard
map[string]string 		- evictionHard is a map of signal names to quantities that defines hard eviction -thresholds. For example: `{"memory.available": "300Mi"}`. +

evictionHard is a map of signal names to quantities that defines hard eviction +thresholds. For example: {"memory.available": "300Mi"}. To explicitly disable, pass a 0% or 100% threshold on an arbitrary resource. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may trigger or delay Pod evictions. Default: - memory.available: "100Mi" - nodefs.available: "10%" - nodefs.inodesFree: "5%" - imagefs.available: "15%"
evictionSoft
map[string]string 		- evictionSoft is a map of signal names to quantities that defines soft eviction thresholds. -For example: `{"memory.available": "300Mi"}`. +

evictionSoft is a map of signal names to quantities that defines soft eviction thresholds. +For example: {"memory.available": "300Mi"}. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may trigger or delay Pod evictions, and may change the allocatable reported by the node. -Default: nil
evictionSoftGracePeriod
map[string]string 		- evictionSoftGracePeriod is a map of signal names to quantities that defines grace -periods for each soft eviction signal. For example: `{"memory.available": "30s"}`. +

evictionSoftGracePeriod is a map of signal names to quantities that defines grace +periods for each soft eviction signal. For example: {"memory.available": "30s"}. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may trigger or delay Pod evictions. -Default: nil
evictionPressureTransitionPeriod
-meta/v1.Duration +meta/v1.Duration 		- evictionPressureTransitionPeriod is the duration for which the kubelet has to wait +

evictionPressureTransitionPeriod is the duration for which the kubelet has to wait before transitioning out of an eviction pressure condition. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that lowering it may decrease the stability of the node when the node is overcommitted. -Default: "5m"
evictionMaxPodGracePeriod
int32 		- evictionMaxPodGracePeriod is the maximum allowed grace period (in seconds) to use +

evictionMaxPodGracePeriod is the maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met. This value effectively caps the Pod's terminationGracePeriodSeconds value during soft evictions. Note: Due to issue #64530, the behavior has a bug where this value currently just @@ -1174,47 +942,44 @@ If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that lowering it decreases the amount of time Pods will have to gracefully clean up before being killed during a soft eviction. -Default: 0
evictionMinimumReclaim
map[string]string 		- evictionMinimumReclaim is a map of signal names to quantities that defines minimum reclaims, +

evictionMinimumReclaim is a map of signal names to quantities that defines minimum reclaims, which describe the minimum amount of a given resource the kubelet will reclaim when performing a pod eviction while that resource is under pressure. -For example: `{"imagefs.available": "2Gi"}`. +For example: {"imagefs.available": "2Gi"}. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may change how well eviction can manage resource pressure. -Default: nil
podsPerCore
int32 		- podsPerCore is the maximum number of pods per core. Cannot exceed maxPods. +

podsPerCore is the maximum number of pods per core. Cannot exceed maxPods. The value must be a non-negative integer. If 0, there is no limit on the number of Pods. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that changes may cause Pods to fail admission on Kubelet restart, and may change -the value reported in `Node.status.capacity.pods`, thus affecting +the value reported in Node.status.capacity.pods, thus affecting future scheduling decisions. Increasing this value may also decrease performance, as more Pods can be packed into a single node. -Default: 0
enableControllerAttachDetach
bool 		- enableControllerAttachDetach enables the Attach/Detach controller to +

enableControllerAttachDetach enables the Attach/Detach controller to manage attachment/detachment of volumes scheduled to this node, and disables kubelet from executing any attach/detach operations. If DynamicKubeletConfig (deprecated; default off) is on, when @@ -1224,45 +989,42 @@ may result in volumes refusing to detach if the node is not drained prior to the update, and if Pods are scheduled to the node before the volumes.kubernetes.io/controller-managed-attach-detach annotation is updated by the Kubelet. In general, it is safest to leave this value set the same as local config. -Default: true
protectKernelDefaults
bool 		- protectKernelDefaults, if true, causes the Kubelet to error if kernel +

protectKernelDefaults, if true, causes the Kubelet to error if kernel flags are not as it expects. Otherwise the Kubelet will attempt to modify kernel flags to match its expectation. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that enabling it may cause the Kubelet to crash-loop if the Kernel is not configured as Kubelet expects. -Default: false
makeIPTablesUtilChains
bool 		- makeIPTablesUtilChains, if true, causes the Kubelet ensures a set of iptables rules +

makeIPTablesUtilChains, if true, causes the Kubelet ensures a set of iptables rules are present on host. These rules will serve as utility rules for various components, e.g. kube-proxy. The rules will be created based on iptablesMasqueradeBit and iptablesDropBit. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that disabling it will prevent the Kubelet from healing locally misconfigured iptables rules. -Default: true
iptablesMasqueradeBit
int32 		- iptablesMasqueradeBit is the bit of the iptables fwmark space to mark for SNAT. +

iptablesMasqueradeBit is the bit of the iptables fwmark space to mark for SNAT. Values must be within the range [0, 31]. Must be different from other mark bits. Warning: Please match the value of the corresponding parameter in kube-proxy. TODO: clean up IPTablesMasqueradeBit in kube-proxy. @@ -1270,107 +1032,99 @@ If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it needs to be coordinated with other components, like kube-proxy, and the update will only be effective if MakeIPTablesUtilChains is enabled. -Default: 14
iptablesDropBit
int32 		- iptablesDropBit is the bit of the iptables fwmark space to mark for dropping packets. +

iptablesDropBit is the bit of the iptables fwmark space to mark for dropping packets. Values must be within the range [0, 31]. Must be different from other mark bits. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it needs to be coordinated with other components, like kube-proxy, and the update will only be effective if MakeIPTablesUtilChains is enabled. -Default: 15
featureGates
map[string]bool 		- featureGates is a map of feature names to bools that enable or disable experimental +

featureGates is a map of feature names to bools that enable or disable experimental features. This field modifies piecemeal the built-in default values from -"k8s.io/kubernetes/pkg/features/kube_features.go". +"k8s.io/kubernetes/pkg/features/kube_features.go". If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider the documentation for the features you are enabling or disabling. While we encourage feature developers to make it possible to dynamically enable and disable features, some changes may require node reboots, and some features may require careful coordination to retroactively disable. -Default: nil
failSwapOn
bool 		- failSwapOn tells the Kubelet to fail to start if swap is enabled on the node. +

failSwapOn tells the Kubelet to fail to start if swap is enabled on the node. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that setting it to true will cause the Kubelet to crash-loop if swap is enabled. -Default: true
memorySwap
MemorySwapConfiguration 		- memorySwap configures swap memory available to container workloads.
containerLogMaxSize
string 		- containerLogMaxSize is a quantity defining the maximum size of the container log -file before it is rotated. For example: "5Mi" or "256Ki". +

containerLogMaxSize is a quantity defining the maximum size of the container log +file before it is rotated. For example: "5Mi" or "256Ki". If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may trigger log rotation. -Default: "10Mi"
containerLogMaxFiles
int32 		- containerLogMaxFiles specifies the maximum number of container log files that can +

containerLogMaxFiles specifies the maximum number of container log files that can be present for a container. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that lowering it may cause log files to be deleted. -Default: 5
configMapAndSecretChangeDetectionStrategy
ResourceChangeDetectionStrategy 		- configMapAndSecretChangeDetectionStrategy is a mode in which ConfigMap and Secret -managers are running. Valid values include: - -- `Get`: kubelet fetches necessary objects directly from the API server; -- `Cache`: kubelet uses TTL cache for object fetched from the API server; -- `Watch`: kubelet uses watches to observe changes to objects that are in its interest. - -Default: "Watch"
systemReserved
map[string]string 		- systemReserved is a set of ResourceName=ResourceQuantity (e.g. cpu=200m,memory=150G) +

systemReserved is a set of ResourceName=ResourceQuantity (e.g. cpu=200m,memory=150G) pairs that describe resources reserved for non-kubernetes components. Currently only cpu and memory are supported. See http://kubernetes.io/docs/user-guide/compute-resources for more detail. @@ -1379,15 +1133,14 @@ dynamically updating this field, consider that it may not be possible to increase the reserved resources, because this requires resizing cgroups. Always look for a NodeAllocatableEnforced event after updating this field to ensure that the update was successful. -Default: nil
kubeReserved
map[string]string 		- kubeReserved is a set of ResourceName=ResourceQuantity (e.g. cpu=200m,memory=150G) pairs +

kubeReserved is a set of ResourceName=ResourceQuantity (e.g. cpu=200m,memory=150G) pairs that describe resources reserved for kubernetes system components. Currently cpu, memory and local storage for root file system are supported. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ @@ -1397,76 +1150,71 @@ dynamically updating this field, consider that it may not be possible to increase the reserved resources, because this requires resizing cgroups. Always look for a NodeAllocatableEnforced event after updating this field to ensure that the update was successful. -Default: nil
reservedSystemCPUs [Required]
string 		- The reservedSystemCPUs option specifies the CPU list reserved for the host -level system threads and kubernetes related threads. This provide a "static" -CPU list rather than the "dynamic" list by systemReserved and kubeReserved. -This option does not support systemReservedCgroup or kubeReservedCgroup.
showHiddenMetricsForVersion
string 		- showHiddenMetricsForVersion is the previous version for which you want to show +

showHiddenMetricsForVersion is the previous version for which you want to show hidden metrics. Only the previous minor version is meaningful, other values will not be allowed. -The format is `.`, e.g.: `1.16`. +The format is <major>.<minor>, e.g.: 1.16. The purpose of this format is make sure you have the opportunity to notice if the next release hides additional metrics, rather than being surprised when they are permanently removed in the release after that. -Default: ""
systemReservedCgroup
string 		- systemReservedCgroup helps the kubelet identify absolute name of top level CGroup used -to enforce `systemReserved` compute resource reservation for OS system daemons. -Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) +

systemReservedCgroup helps the kubelet identify absolute name of top level CGroup used +to enforce systemReserved compute resource reservation for OS system daemons. +Refer to Node Allocatable doc for more information. Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. -Default: ""
kubeReservedCgroup
string 		- kubeReservedCgroup helps the kubelet identify absolute name of top level CGroup used -to enforce `KubeReserved` compute resource reservation for Kubernetes node system daemons. -Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) +

kubeReservedCgroup helps the kubelet identify absolute name of top level CGroup used +to enforce KubeReserved compute resource reservation for Kubernetes node system daemons. +Refer to Node Allocatable doc for more information. Dynamic Kubelet Config (deprecated): This field should not be updated without a full node reboot. It is safest to keep this value the same as the local config. -Default: ""
enforceNodeAllocatable
[]string 		- This flag specifies the various Node Allocatable enforcements that Kubelet needs to perform. -This flag accepts a list of options. Acceptable options are `none`, `pods`, -`system-reserved` and `kube-reserved`. -If `none` is specified, no other options may be specified. -When `system-reserved` is in the list, systemReservedCgroup must be specified. -When `kube-reserved` is in the list, kubeReservedCgroup must be specified. -This field is supported only when `cgroupsPerQOS` is set to true. -Refer to [Node Allocatable](https://git.k8s.io/community/contributors/design-proposals/node/node-allocatable.md) +

This flag specifies the various Node Allocatable enforcements that Kubelet needs to perform. +This flag accepts a list of options. Acceptable options are none, pods, +system-reserved and kube-reserved. +If none is specified, no other options may be specified. +When system-reserved is in the list, systemReservedCgroup must be specified. +When kube-reserved is in the list, kubeReservedCgroup must be specified. +This field is supported only when cgroupsPerQOS is set to true. +Refer to Node Allocatable for more information. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that @@ -1475,111 +1223,102 @@ enforcements may reduce the stability of components which were using more than the reserved amount of resources; for example, enforcing kube-reserved may cause Kubelets to OOM if it uses more than the reserved resources, and enforcing system-reserved may cause system daemons to OOM if they use more than the reserved resources. -Default: ["pods"]
allowedUnsafeSysctls
[]string 		- A comma separated whitelist of unsafe sysctls or sysctl patterns (ending in `∗`). -Unsafe sysctl groups are `kernel.shm∗`, `kernel.msg∗`, `kernel.sem`, `fs.mqueue.∗`, -and `net.∗`. For example: "`kernel.msg∗,net.ipv4.route.min_pmtu`" -Default: []
volumePluginDir
string 		- volumePluginDir is the full path of the directory in which to search +

volumePluginDir is the full path of the directory in which to search for additional third party volume plugins. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that changing the volumePluginDir may disrupt workloads relying on third party volume plugins. -Default: "/usr/libexec/kubernetes/kubelet-plugins/volume/exec/"
providerID
string 		- providerID, if set, sets the unique ID of the instance that an external +

providerID, if set, sets the unique ID of the instance that an external provider (i.e. cloudprovider) can use to identify a specific node. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may impact the ability of the Kubelet to interact with cloud providers. -Default: ""
kernelMemcgNotification
bool 		- kernelMemcgNotification, if set, instructs the the kubelet to integrate with the +

kernelMemcgNotification, if set, instructs the the kubelet to integrate with the kernel memcg notification for determining if memory eviction thresholds are exceeded rather than polling. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that it may impact the way Kubelet interacts with the kernel. -Default: false
logging [Required]
LoggingConfiguration 		- logging specifies the options of logging. -Refer to [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) +

logging specifies the options of logging. +Refer to Logs Options for more information. Default: - Format: text
enableSystemLogHandler
bool 		- enableSystemLogHandler enables system logs via web interface host:port/logs/ -Default: true
shutdownGracePeriod
-meta/v1.Duration +meta/v1.Duration 		- shutdownGracePeriod specifies the total duration that the node should delay the +

shutdownGracePeriod specifies the total duration that the node should delay the shutdown and total grace period for pod termination during a node shutdown. -Default: "0s"
shutdownGracePeriodCriticalPods
-meta/v1.Duration +meta/v1.Duration 		- shutdownGracePeriodCriticalPods specifies the duration used to terminate critical +

shutdownGracePeriodCriticalPods specifies the duration used to terminate critical pods during a node shutdown. This should be less than shutdownGracePeriod. For example, if shutdownGracePeriod=30s, and shutdownGracePeriodCriticalPods=10s, during a node shutdown the first 20 seconds would be reserved for gracefully terminating normal pods, and the last 10 seconds would be reserved for terminating critical pods. -Default: "0s"
shutdownGracePeriodByPodPriority
[]ShutdownGracePeriodByPodPriority 		- shutdownGracePeriodByPodPriority specifies the shutdown grace period for Pods based +

shutdownGracePeriodByPodPriority specifies the shutdown grace period for Pods based on their associated priority class value. When a shutdown request is received, the Kubelet will initiate shutdown on all pods running on the node with a grace period that depends on the priority of the pod, @@ -1587,32 +1326,31 @@ and then wait for all pods to exit. Each entry in the array represents the graceful shutdown time a pod with a priority class value that lies in the range of that value and the next higher entry in the list when the node is shutting down. -For example, to allow critical pods 10s to shutdown, priority>=10000 pods 20s to -shutdown, and all remaining pods 30s to shutdown. - -shutdownGracePeriodByPodPriority: - - priority: 2000000000 - shutdownGracePeriodSeconds: 10 - - priority: 10000 - shutdownGracePeriodSeconds: 20 - - priority: 0 - shutdownGracePeriodSeconds: 30 - -The time the Kubelet will wait before exiting will at most be the maximum of all +For example, to allow critical pods 10s to shutdown, priority>=10000 pods 20s to +shutdown, and all remaining pods 30s to shutdown.

+

shutdownGracePeriodByPodPriority:

+
    +
  • priority: 2000000000 +shutdownGracePeriodSeconds: 10
    • +
  • priority: 10000 +shutdownGracePeriodSeconds: 20
    • +
  • priority: 0 +shutdownGracePeriodSeconds: 30
    • +
+

The time the Kubelet will wait before exiting will at most be the maximum of all shutdownGracePeriodSeconds for each priority class range represented on the node. When all pods have exited or reached their grace periods, the Kubelet will release the shutdown inhibit lock. Requires the GracefulNodeShutdown feature gate to be enabled. This configuration must be empty if either ShutdownGracePeriod or ShutdownGracePeriodCriticalPods is set. -Default: nil
reservedMemory
[]MemoryReservation 		- reservedMemory specifies a comma-separated list of memory reservations for NUMA nodes. +

reservedMemory specifies a comma-separated list of memory reservations for NUMA nodes. The parameter makes sense only in the context of the memory manager feature. The memory manager will not allocate reserved memory for container workloads. For example, if you have a NUMA0 with 10Gi of memory and the reservedMemory was @@ -1621,81 +1359,74 @@ only 9Gi is available for allocation. You can specify a different amount of NUMA node and memory types. You can omit this parameter at all, but you should be aware that the amount of reserved memory from all NUMA nodes should be equal to the amount of memory specified -by the [node allocatable](https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable). +by the node allocatable. If at least one node allocatable parameter has a non-zero value, you will need to specify at least one NUMA node. -Also, avoid specifying: - -1. Duplicates, the same NUMA node, and memory type, but with a different value. -2. zero limits for any memory type. -3. NUMAs nodes IDs that do not exist under the machine. -4. memory types except for memory and hugepages- - -Default: nil
enableProfilingHandler
bool 		- enableProfilingHandler enables profiling via web interface host:port/debug/pprof/ -Default: true
enableDebugFlagsHandler
bool 		- enableDebugFlagsHandler enables flags endpoint via web interface host:port/debug/flags/v -Default: true
seccompDefault
bool 		- SeccompDefault enables the use of `RuntimeDefault` as the default seccomp profile for all workloads. +

SeccompDefault enables the use of RuntimeDefault as the default seccomp profile for all workloads. This requires the corresponding SeccompDefault feature gate to be enabled as well. -Default: false
memoryThrottlingFactor
float64 		- MemoryThrottlingFactor specifies the factor multiplied by the memory limit or node allocatable memory +

MemoryThrottlingFactor specifies the factor multiplied by the memory limit or node allocatable memory when setting the cgroupv2 memory.high value to enforce MemoryQoS. Decreasing this factor will set lower high limit for container cgroups and put heavier reclaim pressure while increasing will put less reclaim pressure. See http://kep.k8s.io/2570 for more details. -Default: 0.8
registerWithTaints
[]core/v1.Taint 		- registerWithTaints are an array of taints to add to a node object when +

registerWithTaints are an array of taints to add to a node object when the kubelet registers itself. This only takes effect when registerNode is true and upon the initial registration of the node. -Default: nil
registerNode
bool 		- registerNode enables automatic registration with the apiserver. -Default: true
@@ -1703,11 +1434,10 @@ Default: true - - -SerializedNodeConfigSource allows us to serialize v1.NodeConfigSource. +

SerializedNodeConfigSource allows us to serialize v1.NodeConfigSource. This type is used internally by the Kubelet for tracking checkpointed dynamic configs. -It exists in the kubeletconfig API group because it is classified as a versioned input to the Kubelet. +It exists in the kubeletconfig API group because it is classified as a versioned input to the Kubelet.

+ @@ -1716,28 +1446,23 @@ It exists in the kubeletconfig API group because it is classified as a versioned - - +

source is the source that we are serializing.

+ - -
FieldDescription
apiVersion
string		kubelet.config.k8s.io/v1beta1
kind
string		SerializedNodeConfigSource
source
core/v1.NodeConfigSource 		- source is the source that we are serializing.
## `KubeletAnonymousAuthentication` {#kubelet-config-k8s-io-v1beta1-KubeletAnonymousAuthentication} - - **Appears in:** -- [KubeletAuthentication](#kubelet-config-k8s-io-v1beta1-KubeletAuthentication) +- [KubeletAuthentication](#kubelet-config-k8s-io-v1beta1-KubeletAuthentication) @@ -1745,31 +1470,27 @@ It exists in the kubeletconfig API group because it is classified as a versioned FieldDescription - enabled
bool - enabled allows anonymous requests to the kubelet server. +

enabled allows anonymous requests to the kubelet server. Requests that are not rejected by another authentication method are treated as anonymous requests. -Anonymous requests have a username of `system:anonymous`, and a group name of -`system:unauthenticated`. +Anonymous requests have a username of system:anonymous, and a group name of +system:unauthenticated.

+ - - ## `KubeletAuthentication` {#kubelet-config-k8s-io-v1beta1-KubeletAuthentication} - - **Appears in:** -- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) +- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) @@ -1777,43 +1498,37 @@ Anonymous requests have a username of `system:anonymous`, and a group name of FieldDescription - x509
KubeletX509Authentication - x509 contains settings related to x509 client certificate authentication. +

x509 contains settings related to x509 client certificate authentication.

+ - - webhook
KubeletWebhookAuthentication - webhook contains settings related to webhook bearer token authentication. +

webhook contains settings related to webhook bearer token authentication.

+ - - anonymous
KubeletAnonymousAuthentication - anonymous contains settings related to anonymous authentication. +

anonymous contains settings related to anonymous authentication.

+ - - ## `KubeletAuthorization` {#kubelet-config-k8s-io-v1beta1-KubeletAuthorization} - - **Appears in:** -- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) +- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) @@ -1821,26 +1536,23 @@ Anonymous requests have a username of `system:anonymous`, and a group name of FieldDescription - mode
KubeletAuthorizationMode - mode is the authorization mode to apply to requests to the kubelet server. -Valid values are `AlwaysAllow` and `Webhook`. -Webhook mode uses the SubjectAccessReview API to determine authorization. +

mode is the authorization mode to apply to requests to the kubelet server. +Valid values are AlwaysAllow and Webhook. +Webhook mode uses the SubjectAccessReview API to determine authorization.

+ - - webhook
KubeletWebhookAuthorization - webhook contains settings related to Webhook authorization. +

webhook contains settings related to Webhook authorization.

+ - - @@ -1848,10 +1560,9 @@ Webhook mode uses the SubjectAccessReview API to determine authorization. (Alias of `string`) - **Appears in:** -- [KubeletAuthorization](#kubelet-config-k8s-io-v1beta1-KubeletAuthorization) +- [KubeletAuthorization](#kubelet-config-k8s-io-v1beta1-KubeletAuthorization) @@ -1860,11 +1571,9 @@ Webhook mode uses the SubjectAccessReview API to determine authorization. ## `KubeletWebhookAuthentication` {#kubelet-config-k8s-io-v1beta1-KubeletWebhookAuthentication} - - **Appears in:** -- [KubeletAuthentication](#kubelet-config-k8s-io-v1beta1-KubeletAuthentication) +- [KubeletAuthentication](#kubelet-config-k8s-io-v1beta1-KubeletAuthentication) @@ -1872,36 +1581,31 @@ Webhook mode uses the SubjectAccessReview API to determine authorization. FieldDescription - enabled
bool - enabled allows bearer token authentication backed by the -tokenreviews.authentication.k8s.io API. +

enabled allows bearer token authentication backed by the +tokenreviews.authentication.k8s.io API.

+ - - cacheTTL
-meta/v1.Duration +meta/v1.Duration - cacheTTL enables caching of authentication results +

cacheTTL enables caching of authentication results

+ - - ## `KubeletWebhookAuthorization` {#kubelet-config-k8s-io-v1beta1-KubeletWebhookAuthorization} - - **Appears in:** -- [KubeletAuthorization](#kubelet-config-k8s-io-v1beta1-KubeletAuthorization) +- [KubeletAuthorization](#kubelet-config-k8s-io-v1beta1-KubeletAuthorization) @@ -1909,37 +1613,32 @@ tokenreviews.authentication.k8s.io API. FieldDescription - cacheAuthorizedTTL
-meta/v1.Duration +meta/v1.Duration - cacheAuthorizedTTL is the duration to cache 'authorized' responses from the -webhook authorizer. +

cacheAuthorizedTTL is the duration to cache 'authorized' responses from the +webhook authorizer.

+ - - cacheUnauthorizedTTL
-meta/v1.Duration +meta/v1.Duration - cacheUnauthorizedTTL is the duration to cache 'unauthorized' responses from -the webhook authorizer. +

cacheUnauthorizedTTL is the duration to cache 'unauthorized' responses from +the webhook authorizer.

+ - - ## `KubeletX509Authentication` {#kubelet-config-k8s-io-v1beta1-KubeletX509Authentication} - - **Appears in:** -- [KubeletAuthentication](#kubelet-config-k8s-io-v1beta1-KubeletAuthentication) +- [KubeletAuthentication](#kubelet-config-k8s-io-v1beta1-KubeletAuthentication) @@ -1947,68 +1646,57 @@ the webhook authorizer. FieldDescription - clientCAFile
string - clientCAFile is the path to a PEM-encoded certificate bundle. If set, any request +

clientCAFile is the path to a PEM-encoded certificate bundle. If set, any request presenting a client certificate signed by one of the authorities in the bundle is authenticated with a username corresponding to the CommonName, -and groups corresponding to the Organization in the client certificate. +and groups corresponding to the Organization in the client certificate.

+ - - ## `MemoryReservation` {#kubelet-config-k8s-io-v1beta1-MemoryReservation} - - **Appears in:** + - [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) -MemoryReservation specifies the memory reservation of different types for each NUMA node +

MemoryReservation specifies the memory reservation of different types for each NUMA node

+ - + No description provided. - - + No description provided. - -
FieldDescription
numaNode [Required]
int32 		- No description provided. -
limits [Required]
core/v1.ResourceList 		- No description provided. -
## `MemorySwapConfiguration` {#kubelet-config-k8s-io-v1beta1-MemorySwapConfiguration} - - **Appears in:** -- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) +- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) @@ -2016,18 +1704,16 @@ MemoryReservation specifies the memory reservation of different types for each N FieldDescription - swapBehavior
string - swapBehavior configures swap memory available to container workloads. May be one of -"", "LimitedSwap": workload combined memory and swap usage cannot exceed pod memory limit -"UnlimitedSwap": workloads can use unlimited swap, up to the allocatable limit. +

swapBehavior configures swap memory available to container workloads. May be one of +"", "LimitedSwap": workload combined memory and swap usage cannot exceed pod memory limit +"UnlimitedSwap": workloads can use unlimited swap, up to the allocatable limit.

+ - - @@ -2035,49 +1721,197 @@ MemoryReservation specifies the memory reservation of different types for each N (Alias of `string`) - **Appears in:** + - [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) -ResourceChangeDetectionStrategy denotes a mode in which internal -managers (secret, configmap) are discovering object changes. +

ResourceChangeDetectionStrategy denotes a mode in which internal +managers (secret, configmap) are discovering object changes.

+ ## `ShutdownGracePeriodByPodPriority` {#kubelet-config-k8s-io-v1beta1-ShutdownGracePeriodByPodPriority} - - **Appears in:** + - [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) -ShutdownGracePeriodByPodPriority specifies the shutdown grace period for Pods based on their associated priority class value +

ShutdownGracePeriodByPodPriority specifies the shutdown grace period for Pods based on their associated priority class value

+ - +

priority is the priority value associated with the shutdown grace period

+ - - +

shutdownGracePeriodSeconds is the shutdown grace period in seconds

+ - -
FieldDescription
priority [Required]
int32 		- priority is the priority value associated with the shutdown grace period
shutdownGracePeriodSeconds [Required]
int64 		- shutdownGracePeriodSeconds is the shutdown grace period in seconds
+ + + +## `FormatOptions` {#FormatOptions} + + +**Appears in:** + +- [LoggingConfiguration](#LoggingConfiguration) + + +

FormatOptions contains options for the different logging formats.

+ + + + + + + + + + + +
FieldDescription
json [Required]
+JSONOptions +		 +

[Experimental] JSON contains options for logging format "json".

+
+ +## `JSONOptions` {#JSONOptions} + + +**Appears in:** + +- [FormatOptions](#FormatOptions) + + +

JSONOptions contains options for logging format "json".

+ + + + + + + + + + + + + + +
FieldDescription
splitStream [Required]
+bool +		 +

[Experimental] SplitStream redirects error messages to stderr while +info messages go to stdout, with buffering. The default is to write +both to stdout, without buffering.

+
infoBufferSize [Required]
+k8s.io/apimachinery/pkg/api/resource.QuantityValue +		 +

[Experimental] InfoBufferSize sets the size of the info stream when +using split streams. The default is zero, which disables buffering.

+
+ +## `LoggingConfiguration` {#LoggingConfiguration} + + +**Appears in:** + +- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) + + +

LoggingConfiguration contains logging options +Refer Logs Options for more information.

+ + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
format [Required]
+string +		 +

Format Flag specifies the structure of log messages. +default value of format is text

+
flushFrequency [Required]
+time.Duration +		 +

Maximum number of seconds between log flushes. Ignored if the +selected logging backend writes log messages without buffering.

+
verbosity [Required]
+uint32 +		 +

Verbosity is the threshold that determines which log messages are +logged. Default is zero which logs only the most important +messages. Higher values enable additional messages. Error messages +are always logged.

+
vmodule [Required]
+VModuleConfiguration +		 +

VModule overrides the verbosity threshold for individual files. +Only supported for "text" log format.

+
sanitization [Required]
+bool +		 +

[Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). +Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)

+
options [Required]
+FormatOptions +		 +

[Experimental] Options holds additional parameters that are specific +to the different logging formats. Only the options for the selected +format get used, but all of them get validated.

+
+ +## `VModuleConfiguration` {#VModuleConfiguration} + +(Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`) + +**Appears in:** + +- [LoggingConfiguration](#LoggingConfiguration) + + +

VModuleConfiguration is a collection of individual file names or patterns +and the corresponding verbosity threshold.

+ + + diff --git a/content/en/docs/reference/config-api/kubelet-credentialprovider.v1alpha1.md b/content/en/docs/reference/config-api/kubelet-credentialprovider.v1alpha1.md new file mode 100644 index 0000000000..070fe96d09 --- /dev/null +++ b/content/en/docs/reference/config-api/kubelet-credentialprovider.v1alpha1.md @@ -0,0 +1,192 @@ +--- +title: Kubelet CredentialProvider (v1alpha1) +content_type: tool-reference +package: credentialprovider.kubelet.k8s.io/v1alpha1 +auto_generated: true +--- + + +## Resource Types + + +- [CredentialProviderRequest](#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderRequest) +- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderResponse) + + + + +## `CredentialProviderRequest` {#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderRequest} + + + + + +CredentialProviderRequest includes the image that the kubelet requires authentication for. +Kubelet will pass this request object to the plugin via stdin. In general, plugins should +prefer responding with the same apiVersion they were sent. + + + + + + + + + + + + + + + + + +
FieldDescription
apiVersion
string		credentialprovider.kubelet.k8s.io/v1alpha1
kind
string		CredentialProviderRequest
image [Required]
+string +		 + image is the container image that is being pulled as part of the +credential provider plugin request. Plugins may optionally parse the image +to extract any information required to fetch credentials.
+ + + +## `CredentialProviderResponse` {#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderResponse} + + + + + +CredentialProviderResponse holds credentials that the kubelet should use for the specified +image provided in the original request. Kubelet will read the response from the plugin via stdout. +This response should be set to the same apiVersion as CredentialProviderRequest. + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldDescription
apiVersion
string		credentialprovider.kubelet.k8s.io/v1alpha1
kind
string		CredentialProviderResponse
cacheKeyType [Required]
+PluginCacheKeyType +		 + cacheKeyType indiciates the type of caching key to use based on the image provided +in the request. There are three valid values for the cache key type: Image, Registry, and +Global. If an invalid value is specified, the response will NOT be used by the kubelet.
cacheDuration
+meta/v1.Duration +		 + cacheDuration indicates the duration the provided credentials should be cached for. +The kubelet will use this field to set the in-memory cache duration for credentials +in the AuthConfig. If null, the kubelet will use defaultCacheDuration provided in +CredentialProviderConfig. If set to 0, the kubelet will not cache the provided AuthConfig.
auth
+map[string]k8s.io/kubelet/pkg/apis/credentialprovider/v1alpha1.AuthConfig +		 + auth is a map containing authentication information passed into the kubelet. +Each key is a match image string (more on this below). The corresponding authConfig value +should be valid for all images that match against this key. A plugin should set +this field to null if no valid credentials can be returned for the requested image. + +Each key in the map is a pattern which can optionally contain a port and a path. +Globs can be used in the domain, but not in the port or the path. Globs are supported +as subdomains like '∗.k8s.io' or 'k8s.∗.io', and top-level-domains such as 'k8s.∗'. +Matching partial subdomains like 'app∗.k8s.io' is also supported. Each glob can only match +a single subdomain segment, so ∗.io does not match ∗.k8s.io. + +The kubelet will match images against the key when all of the below are true: +- Both contain the same number of domain parts and each part matches. +- The URL path of an imageMatch must be a prefix of the target image URL path. +- If the imageMatch contains a port, then the port must match in the image as well. + +When multiple keys are returned, the kubelet will traverse all keys in reverse order so that: +- longer keys come before shorter keys with the same prefix +- non-wildcard keys come before wildcard keys with the same prefix. + +For any given match, the kubelet will attempt an image pull with the provided credentials, +stopping after the first successfully authenticated pull. + +Example keys: + - 123456789.dkr.ecr.us-east-1.amazonaws.com + - ∗.azurecr.io + - gcr.io + - ∗.∗.registry.io + - registry.io:8080/path
+ + + +## `AuthConfig` {#credentialprovider-kubelet-k8s-io-v1alpha1-AuthConfig} + + + + +**Appears in:** + +- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderResponse) + + +AuthConfig contains authentication information for a container registry. +Only username/password based authentication is supported today, but more authentication +mechanisms may be added in the future. + + + + + + + + + + + + + + + + + + +
FieldDescription
username [Required]
+string +		 + username is the username used for authenticating to the container registry +An empty username is valid.
password [Required]
+string +		 + password is the password used for authenticating to the container registry +An empty password is valid.
+ + + +## `PluginCacheKeyType` {#credentialprovider-kubelet-k8s-io-v1alpha1-PluginCacheKeyType} + +(Alias of `string`) + + +**Appears in:** + +- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderResponse) + + + + + + + diff --git a/content/en/docs/reference/glossary/finalizer.md b/content/en/docs/reference/glossary/finalizer.md index c44386fbf3..e01f66d7f2 100644 --- a/content/en/docs/reference/glossary/finalizer.md +++ b/content/en/docs/reference/glossary/finalizer.md @@ -19,12 +19,12 @@ to clean up resources the deleted object owned. When you tell Kubernetes to delete an object that has finalizers specified for -it, the Kubernetes API marks the object for deletion, putting it into a -read-only state. The target object remains in a terminating state while the +it, the Kubernetes API marks the object for deletion by populating `.metadata.deletionTimestamp`, +and returns a `202` status code (HTTP "Accepted"). The target object remains in a terminating state while the control plane, or other components, take the actions defined by the finalizers. After these actions are complete, the controller removes the relevant finalizers from the target object. When the `metadata.finalizers` field is empty, -Kubernetes considers the deletion complete. +Kubernetes considers the deletion complete and deletes the object. You can use finalizers to control {{}} of resources. For example, you can define a finalizer to clean up related resources or diff --git a/content/en/docs/reference/issues-security/security.md b/content/en/docs/reference/issues-security/security.md index b237f9c732..e5d2a565dd 100644 --- a/content/en/docs/reference/issues-security/security.md +++ b/content/en/docs/reference/issues-security/security.md @@ -19,8 +19,6 @@ This page describes Kubernetes security and disclosure information. Join the [kubernetes-security-announce](https://groups.google.com/forum/#!forum/kubernetes-security-announce) group for emails about security and major API announcements. -You can also subscribe to an RSS feed of the above using [this link](https://groups.google.com/forum/feed/kubernetes-security-announce/msgs/rss_v2_0.xml?num=50). - ## Report a Vulnerability We're extremely grateful for security researchers and users that report vulnerabilities to the Kubernetes Open Source Community. All reports are thoroughly investigated by a set of community volunteers. diff --git a/content/en/docs/reference/kubectl/cheatsheet.md b/content/en/docs/reference/kubectl/cheatsheet.md index 87451a03ac..b3c3536b31 100644 --- a/content/en/docs/reference/kubectl/cheatsheet.md +++ b/content/en/docs/reference/kubectl/cheatsheet.md @@ -73,6 +73,10 @@ kubectl config set-context gce --user=cluster-admin --namespace=foo \ && kubectl config use-context gce kubectl config unset users.foo # delete user foo + +# short alias to set/show context/namespace (only works for bash and bash-compatible shells, current context to be set before using kn to set namespace) +alias kx='f() { [ "$1" ] && kubectl config use-context $1 || kubectl config current-context ; } ; f' +alias kn='f() { [ "$1" ] && kubectl config set-context --current --namespace $1 || kubectl config view --minify | grep namespace | cut -d" " -f6 ; } ; f' ``` ## Kubectl apply @@ -212,10 +216,10 @@ kubectl diff -f ./my-manifest.yaml # Produce a period-delimited tree of all keys returned for nodes # Helpful when locating a key within a complex nested JSON structure -kubectl get nodes -o json | jq -c 'path(..)|[.[]|tostring]|join(".")' +kubectl get nodes -o json | jq -c 'paths|join(".")' # Produce a period-delimited tree of all keys returned for pods, etc -kubectl get pods -o json | jq -c 'path(..)|[.[]|tostring]|join(".")' +kubectl get pods -o json | jq -c 'paths|join(".")' # Produce ENV for all pods, assuming you have a default container for the pods, default namespace and the `env` command is supported. # Helpful when running any supported command across all pods, not just `env` diff --git a/content/en/docs/reference/labels-annotations-taints.md b/content/en/docs/reference/labels-annotations-taints.md index 80dfba8162..18e599e12e 100644 --- a/content/en/docs/reference/labels-annotations-taints.md +++ b/content/en/docs/reference/labels-annotations-taints.md @@ -72,6 +72,22 @@ This annotation is a best guess at why something was changed. It is populated when adding `--record` to a `kubectl` command that may change an object. +## kubernetes.io/description {#description} + +Example: `kubernetes.io/description: "Description of K8s object."` + +Used on: All Objects + +This annotation is used for describing specific behaviour of given object. + +## kubernetes.io/enforce-mountable-secrets {#enforce-mountable-secrets} + +Example: `kubernetes.io/enforce-mountable-secrets: "true"` + +Used on: ServiceAccount + +The value for this annotation must be **true** to take effect. This annotation indicates that pods running as this service account may only reference Secret API objects specified in the service account's `secrets` field. + ## controller.kubernetes.io/pod-deletion-cost {#pod-deletion-cost} Example: `controller.kubernetes.io/pod-deletion-cost=10` @@ -529,4 +545,4 @@ This annotation has been deprecated since Kubernetes v1.19 and will become non-f The tutorial [Restrict a Container's Syscalls with seccomp](/docs/tutorials/clusters/seccomp/) takes you through the steps you follow to apply a seccomp profile to a Pod or to one of its containers. That tutorial covers the supported mechanism for configuring seccomp in Kubernetes, -based on setting `securityContext` within the Pod's `.spec`. \ No newline at end of file +based on setting `securityContext` within the Pod's `.spec`. diff --git a/content/en/docs/reference/node/_index.md b/content/en/docs/reference/node/_index.md new file mode 100644 index 0000000000..6ffb648381 --- /dev/null +++ b/content/en/docs/reference/node/_index.md @@ -0,0 +1,4 @@ +--- +title: Node Reference Information +weight: 40 +--- diff --git a/content/en/docs/reference/node/topics-on-dockershim-and-cri-compatible-runtimes.md b/content/en/docs/reference/node/topics-on-dockershim-and-cri-compatible-runtimes.md new file mode 100644 index 0000000000..a90c08fd91 --- /dev/null +++ b/content/en/docs/reference/node/topics-on-dockershim-and-cri-compatible-runtimes.md @@ -0,0 +1,50 @@ +--- +title: Articles on dockershim Removal and on Using CRI-compatible Runtimes +content_type: reference +--- + +This is a list of articles and other pages that are either +about the Kubernetes' deprecation and removal of _dockershim_, +or about using CRI-compatible container runtimes, in connection +with that removal. + + + +## Kubernetes project + +* Kubernetes blog: [Dockershim Removal FAQ](/blog/2022/02/17/dockershim-faq/) (originally published 2022/02/17) + +* Kubernetes blog: [Kubernetes is Moving on From Dockershim: Commitments and Next Steps](/blog/2022/01/07/kubernetes-is-moving-on-from-dockershim/) (published 2022/01/07) + +* Kubernetes blog: [Dockershim removal is coming. Are you ready?](/blog/2021/11/12/are-you-ready-for-dockershim-removal/) (published 2021/11/12) + +* Kubernetes documentation: [Migrating from dockershim](/docs/tasks/administer-cluster/migrating-from-dockershim/) + +* Kubernetes documentation: [Container runtimes](/docs/setup/production-environment/container-runtimes/) + +* Kubernetes enhancement proposal: [KEP-2221: Removing dockershim from kubelet](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/2221-remove-dockershim/README.md) + +* Kubernetes enhancement proposal issue: [Removing dockershim from kubelet](https://github.com/kubernetes/enhancements/issues/2221) (_k/enhancements#2221_) + + +You can provide feedback via the GitHub issue [**Dockershim removal feedback & issues**](https://github.com/kubernetes/kubernetes/issues/106917). + +## External sources {#third-party} + + + +* Amazon Web Services EKS documentation: [Dockershim deprecation](https://docs.aws.amazon.com/eks/latest/userguide/dockershim-deprecation.html) + +* CNCF conference video: [Lessons Learned Migrating Kubernetes from Docker to containerd Runtime](https://www.youtube.com/watch?v=uDOu6rK4yOk) (Ana Caylin, at KubeCon Europe 2019) + +* Docker.com blog: [What developers need to know about Docker, Docker Engine, and Kubernetes v1.20](https://www.docker.com/blog/what-developers-need-to-know-about-docker-docker-engine-and-kubernetes-v1-20/) (published 2020/12/04) + +* "_Google Open Source_" channel on YouTube: [Learn Kubernetes with Google - Migrating from Dockershim to Containerd](https://youtu.be/fl7_4hjT52g) + +* Microsoft Apps on Azure blog: [Dockershim deprecation and AKS](https://techcommunity.microsoft.com/t5/apps-on-azure-blog/dockershim-deprecation-and-aks/ba-p/3055902) (published 2022/01/21) + +* Mirantis blog: [The Future of Dockershim is cri-dockerd](https://www.mirantis.com/blog/the-future-of-dockershim-is-cri-dockerd/) (published 2021/04/21) + +* Mirantis: [Mirantis/cri-dockerd](https://github.com/Mirantis/cri-dockerd) Git repository (on GitHub) + +* Tripwire: [How Dockershim’s Forthcoming Deprecation Affects Your Kubernetes](https://www.tripwire.com/state-of-security/security-data-protection/cloud/how-dockershim-forthcoming-deprecation-affects-your-kubernetes/) diff --git a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-kubeconfig.md b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-kubeconfig.md index f912285f7d..a5684ecceb 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-kubeconfig.md +++ b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-kubeconfig.md @@ -6,6 +6,9 @@ weight: 90 `kubeadm kubeconfig` provides utilities for managing kubeconfig files. +For examples on how to use `kubeadm kubeconfig user` see +[Generating kubeconfig files for additional users](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs#kubeconfig-additional-users). + ## kubeadm kubeconfig {#cmd-kubeconfig} {{< tabs name="tab-kubeconfig" >}} diff --git a/content/en/docs/reference/using-api/api-concepts.md b/content/en/docs/reference/using-api/api-concepts.md index 7b04d04e7c..2e4fb85df2 100644 --- a/content/en/docs/reference/using-api/api-concepts.md +++ b/content/en/docs/reference/using-api/api-concepts.md @@ -183,7 +183,7 @@ and starting the **watch** from the `resourceVersion` that was returned. For subscribing to collections, Kubernetes client libraries typically offer some form of standard tool for this **list**-then-**watch** logic. (In the Go client library, -this is called a `Reflector` and is located in the `k8s.io/client-go/cache` package.) +this is called a `Reflector` and is located in the `k8s.io/client-go/tools/cache` package.) ### Watch bookmarks diff --git a/content/en/docs/setup/best-practices/enforcing-pod-security-standards.md b/content/en/docs/setup/best-practices/enforcing-pod-security-standards.md index 9ddb8b4108..59b19c01f5 100644 --- a/content/en/docs/setup/best-practices/enforcing-pod-security-standards.md +++ b/content/en/docs/setup/best-practices/enforcing-pod-security-standards.md @@ -70,6 +70,8 @@ few different ways: Other alternatives for enforcing security profiles are being developed in the Kubernetes ecosystem: +- [Kubewarden](https://github.com/kubewarden). +- [Kyverno](https://kyverno.io/policies/). - [OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper). The decision to go with a _built-in_ solution (e.g. PodSecurity admission controller) versus a diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md b/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md index 9d7b717594..aa6f99d69c 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md @@ -210,7 +210,8 @@ export KUBECONFIG=/etc/kubernetes/admin.conf Kubeadm signs the certificate in the `admin.conf` to have `Subject: O = system:masters, CN = kubernetes-admin`. `system:masters` is a break-glass, super user group that bypasses the authorization layer (e.g. RBAC). Do not share the `admin.conf` file with anyone and instead grant users custom permissions by generating -them a kubeconfig file using the `kubeadm kubeconfig user` command. +them a kubeconfig file using the `kubeadm kubeconfig user` command. For more details see +[Generating kubeconfig files for additional users](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs#kubeconfig-additional-users). {{< /warning >}} Make a record of the `kubeadm join` command that `kubeadm init` outputs. You @@ -283,6 +284,15 @@ If your network is not working or CoreDNS is not in the `Running` state, check o [troubleshooting guide](/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm/) for `kubeadm`. +### Managed node labels + +By default, kubeadm enables the [NodeRestriction](/docs/reference/access-authn-authz/admission-controllers/#noderestriction) +admission controller that restricts what labels can be self-applied by kubelets on node registration. +The admission controller documentation covers what labels are permitted to be used with the kubelet `--node-labels` option. +The `node-role.kubernetes.io/control-plane` label is such a restricted label and kubeadm manually applies it using +a privileged client after a node has been created. To do that manually you can do the same by using `kubectl label` +and ensure it is using a privileged kubeconfig such as the kubeadm managed `/etc/kubernetes/admin.conf`. + ### Control plane node isolation By default, your cluster will not schedule Pods on the control-plane node for security @@ -384,8 +394,8 @@ A few seconds later, you should notice this node in the output from `kubectl get nodes` when run on the control-plane node. {{< note >}} -As the cluster nodes are usually initialized sequentially, the CoreDNS Pods are likely to all run -on the first control-plane node. To provide higher availability, please rebalance the CoreDNS Pods +As the cluster nodes are usually initialized sequentially, the CoreDNS Pods are likely to all run +on the first control-plane node. To provide higher availability, please rebalance the CoreDNS Pods with `kubectl -n kube-system rollout restart deployment coredns` after at least one new node is joined. {{< /note >}} diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index 1edc8ecd71..dc3ad5d7a6 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -217,6 +217,10 @@ sudo systemctl enable --now kubelet - You can leave SELinux enabled if you know how to configure it but it may require settings that are not supported by kubeadm. + - If the `baseurl` fails because your Red Hat-based distribution cannot interpret `basearch`, replace `\$basearch` with your computer's architecture. + Type `uname -m` to see that value. + For example, the `baseurl` URL for `x86_64` could be: `https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64`. + {{% /tab %}} {{% tab name="Without a package manager" %}} Install CNI plugins (required for most pod network): diff --git a/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md b/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md index 659aa95af8..91118c4d6c 100644 --- a/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md +++ b/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md @@ -265,9 +265,9 @@ with recommendations on when to use each CNI: | -------------- | ----------- | ------------------------------ | --------------- | ------------------------------ | | L2bridge | Containers are attached to an external vSwitch. Containers are attached to the underlay network, although the physical network doesn't need to learn the container MACs because they are rewritten on ingress/egress. | MAC is rewritten to host MAC, IP may be rewritten to host IP using HNS OutboundNAT policy. | [win-bridge](https://github.com/containernetworking/plugins/tree/master/plugins/main/windows/win-bridge), [Azure-CNI](https://github.com/Azure/azure-container-networking/blob/master/docs/cni.md), Flannel host-gateway uses win-bridge | win-bridge uses L2bridge network mode, connects containers to the underlay of hosts, offering best performance. Requires user-defined routes (UDR) for inter-node connectivity. | | L2Tunnel | This is a special case of l2bridge, but only used on Azure. All packets are sent to the virtualization host where SDN policy is applied. | MAC rewritten, IP visible on the underlay network | [Azure-CNI](https://github.com/Azure/azure-container-networking/blob/master/docs/cni.md) | Azure-CNI allows integration of containers with Azure vNET, and allows them to leverage the set of capabilities that [Azure Virtual Network provides](https://azure.microsoft.com/en-us/services/virtual-network/). For example, securely connect to Azure services or use Azure NSGs. See [azure-cni for some examples](https://docs.microsoft.com/en-us/azure/aks/concepts-network#azure-cni-advanced-networking) | -| Overlay (Overlay networking for Windows in Kubernetes is in *alpha* stage) | Containers are given a vNIC connected to an external vSwitch. Each overlay network gets its own IP subnet, defined by a custom IP prefix.The overlay network driver uses VXLAN encapsulation. | Encapsulated with an outer header. | [Win-overlay](https://github.com/containernetworking/plugins/tree/master/plugins/main/windows/win-overlay), Flannel VXLAN (uses win-overlay) | win-overlay should be used when virtual container networks are desired to be isolated from underlay of hosts (e.g. for security reasons). Allows for IPs to be re-used for different overlay networks (which have different VNID tags) if you are restricted on IPs in your datacenter. This option requires [KB4489899](https://support.microsoft.com/help/4489899) on Windows Server 2019. | +| Overlay (Overlay networking for Windows in Kubernetes is in *alpha* stage) | Containers are given a vNIC connected to an external vSwitch. Each overlay network gets its own IP subnet, defined by a custom IP prefix.The overlay network driver uses VXLAN encapsulation. | Encapsulated with an outer header. | [win-overlay](https://github.com/containernetworking/plugins/tree/master/plugins/main/windows/win-overlay), Flannel VXLAN (uses win-overlay) | win-overlay should be used when virtual container networks are desired to be isolated from underlay of hosts (e.g. for security reasons). Allows for IPs to be re-used for different overlay networks (which have different VNID tags) if you are restricted on IPs in your datacenter. This option requires [KB4489899](https://support.microsoft.com/help/4489899) on Windows Server 2019. | | Transparent (special use case for [ovn-kubernetes](https://github.com/openvswitch/ovn-kubernetes)) | Requires an external vSwitch. Containers are attached to an external vSwitch which enables intra-pod communication via logical networks (logical switches and routers). | Packet is encapsulated either via [GENEVE](https://datatracker.ietf.org/doc/draft-gross-geneve/) or [STT](https://datatracker.ietf.org/doc/draft-davie-stt/) tunneling to reach pods which are not on the same host.
Packets are forwarded or dropped via the tunnel metadata information supplied by the ovn network controller.
NAT is done for north-south communication. | [ovn-kubernetes](https://github.com/openvswitch/ovn-kubernetes) | [Deploy via ansible](https://github.com/openvswitch/ovn-kubernetes/tree/master/contrib). Distributed ACLs can be applied via Kubernetes policies. IPAM support. Load-balancing can be achieved without kube-proxy. NATing is done without using iptables/netsh. | -| NAT (*not used in Kubernetes*) | Containers are given a vNIC connected to an internal vSwitch. DNS/DHCP is provided using an internal component called [WinNAT](https://blogs.technet.microsoft.com/virtualization/2016/05/25/windows-nat-winnat-capabilities-and-limitations/) | MAC and IP is rewritten to host MAC/IP. | [nat](https://github.com/Microsoft/windows-container-networking/tree/master/plugins/nat) | Included here for completeness | +| NAT (*not used in Kubernetes*) | Containers are given a vNIC connected to an internal vSwitch. DNS/DHCP is provided using an internal component called [WinNAT](https://techcommunity.microsoft.com/t5/virtualization/windows-nat-winnat-capabilities-and-limitations/ba-p/382303) | MAC and IP is rewritten to host MAC/IP. | [nat](https://github.com/Microsoft/windows-container-networking/tree/master/plugins/nat) | Included here for completeness | As outlined above, the [Flannel](https://github.com/coreos/flannel) CNI [meta plugin](https://github.com/containernetworking/plugins/tree/master/plugins/meta/flannel) @@ -327,6 +327,17 @@ In a cluster that includes Windows nodes, you can use the following types of Ser * `LoadBalancer` * `ExternalName` +{{< warning >}} +There are known issue with NodePort services on overlay networking, if the target destination node is running Windows Server 2022. +To avoid the issue entirely, you can configure the service with `externalTrafficPolicy: Local`. + +There are known issues with pod to pod connectivity on l2bridge network on Windows Server 2022 with KB5005619 or higher installed. +To workaround the issue and restore pod-pod connectivity, you can disable the WinDSR feature in kube-proxy. + +These issues require OS fixes. +Please follow https://github.com/microsoft/Windows-Containers/issues/204 for updates. +{{< /warning >}} + Windows container networking differs in some important ways from Linux networking. The [Microsoft documentation for Windows Container Networking](https://docs.microsoft.com/en-us/virtualization/windowscontainers/container-networking/architecture) provides additional details and background. diff --git a/content/en/docs/tasks/access-application-cluster/access-cluster.md b/content/en/docs/tasks/access-application-cluster/access-cluster.md index aad72d9dae..c70fde47e6 100644 --- a/content/en/docs/tasks/access-application-cluster/access-cluster.md +++ b/content/en/docs/tasks/access-application-cluster/access-cluster.md @@ -86,12 +86,36 @@ The output is similar to this: ### Without kubectl proxy -Use `kubectl describe secret...` to get the token for the default service account with grep/cut: +Use `kubectl apply` and `kubectl describe secret...` to create a token for the default service account with grep/cut: + +First, create the Secret, requesting a token for the default ServiceAccount: + +```shell +kubectl apply -f - </dev/null; do + echo "waiting for token..." >&2 + sleep 1 +done +``` + +Capture and use the generated token: ```shell APISERVER=$(kubectl config view --minify | grep server | cut -f 2- -d ":" | tr -d " ") -SECRET_NAME=$(kubectl get secrets | grep ^default | cut -f1 -d ' ') -TOKEN=$(kubectl describe secret $SECRET_NAME | grep -E '^token' | cut -f2 -d':' | tr -d " ") +TOKEN=$(kubectl describe secret default-token | grep -E '^token' | cut -f2 -d':' | tr -d " ") curl $APISERVER/api --header "Authorization: Bearer $TOKEN" --insecure ``` @@ -117,8 +141,7 @@ Using `jsonpath`: ```shell APISERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}') -SECRET_NAME=$(kubectl get serviceaccount default -o jsonpath='{.secrets[0].name}') -TOKEN=$(kubectl get secret $SECRET_NAME -o jsonpath='{.data.token}' | base64 --decode) +TOKEN=$(kubectl get secret default-token -o jsonpath='{.data.token}' | base64 --decode) curl $APISERVER/api --header "Authorization: Bearer $TOKEN" --insecure ``` diff --git a/content/en/docs/tasks/access-application-cluster/web-ui-dashboard.md b/content/en/docs/tasks/access-application-cluster/web-ui-dashboard.md index 79015b0209..8439dcd0b1 100644 --- a/content/en/docs/tasks/access-application-cluster/web-ui-dashboard.md +++ b/content/en/docs/tasks/access-application-cluster/web-ui-dashboard.md @@ -1,6 +1,8 @@ --- reviewers: -- bryk +- floreks +- maciaszczykm +- shu-mutou - mikedanese title: Deploy and Access the Kubernetes Dashboard description: >- @@ -35,7 +37,7 @@ Dashboard also provides information on the state of Kubernetes resources in your The Dashboard UI is not deployed by default. To deploy it, run the following command: ``` -kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.4.0/aio/deploy/recommended.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.5.0/aio/deploy/recommended.yaml ``` ## Accessing the Dashboard UI diff --git a/content/en/docs/tasks/administer-cluster/access-cluster-api.md b/content/en/docs/tasks/administer-cluster/access-cluster-api.md index 827cb50f7c..e8c37aa613 100644 --- a/content/en/docs/tasks/administer-cluster/access-cluster-api.md +++ b/content/en/docs/tasks/administer-cluster/access-cluster-api.md @@ -95,8 +95,25 @@ export CLUSTER_NAME="some_server_name" # Point to the API server referring the cluster name APISERVER=$(kubectl config view -o jsonpath="{.clusters[?(@.name==\"$CLUSTER_NAME\")].cluster.server}") -# Gets the token value -TOKEN=$(kubectl get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='default')].data.token}"|base64 --decode) +# Create a secret to hold a token for the default service account +kubectl apply -f - </dev/null; do + echo "waiting for token..." >&2 + sleep 1 +done + +# Get the token value +TOKEN=$(kubectl get secret default-token -o jsonpath='{.data.token}' | base64 --decode) # Explore the API with TOKEN curl -X GET $APISERVER/api --header "Authorization: Bearer $TOKEN" --insecure @@ -119,26 +136,6 @@ The output is similar to this: } ``` -Using `jsonpath` approach: - -```shell -APISERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}') -TOKEN=$(kubectl get secret $(kubectl get serviceaccount default -o jsonpath='{.secrets[0].name}') -o jsonpath='{.data.token}' | base64 --decode ) -curl $APISERVER/api --header "Authorization: Bearer $TOKEN" --insecure -{ - "kind": "APIVersions", - "versions": [ - "v1" - ], - "serverAddressByClientCIDRs": [ - { - "clientCIDR": "0.0.0.0/0", - "serverAddress": "10.0.1.149:443" - } - ] -} -``` - The above example uses the `--insecure` flag. This leaves it subject to MITM attacks. When kubectl accesses the cluster it uses a stored root certificate and client certificates to access the server. (These are installed in the diff --git a/content/en/docs/tasks/administer-cluster/configure-upgrade-etcd.md b/content/en/docs/tasks/administer-cluster/configure-upgrade-etcd.md index e1693a9ba2..bf5ddd8f5f 100644 --- a/content/en/docs/tasks/administer-cluster/configure-upgrade-etcd.md +++ b/content/en/docs/tasks/administer-cluster/configure-upgrade-etcd.md @@ -361,3 +361,12 @@ We also recommend restarting any components (e.g. `kube-scheduler`, stale data. Note that in practice, the restore takes a bit of time. During the restoration, critical components will lose leader lock and restart themselves. {{< /note >}} + +## Upgrading etcd clusters + + +For more details on etcd upgrade, please refer to the [etcd upgrades](https://etcd.io/docs/latest/upgrades/) documentation. + +{{< note >}} +Before you start an upgrade, please back up your etcd cluster first. +{{< /note >}} diff --git a/content/en/docs/tasks/administer-cluster/cpu-management-policies.md b/content/en/docs/tasks/administer-cluster/cpu-management-policies.md index 076cbe6149..0a9183f276 100644 --- a/content/en/docs/tasks/administer-cluster/cpu-management-policies.md +++ b/content/en/docs/tasks/administer-cluster/cpu-management-policies.md @@ -46,7 +46,8 @@ management policies to determine some placement preferences on the node. ### Configuration The CPU Manager policy is set with the `--cpu-manager-policy` kubelet -option. There are two supported policies: +flag or the `cpuManagerPolicy` field in [KubeletConfiguration](/docs/reference/config-api/kubelet-config.v1beta1/). +There are two supported policies: * [`none`](#none-policy): the default policy. * [`static`](#static-policy): allows pods with certain resource characteristics to be @@ -68,6 +69,27 @@ and `CPUManagerPolicyBetaOptions` feature gates. Diverging from the Kubernetes s feature gates guard groups of options, because it would have been too cumbersome to add a feature gate for each individual option. +### Changing the CPU Manager Policy + +Since the CPU manger policy can only be applied when kubelet spawns new pods, simply changing from +"none" to "static" won't apply to existing pods. So in order to properly change the CPU manager +policy on a node, perform the following steps: + +1. [Drain](/docs/tasks/administer-cluster/safely-drain-node) the node. +2. Stop kubelet. +3. Remove the old CPU manager state file. The path to this file is +`/var/lib/kubelet/cpu_manager_state` by default. This clears the state maintained by the +CPUManager so that the cpu-sets set up by the new policy won’t conflict with it. +4. Edit the kubelet configuration to change the CPU manager policy to the desired value. +5. Start kubelet. + +Repeat this process for every node that needs its CPU manager policy changed. Skipping this +process will result in kubelet crashlooping with the following error: + +``` +could not restore state from checkpoint: configured policy "static" differs from state checkpoint policy "none", please drain this node and delete the CPU manager checkpoint file "/var/lib/kubelet/cpu_manager_state" before restarting Kubelet +``` + ### None policy The `none` policy explicitly enables the existing default CPU diff --git a/content/en/docs/tasks/administer-cluster/encrypt-data.md b/content/en/docs/tasks/administer-cluster/encrypt-data.md index a0fd004b2e..c48f9ee2da 100644 --- a/content/en/docs/tasks/administer-cluster/encrypt-data.md +++ b/content/en/docs/tasks/administer-cluster/encrypt-data.md @@ -1,7 +1,7 @@ --- +title: Encrypting Secret Data at Rest reviewers: - smarterclayton -title: Encrypting Secret Data at Rest content_type: task min-kubernetes-server-version: 1.13 --- @@ -9,27 +9,26 @@ min-kubernetes-server-version: 1.13 This page shows how to enable and configure encryption of secret data at rest. - ## {{% heading "prerequisites" %}} - * {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} * etcd v3.0 or later is required - - ## Configuration and determining whether encryption at rest is already enabled The `kube-apiserver` process accepts an argument `--encryption-provider-config` -that controls how API data is encrypted in etcd. An example configuration -is provided below. +that controls how API data is encrypted in etcd. +The configuration is provided as an API named +[`EncryptionConfiguration`](/docs/reference/config-api/apiserver-encryption.v1/). +An example configuration is provided below. {{< caution >}} -**IMPORTANT:** For multi-master configurations (with two or more control plane nodes) the encryption configuration file must be the same! -Otherwise, the kube-apiserver can't decrypt data stored inside the key-value store. +**IMPORTANT:** For high-availability configurations (with two or more control plane nodes), the +encryption configuration file must be the same! Otherwise, the `kube-apiserver` component cannot +decrypt data stored in the etcd. {{< /caution >}} ## Understanding the encryption at rest configuration. @@ -39,39 +38,44 @@ apiVersion: apiserver.config.k8s.io/v1 kind: EncryptionConfiguration resources: - resources: - - secrets + - secrets providers: - - identity: {} - - aesgcm: - keys: - - name: key1 - secret: c2VjcmV0IGlzIHNlY3VyZQ== - - name: key2 - secret: dGhpcyBpcyBwYXNzd29yZA== - - aescbc: - keys: - - name: key1 - secret: c2VjcmV0IGlzIHNlY3VyZQ== - - name: key2 - secret: dGhpcyBpcyBwYXNzd29yZA== - - secretbox: - keys: - - name: key1 - secret: YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY= + - identity: {} + - aesgcm: + keys: + - name: key1 + secret: c2VjcmV0IGlzIHNlY3VyZQ== + - name: key2 + secret: dGhpcyBpcyBwYXNzd29yZA== + - aescbc: + keys: + - name: key1 + secret: c2VjcmV0IGlzIHNlY3VyZQ== + - name: key2 + secret: dGhpcyBpcyBwYXNzd29yZA== + - secretbox: + keys: + - name: key1 + secret: YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY= ``` Each `resources` array item is a separate config and contains a complete configuration. The `resources.resources` field is an array of Kubernetes resource names (`resource` or `resource.group`) that should be encrypted. The `providers` array is an ordered list of the possible encryption -providers. Only one provider type may be specified per entry (`identity` or `aescbc` may be provided, but not both in the same item). +providers. -The first provider in the list is used to encrypt resources going into storage. When reading -resources from storage each provider that matches the stored data attempts to decrypt the data in -order. If no provider can read the stored data due to a mismatch in format or secret key, an error +Only one provider type may be specified per entry (`identity` or `aescbc` may be provided, +but not both in the same item). +The first provider in the list is used to encrypt resources written into the storage. When reading +resources from storage, each provider that matches the stored data attempts in order to decrypt the +data. If no provider can read the stored data due to a mismatch in format or secret key, an error is returned which prevents clients from accessing that resource. +For more detailed information about the `EncryptionConfiguration` struct, please refer to the +[encryption configuration API](/docs/reference/config-api/apiserver-encryption.v1/). + {{< caution >}} -**IMPORTANT:** If any resource is not readable via the encryption config (because keys were changed), +If any resource is not readable via the encryption config (because keys were changed), the only recourse is to delete that key from the underlying etcd directly. Calls that attempt to read that resource will fail until it is deleted or a valid decryption key is provided. {{< /caution >}} @@ -90,15 +94,24 @@ Name | Encryption | Strength | Speed | Key Length | Other Considerations Each provider supports multiple keys - the keys are tried in order for decryption, and if the provider is the first provider, the first key is used for encryption. -__Storing the raw encryption key in the EncryptionConfig only moderately improves your security posture, compared to no encryption. -Please use `kms` provider for additional security.__ By default, the `identity` provider is used to protect secrets in etcd, which -provides no encryption. `EncryptionConfiguration` was introduced to encrypt secrets locally, with a locally managed key. -Encrypting secrets with a locally managed key protects against an etcd compromise, but it fails to protect against a host compromise. -Since the encryption keys are stored on the host in the EncryptionConfig YAML file, a skilled attacker can access that file and -extract the encryption keys. +{{< caution >}} +Storing the raw encryption key in the EncryptionConfig only moderately improves your security +posture, compared to no encryption. Please use `kms` provider for additional security. +{{< /caution >}} -Envelope encryption creates dependence on a separate key, not stored in Kubernetes. In this case, an attacker would need to compromise etcd, the kubeapi-server, and the third-party KMS provider to retrieve the plaintext values, providing a higher level of security than locally-stored encryption keys. +By default, the `identity` provider is used to protect Secrets in etcd, which provides no +encryption. `EncryptionConfiguration` was introduced to encrypt Secrets locally, with a locally +managed key. + +Encrypting Secrets with a locally managed key protects against an etcd compromise, but it fails to +protect against a host compromise. Since the encryption keys are stored on the host in the +EncryptionConfiguration YAML file, a skilled attacker can access that file and extract the encryption +keys. + +Envelope encryption creates dependence on a separate key, not stored in Kubernetes. In this case, +an attacker would need to compromise etcd, the `kubeapi-server`, and the third-party KMS provider to +retrieve the plaintext values, providing a higher level of security than locally stored encryption keys. ## Encrypting your data @@ -109,113 +122,122 @@ apiVersion: apiserver.config.k8s.io/v1 kind: EncryptionConfiguration resources: - resources: - - secrets + - secrets providers: - - aescbc: - keys: - - name: key1 - secret: - - identity: {} + - aescbc: + keys: + - name: key1 + secret: + - identity: {} ``` -To create a new secret perform the following steps: +To create a new Secret, perform the following steps: -1. Generate a 32 byte random key and base64 encode it. If you're on Linux or macOS, run the following command: +1. Generate a 32-byte random key and base64 encode it. If you're on Linux or macOS, run the following command: ```shell head -c 32 /dev/urandom | base64 ``` -2. Place that value in the secret field. -3. Set the `--encryption-provider-config` flag on the `kube-apiserver` to point to the location of the config file. -4. Restart your API server. +1. Place that value in the `secret` field of the `EncryptionConfiguration` struct. +1. Set the `--encryption-provider-config` flag on the `kube-apiserver` to point to + the location of the config file. +1. Restart your API server. {{< caution >}} -Your config file contains keys that can decrypt content in etcd, so you must properly restrict permissions on your masters so only the user who runs the kube-apiserver can read it. +Your config file contains keys that can decrypt the contents in etcd, so you must properly restrict +permissions on your control-plane nodes so only the user who runs the `kube-apiserver` can read it. {{< /caution >}} - ## Verifying that data is encrypted Data is encrypted when written to etcd. After restarting your `kube-apiserver`, any newly created or -updated secret should be encrypted when stored. To check, you can use the `etcdctl` command line -program to retrieve the contents of your secret. +updated Secret should be encrypted when stored. To check this, you can use the `etcdctl` command line +program to retrieve the contents of your Secret. -1. Create a new secret called `secret1` in the `default` namespace: +1. Create a new Secret called `secret1` in the `default` namespace: ```shell kubectl create secret generic secret1 -n default --from-literal=mykey=mydata ``` -2. Using the etcdctl commandline, read that secret out of etcd: +1. Using the `etcdctl` command line, read that Secret out of etcd: `ETCDCTL_API=3 etcdctl get /registry/secrets/default/secret1 [...] | hexdump -C` where `[...]` must be the additional arguments for connecting to the etcd server. -3. Verify the stored secret is prefixed with `k8s:enc:aescbc:v1:` which indicates the `aescbc` provider has encrypted the resulting data. +1. Verify the stored Secret is prefixed with `k8s:enc:aescbc:v1:` which indicates + the `aescbc` provider has encrypted the resulting data. -4. Verify the secret is correctly decrypted when retrieved via the API: +1. Verify the Secret is correctly decrypted when retrieved via the API: ```shell kubectl describe secret secret1 -n default ``` - should match `mykey: bXlkYXRh`, mydata is encoded, check [decoding a secret](/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret) to - completely decode the secret. + The output should contain `mykey: bXlkYXRh`, with contents of `mydata` encoded, check + [decoding a Secret](/docs/tasks/configmap-secret/managing-secret-using-kubectl/#decoding-secret) + to completely decode the Secret. +## Ensure all Secrets are encrypted -## Ensure all secrets are encrypted - -Since secrets are encrypted on write, performing an update on a secret will encrypt that content. +Since Secrets are encrypted on write, performing an update on a Secret will encrypt that content. ```shell kubectl get secrets --all-namespaces -o json | kubectl replace -f - ``` -The command above reads all secrets and then updates them to apply server side encryption. +The command above reads all Secrets and then updates them to apply server side encryption. {{< note >}} If an error occurs due to a conflicting write, retry the command. For larger clusters, you may wish to subdivide the secrets by namespace or script an update. {{< /note >}} - ## Rotating a decryption key -Changing the secret without incurring downtime requires a multi step operation, especially in -the presence of a highly available deployment where multiple `kube-apiserver` processes are running. +Changing a Secret without incurring downtime requires a multi-step operation, especially in +the presence of a highly-available deployment where multiple `kube-apiserver` processes are running. 1. Generate a new key and add it as the second key entry for the current provider on all servers -2. Restart all `kube-apiserver` processes to ensure each server can decrypt using the new key -3. Make the new key the first entry in the `keys` array so that it is used for encryption in the config -4. Restart all `kube-apiserver` processes to ensure each server now encrypts using the new key -5. Run `kubectl get secrets --all-namespaces -o json | kubectl replace -f -` to encrypt all existing secrets with the new key -6. Remove the old decryption key from the config after you back up etcd with the new key in use and update all secrets - -With a single `kube-apiserver`, step 2 may be skipped. +1. Restart all `kube-apiserver` processes to ensure each server can decrypt using the new key +1. Make the new key the first entry in the `keys` array so that it is used for encryption in the config +1. Restart all `kube-apiserver` processes to ensure each server now encrypts using the new key +1. Run `kubectl get secrets --all-namespaces -o json | kubectl replace -f -` to encrypt all + existing Secrets with the new key +1. Remove the old decryption key from the config after you have backed up etcd with the new key in use + and updated all Secrets +When running a single `kube-apiserver` instance, step 2 may be skipped. ## Decrypting all data -To disable encryption at rest place the `identity` provider as the first entry in the config: +To disable encryption at rest, place the `identity` provider as the first entry in the config +and restart all `kube-apiserver` processes. ```yaml apiVersion: apiserver.config.k8s.io/v1 kind: EncryptionConfiguration resources: - resources: - - secrets + - secrets providers: - - identity: {} - - aescbc: - keys: - - name: key1 - secret: + - identity: {} + - aescbc: + keys: + - name: key1 + secret: ``` -and restart all `kube-apiserver` processes. Then run: +Then run the following command to force decrypt +all Secrets: + ```shell kubectl get secrets --all-namespaces -o json | kubectl replace -f - ``` -to force all secrets to be decrypted. + +## {{% heading "whatsnext" %}} + +* Learn more about the [EncryptionConfiguration configuration API (v1)](/docs/reference/config-api/apiserver-encryption.v1/). + diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md index 094b7a767a..789723777e 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md @@ -10,7 +10,9 @@ weight: 10 {{< feature-state for_k8s_version="v1.15" state="stable" >}} -Client certificates generated by [kubeadm](/docs/reference/setup-tools/kubeadm/) expire after 1 year. This page explains how to manage certificate renewals with kubeadm. +Client certificates generated by [kubeadm](/docs/reference/setup-tools/kubeadm/) expire after 1 year. +This page explains how to manage certificate renewals with kubeadm. It also covers other tasks related +to kubeadm certificate management. ## {{% heading "prerequisites" %}} @@ -126,13 +128,13 @@ command. In that case, you should explicitly set `--certificate-renewal=true`. You can renew your certificates manually at any time with the `kubeadm certs renew` command. -This command performs the renewal using CA (or front-proxy-CA) certificate and key stored in `/etc/kubernetes/pki`. +This command performs the renewal using CA (or front-proxy-CA) certificate and key stored in `/etc/kubernetes/pki`. After running the command you should restart the control plane Pods. This is required since dynamic certificate reload is currently not supported for all components and certificates. [Static Pods](/docs/tasks/configure-pod-container/static-pod/) are managed by the local kubelet and not by the API Server, thus kubectl cannot be used to delete and restart them. -To restart a static Pod you can temporarily remove its manifest file from `/etc/kubernetes/manifests/` +To restart a static Pod you can temporarily remove its manifest file from `/etc/kubernetes/manifests/` and wait for 20 seconds (see the `fileCheckFrequency` value in [KubeletConfiguration struct](/docs/reference/config-api/kubelet-config.v1beta1/). The kubelet will terminate the Pod if it's no longer in the manifest directory. You can then move the file back and after another `fileCheckFrequency` period, the kubelet will recreate @@ -289,3 +291,52 @@ Such a controller is not a secure mechanism unless it not only verifies the Comm in the CSR but also verifies the requested IPs and domain names. This would prevent a malicious actor that has access to a kubelet client certificate to create CSRs requesting serving certificates for any IP or domain name. + +## Generating kubeconfig files for additional users {#kubeconfig-additional-users} + +During cluster creation, kubeadm signs the certificate in the `admin.conf` to have +`Subject: O = system:masters, CN = kubernetes-admin`. +[`system:masters`](/docs/reference/access-authn-authz/rbac/#user-facing-roles) +is a break-glass, super user group that bypasses the authorization layer (e.g. RBAC). +Sharing the `admin.conf` with additional users is **not recommended**! + +Instead, you can use the [`kubeadm kubeconfig user`](/docs/reference/setup-tools/kubeadm/kubeadm-kubeconfig) +command to generate kubeconfig files for additional users. +The command accepts a mixture of command line flags and +[kubeadm configuration](/docs/reference/config-api/kubeadm-config.v1beta3/) options. +The generated kubeconfig will be written to stdout and can be piped to a file +using `kubeadm kubeconfig user ... > somefile.conf`. + +Example configuration file that can be used with `--config`: + +```yaml +# example.yaml +apiVersion: kubeadm.k8s.io/v1beta3 +kind: ClusterConfiguration +# Will be used as the target "cluster" in the kubeconfig +clusterName: "kubernetes" +# Will be used as the "server" (IP or DNS name) of this cluster in the kubeconfig +controlPlaneEndpoint: "some-dns-address:6443" +# The cluster CA key and certificate will be loaded from this local directory +certificatesDir: "/etc/kubernetes/pki" +``` + +Make sure that these settings match the desired target cluster settings. +To see the settings of an existing cluster use: + +```shell +kubectl get cm kubeadm-config -n kube-system -o=jsonpath="{.data.ClusterConfiguration}" +``` + +The following example will generate a kubeconfig file with credentials valid for 24 hours +for a new user `johndoe` that is part of the `appdevs` group: + +```shell +kubeadm kubeconfig user --config example.yaml --org appdevs --client-name johndoe --validity-period 24h +``` + +The following example will generate a kubeconfig file with administrator credentials valid for 1 week: + +```shell +kubeadm kubeconfig user --config example.yaml --client-name admin --validity-period 168h +``` diff --git a/content/en/docs/tasks/administer-cluster/manage-resources/cpu-constraint-namespace.md b/content/en/docs/tasks/administer-cluster/manage-resources/cpu-constraint-namespace.md index bb472ed647..6c52dea6e1 100644 --- a/content/en/docs/tasks/administer-cluster/manage-resources/cpu-constraint-namespace.md +++ b/content/en/docs/tasks/administer-cluster/manage-resources/cpu-constraint-namespace.md @@ -170,7 +170,7 @@ kubectl apply -f https://k8s.io/examples/admin/resource/cpu-constraints-pod-3.ya ``` The output shows that the Pod does not get created, because it defines an unacceptable container. -That container is not acceptable because it specifies a CPU limit that is lower than the +That container is not acceptable because it specifies a CPU request that is lower than the enforced minimum: ``` diff --git a/content/en/docs/tasks/administer-cluster/manage-resources/memory-default-namespace.md b/content/en/docs/tasks/administer-cluster/manage-resources/memory-default-namespace.md index ff2a4082c2..025277127d 100644 --- a/content/en/docs/tasks/administer-cluster/manage-resources/memory-default-namespace.md +++ b/content/en/docs/tasks/administer-cluster/manage-resources/memory-default-namespace.md @@ -13,10 +13,10 @@ This page shows how to configure default memory requests and limits for a {{< glossary_tooltip text="namespace" term_id="namespace" >}}. A Kubernetes cluster can be divided into namespaces. Once you have a namespace that -that has a default memory +has a default memory [limit](/docs/concepts/configuration/manage-resources-containers/#requests-and-limits), and you then try to create a Pod with a container that does not specify its own memory -limit its own memory limit, then the +limit, then the {{< glossary_tooltip text="control plane" term_id="control-plane" >}} assigns the default memory limit to that container. @@ -177,7 +177,7 @@ Here are two of the restrictions that a resource quota imposes on a namespace: * For every Pod that runs in the namespace, the Pod and each of its containers must have a memory limit. (If you specify a memory limit for every container in a Pod, Kubernetes can infer the Pod-level memory limit by adding up the limits for its containers). -* CPU limits apply a resource reservation on the node where the Pod in question is scheduled. +* Memory limits apply a resource reservation on the node where the Pod in question is scheduled. The total amount of memory reserved for all Pods in the namespace must not exceed a specified limit. * The total amount of memory actually used by all Pods in the namespace must also not exceed a specified limit. diff --git a/content/en/docs/tasks/administer-cluster/memory-manager.md b/content/en/docs/tasks/administer-cluster/memory-manager.md index 3680bfb7c6..282c3e064a 100644 --- a/content/en/docs/tasks/administer-cluster/memory-manager.md +++ b/content/en/docs/tasks/administer-cluster/memory-manager.md @@ -138,7 +138,8 @@ The sum of their values will account for the total amount of reserved memory. A new `--reserved-memory` flag was added to Memory Manager to allow for this total reserved memory to be split (by a node administrator) and accordingly reserved across many NUMA nodes. -The flag specifies a comma-separated list of memory reservations per NUMA node. +The flag specifies a comma-separated list of memory reservations of different memory types per NUMA node. +Memory reservations across multiple NUMA nodes can be specified using semicolon as separator. This parameter is only useful in the context of the Memory Manager feature. The Memory Manager will not use this reserved memory for the allocation of container workloads. @@ -180,6 +181,10 @@ or `--reserved-memory 0:memory=1Gi --reserved-memory 1:memory=2Gi` +or + +`--reserved-memory '0:memory=1Gi;1:memory=2Gi'` + When you specify values for `--reserved-memory` flag, you must comply with the setting that you prior provided via Node Allocatable Feature flags. That is, the following rule must be obeyed for each memory type: @@ -215,7 +220,7 @@ Here is an example of a correct configuration: --kube-reserved=cpu=4,memory=4Gi --system-reserved=cpu=1,memory=1Gi --memory-manager-policy=Static ---reserved-memory 0:memory=3Gi --reserved-memory 1:memory=2148Mi +--reserved-memory '0:memory=3Gi;1:memory=2148Mi' ``` Let us validate the configuration above: diff --git a/content/en/docs/tasks/administer-cluster/migrating-from-dockershim/_index.md b/content/en/docs/tasks/administer-cluster/migrating-from-dockershim/_index.md index 6a186e3766..3066f28e72 100644 --- a/content/en/docs/tasks/administer-cluster/migrating-from-dockershim/_index.md +++ b/content/en/docs/tasks/administer-cluster/migrating-from-dockershim/_index.md @@ -11,7 +11,8 @@ dockershim to other container runtimes. Since the announcement of [dockershim deprecation](/blog/2020/12/08/kubernetes-1-20-release-announcement/#dockershim-deprecation) in Kubernetes 1.20, there were questions on how this will affect various workloads and Kubernetes -installations. You can find this blog post useful to understand the problem better: [Dockershim Deprecation FAQ](/blog/2020/12/02/dockershim-faq/) +installations. Our [Dockershim Removal FAQ](/blog/2022/02/17/dockershim-faq/) is there to help you +to understand the problem better. It is recommended to migrate from dockershim to alternative container runtimes. Check out [container runtimes](/docs/setup/production-environment/container-runtimes/) diff --git a/content/en/docs/tasks/administer-cluster/migrating-from-dockershim/change-runtime-containerd.md b/content/en/docs/tasks/administer-cluster/migrating-from-dockershim/change-runtime-containerd.md new file mode 100644 index 0000000000..ac4810eb0b --- /dev/null +++ b/content/en/docs/tasks/administer-cluster/migrating-from-dockershim/change-runtime-containerd.md @@ -0,0 +1,154 @@ +--- +title: "Changing the Container Runtime on a Node from Docker Engine to containerd" +weight: 8 +content_type: task +--- + +This task outlines the steps needed to update your container runtime to containerd from Docker. It is applicable for cluster operators running Kubernetes 1.23 or earlier. Also this covers an example scenario for migrating from dockershim to containerd and alternative container runtimes can be picked from this [page](https://kubernetes.io/docs/setup/production-environment/container-runtimes/). + +## {{% heading "prerequisites" %}} + +{{% thirdparty-content %}} + +Install containerd. For more information see, [containerd's installation documentation](https://containerd.io/docs/getting-started/) and for specific prerequisite follow [this](/docs/setup/production-environment/container-runtimes/#containerd). + +## Drain the node + +``` +# replace with the name of your node you are draining +kubectl drain --ignore-daemonsets +``` +## Stop the Docker daemon + +```shell +systemctl stop kubelet +systemctl disable docker.service --now +``` + +## Install Containerd + +This [page](/docs/setup/production-environment/container-runtimes/#containerd) contains detailed steps to install containerd. + +{{< tabs name="tab-cri-containerd-installation" >}} +{{% tab name="Linux" %}} + +1. Install the `containerd.io` package from the official Docker repositories. +Instructions for setting up the Docker repository for your respective Linux distribution and installing the `containerd.io` package can be found at +[Install Docker Engine](https://docs.docker.com/engine/install/#server). + +2. Configure containerd: + + ```shell + sudo mkdir -p /etc/containerd + containerd config default | sudo tee /etc/containerd/config.toml + ``` + +3. Restart containerd: + + ```shell + sudo systemctl restart containerd + ``` + +{{% /tab %}} +{{% tab name="Windows (PowerShell)" %}} + +Start a Powershell session, set `$Version` to the desired version (ex: `$Version="1.4.3"`), and then run the following commands: + +1. Download containerd: + + ```powershell + curl.exe -L https://github.com/containerd/containerd/releases/download/v$Version/containerd-$Version-windows-amd64.tar.gz -o containerd-windows-amd64.tar.gz + tar.exe xvf .\containerd-windows-amd64.tar.gz + ``` + +2. Extract and configure: + + ```powershell + Copy-Item -Path ".\bin\" -Destination "$Env:ProgramFiles\containerd" -Recurse -Force + cd $Env:ProgramFiles\containerd\ + .\containerd.exe config default | Out-File config.toml -Encoding ascii + + # Review the configuration. Depending on setup you may want to adjust: + # - the sandbox_image (Kubernetes pause image) + # - cni bin_dir and conf_dir locations + Get-Content config.toml + + # (Optional - but highly recommended) Exclude containerd from Windows Defender Scans + Add-MpPreference -ExclusionProcess "$Env:ProgramFiles\containerd\containerd.exe" + ``` + +3. Start containerd: + + ```powershell + .\containerd.exe --register-service + Start-Service containerd + ``` + +{{% /tab %}} +{{< /tabs >}} + +## Configure the kubelet to use containerd as its container runtime + +Edit the file `/var/lib/kubelet/kubeadm-flags.env` and add the containerd runtime to the flags. `--container-runtime=remote` and `--container-runtime-endpoint=unix:///run/containerd/containerd.sock"` + +For users using kubeadm should consider the following: + +The `kubeadm` tool stores the CRI socket for each host as an annotation in the Node object for that host. + +To change it you must do the following: + +Execute `kubectl edit no ` on a machine that has the kubeadm `/etc/kubernetes/admin.conf` file. + +This will start a text editor where you can edit the Node object. + +To choose a text editor you can set the `KUBE_EDITOR` environment variable. + +- Change the value of `kubeadm.alpha.kubernetes.io/cri-socket` from `/var/run/dockershim.sock` + to the CRI socket path of your choice (for example `unix:///run/containerd/containerd.sock`). + + Note that new CRI socket paths must be prefixed with `unix://` ideally. + +- Save the changes in the text editor, which will update the Node object. + +## Restart the kubelet + +```shell +systemctl start kubelet +``` + +## Verify that the node is healthy + +Run `kubectl get nodes -o wide` and containerd appears as the runtime for the node we just changed. + +## Remove Docker Engine + +{{% thirdparty-content %}} + +Finally if everything goes well remove docker + +{{< tabs name="tab-remove-docker-enigine" >}} +{{% tab name="CentOS" %}} + +```shell +sudo yum remove docker-ce docker-ce-cli +``` +{{% /tab %}} +{{% tab name="Debian" %}} + +```shell +sudo apt-get purge docker-ce docker-ce-cli +``` +{{% /tab %}} +{{% tab name="Fedora" %}} + +```shell +sudo dnf remove docker-ce docker-ce-cli +``` +{{% /tab %}} +{{% tab name="Ubuntu" %}} + +```shell +sudo apt-get purge docker-ce docker-ce-cli +``` +{{% /tab %}} +{{< /tabs >}} \ No newline at end of file diff --git a/content/en/docs/tasks/administer-cluster/safely-drain-node.md b/content/en/docs/tasks/administer-cluster/safely-drain-node.md index 04c908c592..74d1694b08 100644 --- a/content/en/docs/tasks/administer-cluster/safely-drain-node.md +++ b/content/en/docs/tasks/administer-cluster/safely-drain-node.md @@ -23,8 +23,6 @@ This task also assumes that you have met the following prerequisites: and have [configured PodDisruptionBudgets](/docs/tasks/run-application/configure-pdb/) for applications that need them. - - ## (Optional) Configure a disruption budget {#configure-poddisruptionbudget} @@ -100,95 +98,12 @@ replicas to fall below the specified budget are blocked. If you prefer not to use [kubectl drain](/docs/reference/generated/kubectl/kubectl-commands/#drain) (such as to avoid calling to an external command, or to get finer control over the pod -eviction process), you can also programmatically cause evictions using the eviction API. +eviction process), you can also programmatically cause evictions using the +eviction API. -You should first be familiar with using [Kubernetes language clients](/docs/tasks/administer-cluster/access-cluster-api/#programmatic-access-to-the-api) to access the API. - -The eviction subresource of a -Pod can be thought of as a kind of policy-controlled DELETE operation on the Pod -itself. To attempt an eviction (more precisely: to attempt to -*create* an Eviction), you POST an attempted operation. Here's an example: - -{{< tabs name="Eviction_example" >}} -{{% tab name="policy/v1" %}} -{{< note >}} -`policy/v1` Eviction is available in v1.22+. Use `policy/v1beta1` with prior releases. -{{< /note >}} - -```json -{ - "apiVersion": "policy/v1", - "kind": "Eviction", - "metadata": { - "name": "quux", - "namespace": "default" - } -} -``` -{{% /tab %}} -{{% tab name="policy/v1beta1" %}} -{{< note >}} -Deprecated in v1.22 in favor of `policy/v1` -{{< /note >}} - -```json -{ - "apiVersion": "policy/v1beta1", - "kind": "Eviction", - "metadata": { - "name": "quux", - "namespace": "default" - } -} -``` -{{% /tab %}} -{{< /tabs >}} - -You can attempt an eviction using `curl`: - -```bash -curl -v -H 'Content-type: application/json' https://your-cluster-api-endpoint.example/api/v1/namespaces/default/pods/quux/eviction -d @eviction.json -``` - -The API can respond in one of three ways: - -- If the eviction is granted, then the Pod is deleted as if you sent - a `DELETE` request to the Pod's URL and received back `200 OK`. -- If the current state of affairs wouldn't allow an eviction by the rules set - forth in the budget, you get back `429 Too Many Requests`. This is - typically used for generic rate limiting of *any* requests, but here we mean - that this request isn't allowed *right now* but it may be allowed later. -- If there is some kind of misconfiguration; for example multiple PodDisruptionBudgets - that refer the same Pod, you get a `500 Internal Server Error` response. - -For a given eviction request, there are two cases: - -- There is no budget that matches this pod. In this case, the server always - returns `200 OK`. -- There is at least one budget. In this case, any of the three above responses may - apply. - -## Stuck evictions - -In some cases, an application may reach a broken state, one where unless you intervene the -eviction API will never return anything other than 429 or 500. - -For example: this can happen if ReplicaSet is creating Pods for your application but -the replacement Pods do not become `Ready`. You can also see similar symptoms if the -last Pod evicted has a very long termination grace period. - -In this case, there are two potential solutions: - -- Abort or pause the automated operation. Investigate the reason for the stuck application, - and restart the automation. -- After a suitably long wait, `DELETE` the Pod from your cluster's control plane, instead - of using the eviction API. - -Kubernetes does not specify what the behavior should be in this case; it is up to the -application owners and cluster owners to establish an agreement on behavior in these cases. +For more information, see [API-initiated eviction](/docs/concepts/scheduling-eviction/api-eviction/). ## {{% heading "whatsnext" %}} - * Follow steps to protect your application by [configuring a Pod Disruption Budget](/docs/tasks/run-application/configure-pdb/). diff --git a/content/en/docs/tasks/administer-cluster/sysctl-cluster.md b/content/en/docs/tasks/administer-cluster/sysctl-cluster.md index 52941ab6e8..b07c8e0689 100644 --- a/content/en/docs/tasks/administer-cluster/sysctl-cluster.md +++ b/content/en/docs/tasks/administer-cluster/sysctl-cluster.md @@ -70,7 +70,7 @@ The following sysctls are supported in the _safe_ set: - `kernel.shm_rmid_forced`, - `net.ipv4.ip_local_port_range`, - `net.ipv4.tcp_syncookies`, -- `net.ipv4.ping_group_range` (since Kubernetes 1.18). +- `net.ipv4.ping_group_range` (since Kubernetes 1.18), - `net.ipv4.ip_unprivileged_port_start` (since Kubernetes 1.22). {{< note >}} diff --git a/content/en/docs/tasks/administer-cluster/use-cascading-deletion.md b/content/en/docs/tasks/administer-cluster/use-cascading-deletion.md index 977278ae60..45466343c0 100644 --- a/content/en/docs/tasks/administer-cluster/use-cascading-deletion.md +++ b/content/en/docs/tasks/administer-cluster/use-cascading-deletion.md @@ -5,7 +5,8 @@ content_type: task -This page shows you how to specify the type of [cascading deletion](/docs/concepts/workloads/controllers/garbage-collection/#cascading-deletion) +This page shows you how to specify the type of +[cascading deletion](/docs/concepts/architecture/garbage-collection/#cascading-deletion) to use in your cluster during {{}}. ## {{% heading "prerequisites" %}} @@ -26,7 +27,7 @@ kubectl get pods -l app=nginx --output=yaml The output has an `ownerReferences` field similar to this: -``` +```yaml apiVersion: v1 ... ownerReferences: @@ -41,7 +42,7 @@ apiVersion: v1 ## Use foreground cascading deletion {#use-foreground-cascading-deletion} -By default, Kubernetes uses [background cascading deletion](/docs/concepts/workloads/controllers/garbage-collection/#background-deletion) +By default, Kubernetes uses [background cascading deletion](/docs/concepts/architecture/garbage-collection/#background-deletion) to delete dependents of an object. You can switch to foreground cascading deletion using either `kubectl` or the Kubernetes API, depending on the Kubernetes version your cluster runs. {{}} @@ -64,9 +65,9 @@ kubectl delete deployment nginx-deployment --cascade=foreground 1. Start a local proxy session: - ```shell - kubectl proxy --port=8080 - ``` + ```shell + kubectl proxy --port=8080 + ``` 1. Use `curl` to trigger deletion: @@ -80,19 +81,19 @@ kubectl delete deployment nginx-deployment --cascade=foreground like this: ``` - "kind": "Deployment", - "apiVersion": "apps/v1", - "metadata": { - "name": "nginx-deployment", - "namespace": "default", - "uid": "d1ce1b02-cae8-4288-8a53-30e84d8fa505", - "resourceVersion": "1363097", - "creationTimestamp": "2021-07-08T20:24:37Z", - "deletionTimestamp": "2021-07-08T20:27:39Z", - "finalizers": [ - "foregroundDeletion" - ] - ... + "kind": "Deployment", + "apiVersion": "apps/v1", + "metadata": { + "name": "nginx-deployment", + "namespace": "default", + "uid": "d1ce1b02-cae8-4288-8a53-30e84d8fa505", + "resourceVersion": "1363097", + "creationTimestamp": "2021-07-08T20:24:37Z", + "deletionTimestamp": "2021-07-08T20:27:39Z", + "finalizers": [ + "foregroundDeletion" + ] + ... ``` {{% /tab %}} @@ -104,9 +105,9 @@ For details, read the [documentation for your Kubernetes version](/docs/home/sup 1. Start a local proxy session: - ```shell - kubectl proxy --port=8080 - ``` + ```shell + kubectl proxy --port=8080 + ``` 1. Use `curl` to trigger deletion: @@ -120,19 +121,19 @@ For details, read the [documentation for your Kubernetes version](/docs/home/sup like this: ``` - "kind": "Deployment", - "apiVersion": "apps/v1", - "metadata": { - "name": "nginx-deployment", - "namespace": "default", - "uid": "d1ce1b02-cae8-4288-8a53-30e84d8fa505", - "resourceVersion": "1363097", - "creationTimestamp": "2021-07-08T20:24:37Z", - "deletionTimestamp": "2021-07-08T20:27:39Z", - "finalizers": [ - "foregroundDeletion" - ] - ... + "kind": "Deployment", + "apiVersion": "apps/v1", + "metadata": { + "name": "nginx-deployment", + "namespace": "default", + "uid": "d1ce1b02-cae8-4288-8a53-30e84d8fa505", + "resourceVersion": "1363097", + "creationTimestamp": "2021-07-08T20:24:37Z", + "deletionTimestamp": "2021-07-08T20:27:39Z", + "finalizers": [ + "foregroundDeletion" + ] + ... ``` {{% /tab %}} {{}} @@ -165,32 +166,32 @@ kubectl delete deployment nginx-deployment --cascade=background 1. Start a local proxy session: - ```shell - kubectl proxy --port=8080 - ``` + ```shell + kubectl proxy --port=8080 + ``` 1. Use `curl` to trigger deletion: - ```shell - curl -X DELETE localhost:8080/apis/apps/v1/namespaces/default/deployments/nginx-deployment \ - -d '{"kind":"DeleteOptions","apiVersion":"v1","propagationPolicy":"Background"}' \ - -H "Content-Type: application/json" - ``` + ```shell + curl -X DELETE localhost:8080/apis/apps/v1/namespaces/default/deployments/nginx-deployment \ + -d '{"kind":"DeleteOptions","apiVersion":"v1","propagationPolicy":"Background"}' \ + -H "Content-Type: application/json" + ``` - The output is similar to this: + The output is similar to this: - ``` - "kind": "Status", - "apiVersion": "v1", - ... - "status": "Success", - "details": { - "name": "nginx-deployment", - "group": "apps", - "kind": "deployments", - "uid": "cc9eefb9-2d49-4445-b1c1-d261c9396456" - } - ``` + ``` + "kind": "Status", + "apiVersion": "v1", + ... + "status": "Success", + "details": { + "name": "nginx-deployment", + "group": "apps", + "kind": "deployments", + "uid": "cc9eefb9-2d49-4445-b1c1-d261c9396456" + } + ``` {{% /tab %}} {{% tab name="Versions prior to Kubernetes 1.20.x" %}} Kubernetes uses background cascading deletion by default, and does so @@ -211,32 +212,32 @@ kubectl delete deployment nginx-deployment --cascade=true 1. Start a local proxy session: - ```shell - kubectl proxy --port=8080 - ``` + ```shell + kubectl proxy --port=8080 + ``` 1. Use `curl` to trigger deletion: - ```shell - curl -X DELETE localhost:8080/apis/apps/v1/namespaces/default/deployments/nginx-deployment \ - -d '{"kind":"DeleteOptions","apiVersion":"v1","propagationPolicy":"Background"}' \ - -H "Content-Type: application/json" - ``` + ```shell + curl -X DELETE localhost:8080/apis/apps/v1/namespaces/default/deployments/nginx-deployment \ + -d '{"kind":"DeleteOptions","apiVersion":"v1","propagationPolicy":"Background"}' \ + -H "Content-Type: application/json" + ``` - The output is similar to this: + The output is similar to this: - ``` - "kind": "Status", - "apiVersion": "v1", - ... - "status": "Success", - "details": { - "name": "nginx-deployment", - "group": "apps", - "kind": "deployments", - "uid": "cc9eefb9-2d49-4445-b1c1-d261c9396456" - } - ``` + ``` + "kind": "Status", + "apiVersion": "v1", + ... + "status": "Success", + "details": { + "name": "nginx-deployment", + "group": "apps", + "kind": "deployments", + "uid": "cc9eefb9-2d49-4445-b1c1-d261c9396456" + } + ``` {{% /tab %}} {{}} @@ -264,33 +265,33 @@ kubectl delete deployment nginx-deployment --cascade=orphan 1. Start a local proxy session: - ```shell - kubectl proxy --port=8080 - ``` + ```shell + kubectl proxy --port=8080 + ``` 1. Use `curl` to trigger deletion: - ```shell - curl -X DELETE localhost:8080/apis/apps/v1/namespaces/default/deployments/nginx-deployment \ - -d '{"kind":"DeleteOptions","apiVersion":"v1","propagationPolicy":"Orphan"}' \ - -H "Content-Type: application/json" - ``` + ```shell + curl -X DELETE localhost:8080/apis/apps/v1/namespaces/default/deployments/nginx-deployment \ + -d '{"kind":"DeleteOptions","apiVersion":"v1","propagationPolicy":"Orphan"}' \ + -H "Content-Type: application/json" + ``` - The output contains `orphan` in the `finalizers` field, similar to this: + The output contains `orphan` in the `finalizers` field, similar to this: - ``` - "kind": "Deployment", - "apiVersion": "apps/v1", - "namespace": "default", - "uid": "6f577034-42a0-479d-be21-78018c466f1f", - "creationTimestamp": "2021-07-09T16:46:37Z", - "deletionTimestamp": "2021-07-09T16:47:08Z", - "deletionGracePeriodSeconds": 0, - "finalizers": [ - "orphan" - ], - ... - ``` + ``` + "kind": "Deployment", + "apiVersion": "apps/v1", + "namespace": "default", + "uid": "6f577034-42a0-479d-be21-78018c466f1f", + "creationTimestamp": "2021-07-09T16:46:37Z", + "deletionTimestamp": "2021-07-09T16:47:08Z", + "deletionGracePeriodSeconds": 0, + "finalizers": [ + "orphan" + ], + ... + ``` {{% /tab %}} {{% tab name="Versions prior to Kubernetes 1.20.x" %}} @@ -309,33 +310,33 @@ kubectl delete deployment nginx-deployment --cascade=orphan 1. Start a local proxy session: - ```shell - kubectl proxy --port=8080 - ``` + ```shell + kubectl proxy --port=8080 + ``` 1. Use `curl` to trigger deletion: - ```shell - curl -X DELETE localhost:8080/apis/apps/v1/namespaces/default/deployments/nginx-deployment \ - -d '{"kind":"DeleteOptions","apiVersion":"v1","propagationPolicy":"Orphan"}' \ - -H "Content-Type: application/json" - ``` + ```shell + curl -X DELETE localhost:8080/apis/apps/v1/namespaces/default/deployments/nginx-deployment \ + -d '{"kind":"DeleteOptions","apiVersion":"v1","propagationPolicy":"Orphan"}' \ + -H "Content-Type: application/json" + ``` - The output contains `orphan` in the `finalizers` field, similar to this: + The output contains `orphan` in the `finalizers` field, similar to this: - ``` - "kind": "Deployment", - "apiVersion": "apps/v1", - "namespace": "default", - "uid": "6f577034-42a0-479d-be21-78018c466f1f", - "creationTimestamp": "2021-07-09T16:46:37Z", - "deletionTimestamp": "2021-07-09T16:47:08Z", - "deletionGracePeriodSeconds": 0, - "finalizers": [ - "orphan" - ], - ... - ``` + ``` + "kind": "Deployment", + "apiVersion": "apps/v1", + "namespace": "default", + "uid": "6f577034-42a0-479d-be21-78018c466f1f", + "creationTimestamp": "2021-07-09T16:46:37Z", + "deletionTimestamp": "2021-07-09T16:47:08Z", + "deletionGracePeriodSeconds": 0, + "finalizers": [ + "orphan" + ], + ... + ``` {{% /tab %}} {{}} @@ -349,4 +350,4 @@ kubectl get pods -l app=nginx * Learn about [owners and dependents](/docs/concepts/overview/working-with-objects/owners-dependents/) in Kubernetes. * Learn about Kubernetes [finalizers](/docs/concepts/overview/working-with-objects/finalizers/). -* Learn about [garbage collection](/docs/concepts/workloads/controllers/garbage-collection/). \ No newline at end of file +* Learn about [garbage collection](/docs/concepts/architecture/garbage-collection/). diff --git a/content/en/docs/tasks/configmap-secret/managing-secret-using-kubectl.md b/content/en/docs/tasks/configmap-secret/managing-secret-using-kubectl.md index dad86e36df..7e607b9b79 100644 --- a/content/en/docs/tasks/configmap-secret/managing-secret-using-kubectl.md +++ b/content/en/docs/tasks/configmap-secret/managing-secret-using-kubectl.md @@ -130,6 +130,12 @@ The output is similar to: Now you can decode the `password` data: ```shell +# This is an example for documentation purposes. +# If you did things this way, the data 'MWYyZDFlMmU2N2Rm' could be stored in +# your shell history. +# Someone with access to you computer could find that remembered command +# and base-64 decode the secret, perhaps without your knowledge. +# It's usually better to combine the steps, as shown later in the page. echo 'MWYyZDFlMmU2N2Rm' | base64 --decode ``` @@ -139,6 +145,15 @@ The output is similar to: 1f2d1e2e67df ``` +In order to avoid storing a secret encoded value in your shell history, you can +run the following command: + +```shell +kubectl get secret db-user-pass -o jsonpath='{.data.password}' | base64 --decode +``` + +The output shall be similar as above. + ## Clean Up Delete the Secret you created: diff --git a/content/en/docs/tasks/configure-pod-container/configure-gmsa.md b/content/en/docs/tasks/configure-pod-container/configure-gmsa.md index 1bd542ab73..e191de41ef 100644 --- a/content/en/docs/tasks/configure-pod-container/configure-gmsa.md +++ b/content/en/docs/tasks/configure-pod-container/configure-gmsa.md @@ -199,7 +199,7 @@ As Pod specs with GMSA fields populated (as described above) are applied in a cl 1. The container runtime configures each Windows container with the specified GMSA credential spec so that the container can assume the identity of the GMSA in Active Directory and access services in the domain using that identity. -## Authenticating to network shares usinig hostname of FQDN +## Authenticating to network shares using hostname or FQDN If you are experiencing issues connecting to SMB shares from Pods using hostname or FQDN, but are able to access the shares via their IPv4 address then make sure the following registry key is set on the Windows nodes. @@ -225,7 +225,7 @@ kubectl exec -it iis-auth-7776966999-n5nzr powershell.exe `nltest.exe /parentdomain` results in the following error: -```PowerShell +```output Getting parent domain failed: Status = 1722 0x6ba RPC_S_SERVER_UNAVAILABLE ``` @@ -245,7 +245,7 @@ nltest.exe /query Results in the following output: -```PowerShell +```output I_NetLogonControl failed: Status = 1722 0x6ba RPC_S_SERVER_UNAVAILABLE ``` @@ -257,7 +257,7 @@ nltest /sc_reset:domain.example If the command is successful you will see and output similar to this: -```PowerShell +```output Flags: 30 HAS_IP HAS_TIMESERV Trusted DC Name \\dc10.domain.example Trusted DC Connection Status Status = 0 0x0 NERR_Success diff --git a/content/en/docs/tasks/configure-pod-container/configure-service-account.md b/content/en/docs/tasks/configure-pod-container/configure-service-account.md index 408f0bc956..ffb863a19f 100644 --- a/content/en/docs/tasks/configure-pod-container/configure-service-account.md +++ b/content/en/docs/tasks/configure-pod-container/configure-service-account.md @@ -291,7 +291,7 @@ command line arguments to `kube-apiserver`: * `--service-account-issuer` - It can be used as the Identifier of the service account token issuer. You can specify the `--service-account-issuer` argument multiple times, this can be useful to enable a non-disruptive change of the issuer. When this flag is specified multiple times, the first is used to generate tokens and all are used to determine which issuers are accepted. You must be running running Kubernetes v1.22 or later to be able to specify `--service-account-issuer` multiple times. + It can be used as the Identifier of the service account token issuer. You can specify the `--service-account-issuer` argument multiple times, this can be useful to enable a non-disruptive change of the issuer. When this flag is specified multiple times, the first is used to generate tokens and all are used to determine which issuers are accepted. You must be running Kubernetes v1.22 or later to be able to specify `--service-account-issuer` multiple times. * `--service-account-key-file` File containing PEM-encoded x509 RSA or ECDSA private or public keys, used to verify ServiceAccount tokens. The specified file can contain multiple keys, and the flag can be specified multiple times with different files. If specified multiple times, tokens signed by any of the specified keys are considered valid by the Kubernetes API server. diff --git a/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md b/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md index 10052fd68e..b3bbcaa06d 100644 --- a/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md +++ b/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md @@ -31,7 +31,7 @@ as Windows server containers, meaning that the version of the base images does n to match that of the host. It is, however, recommended that you use the same base image version as your Windows Server container workloads to ensure you do not have any unused images taking up space on the node. HostProcess containers also support -[volume mounts](./create-hostprocess-pod#volume-mounts) within the container volume. +[volume mounts](#volume-mounts) within the container volume. ### When should I use a Windows HostProcess container? @@ -73,19 +73,20 @@ documentation for more details. These limitations are relevant for Kubernetes v{{< skew currentVersion >}}: - HostProcess containers require containerd 1.6 or higher -{{< glossary_tooltip text="container runtime" term_id="container-runtime" >}}. + {{< glossary_tooltip text="container runtime" term_id="container-runtime" >}}. - HostProcess pods can only contain HostProcess containers. This is a current limitation -of the Windows OS; non-privileged Windows containers cannot share a vNIC with the host IP namespace. + of the Windows OS; non-privileged Windows containers cannot share a vNIC with the host IP namespace. - HostProcess containers run as a process on the host and do not have any degree of -isolation other than resource constraints imposed on the HostProcess user account. Neither -filesystem or Hyper-V isolation are supported for HostProcess containers. -- Volume mounts are supported and are mounted under the container volume. See [Volume Mounts](#volume-mounts) + isolation other than resource constraints imposed on the HostProcess user account. Neither + filesystem or Hyper-V isolation are supported for HostProcess containers. +- Volume mounts are supported and are mounted under the container volume. See + [Volume Mounts](#volume-mounts) - A limited set of host user accounts are available for HostProcess containers by default. See [Choosing a User Account](#choosing-a-user-account). - Resource limits (disk, memory, cpu count) are supported in the same fashion as processes -on the host. + on the host. - Both Named pipe mounts and Unix domain sockets are **not** supported and should instead -be accessed via their path on the host (e.g. \\\\.\\pipe\\\*) + be accessed via their path on the host (e.g. \\\\.\\pipe\\\*) ## HostProcess Pod configuration requirements diff --git a/content/en/docs/tasks/configure-pod-container/migrate-from-psp.md b/content/en/docs/tasks/configure-pod-container/migrate-from-psp.md index adc8225e23..d8251158b2 100644 --- a/content/en/docs/tasks/configure-pod-container/migrate-from-psp.md +++ b/content/en/docs/tasks/configure-pod-container/migrate-from-psp.md @@ -19,30 +19,323 @@ admission controller. This can be done effectively using a combination of dry-ru - Ensure the `PodSecurity` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/#feature-gates-for-alpha-or-beta-features) is enabled. +This page assumes you are already familiar with the basic [Pod Security Admission](/docs/concepts/security/pod-security-admission/) +concepts. + -## Steps +## Overall approach -- **Eliminate mutating PodSecurityPolicies, if your cluster has any set up.** - - Clone all mutating PSPs into a non-mutating version. - - Update all ClusterRoles authorizing use of those mutating PSPs to also authorize use of the - non-mutating variant. - - Watch for Pods using the mutating PSPs and work with code owners to migrate to valid, - non-mutating resources. - - Delete mutating PSPs. -- **Select a compatible policy level for each namespace.** Analyze existing resources in the - namespace to drive this decision. - - Review the requirements of the different [Pod Security Standards](/docs/concepts/security/pod-security-standards). - - Evaluate the difference in privileges that would come from disabling the PSP controller. - - In the event that a PodSecurityPolicy falls between two levels, consider: - - Selecting a _less_ permissive PodSecurity level prioritizes security, and may require adjusting - workloads to fit within the stricter policy. - - Selecting a _more_ permissive PodSecurity level prioritizes avoiding disrupting or - changing workloads, but may allow workload authors in the namespace greater permissions - than desired. -- **Apply the selected profiles in `warn` and `audit` mode.** This will give you an idea of how - your Pods will respond to the new policies, without breaking existing workloads. Iterate on your - [Pods' configuration](/docs/concepts/security/pod-security-admission#configuring-pods) until - they are in compliance with the selected profiles. -- Apply the profiles in `enforce` mode. -- Stop including `PodSecurityPolicy` in the `--enable-admission-plugins` flag. \ No newline at end of file +There are multiple strategies you can take for migrating from PodSecurityPolicy to Pod Security +Admission. The following steps are one possible migration path, with a goal of minimizing both the +risks of a production outage and of a security gap. + + +0. Decide whether Pod Security Admission is the right fit for your use case. +1. Review namespace permissions +2. Simplify & standardize PodSecurityPolicies +3. Update namespaces + 1. Identify an appropriate Pod Security level + 2. Verify the Pod Security level + 3. Enforce the Pod Security level + 4. Bypass PodSecurityPolicy +4. Review namespace creation processes +5. Disable PodSecurityPolicy + +## 0. Decide whether Pod Security Admission is right for you {#is-psa-right-for-you} + +Pod Security Admission was designed to meet the most common security needs out of the box, and to +provide a standard set of security levels across clusters. However, it is less flexible than +PodSecurityPolicy. Notably, the following features are supported by PodSecurityPolicy but not Pod +Security Admission: + +- **Setting default security constraints** - Pod Security Admission is a non-mutating admission + controller, meaning it won't modify pods before validating them. If you were relying on this + aspect of PSP, you will need to either modify your workloads to meet the Pod Security constraints, + or use a [Mutating Admission Webhook](/docs/reference/access-authn-authz/extensible-admission-controllers/) + to make those changes. See [Simplify & Standardize PodSecurityPolicies](#simplify-psps) below for more detail. +- **Fine-grained control over policy definition** - Pod Security Admission only supports + [3 standard levels](/docs/concepts/security/pod-security-standards/). + If you require more control over specific constraints, then you will need to use a + [Validating Admission Webhook](/docs/reference/access-authn-authz/extensible-admission-controllers/) + to enforce those policies. +- **Sub-namespace policy granularity** - PodSecurityPolicy lets you bind different policies to + different Service Accounts or users, even within a single namespace. This approach has many + pitfalls and is not recommended, but if you require this feature anyway you will + need to use a 3rd party webhook instead. The exception to this is if you only need to completely exempt + specific users or [RuntimeClasses](/docs/concepts/containers/runtime-class/), in which case Pod + Security Admission does expose some + [static configuration for exemptions](/docs/concepts/security/pod-security-admission/#exemptions). + +Even if Pod Security Admission does not meet all of your needs it was designed to be _complementary_ +to other policy enforcement mechanisms, and can provide a useful fallback running alongside other +admission webhooks. + + +## 1. Review namespace permissions {#review-namespace-permissions} + +Pod Security Admission is controlled by [labels on +namespaces](/docs/concepts/security/pod-security-admission/#pod-security-admission-labels-for-namespaces). +This means that anyone who can update (or patch or create) a namespace can also modify the Pod +Security level for that namespace, which could be used to bypass a more restrictive policy. Before +proceeding, ensure that only trusted, privileged users have these namespace permissions. It is not +recommended to grant these powerful permissions to users that shouldn't have elevated permissions, +but if you must you will need to use an +[admission webhook](/docs/reference/access-authn-authz/extensible-admission-controllers/) +to place additional restrictions on setting Pod Security labels on Namespace objects. + +## 2. Simplify & standardize PodSecurityPolicies {#simplify-psps} + +In this section, you will reduce mutating PodSecurityPolicies and remove options that are outside +the scope of the Pod Security Standards. You should make the changes recommended here to an offline +copy of the original PodSecurityPolicy being modified. The cloned PSP should have a different +name that is alphabetically before the original (for example, prepend a `0` to it). Do not create the +new policies in Kubernetes yet - that will be covered in the [Rollout the updated +policies](#psp-update-rollout) section below. + +### 2.a. Eliminate purely mutating fields {#eliminate-mutating-fields} + +If a PodSecurityPolicy is mutating pods, then you could end up with pods that don't meet the Pod +Security level requirements when you finally turn PodSecurityPolicy off. In order to avoid this, you +should eliminate all PSP mutation prior to switching over. Unfortunately PSP does not cleanly +separate mutating & validating fields, so this is not a straightforward migration. + +You can start by eliminating the fields that are purely mutating, and don't have any bearing on the +validating policy. These fields (also listed in the +[Mapping PodSecurityPolicies to Pod Security Standards](/docs/reference/access-authn-authz/psp-to-pod-security-standards/) +reference) are: + +- `.spec.defaultAllowPrivilegeEscalation` +- `.spec.runtimeClass.defaultRuntimeClassName` +- `.metadata.annotations['seccomp.security.alpha.kubernetes.io/defaultProfileName']` +- `.metadata.annotations['apparmor.security.beta.kubernetes.io/defaultProfileName']` +- `.spec.defaultAddCapabilities` - Although technically a mutating & validating field, these should + be merged into `.spec.allowedCapabilities` which performs the same validation without mutation. + +{{< caution >}} +Removing these could result in workloads missing required configuration, and cause problems. See +[Rollout the updated policies](#psp-update-rollout) below for advice on how to roll these changes +out safely. +{{< /caution >}} + +### 2.b. Eliminate options not covered by the Pod Security Standards {#eliminate-non-standard-options} + +There are several fields in PodSecurityPolicy that are not covered by the Pod Security Standards. If +you must enforce these options, you will need to supplement Pod Security Admission with an +[admission webhook](/docs/reference/access-authn-authz/extensible-admission-controllers/), +which is outside the scope of this guide. + +First, you can remove the purely validating fields that the Pod Security Standards do not cover. +These fields (also listed in the +[Mapping PodSecurityPolicies to Pod Security Standards](/docs/reference/access-authn-authz/psp-to-pod-security-standards/) +reference with "no opinion") are: + +- `.spec.allowedHostPaths` +- `.spec.allowedFlexVolumes` +- `.spec.allowedCSIDrivers` +- `.spec.forbiddenSysctls` +- `.spec.runtimeClass` + +You can also remove the following fields, that are related to POSIX / UNIX group controls. + +{{< caution >}} +If any of these use the `MustRunAs` strategy they may be mutating! Removing these could result in +workloads not setting the required groups, and cause problems. See +[Rollout the updated policies](#psp-update-rollout) below for advice on how to roll these changes +out safely. +{{< /caution >}} + +- `.spec.runAsGroup` +- `.spec.supplementalGroups` +- `.spec.fsGroup` + +The remaining mutating fields are required to properly support the Pod Security Standards, and will +need to be handled on a case-by-case basis later: + +- `.spec.requiredDropCapabilities` - Required to drop `ALL` for the Restricted profile. +- `.spec.seLinux` - (Only mutating with the `MustRunAs` rule) required to enforce the SELinux + requirements of the Baseline & Restricted profiles. +- `.spec.runAsUser` - (Non-mutating with the `RunAsAny` rule) required to enforce `RunAsNonRoot` for + the Restricted profile. +- `.spec.allowPrivilegeEscalation` - (Only mutating if set to `false`) required for the Restricted + profile. + +### 2.c. Rollout the updated PSPs {#psp-update-rollout} + +Next, you can rollout the updated policies to your cluster. You should proceed with caution, as +removing the mutating options may result in workloads missing required configuration. + +For each updated PodSecurityPolicy: + +1. Identify pods running under the original PSP. This can be done using the `kubernetes.io/psp` + annotation. For example, using kubectl: + ```sh + PSP_NAME="original" # Set the name of the PSP you're checking for + kubectl get pods --all-namespaces -o jsonpath="{range .items[?(@.metadata.annotations.kubernetes\.io\/psp=='$PSP_NAME')]}{.metadata.namespace} {.metadata.name}{'\n'}{end}" + ``` +2. Compare these running pods against the original pod spec to determine whether PodSecurityPolicy + has modified the pod. For pods created by a [workload resource](/docs/concepts/workloads/controllers/) + you can compare the pod with the PodTemplate in the controller resource. If any changes are + identified, the original Pod or PodTemplate should be updated with the desired configuration. + The fields to review are: + - `.metadata.annotations['container.apparmor.security.beta.kubernetes.io/*']` (replace * with each container name) + - `.spec.runtimeClassName` + - `.spec.securityContext.fsGroup` + - `.spec.securityContext.seccompProfile` + - `.spec.securityContext.seLinuxOptions` + - `.spec.securityContext.supplementalGroups` + - On containers, under `.spec.containers[*]` and `.spec.initContainers[*]`: + - `.securityContext.allowPrivilegeEscalation` + - `.securityContext.capabilities.add` + - `.securityContext.capabilities.drop` + - `.securityContext.readOnlyRootFilesystem` + - `.securityContext.runAsGroup` + - `.securityContext.runAsNonRoot` + - `.securityContext.runAsUser` + - `.securityContext.seccompProfile` + - `.securityContext.seLinuxOptions` +3. Create the new PodSecurityPolicies. If any Roles or ClusterRoles are granting `use` on all PSPs + this could cause the new PSPs to be used instead of their mutating counter-parts. +4. Update your authorization to grant access to the new PSPs. In RBAC this means updating any Roles + or ClusterRoles that grant the `use` permision on the original PSP to also grant it to the + updated PSP. +5. Verify: after some soak time, rerun the command from step 1 to see if any pods are still using + the original PSPs. Note that pods need to be recreated after the new policies have been rolled + out before they can be fully verified. +6. (optional) Once you have verified that the original PSPs are no longer in use, you can delete + them. + +## 3. Update Namespaces {#update-namespaces} + +The following steps will need to be performed on every namespace in the cluster. Commands referenced +in these steps use the `$NAMESPACE` variable to refer to the namespace being updated. + +### 3.a. Identify an appropriate Pod Security level {#identify-appropriate-level} + +Start reviewing the [Pod Security Standards](/docs/concepts/security/pod-security-standards/) and +familiarizing yourself with the 3 different levels. + +There are several ways to choose a Pod Security level for your namespace: + +1. **By security requirements for the namespace** - If you are familiar with the expected access + level for the namespace, you can choose an appropriate level based on those requirements, similar + to how one might approach this on a new cluster. +2. **By existing PodSecurityPolicies** - Using the + [Mapping PodSecurityPolicies to Pod Security Standards](/docs/reference/access-authn-authz/psp-to-pod-security-standards/) + reference you can map each + PSP to a Pod Security Standard level. If your PSPs aren't based on the Pod Security Standards, you + may need to decide between choosing a level that is at least as permissive as the PSP, and a + level that is at least as restrictive. You can see which PSPs are in use for pods in a given + namespace with this command: + ```sh + kubectl get pods -n $NAMESPACE -o jsonpath="{.items[*].metadata.annotations.kubernetes\.io\/psp}" | tr " " "\n" | sort -u + ``` +3. **By existing pods** - Using the strategies under [Verify the Pod Security level](#verify-pss-level), + you can test out both the Baseline and Restricted levels to see + whether they are sufficiently permissive for existing workloads, and chose the least-privileged + valid level. + +{{< caution >}} +Options 2 & 3 above are based on _existing_ pods, and may miss workloads that aren't currently +running, such as CronJobs, scale-to-zero workloads, or other workloads that haven't rolled out. +{{< /caution >}} + +### 3.b. Verify the Pod Security level {#verify-pss-level} + +Once you have selected a Pod Security level for the namespace (or if you're trying several), it's a +good idea to test it out first (you can skip this step if using the Privileged level). Pod Security +includes several tools to help test and safely roll out profiles. + +First, you can dry-run the policy, which will evaluate pods currently running in the namespace +against the applied policy, without making the new policy take effect: +```sh +# $LEVEL is the level to dry-run, either "baseline" or "restricted". +kubectl label --dry-run=server --overwrite ns $NAMESPACE pod-security.kubernetes.io/enforce=$LEVEL +``` +This command will return a warning for any _existing_ pods that are not valid under the proposed +level. + +The second option is better for catching workloads that are not currently running: audit mode. When +running under audit-mode (as opposed to enforcing), pods that violate the policy level are recorded +in the audit logs, which can be reviewed later after some soak time, but are not forbidden. Warning +mode works similarly, but returns the warning to the user immediately. You can set the audit level +on a namespace with this command: +```sh +kubectl label --overwrite ns $NAMESPACE pod-security.kubernetes.io/audit=$LEVEL +``` + +If either of these approaches yield unexpected violations, you will need to either update the +violating workloads to meet the policy requirements, or relax the namespace Pod Security level. + +### 3.c. Enforce the Pod Security level {#enforce-pod-security-level} + +When you are satisfied that the chosen level can safely be enforced on the namespace, you can update +the namespace to enforce the desired level: + +```sh +kubectl label --overwrite ns $NAMESPACE pod-security.kubernetes.io/enforce=$LEVEL +``` + +### 3.d. Bypass PodSecurityPolicy {#bypass-psp} + +Finally, you can effectively bypass PodSecurityPolicy at the namespace level by binding the fully +{{< example file="policy/privileged-psp.yaml" >}}privileged PSP{{< /example >}} to all service +accounts in the namespace. + +```sh +# The following cluster-scoped commands are only needed once. +kubectl apply -f privileged-psp.yaml +kubectl create clusterrole privileged-psp --verb use --resource podsecuritypolicies.policy --resource-name privileged + +# Per-namespace disable +kubectl create -n $NAMESPACE rolebinding disable-psp --clusterrole privileged-psp --group system:serviceaccounts:$NAMESPACE +``` + +Since the privileged PSP is non-mutating, and the PSP admission controller always +prefers non-mutating PSPs, this will ensure that pods in this namespace are no longer being modified +or restricted by PodSecurityPolicy. + +The advantage to disabling PodSecurityPolicy on a per-namespace basis like this is if a problem +arises you can easily roll the change back by deleting the RoleBinding. Just make sure the +pre-existing PodSecurityPolicies are still in place! + +```sh +# Undo PodSecurityPolicy disablement. +kubectl delete -n $NAMESPACE rolebinding disable-psp +``` + +## 4. Review namespace creation processes {#review-namespace-creation-process} + +Now that existing namespaces have been updated to enforce Pod Security Admission, you should ensure +that your processes and/or policies for creating new namespaces are updated to ensure that an +appropriate Pod Security profile is applied to new namespaces. + +You can also statically configure the Pod Security admission controller to set a default enforce, +audit, and/or warn level for unlabeled namespaces. See +[Configure the Admission Controller](docs/tasks/configure-pod-container/enforce-standards-admission-controller/#configure-the-admission-controller) +for more information. + +## 5. Disable PodSecurityPolicy {#disable-psp} + +Finally, you're ready to disable PodSecurityPolicy. To do so, you will need to modify the admission +configuration of the API server: +[How do I turn off an admission controller?](/docs/reference/access-authn-authz/admission-controllers/#how-do-i-turn-off-an-admission-controller). + +To verify that the PodSecurityPolicy admission controller is no longer enabled, you can manually run +a test by impersonating a user without access to any PodSecurityPolicies (see the +[PodSecurityPolicy example](/docs/concepts/policy/pod-security-policy/#example)), or by verifying in +the API server logs. At startup, the API server outputs log lines listing the loaded admission +controller plugins: + +``` +I0218 00:59:44.903329 13 plugins.go:158] Loaded 16 mutating admission controller(s) successfully in the following order: NamespaceLifecycle,LimitRanger,ServiceAccount,NodeRestriction,TaintNodesByCondition,Priority,DefaultTolerationSeconds,ExtendedResourceToleration,PersistentVolumeLabel,DefaultStorageClass,StorageObjectInUseProtection,RuntimeClass,DefaultIngressClass,MutatingAdmissionWebhook. +I0218 00:59:44.903350 13 plugins.go:161] Loaded 14 validating admission controller(s) successfully in the following order: LimitRanger,ServiceAccount,PodSecurity,Priority,PersistentVolumeClaimResize,RuntimeClass,CertificateApproval,CertificateSigning,CertificateSubjectRestriction,DenyServiceExternalIPs,ValidatingAdmissionWebhook,ResourceQuota. +``` + +You should see `PodSecurity` (in the validating admission controllers), and neither list should +contain `PodSecurityPolicy`. + +Once you are certain the PSP admission controller is disabled (and after sufficient soak time to be +confident you won't need to roll back), you are free to delete your PodSecurityPolicies and any +associated Roles, ClusterRoles, RoleBindings and ClusterRoleBindings (just make sure they don't +grant any other unrelated permissions). diff --git a/content/en/docs/tasks/configure-pod-container/security-context.md b/content/en/docs/tasks/configure-pod-container/security-context.md index bf30d1b42c..30dfeb0e5d 100644 --- a/content/en/docs/tasks/configure-pod-container/security-context.md +++ b/content/en/docs/tasks/configure-pod-container/security-context.md @@ -14,21 +14,31 @@ A security context defines privilege and access control settings for a Pod or Container. Security context settings include, but are not limited to: * Discretionary Access Control: Permission to access an object, like a file, is based on -[user ID (UID) and group ID (GID)](https://wiki.archlinux.org/index.php/users_and_groups). + [user ID (UID) and group ID (GID)](https://wiki.archlinux.org/index.php/users_and_groups). -* [Security Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux): Objects are assigned security labels. +* [Security Enhanced Linux (SELinux)](https://en.wikipedia.org/wiki/Security-Enhanced_Linux): + Objects are assigned security labels. * Running as privileged or unprivileged. -* [Linux Capabilities](https://linux-audit.com/linux-capabilities-hardening-linux-binaries-by-removing-setuid/): Give a process some privileges, but not all the privileges of the root user. +* [Linux Capabilities](https://linux-audit.com/linux-capabilities-hardening-linux-binaries-by-removing-setuid/): + Give a process some privileges, but not all the privileges of the root user. -* [AppArmor](/docs/tutorials/clusters/apparmor/): Use program profiles to restrict the capabilities of individual programs. +* [AppArmor](/docs/tutorials/security/apparmor/): + Use program profiles to restrict the capabilities of individual programs. -* [Seccomp](/docs/tutorials/clusters/seccomp/): Filter a process's system calls. +* [Seccomp](/docs/tutorials/security/seccomp/): Filter a process's system calls. -* AllowPrivilegeEscalation: Controls whether a process can gain more privileges than its parent process. This bool directly controls whether the [`no_new_privs`](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt) flag gets set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged OR 2) has `CAP_SYS_ADMIN`. +* `allowPrivilegeEscalation`: Controls whether a process can gain more privileges than + its parent process. This bool directly controls whether the + [`no_new_privs`](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt) + flag gets set on the container process. + `allowPrivilegeEscalation` is always true when the container: -* readOnlyRootFilesystem: Mounts the container's root filesystem as read-only. + - is run as privileged, or + - has `CAP_SYS_ADMIN` + +* `readOnlyRootFilesystem`: Mounts the container's root filesystem as read-only. The above bullets are not a complete set of security context settings -- please see [SecurityContext](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#securitycontext-v1-core) @@ -37,15 +47,10 @@ for a comprehensive list. For more information about security mechanisms in Linux, see [Overview of Linux Kernel Security Features](https://www.linux.com/learn/overview-linux-kernel-security-features) - - ## {{% heading "prerequisites" %}} - {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} - - ## Set the security context for a Pod @@ -91,7 +96,7 @@ ps The output shows that the processes are running as user 1000, which is the value of `runAsUser`: -```shell +```none PID USER TIME COMMAND 1 1000 0:00 sleep 1h 6 1000 0:00 sh @@ -108,7 +113,7 @@ ls -l The output shows that the `/data/demo` directory has group ID 2000, which is the value of `fsGroup`. -```shell +```none drwxrwsrwx 2 root 2000 4096 Jun 6 20:08 demo ``` @@ -127,19 +132,26 @@ ls -l The output shows that `testfile` has group ID 2000, which is the value of `fsGroup`. -```shell +```none -rw-r--r-- 1 1000 2000 6 Jun 6 20:08 testfile ``` Run the following command: ```shell -$ id +id +``` + +The output is similar to this: + +```none uid=1000 gid=3000 groups=2000 ``` -You will see that gid is 3000 which is same as `runAsGroup` field. If the `runAsGroup` was omitted the gid would -remain as 0(root) and the process will be able to interact with files that are owned by root(0) group and that have -the required group permissions for root(0) group. + +From the output, you can see that `gid` is 3000 which is same as the `runAsGroup` field. +If the `runAsGroup` was omitted, the `gid` would remain as 0 (root) and the process will +be able to interact with files that are owned by the root(0) group and groups that have +the required group permissions for the root (0) group. Exit your shell: @@ -159,11 +171,14 @@ slowing Pod startup. You can use the `fsGroupChangePolicy` field inside a `secur to control the way that Kubernetes checks and manages ownership and permissions for a volume. -**fsGroupChangePolicy** - `fsGroupChangePolicy` defines behavior for changing ownership and permission of the volume -before being exposed inside a Pod. This field only applies to volume types that support -`fsGroup` controlled ownership and permissions. This field has two possible values: +**fsGroupChangePolicy** - `fsGroupChangePolicy` defines behavior for changing ownership + and permission of the volume before being exposed inside a Pod. + This field only applies to volume types that support `fsGroup` controlled ownership and permissions. + This field has two possible values: -* _OnRootMismatch_: Only change permissions and ownership if permission and ownership of root directory does not match with expected permissions of the volume. This could help shorten the time it takes to change ownership and permission of a volume. +* _OnRootMismatch_: Only change permissions and ownership if permission and ownership of + root directory does not match with expected permissions of the volume. + This could help shorten the time it takes to change ownership and permission of a volume. * _Always_: Always change permission and ownership of the volume when volume is mounted. For example: @@ -176,7 +191,6 @@ securityContext: fsGroupChangePolicy: "OnRootMismatch" ``` - {{< note >}} This field has no effect on ephemeral volume types such as [`secret`](/docs/concepts/storage/volumes/#secret), @@ -238,7 +252,7 @@ kubectl exec -it security-context-demo-2 -- sh In your shell, list the running processes: -``` +```shell ps aux ``` @@ -297,7 +311,7 @@ ps aux The output shows the process IDs (PIDs) for the Container: -```shell +``` USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.0 4336 796 ? Ss 18:17 0:00 /bin/sh -c node server.js root 5 0.1 0.5 772124 22700 ? Sl 18:17 0:00 node server.js @@ -354,7 +368,7 @@ cat status The output shows capabilities bitmap for the process: -```shell +``` ... CapPrm: 00000000aa0435fb CapEff: 00000000aa0435fb @@ -374,7 +388,10 @@ See [capability.h](https://github.com/torvalds/linux/blob/master/include/uapi/li for definitions of the capability constants. {{< note >}} -Linux capability constants have the form `CAP_XXX`. But when you list capabilities in your Container manifest, you must omit the `CAP_` portion of the constant. For example, to add `CAP_SYS_TIME`, include `SYS_TIME` in your list of capabilities. +Linux capability constants have the form `CAP_XXX`. +But when you list capabilities in your container manifest, you must +omit the `CAP_` portion of the constant. +For example, to add `CAP_SYS_TIME`, include `SYS_TIME` in your list of capabilities. {{< /note >}} ## Set the Seccomp Profile for a Container @@ -437,18 +454,19 @@ the Pod's Volumes when applicable. Specifically `fsGroup` and `seLinuxOptions` a applied to Volumes as follows: * `fsGroup`: Volumes that support ownership management are modified to be owned -and writable by the GID specified in `fsGroup`. See the -[Ownership Management design document](https://git.k8s.io/community/contributors/design-proposals/storage/volume-ownership-management.md) -for more details. + and writable by the GID specified in `fsGroup`. See the + [Ownership Management design document](https://git.k8s.io/community/contributors/design-proposals/storage/volume-ownership-management.md) + for more details. * `seLinuxOptions`: Volumes that support SELinux labeling are relabeled to be accessible -by the label specified under `seLinuxOptions`. Usually you only -need to set the `level` section. This sets the -[Multi-Category Security (MCS)](https://selinuxproject.org/page/NB_MLS) -label given to all Containers in the Pod as well as the Volumes. + by the label specified under `seLinuxOptions`. Usually you only + need to set the `level` section. This sets the + [Multi-Category Security (MCS)](https://selinuxproject.org/page/NB_MLS) + label given to all Containers in the Pod as well as the Volumes. {{< warning >}} -After you specify an MCS label for a Pod, all Pods with the same label can access the Volume. If you need inter-Pod protection, you must assign a unique MCS label to each Pod. +After you specify an MCS label for a Pod, all Pods with the same label can access the Volume. +If you need inter-Pod protection, you must assign a unique MCS label to each Pod. {{< /warning >}} ## Clean up @@ -462,11 +480,8 @@ kubectl delete pod security-context-demo-3 kubectl delete pod security-context-demo-4 ``` - - ## {{% heading "whatsnext" %}} - * [PodSecurityContext](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritycontext-v1-core) * [SecurityContext](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#securitycontext-v1-core) * [Tuning Docker with the newest security enhancements](https://github.com/containerd/containerd/blob/main/docs/cri/config.md) diff --git a/content/en/docs/tasks/debug-application-cluster/crictl.md b/content/en/docs/tasks/debug-application-cluster/crictl.md index cb04f1673e..8e649d3b27 100644 --- a/content/en/docs/tasks/debug-application-cluster/crictl.md +++ b/content/en/docs/tasks/debug-application-cluster/crictl.md @@ -19,15 +19,14 @@ Kubernetes node. `crictl` and its source are hosted in the ## {{% heading "prerequisites" %}} - `crictl` requires a Linux operating system with a CRI runtime. ## Installing crictl -You can download a compressed archive `crictl` from the cri-tools [release -page](https://github.com/kubernetes-sigs/cri-tools/releases), for several +You can download a compressed archive `crictl` from the cri-tools +[release page](https://github.com/kubernetes-sigs/cri-tools/releases), for several different architectures. Download the version that corresponds to your version of Kubernetes. Extract it and move it to a location on your system path, such as `/usr/local/bin/`. @@ -85,6 +84,7 @@ List all pods: ```shell crictl pods ``` + The output is similar to this: ``` @@ -100,6 +100,7 @@ List pods by name: ```shell crictl pods --name nginx-65899c769f-wv2gp ``` + The output is similar to this: ``` @@ -112,6 +113,7 @@ List pods by label: ```shell crictl pods --label run=nginx ``` + The output is similar to this: ``` @@ -126,6 +128,7 @@ List all images: ```shell crictl images ``` + The output is similar to this: ``` @@ -141,6 +144,7 @@ List images by repository: ```shell crictl images nginx ``` + The output is similar to this: ``` @@ -153,6 +157,7 @@ Only list image IDs: ```shell crictl images -q ``` + The output is similar to this: ``` @@ -169,6 +174,7 @@ List all containers: ```shell crictl ps -a ``` + The output is similar to this: ``` @@ -181,9 +187,10 @@ CONTAINER ID IMAGE List running containers: -``` +```shell crictl ps ``` + The output is similar to this: ``` @@ -198,6 +205,7 @@ CONTAINER ID IMAGE ```shell crictl exec -i -t 1f73f2d81bf98 ls ``` + The output is similar to this: ``` @@ -211,6 +219,7 @@ Get all container logs: ```shell crictl logs 87d3992f84f74 ``` + The output is similar to this: ``` @@ -224,6 +233,7 @@ Get only the latest `N` lines of logs: ```shell crictl logs --tail=1 87d3992f84f74 ``` + The output is similar to this: ``` @@ -236,29 +246,29 @@ Using `crictl` to run a pod sandbox is useful for debugging container runtimes. On a running Kubernetes cluster, the sandbox will eventually be stopped and deleted by the Kubelet. -1. Create a JSON file like the following: +1. Create a JSON file like the following: - ```json - { - "metadata": { - "name": "nginx-sandbox", - "namespace": "default", - "attempt": 1, - "uid": "hdishd83djaidwnduwk28bcsb" - }, - "logDirectory": "/tmp", - "linux": { - } - } - ``` + ```json + { + "metadata": { + "name": "nginx-sandbox", + "namespace": "default", + "attempt": 1, + "uid": "hdishd83djaidwnduwk28bcsb" + }, + "logDirectory": "/tmp", + "linux": { + } + } + ``` -2. Use the `crictl runp` command to apply the JSON and run the sandbox. +2. Use the `crictl runp` command to apply the JSON and run the sandbox. - ```shell - crictl runp pod-config.json - ``` + ```shell + crictl runp pod-config.json + ``` - The ID of the sandbox is returned. + The ID of the sandbox is returned. ### Create a container @@ -266,68 +276,73 @@ Using `crictl` to create a container is useful for debugging container runtimes. On a running Kubernetes cluster, the sandbox will eventually be stopped and deleted by the Kubelet. -1. Pull a busybox image +1. Pull a busybox image - ```shell - crictl pull busybox - Image is up to date for busybox@sha256:141c253bc4c3fd0a201d32dc1f493bcf3fff003b6df416dea4f41046e0f37d47 - ``` + ```shell + crictl pull busybox + ``` + ```none + Image is up to date for busybox@sha256:141c253bc4c3fd0a201d32dc1f493bcf3fff003b6df416dea4f41046e0f37d47 + ``` -2. Create configs for the pod and the container: +2. Create configs for the pod and the container: - **Pod config**: - ```yaml - { - "metadata": { - "name": "nginx-sandbox", - "namespace": "default", - "attempt": 1, - "uid": "hdishd83djaidwnduwk28bcsb" - }, - "log_directory": "/tmp", - "linux": { - } - } - ``` + **Pod config**: - **Container config**: - ```yaml - { - "metadata": { - "name": "busybox" - }, - "image":{ - "image": "busybox" - }, - "command": [ - "top" - ], - "log_path":"busybox.log", - "linux": { - } - } - ``` + ```json + { + "metadata": { + "name": "nginx-sandbox", + "namespace": "default", + "attempt": 1, + "uid": "hdishd83djaidwnduwk28bcsb" + }, + "log_directory": "/tmp", + "linux": { + } + } + ``` -3. Create the container, passing the ID of the previously-created pod, the - container config file, and the pod config file. The ID of the container is - returned. + **Container config**: - ```shell - crictl create f84dd361f8dc51518ed291fbadd6db537b0496536c1d2d6c05ff943ce8c9a54f container-config.json pod-config.json - ``` + ```json + { + "metadata": { + "name": "busybox" + }, + "image":{ + "image": "busybox" + }, + "command": [ + "top" + ], + "log_path":"busybox.log", + "linux": { + } + } + ``` -4. List all containers and verify that the newly-created container has its - state set to `Created`. +3. Create the container, passing the ID of the previously-created pod, the + container config file, and the pod config file. The ID of the container is + returned. - ```shell - crictl ps -a - ``` - The output is similar to this: + ```shell + crictl create f84dd361f8dc51518ed291fbadd6db537b0496536c1d2d6c05ff943ce8c9a54f container-config.json pod-config.json + ``` + +4. List all containers and verify that the newly-created container has its + state set to `Created`. + + ```shell + crictl ps -a + ``` + + The output is similar to this: - ``` - CONTAINER ID IMAGE CREATED STATE NAME ATTEMPT - 3e025dd50a72d busybox 32 seconds ago Created busybox 0 - ``` + ``` + CONTAINER ID IMAGE CREATED STATE NAME ATTEMPT + 3e025dd50a72d busybox 32 seconds ago Created busybox 0 + ``` ### Start a container @@ -336,6 +351,7 @@ To start a container, pass its ID to `crictl start`: ```shell crictl start 3e025dd50a72d956c4f14881fbb5b1080c9275674e95fb67f965f6478a957d60 ``` + The output is similar to this: ``` @@ -350,13 +366,12 @@ crictl ps The output is similar to this: ``` -CONTAINER ID IMAGE CREATED STATE NAME ATTEMPT -3e025dd50a72d busybox About a minute ago Running busybox 0 +CONTAINER ID IMAGE CREATED STATE NAME ATTEMPT +3e025dd50a72d busybox About a minute ago Running busybox 0 ``` ## {{% heading "whatsnext" %}} * [Learn more about `crictl`](https://github.com/kubernetes-sigs/cri-tools). -* [Map `docker` CLI commands to `crictl`](/reference/tools/map-crictl-dockercli/). +* [Map `docker` CLI commands to `crictl`](/docs/reference/tools/map-crictl-dockercli/). - \ No newline at end of file diff --git a/content/en/docs/tasks/debug-application-cluster/debug-application-introspection.md b/content/en/docs/tasks/debug-application-cluster/debug-application-introspection.md index 03ba9d2c02..c7720ad1f6 100644 --- a/content/en/docs/tasks/debug-application-cluster/debug-application-introspection.md +++ b/content/en/docs/tasks/debug-application-cluster/debug-application-introspection.md @@ -40,70 +40,77 @@ kubectl get pods ``` ```none -NAME READY STATUS RESTARTS AGE -nginx-deployment-1006230814-6winp 1/1 Running 0 11s -nginx-deployment-1006230814-fmgu3 1/1 Running 0 11s +NAME READY STATUS RESTARTS AGE +nginx-deployment-67d4bdd6f5-cx2nz 1/1 Running 0 13s +nginx-deployment-67d4bdd6f5-w6kd7 1/1 Running 0 13s ``` We can retrieve a lot more information about each of these pods using `kubectl describe pod`. For example: ```shell -kubectl describe pod nginx-deployment-1006230814-6winp +kubectl describe pod nginx-deployment-67d4bdd6f5-w6kd7 ``` ```none -Name: nginx-deployment-1006230814-6winp -Namespace: default -Node: kubernetes-node-wul5/10.240.0.9 -Start Time: Thu, 24 Mar 2016 01:39:49 +0000 -Labels: app=nginx,pod-template-hash=1006230814 -Annotations: kubernetes.io/created-by={"kind":"SerializedReference","apiVersion":"v1","reference":{"kind":"ReplicaSet","namespace":"default","name":"nginx-deployment-1956810328","uid":"14e607e7-8ba1-11e7-b5cb-fa16" ... -Status: Running -IP: 10.244.0.6 -Controllers: ReplicaSet/nginx-deployment-1006230814 +Name: nginx-deployment-67d4bdd6f5-w6kd7 +Namespace: default +Priority: 0 +Node: kube-worker-1/192.168.0.113 +Start Time: Thu, 17 Feb 2022 16:51:01 -0500 +Labels: app=nginx + pod-template-hash=67d4bdd6f5 +Annotations: +Status: Running +IP: 10.88.0.3 +IPs: + IP: 10.88.0.3 + IP: 2001:db8::1 +Controlled By: ReplicaSet/nginx-deployment-67d4bdd6f5 Containers: nginx: - Container ID: docker://90315cc9f513c724e9957a4788d3e625a078de84750f244a40f97ae355eb1149 - Image: nginx - Image ID: docker://6f62f48c4e55d700cf3eb1b5e33fa051802986b77b874cc351cce539e5163707 - Port: 80/TCP - QoS Tier: - cpu: Guaranteed - memory: Guaranteed + Container ID: containerd://5403af59a2b46ee5a23fb0ae4b1e077f7ca5c5fb7af16e1ab21c00e0e616462a + Image: nginx + Image ID: docker.io/library/nginx@sha256:2834dc507516af02784808c5f48b7cbe38b8ed5d0f4837f16e78d00deb7e7767 + Port: 80/TCP + Host Port: 0/TCP + State: Running + Started: Thu, 17 Feb 2022 16:51:05 -0500 + Ready: True + Restart Count: 0 Limits: - cpu: 500m - memory: 128Mi + cpu: 500m + memory: 128Mi Requests: - memory: 128Mi - cpu: 500m - State: Running - Started: Thu, 24 Mar 2016 01:39:51 +0000 - Ready: True - Restart Count: 0 - Environment: + cpu: 500m + memory: 128Mi + Environment: Mounts: - /var/run/secrets/kubernetes.io/serviceaccount from default-token-5kdvl (ro) + /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-bgsgp (ro) Conditions: - Type Status - Initialized True - Ready True - PodScheduled True + Type Status + Initialized True + Ready True + ContainersReady True + PodScheduled True Volumes: - default-token-4bcbi: - Type: Secret (a volume populated by a Secret) - SecretName: default-token-4bcbi - Optional: false -QoS Class: Guaranteed -Node-Selectors: -Tolerations: + kube-api-access-bgsgp: + Type: Projected (a volume that contains injected data from multiple sources) + TokenExpirationSeconds: 3607 + ConfigMapName: kube-root-ca.crt + ConfigMapOptional: + DownwardAPI: true +QoS Class: Guaranteed +Node-Selectors: +Tolerations: node.kubernetes.io/not-ready:NoExecute op=Exists for 300s + node.kubernetes.io/unreachable:NoExecute op=Exists for 300s Events: - FirstSeen LastSeen Count From SubobjectPath Type Reason Message - --------- -------- ----- ---- ------------- -------- ------ ------- - 54s 54s 1 {default-scheduler } Normal Scheduled Successfully assigned nginx-deployment-1006230814-6winp to kubernetes-node-wul5 - 54s 54s 1 {kubelet kubernetes-node-wul5} spec.containers{nginx} Normal Pulling pulling image "nginx" - 53s 53s 1 {kubelet kubernetes-node-wul5} spec.containers{nginx} Normal Pulled Successfully pulled image "nginx" - 53s 53s 1 {kubelet kubernetes-node-wul5} spec.containers{nginx} Normal Created Created container with docker id 90315cc9f513 - 53s 53s 1 {kubelet kubernetes-node-wul5} spec.containers{nginx} Normal Started Started container with docker id 90315cc9f513 + Type Reason Age From Message + ---- ------ ---- ---- ------- + Normal Scheduled 34s default-scheduler Successfully assigned default/nginx-deployment-67d4bdd6f5-w6kd7 to kube-worker-1 + Normal Pulling 31s kubelet Pulling image "nginx" + Normal Pulled 30s kubelet Successfully pulled image "nginx" in 1.146417389s + Normal Created 30s kubelet Created container nginx + Normal Started 30s kubelet Started container nginx ``` Here you can see configuration information about the container(s) and Pod (labels, resource requirements, etc.), as well as status information about the container(s) and Pod (state, readiness, restart count, events, etc.). @@ -203,18 +210,22 @@ kubectl get pod nginx-deployment-1006230814-6winp -o yaml apiVersion: v1 kind: Pod metadata: - annotations: - kubernetes.io/created-by: | - {"kind":"SerializedReference","apiVersion":"v1","reference":{"kind":"ReplicaSet","namespace":"default","name":"nginx-deployment-1006230814","uid":"4c84c175-f161-11e5-9a78-42010af00005","apiVersion":"extensions","resourceVersion":"133434"}} - creationTimestamp: 2016-03-24T01:39:50Z - generateName: nginx-deployment-1006230814- + creationTimestamp: "2022-02-17T21:51:01Z" + generateName: nginx-deployment-67d4bdd6f5- labels: app: nginx - pod-template-hash: "1006230814" - name: nginx-deployment-1006230814-6winp + pod-template-hash: 67d4bdd6f5 + name: nginx-deployment-67d4bdd6f5-w6kd7 namespace: default - resourceVersion: "133447" - uid: 4c879808-f161-11e5-9a78-42010af00005 + ownerReferences: + - apiVersion: apps/v1 + blockOwnerDeletion: true + controller: true + kind: ReplicaSet + name: nginx-deployment-67d4bdd6f5 + uid: 7d41dfd4-84c0-4be4-88ab-cedbe626ad82 + resourceVersion: "1364" + uid: a6501da1-0447-4262-98eb-c03d4002222e spec: containers: - image: nginx @@ -231,42 +242,88 @@ spec: cpu: 500m memory: 128Mi terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kubernetes.io/serviceaccount - name: default-token-4bcbi + name: kube-api-access-bgsgp readOnly: true dnsPolicy: ClusterFirst - nodeName: kubernetes-node-wul5 + enableServiceLinks: true + nodeName: kube-worker-1 + preemptionPolicy: PreemptLowerPriority + priority: 0 restartPolicy: Always + schedulerName: default-scheduler securityContext: {} serviceAccount: default serviceAccountName: default terminationGracePeriodSeconds: 30 + tolerations: + - effect: NoExecute + key: node.kubernetes.io/not-ready + operator: Exists + tolerationSeconds: 300 + - effect: NoExecute + key: node.kubernetes.io/unreachable + operator: Exists + tolerationSeconds: 300 volumes: - - name: default-token-4bcbi - secret: - secretName: default-token-4bcbi + - name: kube-api-access-bgsgp + projected: + defaultMode: 420 + sources: + - serviceAccountToken: + expirationSeconds: 3607 + path: token + - configMap: + items: + - key: ca.crt + path: ca.crt + name: kube-root-ca.crt + - downwardAPI: + items: + - fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + path: namespace status: conditions: - lastProbeTime: null - lastTransitionTime: 2016-03-24T01:39:51Z + lastTransitionTime: "2022-02-17T21:51:01Z" + status: "True" + type: Initialized + - lastProbeTime: null + lastTransitionTime: "2022-02-17T21:51:06Z" status: "True" type: Ready + - lastProbeTime: null + lastTransitionTime: "2022-02-17T21:51:06Z" + status: "True" + type: ContainersReady + - lastProbeTime: null + lastTransitionTime: "2022-02-17T21:51:01Z" + status: "True" + type: PodScheduled containerStatuses: - - containerID: docker://90315cc9f513c724e9957a4788d3e625a078de84750f244a40f97ae355eb1149 - image: nginx - imageID: docker://6f62f48c4e55d700cf3eb1b5e33fa051802986b77b874cc351cce539e5163707 + - containerID: containerd://5403af59a2b46ee5a23fb0ae4b1e077f7ca5c5fb7af16e1ab21c00e0e616462a + image: docker.io/library/nginx:latest + imageID: docker.io/library/nginx@sha256:2834dc507516af02784808c5f48b7cbe38b8ed5d0f4837f16e78d00deb7e7767 lastState: {} name: nginx ready: true restartCount: 0 + started: true state: running: - startedAt: 2016-03-24T01:39:51Z - hostIP: 10.240.0.9 + startedAt: "2022-02-17T21:51:05Z" + hostIP: 192.168.0.113 phase: Running - podIP: 10.244.0.6 - startTime: 2016-03-24T01:39:49Z + podIP: 10.88.0.3 + podIPs: + - ip: 10.88.0.3 + - ip: 2001:db8::1 + qosClass: Guaranteed + startTime: "2022-02-17T21:51:01Z" ``` ## Example: debugging a down/unreachable node @@ -279,116 +336,177 @@ kubectl get nodes ```none NAME STATUS ROLES AGE VERSION -kubernetes-node-861h NotReady 1h v1.13.0 -kubernetes-node-bols Ready 1h v1.13.0 -kubernetes-node-st6x Ready 1h v1.13.0 -kubernetes-node-unaj Ready 1h v1.13.0 +kube-worker-1 NotReady 1h v1.23.3 +kubernetes-node-bols Ready 1h v1.23.3 +kubernetes-node-st6x Ready 1h v1.23.3 +kubernetes-node-unaj Ready 1h v1.23.3 ``` ```shell -kubectl describe node kubernetes-node-861h +kubectl describe node kube-worker-1 ``` ```none -Name: kubernetes-node-861h -Role -Labels: kubernetes.io/arch=amd64 - kubernetes.io/os=linux - kubernetes.io/hostname=kubernetes-node-861h -Annotations: node.alpha.kubernetes.io/ttl=0 - volumes.kubernetes.io/controller-managed-attach-detach=true -Taints: -CreationTimestamp: Mon, 04 Sep 2017 17:13:23 +0800 -Phase: +Name: kube-worker-1 +Roles: +Labels: beta.kubernetes.io/arch=amd64 + beta.kubernetes.io/os=linux + kubernetes.io/arch=amd64 + kubernetes.io/hostname=kube-worker-1 + kubernetes.io/os=linux +Annotations: kubeadm.alpha.kubernetes.io/cri-socket: /run/containerd/containerd.sock + node.alpha.kubernetes.io/ttl: 0 + volumes.kubernetes.io/controller-managed-attach-detach: true +CreationTimestamp: Thu, 17 Feb 2022 16:46:30 -0500 +Taints: node.kubernetes.io/unreachable:NoExecute + node.kubernetes.io/unreachable:NoSchedule +Unschedulable: false +Lease: + HolderIdentity: kube-worker-1 + AcquireTime: + RenewTime: Thu, 17 Feb 2022 17:13:09 -0500 Conditions: - Type Status LastHeartbeatTime LastTransitionTime Reason Message - ---- ------ ----------------- ------------------ ------ ------- - OutOfDisk Unknown Fri, 08 Sep 2017 16:04:28 +0800 Fri, 08 Sep 2017 16:20:58 +0800 NodeStatusUnknown Kubelet stopped posting node status. - MemoryPressure Unknown Fri, 08 Sep 2017 16:04:28 +0800 Fri, 08 Sep 2017 16:20:58 +0800 NodeStatusUnknown Kubelet stopped posting node status. - DiskPressure Unknown Fri, 08 Sep 2017 16:04:28 +0800 Fri, 08 Sep 2017 16:20:58 +0800 NodeStatusUnknown Kubelet stopped posting node status. - Ready Unknown Fri, 08 Sep 2017 16:04:28 +0800 Fri, 08 Sep 2017 16:20:58 +0800 NodeStatusUnknown Kubelet stopped posting node status. -Addresses: 10.240.115.55,104.197.0.26 + Type Status LastHeartbeatTime LastTransitionTime Reason Message + ---- ------ ----------------- ------------------ ------ ------- + NetworkUnavailable False Thu, 17 Feb 2022 17:09:13 -0500 Thu, 17 Feb 2022 17:09:13 -0500 WeaveIsUp Weave pod has set this + MemoryPressure Unknown Thu, 17 Feb 2022 17:12:40 -0500 Thu, 17 Feb 2022 17:13:52 -0500 NodeStatusUnknown Kubelet stopped posting node status. + DiskPressure Unknown Thu, 17 Feb 2022 17:12:40 -0500 Thu, 17 Feb 2022 17:13:52 -0500 NodeStatusUnknown Kubelet stopped posting node status. + PIDPressure Unknown Thu, 17 Feb 2022 17:12:40 -0500 Thu, 17 Feb 2022 17:13:52 -0500 NodeStatusUnknown Kubelet stopped posting node status. + Ready Unknown Thu, 17 Feb 2022 17:12:40 -0500 Thu, 17 Feb 2022 17:13:52 -0500 NodeStatusUnknown Kubelet stopped posting node status. +Addresses: + InternalIP: 192.168.0.113 + Hostname: kube-worker-1 Capacity: - cpu: 2 - hugePages: 0 - memory: 4046788Ki - pods: 110 + cpu: 2 + ephemeral-storage: 15372232Ki + hugepages-2Mi: 0 + memory: 2025188Ki + pods: 110 Allocatable: - cpu: 1500m - hugePages: 0 - memory: 1479263Ki - pods: 110 + cpu: 2 + ephemeral-storage: 14167048988 + hugepages-2Mi: 0 + memory: 1922788Ki + pods: 110 System Info: - Machine ID: 8e025a21a4254e11b028584d9d8b12c4 - System UUID: 349075D1-D169-4F25-9F2A-E886850C47E3 - Boot ID: 5cd18b37-c5bd-4658-94e0-e436d3f110e0 - Kernel Version: 4.4.0-31-generic - OS Image: Debian GNU/Linux 8 (jessie) - Operating System: linux - Architecture: amd64 - Container Runtime Version: docker://1.12.5 - Kubelet Version: v1.6.9+a3d1dfa6f4335 - Kube-Proxy Version: v1.6.9+a3d1dfa6f4335 -ExternalID: 15233045891481496305 -Non-terminated Pods: (9 in total) - Namespace Name CPU Requests CPU Limits Memory Requests Memory Limits - --------- ---- ------------ ---------- --------------- ------------- -...... + Machine ID: 9384e2927f544209b5d7b67474bbf92b + System UUID: aa829ca9-73d7-064d-9019-df07404ad448 + Boot ID: 5a295a03-aaca-4340-af20-1327fa5dab5c + Kernel Version: 5.13.0-28-generic + OS Image: Ubuntu 21.10 + Operating System: linux + Architecture: amd64 + Container Runtime Version: containerd://1.5.9 + Kubelet Version: v1.23.3 + Kube-Proxy Version: v1.23.3 +Non-terminated Pods: (4 in total) + Namespace Name CPU Requests CPU Limits Memory Requests Memory Limits Age + --------- ---- ------------ ---------- --------------- ------------- --- + default nginx-deployment-67d4bdd6f5-cx2nz 500m (25%) 500m (25%) 128Mi (6%) 128Mi (6%) 23m + default nginx-deployment-67d4bdd6f5-w6kd7 500m (25%) 500m (25%) 128Mi (6%) 128Mi (6%) 23m + kube-system kube-proxy-dnxbz 0 (0%) 0 (0%) 0 (0%) 0 (0%) 28m + kube-system weave-net-gjxxp 100m (5%) 0 (0%) 200Mi (10%) 0 (0%) 28m Allocated resources: (Total limits may be over 100 percent, i.e., overcommitted.) - CPU Requests CPU Limits Memory Requests Memory Limits - ------------ ---------- --------------- ------------- - 900m (60%) 2200m (146%) 1009286400 (66%) 5681286400 (375%) -Events: + Resource Requests Limits + -------- -------- ------ + cpu 1100m (55%) 1 (50%) + memory 456Mi (24%) 256Mi (13%) + ephemeral-storage 0 (0%) 0 (0%) + hugepages-2Mi 0 (0%) 0 (0%) +Events: +... ``` ```shell -kubectl get node kubernetes-node-861h -o yaml +kubectl get node kube-worker-1 -o yaml ``` ```yaml apiVersion: v1 kind: Node metadata: - creationTimestamp: 2015-07-10T21:32:29Z + annotations: + kubeadm.alpha.kubernetes.io/cri-socket: /run/containerd/containerd.sock + node.alpha.kubernetes.io/ttl: "0" + volumes.kubernetes.io/controller-managed-attach-detach: "true" + creationTimestamp: "2022-02-17T21:46:30Z" labels: - kubernetes.io/hostname: kubernetes-node-861h - name: kubernetes-node-861h - resourceVersion: "757" - uid: 2a69374e-274b-11e5-a234-42010af0d969 -spec: - externalID: "15233045891481496305" - podCIDR: 10.244.0.0/24 - providerID: gce://striped-torus-760/us-central1-b/kubernetes-node-861h + beta.kubernetes.io/arch: amd64 + beta.kubernetes.io/os: linux + kubernetes.io/arch: amd64 + kubernetes.io/hostname: kube-worker-1 + kubernetes.io/os: linux + name: kube-worker-1 + resourceVersion: "4026" + uid: 98efe7cb-2978-4a0b-842a-1a7bf12c05f8 +spec: {} status: addresses: - - address: 10.240.115.55 + - address: 192.168.0.113 type: InternalIP - - address: 104.197.0.26 - type: ExternalIP + - address: kube-worker-1 + type: Hostname + allocatable: + cpu: "2" + ephemeral-storage: "14167048988" + hugepages-2Mi: "0" + memory: 1922788Ki + pods: "110" capacity: - cpu: "1" - memory: 3800808Ki - pods: "100" + cpu: "2" + ephemeral-storage: 15372232Ki + hugepages-2Mi: "0" + memory: 2025188Ki + pods: "110" conditions: - - lastHeartbeatTime: 2015-07-10T21:34:32Z - lastTransitionTime: 2015-07-10T21:35:15Z - reason: Kubelet stopped posting node status. - status: Unknown + - lastHeartbeatTime: "2022-02-17T22:20:32Z" + lastTransitionTime: "2022-02-17T22:20:32Z" + message: Weave pod has set this + reason: WeaveIsUp + status: "False" + type: NetworkUnavailable + - lastHeartbeatTime: "2022-02-17T22:20:15Z" + lastTransitionTime: "2022-02-17T22:13:25Z" + message: kubelet has sufficient memory available + reason: KubeletHasSufficientMemory + status: "False" + type: MemoryPressure + - lastHeartbeatTime: "2022-02-17T22:20:15Z" + lastTransitionTime: "2022-02-17T22:13:25Z" + message: kubelet has no disk pressure + reason: KubeletHasNoDiskPressure + status: "False" + type: DiskPressure + - lastHeartbeatTime: "2022-02-17T22:20:15Z" + lastTransitionTime: "2022-02-17T22:13:25Z" + message: kubelet has sufficient PID available + reason: KubeletHasSufficientPID + status: "False" + type: PIDPressure + - lastHeartbeatTime: "2022-02-17T22:20:15Z" + lastTransitionTime: "2022-02-17T22:15:15Z" + message: kubelet is posting ready status. AppArmor enabled + reason: KubeletReady + status: "True" type: Ready + daemonEndpoints: + kubeletEndpoint: + Port: 10250 nodeInfo: - bootID: 4e316776-b40d-4f78-a4ea-ab0d73390897 - containerRuntimeVersion: docker://Unknown - kernelVersion: 3.16.0-0.bpo.4-amd64 - kubeProxyVersion: v0.21.1-185-gffc5a86098dc01 - kubeletVersion: v0.21.1-185-gffc5a86098dc01 - machineID: "" - osImage: Debian GNU/Linux 7 (wheezy) - systemUUID: ABE5F6B4-D44B-108B-C46A-24CCE16C8B6E + architecture: amd64 + bootID: 22333234-7a6b-44d4-9ce1-67e31dc7e369 + containerRuntimeVersion: containerd://1.5.9 + kernelVersion: 5.13.0-28-generic + kubeProxyVersion: v1.23.3 + kubeletVersion: v1.23.3 + machineID: 9384e2927f544209b5d7b67474bbf92b + operatingSystem: linux + osImage: Ubuntu 21.10 + systemUUID: aa829ca9-73d7-064d-9019-df07404ad448 ``` - ## {{% heading "whatsnext" %}} diff --git a/content/en/docs/tasks/debug-application-cluster/debug-application.md b/content/en/docs/tasks/debug-application-cluster/debug-application.md index f3c8ea5269..179a86021b 100644 --- a/content/en/docs/tasks/debug-application-cluster/debug-application.md +++ b/content/en/docs/tasks/debug-application-cluster/debug-application.md @@ -58,7 +58,8 @@ Again, the information from `kubectl describe ...` should be informative. The m * Make sure that you have the name of the image correct. * Have you pushed the image to the registry? -* Run a manual `docker pull ` on your machine to see if the image can be pulled. +* Try to manually pull the image to see if the image can be pulled. For example, + if you use Docker on your PC, run `docker pull `. #### My pod is crashing or otherwise unhealthy diff --git a/content/en/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md b/content/en/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md index c99182b854..56d00d5323 100644 --- a/content/en/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md +++ b/content/en/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md @@ -86,8 +86,8 @@ worker node, but it can't run on that machine. Again, the information from * Make sure that you have the name of the image correct. * Have you pushed the image to the repository? -* Run a manual `docker pull ` on your machine to see if the image can be - pulled. +* Try to manually pull the image to see if it can be pulled. For example, if you + use Docker on your PC, run `docker pull `. ### My pod is crashing or otherwise unhealthy diff --git a/content/en/docs/tasks/debug-application-cluster/determine-reason-pod-failure.md b/content/en/docs/tasks/debug-application-cluster/determine-reason-pod-failure.md index f1ddd96389..9a01b37e19 100644 --- a/content/en/docs/tasks/debug-application-cluster/determine-reason-pod-failure.md +++ b/content/en/docs/tasks/debug-application-cluster/determine-reason-pod-failure.md @@ -75,6 +75,12 @@ only the termination message: kubectl get pod termination-demo -o go-template="{{range .status.containerStatuses}}{{.lastState.terminated.message}}{{end}}" +If you are running a multi-container pod, you can use a Go template to include the container's name. By doing so, you can discover which of the containers is failing: + +```shell +kubectl get pod multi-container-pod -o go-template='{{range .status.containerStatuses}}{{printf "%s:\n%s\n\n" .name .lastState.terminated.message}}{{end}}' +``` + ## Customizing the termination message Kubernetes retrieves termination messages from the termination message file diff --git a/content/en/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md b/content/en/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md index adfc42b545..14afc52c24 100644 --- a/content/en/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md +++ b/content/en/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md @@ -2,75 +2,208 @@ reviewers: - fgrzadkowski - piosz -title: Resource metrics pipeline +title: Resource metrics pipeline content_type: concept --- -Resource usage metrics, such as container CPU and memory usage, -are available in Kubernetes through the Metrics API. These metrics can be accessed either directly -by the user with the `kubectl top` command, or by a controller in the cluster, for example -Horizontal Pod Autoscaler, to make decisions. +For Kubernetes, the _Metrics API_ offers a basic set of metrics to support automatic scaling and similar use cases. +This API makes information available about resource usage for node and pod, including metrics for CPU and memory. +If you deploy the Metrics API into your cluster, clients of the Kubernetes API can then query for this information, and +you can use Kubernetes' access control mechanisms to manage permissions to do so. - +The [HorizontalPodAutoscaler](/docs/tasks/run-application/horizontal-pod-autoscale/) (HPA) and [VerticalPodAutoscaler](https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler#readme) (VPA) use data from the metrics API to adjust workload replicas and resources to meet customer demand. -## The Metrics API - -Through the Metrics API, you can get the amount of resource currently used -by a given node or a given pod. This API doesn't store the metric values, -so it's not possible, for example, to get the amount of resources used by a -given node 10 minutes ago. - -The API is no different from any other API: - -- it is discoverable through the same endpoint as the other Kubernetes APIs under the path: `/apis/metrics.k8s.io/` -- it offers the same security, scalability, and reliability guarantees - -The API is defined in [k8s.io/metrics](https://github.com/kubernetes/metrics/blob/master/pkg/apis/metrics/v1beta1/types.go) -repository. You can find more information about the API there. +You can also view the resource metrics using the [`kubectl top`](https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#top) command. {{< note >}} -The API requires the metrics server to be deployed in the cluster. Otherwise it will be not available. +The Metrics API, and the metrics pipeline that it enables, only offers the minimum +CPU and memory metrics to enable automatic scaling using HPA and / or VPA. +If you would like to provide a more complete set of metrics, you can complement +the simpler Metrics API by deploying a second +[metrics pipeline](/docs/tasks/debug-application-cluster/resource-usage-monitoring/#full-metrics-pipeline) +that uses the _Custom Metrics API_. {{< /note >}} -## Measuring Resource Usage + +Figure 1 illustrates the architecture of the resource metrics pipeline. + +{{< mermaid >}} +flowchart RL +subgraph cluster[Cluster] +direction RL +S[

] +A[Metrics-
Server] +subgraph B[Nodes] +direction TB +D[cAdvisor] --> C[kubelet] +E[Container
runtime] --> D +E1[Container
runtime] --> D +P[pod data] -.- C +end +L[API
server] +W[HPA] +C ---->|Summary
API| A -->|metrics
API| L --> W +end +L ---> K[kubectl
top] +classDef box fill:#fff,stroke:#000,stroke-width:1px,color:#000; +class W,B,P,K,cluster,D,E,E1 box +classDef spacewhite fill:#ffffff,stroke:#fff,stroke-width:0px,color:#000 +class S spacewhite +classDef k8s fill:#326ce5,stroke:#fff,stroke-width:1px,color:#fff; +class A,L,C k8s +{{< /mermaid >}} + +Figure 1. Resource Metrics Pipeline + +The architecture components, from right to left in the figure, consist of the following: + +* [cAdvisor](https://github.com/google/cadvisor): Daemon for collecting, aggregating and exposing container metrics included in Kubelet. +* [kubelet](/docs/concepts/overview/components/#kubelet): Node agent for managing container resources. Resource metrics are accessible using the `/metrics/resource` and `/stats` kubelet API endpoints. +* [Summary API](#summary-api-source): API provided by the kubelet for discovering and retrieving per-node summarized stats available through the `/stats` endpoint. +* [metrics-server](#metrics-server): Cluster addon component that collects and aggregates resource metrics pulled from each kubelet. The API server serves Metrics API for use by HPA, VPA, and by the `kubectl top` command. Metrics Server is a reference implementation of the Metrics API. +* [Metrics API](#metrics-api): Kubernetes API supporting access to CPU and memory used for workload autoscaling. To make this work in your cluster, you need an API extension server that provides the Metrics API. + + {{< note >}} + cAdvisor supports reading metrics from cgroups, which works with typical container runtimes on Linux. + If you use a container runtime that uses another resource isolation mechanism, for example virtualization, then that container runtime must support [CRI Container Metrics](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-node/cri-container-stats.md) in order for metrics to be available to the kubelet. + {{< /note >}} + + + + +## Metrics API + +The metrics-server implements the Metrics API. This API allows you to access CPU and memory usage for the nodes and pods in your cluster. Its primary role is to feed resource usage metrics to K8s autoscaler components. + +Here is an example of the Metrics API request for a `minikube` node piped through `jq` for easier reading: +```shell +kubectl get --raw "/apis/metrics.k8s.io/v1beta1/nodes/minikube" | jq '.' +``` + +Here is the same API call using `curl`: +```shell +curl http://localhost:8080/apis/metrics.k8s.io/v1beta1/nodes/minikube +``` +Sample reply: +```json +{ + "kind": "NodeMetrics", + "apiVersion": "metrics.k8s.io/v1beta1", + "metadata": { + "name": "minikube", + "selfLink": "/apis/metrics.k8s.io/v1beta1/nodes/minikube", + "creationTimestamp": "2022-01-27T18:48:43Z" + }, + "timestamp": "2022-01-27T18:48:33Z", + "window": "30s", + "usage": { + "cpu": "487558164n", + "memory": "732212Ki" + } +} +``` +Here is an example of the Metrics API request for a `kube-scheduler-minikube` pod contained in the `kube-system` namespace and piped through `jq` for easier reading: + +```shell +kubectl get --raw "/apis/metrics.k8s.io/v1beta1/namespaces/kube-system/pods/kube-scheduler-minikube" | jq '.' +``` +Here is the same API call using `curl`: +```shell +curl http://localhost:8080/apis/metrics.k8s.io/v1beta1/namespaces/kube-system/pods/kube-scheduler-minikube +``` +Sample reply: +```json +{ + "kind": "PodMetrics", + "apiVersion": "metrics.k8s.io/v1beta1", + "metadata": { + "name": "kube-scheduler-minikube", + "namespace": "kube-system", + "selfLink": "/apis/metrics.k8s.io/v1beta1/namespaces/kube-system/pods/kube-scheduler-minikube", + "creationTimestamp": "2022-01-27T19:25:00Z" + }, + "timestamp": "2022-01-27T19:24:31Z", + "window": "30s", + "containers": [ + { + "name": "kube-scheduler", + "usage": { + "cpu": "9559630n", + "memory": "22244Ki" + } + } + ] +} +``` + +The Metrics API is defined in the [k8s.io/metrics](https://github.com/kubernetes/metrics) repository. You must enable the [API aggregation layer](/docs/tasks/extend-kubernetes/configure-aggregation-layer/) and register an [APIService](/docs/reference/kubernetes-api/cluster-resources/api-service-v1/) for the `metrics.k8s.io` API. + +To learn more about the Metrics API, see [resource metrics API design](https://github.com/kubernetes/design-proposals-archive/blob/main/instrumentation/resource-metrics-api.md), the [metrics-server repository](https://github.com/kubernetes-sigs/metrics-server) and the [resource metrics API](https://github.com/kubernetes/metrics#resource-metrics-api). + + +{{< note >}} You must deploy the metrics-server or alternative adapter that serves the Metrics API to be able to access it. {{< /note >}} + +## Measuring resource usage ### CPU -CPU is reported as the average usage, in -[CPU cores](/docs/concepts/configuration/manage-resources-containers/#meaning-of-cpu), -over a period of time. This value is derived by taking a rate over a cumulative CPU counter -provided by the kernel (in both Linux and Windows kernels). -The kubelet chooses the window for the rate calculation. +CPU is reported as the average core usage measured in cpu units. One cpu, in Kubernetes, is equivalent to 1 vCPU/Core for cloud providers, and 1 hyper-thread on bare-metal Intel processors. + +This value is derived by taking a rate over a cumulative CPU counter provided by the kernel (in both Linux and Windows kernels). The time window used to calculate CPU is shown under window field in Metrics API. + +To learn more about how Kubernetes allocates and measures CPU resources, see [meaning of CPU](/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu). ### Memory -Memory is reported as the working set, in bytes, at the instant the metric was collected. -In an ideal world, the "working set" is the amount of memory in-use that cannot be freed under memory pressure. -However, calculation of the working set varies by host OS, and generally makes heavy use of heuristics to produce an estimate. -It includes all anonymous (non-file-backed) memory since Kubernetes does not support swap. -The metric typically also includes some cached (file-backed) memory, because the host OS cannot always reclaim such pages. +Memory is reported as the working set, measured in bytes, at the instant the metric was collected. + +In an ideal world, the "working set" is the amount of memory in-use that cannot be freed under memory pressure. However, calculation of the working set varies by host OS, and generally makes heavy use of heuristics to produce an estimate. + +The Kubernetes model for a container's working set expects that the container runtime counts anonymous memory associated with the container in question. The working set metric typically also includes some cached (file-backed) memory, because the host OS cannot always reclaim pages. + +To learn more about how Kubernetes allocates and measures memory resources, see [meaning of memory](/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory). ## Metrics Server -[Metrics Server](https://github.com/kubernetes-sigs/metrics-server) is a cluster-wide aggregator of resource usage data. -By default, it is deployed in clusters created by `kube-up.sh` script -as a Deployment object. If you use a different Kubernetes setup mechanism, you can deploy it using the provided -[deployment components.yaml](https://github.com/kubernetes-sigs/metrics-server/releases) file. +The metrics-server fetches resource metrics from the kubelets and exposes them in the Kubernetes API server through the Metrics API for use by the HPA and VPA. You can also view these metrics using the `kubectl top` command. -Metrics Server collects metrics from the Summary API, exposed by -[Kubelet](/docs/reference/command-line-tools-reference/kubelet/) on each node, and is registered with the main API server via -[Kubernetes aggregator](/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/). +The metrics-server uses the Kubernetes API to track nodes and pods in your cluster. The metrics-server queries each node over HTTP to fetch metrics. The metrics-server also builds an internal view of pod metadata, and keeps a cache of pod health. That cached pod health information is available via the extension API that the metrics-server makes available. -Learn more about the metrics server in -[the design doc](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/instrumentation/metrics-server.md). +For example with an HPA query, the metrics-server needs to identify which pods fulfill the label selectors in the deployment. -### Summary API Source -The [Kubelet](/docs/reference/command-line-tools-reference/kubelet/) gathers stats at node, volume, pod and container level, and emits their statistics in +The metrics-server calls the [kubelet](/docs/reference/command-line-tools-reference/kubelet/) API to collect metrics from each node. Depending on the metrics-server version it uses: +* Metrics resource endpoint `/metrics/resource` in version v0.6.0+ or +* Summary API endpoint `/stats/summary` in older versions + + +To learn more about the metrics-server, see the [metrics-server repository](https://github.com/kubernetes-sigs/metrics-server). + +You can also check out the following: + +* [metrics-server design](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/instrumentation/metrics-server.md) +* [metrics-server FAQ](https://github.com/kubernetes-sigs/metrics-server/blob/master/FAQ.md) +* [metrics-server known issues](https://github.com/kubernetes-sigs/metrics-server/blob/master/KNOWN_ISSUES.md) +* [metrics-server releases](https://github.com/kubernetes-sigs/metrics-server/releases) +* [Horizontal Pod Autoscaling](/docs/tasks/run-application/horizontal-pod-autoscale/) + +### Summary API source + +The [kubelet](/docs/reference/command-line-tools-reference/kubelet/) gathers stats at the node, volume, pod and container level, and emits this information in the [Summary API](https://github.com/kubernetes/kubernetes/blob/7d309e0104fedb57280b261e5677d919cb2a0e2d/staging/src/k8s.io/kubelet/pkg/apis/stats/v1alpha1/types.go) for consumers to read. -Pre-1.23, these resources have been primarily gathered from [cAdvisor](https://github.com/google/cadvisor). However, in 1.23 with the -introduction of the `PodAndContainerStatsFromCRI` FeatureGate, container and pod level stats can be gathered by the CRI implementation. -Note: this also requires support from the CRI implementations (containerd >= 1.6.0, CRI-O >= 1.23.0). +Here is an example of a Summary API request for a `minikube` node: + + +```shell +kubectl get --raw "/api/v1/nodes/minikube/proxy/stats/summary" +``` +Here is the same API call using `curl`: +```shell +curl http://localhost:8080/api/v1/nodes/minikube/proxy/stats/summary +``` +{{< note >}} +The summary API `/stats/summary` endpoint will be replaced by the `/metrics/resource` endpoint beginning with metrics-server 0.6.x. +{{< /note >}} \ No newline at end of file diff --git a/content/en/docs/tasks/debug-application-cluster/troubleshooting.md b/content/en/docs/tasks/debug-application-cluster/troubleshooting.md index a5385b25fc..4bfa053bd5 100644 --- a/content/en/docs/tasks/debug-application-cluster/troubleshooting.md +++ b/content/en/docs/tasks/debug-application-cluster/troubleshooting.md @@ -45,8 +45,9 @@ and command-line interfaces (CLIs), such as [`kubectl`](/docs/reference/kubectl/ Someone else from the community may have already asked a similar question or may be able to help with your problem. The Kubernetes team will also monitor [posts tagged Kubernetes](https://stackoverflow.com/questions/tagged/kubernetes). -If there aren't any existing questions that help, please -[ask a new one](https://stackoverflow.com/questions/ask?tags=kubernetes)! +If there aren't any existing questions that help, **please [ensure that your question is on-topic on Stack Overflow](https://stackoverflow.com/help/on-topic) +and that you read through the guidance on [how to ask a new question](https://stackoverflow.com/help/how-to-ask)**, +before [asking a new one](https://stackoverflow.com/questions/ask?tags=kubernetes)! ### Slack @@ -100,7 +101,7 @@ If filing a bug, please include detailed information about how to reproduce the problem, such as: * Kubernetes version: `kubectl version` -* Cloud provider, OS distro, network configuration, and Docker version +* Cloud provider, OS distro, network configuration, and container runtime version * Steps to reproduce the problem diff --git a/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md b/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md index e4c5e39915..6b30143470 100644 --- a/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md +++ b/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md @@ -725,7 +725,7 @@ For example: properties: spec: type: object - x-kubernetes-validation-rules: + x-kubernetes-validations: - rule: "self.minReplicas <= self.replicas" message: "replicas should be greater than or equal to minReplicas." - rule: "self.replicas <= self.maxReplicas" @@ -829,7 +829,7 @@ Xref: [Supported evaluation on CEL](https://github.com/google/cel-spec/blob/v0.6 ... openAPIV3Schema: type: object - x-kubernetes-validation-rules: + x-kubernetes-validations: - rule: "self.status.availableReplicas >= self.spec.minReplicas" properties: spec: @@ -856,7 +856,7 @@ Xref: [Supported evaluation on CEL](https://github.com/google/cel-spec/blob/v0.6 properties: spec: type: object - x-kubernetes-validation-rules: + x-kubernetes-validations: - rule: "has(self.foo)" properties: ... @@ -874,7 +874,7 @@ Xref: [Supported evaluation on CEL](https://github.com/google/cel-spec/blob/v0.6 properties: spec: type: object - x-kubernetes-validation-rules: + x-kubernetes-validations: - rule: "self['xyz'].foo > 0" additionalProperties: ... @@ -894,7 +894,7 @@ Xref: [Supported evaluation on CEL](https://github.com/google/cel-spec/blob/v0.6 ... foo: type: array - x-kubernetes-validation-rules: + x-kubernetes-validations: - rule: "size(self) == 1" items: type: string @@ -912,7 +912,7 @@ Xref: [Supported evaluation on CEL](https://github.com/google/cel-spec/blob/v0.6 ... foo: type: integer - x-kubernetes-validation-rules: + x-kubernetes-validations: - rule: "self > 0" ``` Examples: diff --git a/content/en/docs/tasks/kubelet-credential-provider/kubelet-credential-provider.md b/content/en/docs/tasks/kubelet-credential-provider/kubelet-credential-provider.md index b192579970..70e514b473 100644 --- a/content/en/docs/tasks/kubelet-credential-provider/kubelet-credential-provider.md +++ b/content/en/docs/tasks/kubelet-credential-provider/kubelet-credential-provider.md @@ -152,4 +152,5 @@ Some example values of `matchImages` patterns are: * Read the details about `CredentialProviderConfig` in the [kubelet configuration API (v1alpha1) reference](/docs/reference/config-api/kubelet-config.v1alpha1/). +* Read the [kubelet credential provider API reference (v1alpha1)](/docs/reference/config-api/kubelet-credentialprovider.v1alpha1/). diff --git a/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md b/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md index 02018745d4..04d3e3daaa 100644 --- a/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md +++ b/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md @@ -321,7 +321,7 @@ object: metric: name: requests-per-second describedObject: - apiVersion: networking.k8s.io/v1beta1 + apiVersion: networking.k8s.io/v1 kind: Ingress name: main-route target: @@ -367,7 +367,7 @@ spec: metric: name: requests-per-second describedObject: - apiVersion: networking.k8s.io/v1beta1 + apiVersion: networking.k8s.io/v1 kind: Ingress name: main-route target: @@ -390,7 +390,7 @@ status: metric: name: requests-per-second describedObject: - apiVersion: networking.k8s.io/v1beta1 + apiVersion: networking.k8s.io/v1 kind: Ingress name: main-route current: diff --git a/content/en/docs/tasks/run-application/horizontal-pod-autoscale.md b/content/en/docs/tasks/run-application/horizontal-pod-autoscale.md index 2eb0410a8b..e5c05ea90c 100644 --- a/content/en/docs/tasks/run-application/horizontal-pod-autoscale.md +++ b/content/en/docs/tasks/run-application/horizontal-pod-autoscale.md @@ -56,8 +56,9 @@ Kubernetes implements horizontal pod autoscaling as a control loop that runs int (and the default interval is 15 seconds). Once during each period, the controller manager queries the resource utilization against the -metrics specified in each HorizontalPodAutoscaler definition. The controller manager -obtains the metrics from either the resource metrics API (for per-pod resource metrics), +metrics specified in each HorizontalPodAutoscaler definition. The controller manager +finds the target resource defined by the `scaleTargetRef`, +then selects the pods based on the target resource's `.spec.selector` labels, and obtains the metrics from either the resource metrics API (for per-pod resource metrics), or the custom metrics API (for all other metrics). * For per-pod resource metrics (like CPU), the controller fetches the metrics @@ -87,7 +88,7 @@ or the custom metrics API (for all other metrics). The common use for HorizontalPodAutoscaler is to configure it to fetch metrics from {{< glossary_tooltip text="aggregated APIs" term_id="aggregation-layer" >}} (`metrics.k8s.io`, `custom.metrics.k8s.io`, or `external.metrics.k8s.io`). The `metrics.k8s.io` API is -usually provided by an add on named Metrics Server, which needs to be launched separately. +usually provided by an add-on named Metrics Server, which needs to be launched separately. For more information about resource metrics, see [Metrics Server](/docs/tasks/debug-application-cluster/resource-metrics-pipeline/#metrics-server). @@ -328,7 +329,7 @@ APIs, cluster administrators must ensure that: * The corresponding APIs are registered: * For resource metrics, this is the `metrics.k8s.io` API, generally provided by [metrics-server](https://github.com/kubernetes-sigs/metrics-server). - It can be launched as a cluster addon. + It can be launched as a cluster add-on. * For custom metrics, this is the `custom.metrics.k8s.io` API. It's provided by "adapter" API servers provided by metrics solution vendors. Check with your metrics pipeline to see if there is a Kubernetes metrics adapter available. @@ -513,7 +514,7 @@ Finally, you can delete an autoscaler using `kubectl delete hpa`. In addition, there is a special `kubectl autoscale` command for creating a HorizontalPodAutoscaler object. For instance, executing `kubectl autoscale rs foo --min=2 --max=5 --cpu-percent=80` -will create an autoscaler for replication set *foo*, with target CPU utilization set to `80%` +will create an autoscaler for ReplicaSet *foo*, with target CPU utilization set to `80%` and the number of replicas between 2 and 5. ## Implicit maintenance-mode deactivation @@ -537,7 +538,7 @@ desired and could be troublesome when an HPA is active. Keep in mind that the removal of `spec.replicas` may incur a one-time degradation of Pod counts as the default value of this key is 1 (reference -[Deployment Replicas](/docs/concepts/workloads/controllers/deployment#replicas). +[Deployment Replicas](/docs/concepts/workloads/controllers/deployment#replicas)). Upon the update, all Pods except 1 will begin their termination procedures. Any deployment application afterwards will behave as normal and respect a rolling update configuration as desired. You can avoid this degradation by choosing one of the following two diff --git a/content/en/docs/tasks/tls/managing-tls-in-a-cluster.md b/content/en/docs/tasks/tls/managing-tls-in-a-cluster.md index e715de5fd1..f66db84449 100644 --- a/content/en/docs/tasks/tls/managing-tls-in-a-cluster.md +++ b/content/en/docs/tasks/tls/managing-tls-in-a-cluster.md @@ -18,7 +18,7 @@ draft](https://github.com/ietf-wg-acme/acme/). {{< note >}} Certificates created using the `certificates.k8s.io` API are signed by a -dedicated CA. It is possible to configure your cluster to use the cluster root +[dedicated CA](#a-note-to-cluster-administrators). It is possible to configure your cluster to use the cluster root CA for this purpose, but you should never rely on this. Do not assume that these certificates will validate against the cluster root CA. {{< /note >}} @@ -29,26 +29,40 @@ these certificates will validate against the cluster root CA. ## {{% heading "prerequisites" %}} -{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} +{{< include "task-tutorial-prereqs.md" >}} +You need the `cfssl` tool. You can download `cfssl` from +[https://github.com/cloudflare/cfssl/releases](https://github.com/cloudflare/cfssl/releases). +Some steps in this page use the `jq` tool. If you don't have `jq`, you can +install it via your operating system's software sources, or fetch it from +[https://stedolan.github.io/jq/](https://stedolan.github.io/jq/). -## Trusting TLS in a Cluster +## Trusting TLS in a cluster -Trusting the custom CA from an application running as a pod usually requires +Trusting the [custom CA](#a-note-to-cluster-administrators) from an application running as a pod usually requires some extra application configuration. You will need to add the CA certificate bundle to the list of CA certificates that the TLS client or server trusts. For example, you would do this with a golang TLS config by parsing the certificate chain and adding the parsed certificates to the `RootCAs` field in the [`tls.Config`](https://godoc.org/crypto/tls#Config) struct. -You can distribute the CA certificate as a -[ConfigMap](/docs/tasks/configure-pod-container/configure-pod-configmap) that your -pods have access to use. +{{< note >}} +Even though the custom CA certificate may be included in the filesystem (in the +ConfigMap `kube-root-ca.crt`), +you should not use that certificate authority for any purpose other than to verify internal +Kubernetes endpoints. An example of an internal Kubernetes endpoint is the +Service named `kubernetes` in the default namespace. -## Requesting a Certificate +If you want to use a custom certificate authority for your workloads, you should generate +that CA separately, and distribute its CA certificate using a +[ConfigMap](/docs/tasks/configure-pod-container/configure-pod-configmap) that your pods +have access to read. +{{< /note >}} + +## Requesting a certificate The following section demonstrates how to create a TLS certificate for a Kubernetes service accessed through DNS. @@ -57,12 +71,7 @@ Kubernetes service accessed through DNS. This tutorial uses CFSSL: Cloudflare's PKI and TLS toolkit [click here](https://blog.cloudflare.com/introducing-cfssl/) to know more. {{< /note >}} -## Download and install CFSSL - -The cfssl tools used in this example can be downloaded at -[https://github.com/cloudflare/cfssl/releases](https://github.com/cloudflare/cfssl/releases). - -## Create a Certificate Signing Request +## Create a certificate signing request Generate a private key and certificate signing request (or CSR) by running the following command: @@ -98,14 +107,14 @@ is the pod's DNS name. You should see the output similar to: ``` This command generates two files; it generates `server.csr` containing the PEM -encoded [pkcs#10](https://tools.ietf.org/html/rfc2986) certification request, +encoded [PKCS#10](https://tools.ietf.org/html/rfc2986) certification request, and `server-key.pem` containing the PEM encoded key to the certificate that is still to be created. -## Create a Certificate Signing Request object to send to the Kubernetes API +## Create a CertificateSigningRequest object to send to the Kubernetes API -Generate a CSR yaml blob and send it to the apiserver by running the following -command: +Generate a CSR manifest (in YAML), and send it to the API server. You can do that by +running the following command: ```shell cat < ``` -## Get the Certificate Signing Request Approved +## Get the CertificateSigningRequest approved {#get-the-certificate-signing-request-approved} Approving the [certificate signing request](/docs/reference/access-authn-authz/certificate-signing-requests/) is either done by an automated approval process or on a one off basis by a cluster @@ -186,16 +195,18 @@ my-svc.my-namespace 10m example.com/serving yourname@example.com This means the certificate request has been approved and is waiting for the requested signer to sign it. -## Sign the Certificate Signing Request +## Sign the CertificateSigningRequest {#sign-the-certificate-signing-request} Next, you'll play the part of a certificate signer, issue the certificate, and upload it to the API. -A signer would typically watch the Certificate Signing Request API for objects with its `signerName`, -check that they have been approved, sign certificates for those requests, +A signer would typically watch the CertificateSigningRequest API for objects with its `signerName`, +check that they have been approved, sign certificates for those requests, and update the API object status with the issued certificate. ### Create a Certificate Authority +You need an authority to provide the digital signature on the new certificate. + First, create a signing certificate by running the following: ```shell @@ -210,7 +221,7 @@ cat <}} @@ -245,7 +256,7 @@ You should see the output similar to: This produces a signed serving certificate file, `ca-signed-server.pem`. -### Upload the Signed Certificate +### Upload the signed certificate Finally, populate the signed certificate in the API object's status: @@ -256,24 +267,27 @@ kubectl get csr my-svc.my-namespace -o json | \ ``` {{< note >}} -This uses the command line tool [jq](https://stedolan.github.io/jq/) to populate the base64-encoded content in the `.status.certificate` field. -If you do not have `jq`, you can also save the JSON output to a file, populate this field manually, and upload the resulting file. +This uses the command line tool [`jq`](https://stedolan.github.io/jq/) to populate the base64-encoded +content in the `.status.certificate` field. +If you do not have `jq`, you can also save the JSON output to a file, populate this field manually, and +upload the resulting file. {{< /note >}} -Once the CSR is approved and the signed certificate is uploaded you should see the following: +Once the CSR is approved and the signed certificate is uploaded, run: ```shell kubectl get csr ``` +The output is similar to: ```none NAME AGE SIGNERNAME REQUESTOR REQUESTEDDURATION CONDITION my-svc.my-namespace 20m example.com/serving yourname@example.com Approved,Issued ``` -## Download the Certificate and Use It +## Download the certificate and use it -Now, as the requesting user, you can download the issued certificate +Now, as the requesting user, you can download the issued certificate and save it to a `server.crt` file by running the following: ```shell @@ -281,37 +295,48 @@ kubectl get csr my-svc.my-namespace -o jsonpath='{.status.certificate}' \ | base64 --decode > server.crt ``` -Now you can populate `server.crt` and `server-key.pem` in a secret and mount -it into a pod to use as the keypair to start your HTTPS server: +Now you can populate `server.crt` and `server-key.pem` in a +{{< glossary_tooltip text="Secret" term_id="secret" >}} +that you could later mount into a Pod (for example, to use with a webserver +that serves HTTPS). ```shell -kubectl create secret tls server --cert server.crt --key server-key.pem +kubectl create secret tls server --cert server.crt --key server-key.pem ``` ```none secret/server created ``` -Finally, you can populate `ca.pem` in a configmap and use it as the trust root -to verify the serving certificate: +Finally, you can populate `ca.pem` into a {< glossary_tooltip text="ConfigMap" term_id="configmap" >}} +and use it as the trust root to verify the serving certificate: ```shell -kubectl create configmap example-serving-ca --from-file ca.crt=ca.pem +kubectl create configmap example-serving-ca --from-file ca.crt=ca.pem ``` ```none configmap/example-serving-ca created ``` -## Approving Certificate Signing Requests +## Approving CertificateSigningRequests {#approving-certificate-signing-requests} A Kubernetes administrator (with appropriate permissions) can manually approve -(or deny) Certificate Signing Requests by using the `kubectl certificate +(or deny) CertificateSigningRequests by using the `kubectl certificate approve` and `kubectl certificate deny` commands. However if you intend to make heavy usage of this API, you might consider writing an automated certificates controller. -Whether a machine or a human using kubectl as above, the role of the approver is +{{< caution >}} +The ability to approve CSRs decides who trusts whom within your environment. The +ability to approve CSRs should not be granted broadly or lightly. + +You should make sure that you confidently understand both the verification requirements +that fall on the approver **and** the repercussions of issuing a specific certificate +before you grant the `approve` permission. +{{< /caution >}} + +Whether a machine or a human using kubectl as above, the role of the _approver_ is to verify that the CSR satisfies two requirements: 1. The subject of the CSR controls the private key used to sign the CSR. This @@ -326,20 +351,15 @@ to verify that the CSR satisfies two requirements: If and only if these two requirements are met, the approver should approve the CSR and otherwise should deny the CSR. -## A Word of Warning on the Approval Permission +For more information on certificate approval and access control, read +the [Certificate Signing Requests](/docs/reference/access-authn-authz/certificate-signing-requests/) +reference page. -The ability to approve CSRs decides who trusts whom within your environment. The -ability to approve CSRs should not be granted broadly or lightly. The -requirements of the challenge noted in the previous section and the -repercussions of issuing a specific certificate should be fully understood -before granting this permission. +## Configuring your cluster to provide signing -## A Note to Cluster Administrators - -This tutorial assumes that a signer is setup to serve the certificates API. The +This page assumes that a signer is setup to serve the certificates API. The Kubernetes controller manager provides a default implementation of a signer. To enable it, pass the `--cluster-signing-cert-file` and `--cluster-signing-key-file` parameters to the controller manager with paths to your Certificate Authority's keypair. - diff --git a/content/en/docs/tasks/tools/install-kubectl-linux.md b/content/en/docs/tasks/tools/install-kubectl-linux.md index faf8dbf444..2788e50e19 100644 --- a/content/en/docs/tasks/tools/install-kubectl-linux.md +++ b/content/en/docs/tasks/tools/install-kubectl-linux.md @@ -95,6 +95,11 @@ For example, to download version {{< param "fullversion" >}} on Linux, type: ```bash kubectl version --client ``` + Or use this for detailed view of version: + + ```cmd + kubectl version --client --output=yaml + ``` ### Install using native package management diff --git a/content/en/docs/tasks/tools/install-kubectl-macos.md b/content/en/docs/tasks/tools/install-kubectl-macos.md index 2dc56e5235..fb5ec2a306 100644 --- a/content/en/docs/tasks/tools/install-kubectl-macos.md +++ b/content/en/docs/tasks/tools/install-kubectl-macos.md @@ -111,6 +111,11 @@ The following methods exist for installing kubectl on macOS: ```bash kubectl version --client ``` + Or use this for detailed view of version: + + ```cmd + kubectl version --client --output=yaml + ``` ### Install with Homebrew on macOS diff --git a/content/en/docs/tasks/tools/install-kubectl-windows.md b/content/en/docs/tasks/tools/install-kubectl-windows.md index 707217df2d..f5248ecfe4 100644 --- a/content/en/docs/tasks/tools/install-kubectl-windows.md +++ b/content/en/docs/tasks/tools/install-kubectl-windows.md @@ -66,6 +66,11 @@ The following methods exist for installing kubectl on Windows: ```cmd kubectl version --client ``` + Or use this for detailed view of version: + + ```cmd + kubectl version --client --output=yaml + ``` {{< note >}} [Docker Desktop for Windows](https://docs.docker.com/docker-for-windows/#kubernetes) adds its own version of `kubectl` to `PATH`. diff --git a/content/en/docs/tutorials/stateful-application/zookeeper.md b/content/en/docs/tutorials/stateful-application/zookeeper.md index b235385217..cc2bd853f6 100644 --- a/content/en/docs/tutorials/stateful-application/zookeeper.md +++ b/content/en/docs/tutorials/stateful-application/zookeeper.md @@ -442,7 +442,7 @@ datadir-zk-2 Bound pvc-bee0817e-bcb1-11e6-994f-42010a800002 20Gi R The `volumeMounts` section of the `StatefulSet`'s container `template` mounts the PersistentVolumes in the ZooKeeper servers' data directories. -```shell +```yaml volumeMounts: - name: datadir mountPath: /var/lib/zookeeper @@ -661,6 +661,8 @@ Use the `kubectl rollout history` command to view a history or previous configur kubectl rollout history sts/zk ``` +The output is similar to this: + ``` statefulsets "zk" REVISION @@ -674,6 +676,8 @@ Use the `kubectl rollout undo` command to roll back the modification. kubectl rollout undo sts/zk ``` +The output is similar to this: + ``` statefulset.apps/zk rolled back ``` @@ -742,14 +746,14 @@ that your application's processes are unhealthy and it should restart them. The Pod `template` for the `zk` `StatefulSet` specifies a liveness probe. ```yaml - livenessProbe: - exec: - command: - - sh - - -c - - "zookeeper-ready 2181" - initialDelaySeconds: 15 - timeoutSeconds: 5 + livenessProbe: + exec: + command: + - sh + - -c + - "zookeeper-ready 2181" + initialDelaySeconds: 15 + timeoutSeconds: 5 ``` The probe calls a bash script that uses the ZooKeeper `ruok` four letter @@ -773,7 +777,7 @@ kubectl get pod -w -l app=zk In another window, using the following command to delete the `zookeeper-ready` script from the file system of Pod `zk-0`. ```shell -kubectl exec zk-0 -- rm /usr/bin/zookeeper-ready +kubectl exec zk-0 -- rm /opt/zookeeper/bin/zookeeper-ready ``` When the liveness probe for the ZooKeeper process fails, Kubernetes will @@ -860,16 +864,16 @@ kubernetes-node-2g2d This is because the Pods in the `zk` `StatefulSet` have a `PodAntiAffinity` specified. ```yaml - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: "app" - operator: In - values: - - zk - topologyKey: "kubernetes.io/hostname" +affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: "app" + operator: In + values: + - zk + topologyKey: "kubernetes.io/hostname" ``` The `requiredDuringSchedulingIgnoredDuringExecution` field tells the @@ -926,6 +930,8 @@ In another terminal, use this command to get the nodes that the Pods are current for i in 0 1 2; do kubectl get pod zk-$i --template {{.spec.nodeName}}; echo ""; done ``` +The output is similar to this: + ``` kubernetes-node-pb41 kubernetes-node-ixsl @@ -939,6 +945,8 @@ drain the node on which the `zk-0` Pod is scheduled. kubectl drain $(kubectl get pod zk-0 --template {{.spec.nodeName}}) --ignore-daemonsets --force --delete-emptydir-data ``` +The output is similar to this: + ``` node "kubernetes-node-pb41" cordoned @@ -971,15 +979,19 @@ Keep watching the `StatefulSet`'s Pods in the first terminal and drain the node `zk-1` is scheduled. ```shell -kubectl drain $(kubectl get pod zk-1 --template {{.spec.nodeName}}) --ignore-daemonsets --force --delete-emptydir-data "kubernetes-node-ixsl" cordoned +kubectl drain $(kubectl get pod zk-1 --template {{.spec.nodeName}}) --ignore-daemonsets --force --delete-emptydir-data ``` +The output is similar to this: + ``` +"kubernetes-node-ixsl" cordoned WARNING: Deleting pods not managed by ReplicationController, ReplicaSet, Job, or DaemonSet: fluentd-cloud-logging-kubernetes-node-ixsl, kube-proxy-kubernetes-node-ixsl; Ignoring DaemonSet-managed pods: node-problem-detector-v0.1-voc74 pod "zk-1" deleted node "kubernetes-node-ixsl" drained ``` + The `zk-1` Pod cannot be scheduled because the `zk` `StatefulSet` contains a `PodAntiAffinity` rule preventing co-location of the Pods, and as only two nodes are schedulable, the Pod will remain in a Pending state. @@ -987,6 +999,8 @@ co-location of the Pods, and as only two nodes are schedulable, the Pod will rem kubectl get pods -w -l app=zk ``` +The output is similar to this: + ``` NAME READY STATUS RESTARTS AGE zk-0 1/1 Running 2 1h @@ -1010,13 +1024,15 @@ zk-1 0/1 Pending 0 0s zk-1 0/1 Pending 0 0s ``` -Continue to watch the Pods of the stateful set, and drain the node on which +Continue to watch the Pods of the StatefulSet, and drain the node on which `zk-2` is scheduled. ```shell kubectl drain $(kubectl get pod zk-2 --template {{.spec.nodeName}}) --ignore-daemonsets --force --delete-emptydir-data ``` +The output is similar to this: + ``` node "kubernetes-node-i4c4" cordoned @@ -1060,6 +1076,8 @@ Use [`kubectl uncordon`](/docs/reference/generated/kubectl/kubectl-commands/#unc kubectl uncordon kubernetes-node-pb41 ``` +The output is similar to this: + ``` node "kubernetes-node-pb41" uncordoned ``` @@ -1070,6 +1088,8 @@ node "kubernetes-node-pb41" uncordoned kubectl get pods -w -l app=zk ``` +The output is similar to this: + ``` NAME READY STATUS RESTARTS AGE zk-0 1/1 Running 2 1h @@ -1103,7 +1123,7 @@ Attempt to drain the node on which `zk-2` is scheduled. kubectl drain $(kubectl get pod zk-2 --template {{.spec.nodeName}}) --ignore-daemonsets --force --delete-emptydir-data ``` -The output: +The output is similar to this: ``` node "kubernetes-node-i4c4" already cordoned @@ -1121,6 +1141,8 @@ Uncordon the second node to allow `zk-2` to be rescheduled. kubectl uncordon kubernetes-node-ixsl ``` +The output is similar to this: + ``` node "kubernetes-node-ixsl" uncordoned ``` diff --git a/content/en/examples/priority-and-fairness/health-for-strangers.yaml b/content/en/examples/priority-and-fairness/health-for-strangers.yaml index ec74077bbd..c57e2cae37 100644 --- a/content/en/examples/priority-and-fairness/health-for-strangers.yaml +++ b/content/en/examples/priority-and-fairness/health-for-strangers.yaml @@ -1,4 +1,4 @@ -apiVersion: flowcontrol.apiserver.k8s.io/v1beta1 +apiVersion: flowcontrol.apiserver.k8s.io/v1beta2 kind: FlowSchema metadata: name: health-for-strangers diff --git a/content/es/docs/concepts/configuration/manage-resources-containers.md b/content/es/docs/concepts/configuration/manage-resources-containers.md index a74f463b7c..919f1c515b 100644 --- a/content/es/docs/concepts/configuration/manage-resources-containers.md +++ b/content/es/docs/concepts/configuration/manage-resources-containers.md @@ -110,11 +110,11 @@ CPU es siempre solicitada como una cantidad absoluta, nunca como una cantidad re Los límites y peticiones de `memoria` son medidos en bytes. Puedes expresar la memoria como un número entero o como un número decimal usando alguno de estos sufijos: -E, P, T, G, M, K. También puedes usar los equivalentes en potencia de dos: Ei, Pi, Ti, Gi, +E, P, T, G, M, k, m (millis). También puedes usar los equivalentes en potencia de dos: Ei, Pi, Ti, Gi, Mi, Ki. Por ejemplo, los siguientes valores representan lo mismo: ```shell -128974848, 129e6, 129M, 123Mi +128974848, 129e6, 129M, 128974848000m, 123Mi ``` Aquí un ejemplo. diff --git a/content/es/docs/concepts/overview/what-is-kubernetes.md b/content/es/docs/concepts/overview/what-is-kubernetes.md index 4b2d829b1b..510f32202d 100644 --- a/content/es/docs/concepts/overview/what-is-kubernetes.md +++ b/content/es/docs/concepts/overview/what-is-kubernetes.md @@ -54,7 +54,7 @@ facilitar sus flujos de trabajo y hacer más fácil a las herramientas administr Además, el [Plano de Control](/docs/concepts/overview/components/) de Kubernetes usa las mismas [APIs](/docs/reference/using-api/api-overview/) que usan los desarrolladores y usuarios finales. -Los usuarios pueden escribir sus propios controladores, como por ejemplo un planificador o [scheduler](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/devel/scheduler.md), +Los usuarios pueden escribir sus propios controladores, como por ejemplo un planificador o [scheduler](https://github.com/kubernetes/community/blob/master/contributors/devel/scheduler.md), usando [sus propias APIs](/docs/concepts/api-extension/custom-resources/) desde una [herramienta de línea de comandos](/docs/user-guide/kubectl-overview/). diff --git a/content/es/docs/concepts/storage/volumes.md b/content/es/docs/concepts/storage/volumes.md index fa2f781a69..c8e7a9d24b 100644 --- a/content/es/docs/concepts/storage/volumes.md +++ b/content/es/docs/concepts/storage/volumes.md @@ -105,7 +105,7 @@ Para desactivar el complemento de almacenamiento `awsElasticBlockStore` de ser c El tipo de volumen `azureDisk` monta un [Data Disk](https://docs.microsoft.com/en-us/azure/aks/csi-storage-drivers) de Microsoft Azure en el Pod. -Para más detalles, mira el [`azureDisk` volume plugin](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/azure_disk/README.md). +Para más detalles, mira el [`azureDisk` volume plugin](https://github.com/kubernetes/examples/tree/master/staging/volumes/azure_disk/README.md). #### Migración CSI azureDisk @@ -119,7 +119,7 @@ de complemento desde el complemento existente dentro del árbol existente al con El tipo de volumen `azureFile` monta un volumen de ficheros de Microsoft Azure (SMB 2.1 and 3.0) en un Pod. -Para más detalles, mira el [`azureFile` volume plugin](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/azure_file/README.md). +Para más detalles, mira el [`azureFile` volume plugin](https://github.com/kubernetes/examples/tree/master/staging/volumes/azure_file/README.md). #### Migración CSI azureFile CSI @@ -141,7 +141,7 @@ A diferencia de `emptydir`, que es borrado cuando se remueve el Pod, el contenid Debes tener tu propio servidor Ceph corriendo con el recurso compartido exportado antes de usarlo. {{< /note >}} -Mira el [CephFS example](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/volumes/cephfs/) para más detalles. +Mira el [CephFS example](https://github.com/kubernetes/examples/tree/master/volumes/cephfs/) para más detalles. ### cinder @@ -292,7 +292,7 @@ Debes configurar FC SAN zoning para asignar y enmascarar esos (volúmenes) LUNs para que los hosts Kubernetes pueda acceder a ellos. {{< /note >}} -Revisa el [ejemplo de canal de fibra](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/fibre_channel) para más detalles. +Revisa el [ejemplo de canal de fibra](https://github.com/kubernetes/examples/tree/master/staging/volumes/fibre_channel) para más detalles. ### flocker (deprecado) {#flocker} @@ -306,7 +306,7 @@ de nuevo por Flocker al nodo donde el Pod está programado. Esto significa que l Debes tener una instalación propia de Flocker ejecutándose antes de poder usarla. {{< /note >}} -Mira el [ejemplo de Flocker ](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/flocker) para más detalles. +Mira el [ejemplo de Flocker ](https://github.com/kubernetes/examples/tree/master/staging/volumes/flocker) para más detalles. ### gcePersistentDisk @@ -453,7 +453,7 @@ y que los datos pueden ser compartidos entre pods. GlusterFS puede ser montado p Debes tener tu propia instalación de GlusterFS ejecutándose antes de poder usarla. {{< /note >}} -Mira el [ejemplo de GlusterFS](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/volumes/glusterfs) para más detalles. +Mira el [ejemplo de GlusterFS](https://github.com/kubernetes/examples/tree/master/volumes/glusterfs) para más detalles. ### hostPath {#hostpath} @@ -560,7 +560,7 @@ Esto significa que puedes pre-poblar un volumen con tu conjunto de datos y servi Desafortunadamente, los volúmenes ISCSI solo se pueden montar por un único consumidor en modo lectura-escritura. Escritores simultáneos no está permitido. -Mira el [ejemplo iSCSI](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/volumes/iscsi) para más detalles. +Mira el [ejemplo iSCSI](https://github.com/kubernetes/examples/tree/master/volumes/iscsi) para más detalles. ### local @@ -634,7 +634,7 @@ NFS puede ser montado por múltiples escritores simultáneamente. Debes tener tu propio servidor NFS en ejecución con el recurso compartido exportado antes de poder usarlo. {{< /note >}} -Mira el [ ejemplo NFS ](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/nfs) para más información. +Mira el [ ejemplo NFS ](https://github.com/kubernetes/examples/tree/master/staging/volumes/nfs) para más información. ### persistentVolumeClaim {#persistentvolumeclaim} @@ -674,7 +674,7 @@ spec: Asegúrate de tener un PortworxVolume con el nombre `pxvol` antes de usarlo en el Pod. {{< /note >}} -Para más detalles, mira los ejemplos de [volumen Portworx](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/portworx/README.md). +Para más detalles, mira los ejemplos de [volumen Portworx](https://github.com/kubernetes/examples/tree/master/staging/volumes/portworx/README.md). ### projected @@ -687,7 +687,7 @@ Actualmente, se pueden los siguientes tipos de volúmenes: - [`configMap`](#configmap) - `serviceAccountToken` -Se requiere que todas las fuentes estén en el mismo namespace que el Pod. Para más detalles mira el [all-in-one volume design document](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/design-proposals/node/all-in-one-volume.md). +Se requiere que todas las fuentes estén en el mismo namespace que el Pod. Para más detalles mira el [all-in-one volume design document](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node/all-in-one-volume.md). #### Configuración de ejemplo con un secret, un downwardAPI, y un configMap {#example-configuration-secret-downwardapi-configmap} @@ -828,7 +828,7 @@ Debes tener una instalación de Ceph ejecutándose antes de usar RBD. Una función de RBD es que solo se puede montar como de solo lectura por múltiples consumidores simultáneamente. Esto significa que puedes pre-poblar un volumen con tu conjunto de datos y luego servirlo en paralelo desde tantos pods como necesites. Desafortunadamente, los volúmenes RBD solo se pueden montar por un único consumidor en modo lectura-escritura. No se permiten escritores simultáneos. -Mira el [ejemplo RBD](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/volumes/rbd) para más detalles. +Mira el [ejemplo RBD](https://github.com/kubernetes/examples/tree/master/volumes/rbd) para más detalles. ### scaleIO (deprecado) {#scaleio} @@ -865,7 +865,7 @@ spec: fsType: xfs ``` -Para más detalles, mira los ejemplos de [ScaleIO](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/scaleio) +Para más detalles, mira los ejemplos de [ScaleIO](https://github.com/kubernetes/examples/tree/master/staging/volumes/scaleio) ### secret diff --git a/content/es/docs/concepts/workloads/controllers/jobs-run-to-completion.md b/content/es/docs/concepts/workloads/controllers/jobs-run-to-completion.md index f3bd77b4bf..49d9741b07 100644 --- a/content/es/docs/concepts/workloads/controllers/jobs-run-to-completion.md +++ b/content/es/docs/concepts/workloads/controllers/jobs-run-to-completion.md @@ -443,7 +443,7 @@ de controlador personalizado para esos Pods. Esto da la máxima flexibilidad, pe cueste un poco más de entender y ofrece menos integración con Kubernetes. Un ejemplo de este patrón sería un Job que arranca un Pod que ejecuta una secuencia de comandos que, a su vez, -arranca un controlador maestro de Spark (ver el [ejemplo de spark](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/spark/README.md)), +arranca un controlador maestro de Spark (ver el [ejemplo de spark](https://github.com/kubernetes/examples/tree/master/staging/spark/README.md)), ejecuta un manejador de spark, y a continuación lo limpia todo. Una ventaja de este enfoque es que el proceso general obtiene la garantía del objeto Job, diff --git a/content/es/docs/concepts/workloads/controllers/statefulset.md b/content/es/docs/concepts/workloads/controllers/statefulset.md index 1211160545..4ff09f2148 100644 --- a/content/es/docs/concepts/workloads/controllers/statefulset.md +++ b/content/es/docs/concepts/workloads/controllers/statefulset.md @@ -36,7 +36,7 @@ proporcione un conjunto de réplicas sin estado, como un ## Limitaciones -* El almacenamiento de un determinado Pod debe provisionarse por un [Provisionador de PersistentVolume](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/persistent-volume-provisioning/README.md) basado en la `storage class` requerida, o pre-provisionarse por un administrador. +* El almacenamiento de un determinado Pod debe provisionarse por un [Provisionador de PersistentVolume](https://github.com/kubernetes/examples/tree/master/staging/persistent-volume-provisioning/README.md) basado en la `storage class` requerida, o pre-provisionarse por un administrador. * Eliminar y/o reducir un StatefulSet *no* eliminará los volúmenes asociados con el StatefulSet. Este comportamiento es intencional y sirve para garantizar la seguridad de los datos, que da más valor que la purga automática de los recursos relacionados del StatefulSet. * Los StatefulSets actualmente necesitan un [Servicio Headless](/docs/concepts/services-networking/service/#headless-services) como responsable de la identidad de red de los Pods. Es tu responsabilidad crear este Service. * Los StatefulSets no proporcionan ninguna garantía de la terminación de los pods cuando se elimina un StatefulSet. Para conseguir un término de los pods ordenado y controlado en el StatefulSet, es posible reducir el StatefulSet a 0 réplicas justo antes de eliminarlo. diff --git a/content/es/docs/tasks/debug-application-cluster/audit.md b/content/es/docs/tasks/debug-application-cluster/audit.md index fc2dec9e27..575a066114 100644 --- a/content/es/docs/tasks/debug-application-cluster/audit.md +++ b/content/es/docs/tasks/debug-application-cluster/audit.md @@ -421,8 +421,8 @@ al plugin de elasticsearch que soporta búsquedas avanzadas y analíticas. [kube-apiserver]: /docs/admin/kube-apiserver [auditing-proposal]: https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/auditing.md -[auditing-api]: https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/staging/src/k8s.io/apiserver/pkg/apis/audit/v1/types.go -[gce-audit-profile]: https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/cluster/gce/gci/configure-helper.sh#L735 +[auditing-api]: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apiserver/pkg/apis/audit/v1/types.go +[gce-audit-profile]: https://github.com/kubernetes/kubernetes/blob/master/cluster/gce/gci/configure-helper.sh#L735 [kubeconfig]: /docs/tasks/access-application-cluster/configure-access-multiple-clusters/ [fluentd]: http://www.fluentd.org/ [fluentd_install_doc]: https://docs.fluentd.org/v1.0/articles/quickstart#step-1:-installing-fluentd diff --git a/content/es/docs/tasks/tools/included/_index.md b/content/es/docs/tasks/tools/included/_index.md new file mode 100644 index 0000000000..dda878fac7 --- /dev/null +++ b/content/es/docs/tasks/tools/included/_index.md @@ -0,0 +1,6 @@ +--- +title: "Herramientas incluidas" +description: "Fragmentos que se incluirán en las páginas principales de kubectl-installs-*." +headless: true +toc_hide: true +--- \ No newline at end of file diff --git a/content/es/docs/tasks/tools/included/install-kubectl-linux.md b/content/es/docs/tasks/tools/included/install-kubectl-linux.md new file mode 100644 index 0000000000..67c802bfb2 --- /dev/null +++ b/content/es/docs/tasks/tools/included/install-kubectl-linux.md @@ -0,0 +1,244 @@ +--- +reviewers: +title: Instalar y configurar kubectl en Linux +content_type: task +weight: 10 +card: + name: tasks + weight: 20 + title: Instalar kubectl en Linux +--- + +## {{% heading "prerequisites" %}} + +Debes usar una versión de kubectl que esté dentro de una diferencia de versión menor de tu clúster. Por ejemplo, un cliente v{{< skew latestVersion >}} puede comunicarse con v{{< skew prevMinorVersion >}}, v{{< skew latestVersion >}}, y v{{< skew nextMinorVersion >}} del plano de control. +El uso de la última versión de kubectl ayuda a evitar problemas inesperados. + +## Instalar kubectl en Linux + +Existen los siguientes métodos para instalar kubectl en Linux: + +- [Instalar el binario kubectl con curl en Linux](#install-kubectl-binary-with-curl-on-linux) +- [Instalar usando la administración nativa de paquetes](#install-using-native-package-management) +- [Instalar usando otra administración de paquetes](#install-using-other-package-management) + +### Instale el binario kubectl con curl en Linux + +1. Descargue la última versión con el comando: + + ```bash + curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" + ``` + + {{< note >}} +Para descargar una versión específica, reemplace la parte de `$(curl -L -s https://dl.k8s.io/release/stable.txt)` del comando con la versión específica. + +Por ejemplo, para descargar la versión {{< param "fullversion" >}} en Linux, escriba: + + ```bash + curl -LO https://dl.k8s.io/release/{{< param "fullversion" >}}/bin/linux/amd64/kubectl + ``` + {{< /note >}} + +1. Validar el binario (opcional) + + Descargue el archivo de comprobación de kubectl: + + ```bash + curl -LO "https://dl.k8s.io/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl.sha256" + ``` + + Valide el binario kubectl con el archivo de comprobación: + + ```bash + echo "$(}} + Descargue la misma versión del binario y el archivo de comprobación. + {{< /note >}} + +1. Instalar kubectl + + ```bash + sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl + ``` + + {{< note >}} + Si no tiene acceso de root en el sistema de destino, aún puede instalar kubectl en el `~/.local/bin` directorio: + + ```bash + chmod +x kubectl + mkdir -p ~/.local/bin/kubectl + mv ./kubectl ~/.local/bin/kubectl + # y luego agregue ~/.local/bin/kubectl en el $PATH + ``` + + {{< /note >}} + +1. Para asegurarse de que la versión que instaló este actualizada ejecute: + + ```bash + kubectl version --client + ``` + +### Instalar usando la administración nativa de paquetes + +{{< tabs name="kubectl_install" >}} +{{% tab name="Debian-based distributions" %}} + +1. Actualice el índice de paquetes de `apt` e instale los paquetes necesarios para usar Kubernetes con el repositorio `apt`: + + ```shell + sudo apt-get update + sudo apt-get install -y apt-transport-https ca-certificates curl + ``` + +2. Descargue la clave de firma pública de Google Cloud: + + ```shell + sudo curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg + ``` + +3. Agregue el repositorio de Kubernetes a `apt`: + + ```shell + echo "deb [signed-by=/usr/share/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list + ``` + +4. Actualice el índice de paquetes de `apt` con el nuevo repositorio e instale kubectl: + + ```shell + sudo apt-get update + sudo apt-get install -y kubectl + ``` + +{{% /tab %}} + +{{< tab name="Red Hat-based distributions" codelang="bash" >}} +cat < /etc/yum.repos.d/kubernetes.repo +[kubernetes] +name=Kubernetes +baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64 +enabled=1 +gpgcheck=1 +repo_gpgcheck=1 +gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg +EOF +yum install -y kubectl +{{< /tab >}} +{{< /tabs >}} + +### Instalar usando otra administración de paquetes + +{{< tabs name="other_kubectl_install" >}} +{{% tab name="Snap" %}} +Si está en Ubuntu u otra distribución de Linux que admita el administrador de paquetes [snap](https://snapcraft.io/docs/core/install), kubectl estará disponible como solicitud de [snap](https://snapcraft.io/). + +```shell +snap install kubectl --classic +kubectl version --client +``` + +{{% /tab %}} + +{{% tab name="Homebrew" %}} +Si está en Linux y usa [Homebrew](https://docs.brew.sh/Homebrew-on-Linux) como administrador de paquetes, kubectl está disponible para [instalación](https://docs.brew.sh/Homebrew-on-Linux#install). + +```shell +brew install kubectl +kubectl version --client +``` + +{{% /tab %}} + +{{< /tabs >}} + +## Verificar la configuración de kubectl + +{{< include "verify-kubectl.md" >}} + +## Plugins y configuraciones opcionales de kubectl + +### Habilitar el autocompletado de shell + +kubectl proporciona soporte de autocompletado para Bash y Zsh, lo que puede ahorrarle mucho tiempo al interactuar con la herramienta. + +A continuación, se muestran los procedimientos para configurar el autocompletado para Bash y Zsh. + +{{< tabs name="kubectl_autocompletion" >}} +{{< tab name="Bash" include="optional-kubectl-configs-bash-linux.md" />}} +{{< tab name="Zsh" include="optional-kubectl-configs-zsh.md" />}} +{{< /tabs >}} + +### Instalar en pc `kubectl convert` plugin + +{{< include "kubectl-convert-overview.md" >}} + +1. Descargue la última versión con el comando: + + ```bash + curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl-convert" + ``` + +1. Valide el binario (opcional) + + Descargue el archivo de comprobación kubectl-convert: + + ```bash + curl -LO "https://dl.k8s.io/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl-convert.sha256" + ``` + + Valide el binario kubectl-convert con el archivo de comprobación: + + ```bash + echo "$(}} + Descargue la misma versión del binario y el archivo de comprobación. + {{< /note >}} + +1. Instale kubectl-convert en pc + + ```bash + sudo install -o root -g root -m 0755 kubectl-convert /usr/local/bin/kubectl-convert + ``` + +1. Verifique que el plugin se haya instalado correctamente + + ```shell + kubectl convert --help + ``` + + Si no ve un error, significa que el plugin se instaló correctamente. + +## {{% heading "whatsnext" %}} + +{{< include "kubectl-whats-next.md" >}} \ No newline at end of file diff --git a/content/es/docs/tasks/tools/included/install-kubectl-macos.md b/content/es/docs/tasks/tools/included/install-kubectl-macos.md new file mode 100644 index 0000000000..71642b7ff1 --- /dev/null +++ b/content/es/docs/tasks/tools/included/install-kubectl-macos.md @@ -0,0 +1,248 @@ +--- +reviewers: +title: Instalar y configurar kubectl en macOS +content_type: task +weight: 10 +card: + name: tasks + weight: 20 + title: Instalar kubectl en macOS +--- + +## {{% heading "prerequisites" %}} + +Debes usar una versión de kubectl que esté dentro de una diferencia de versión menor de tu clúster. Por ejemplo, un cliente v{{< skew latestVersion >}} puede comunicarse con v{{< skew prevMinorVersion >}}, v{{< skew latestVersion >}}, y v{{< skew nextMinorVersion >}} del plano de control. +El uso de la última versión de kubectl ayuda a evitar problemas imprevistos. + +## Instalar kubectl en macOS + +Existen los siguientes métodos para instalar kubectl en macOS: + +- [Instalar el binario de kubectl con curl en macOS](#install-kubectl-binary-with-curl-on-macos) +- [Instalar con Homebrew en macOS](#install-with-homebrew-on-macos) +- [Instalar con Macports en macOS](#install-with-macports-on-macos) + +### Instalar el binario de kubectl con curl en macOS + +1. Descargue la última versión: + + {{< tabs name="download_binary_macos" >}} + {{< tab name="Intel" codelang="bash" >}} + curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/amd64/kubectl" + {{< /tab >}} + {{< tab name="Apple Silicon" codelang="bash" >}} + curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/arm64/kubectl" + {{< /tab >}} + {{< /tabs >}} + + {{< note >}} + Para descargar una versión específica, reemplace el `$(curl -L -s https://dl.k8s.io/release/stable.txt)` parte del comando con la versión específica. + + Por ejemplo, para descargar la versión {{< param "fullversion" >}} en Intel macOS, escriba: + + ```bash + curl -LO "https://dl.k8s.io/release/{{< param "fullversion" >}}/bin/darwin/amd64/kubectl" + ``` + + Y para macOS en Apple Silicon, escriba: + + ```bash + curl -LO "https://dl.k8s.io/release/{{< param "fullversion" >}}/bin/darwin/arm64/kubectl" + ``` + + {{< /note >}} + +1. Validar el binario (opcional) + + Descargue el archivo de comprobación de kubectl: + + {{< tabs name="download_checksum_macos" >}} + {{< tab name="Intel" codelang="bash" >}} + curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/amd64/kubectl.sha256" + {{< /tab >}} + {{< tab name="Apple Silicon" codelang="bash" >}} + curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/arm64/kubectl.sha256" + {{< /tab >}} + {{< /tabs >}} + + Valide el binario kubectl con el archivo de comprobación: + + ```bash + echo "$(}} + Descargue la misma versión del binario y el archivo de comprobación. + {{< /note >}} + +1. Hacer ejecutable el binario de kubectl. + + ```bash + chmod +x ./kubectl + ``` + +1. Mueva el binario kubectl a una ubicación de archivo en su sistema `PATH`. + + ```bash + sudo mv ./kubectl /usr/local/bin/kubectl + sudo chown root: /usr/local/bin/kubectl + ``` + + {{< note >}} + Asegúrese de que `/usr/local/bin` se encuentre definida en su variable de entorno PATH. + {{< /note >}} + +1. Para asegurarse de que la versión que instaló se encuentra actualizada, ejecute: + + ```bash + kubectl version --client + ``` + +### Instalar con Homebrew en macOS + +Si está en macOS y usa [Homebrew](https://brew.sh/) como administrador de paquetes, puede instalar kubectl con Homebrew. + +1. Ejecute el comando de instalación: + + ```bash + brew install kubectl + ``` + + or + + ```bash + brew install kubernetes-cli + ``` + +1. Para asegurarse de que la versión que instaló se encuentra actualizada, ejecute: + + ```bash + kubectl version --client + ``` + +### Instalar con Macports en macOS + +Si está en macOS y usa [Macports](https://macports.org/) como administrador de paquetes, puede instalar kubectl con Macports. + +1. Ejecute el comando de instalación: + + ```bash + sudo port selfupdate + sudo port install kubectl + ``` + +1. Para asegurarse de que la versión que instaló se encuentra actualizada, ejecute: + + ```bash + kubectl version --client + ``` + +## Verificar la configuración de kubectl + +{{< include "verify-kubectl.md" >}} + +## Plugins y configuraciones opcionales de kubectl + +### Habilitar el autocompletado de shell + +kubectl proporciona soporte de autocompletado para Bash y Zsh, lo que puede ahorrarle mucho tiempo al escribir. + +A continuación, se muestran los procedimientos para configurar el autocompletado para Bash y Zsh. + +{{< tabs name="kubectl_autocompletion" >}} +{{< tab name="Bash" include="optional-kubectl-configs-bash-mac.md" />}} +{{< tab name="Zsh" include="optional-kubectl-configs-zsh.md" />}} +{{< /tabs >}} + +### Instalar el plugin `kubectl-convert` + +{{< include "kubectl-convert-overview.md" >}} + +1. Descargue la última versión con el comando: + + {{< tabs name="download_convert_binary_macos" >}} + {{< tab name="Intel" codelang="bash" >}} + curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/amd64/kubectl-convert" + {{< /tab >}} + {{< tab name="Apple Silicon" codelang="bash" >}} + curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/arm64/kubectl-convert" + {{< /tab >}} + {{< /tabs >}} + +1. Validar el binario (opcional) + + Descargue el archivo de comprobación de kubectl: + + {{< tabs name="download_convert_checksum_macos" >}} + {{< tab name="Intel" codelang="bash" >}} + curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/amd64/kubectl-convert.sha256" + {{< /tab >}} + {{< tab name="Apple Silicon" codelang="bash" >}} + curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/arm64/kubectl-convert.sha256" + {{< /tab >}} + {{< /tabs >}} + + Valide el binario kubectl-convert con el archivo de comprobación: + + ```bash + echo "$(}} + Descargue la misma versión del binario y el archivo de comprobación. + {{< /note >}} + +1. Hacer ejecutable el binario de kubectl-convert + + ```bash + chmod +x ./kubectl-convert + ``` + +1. Mueva el binario kubectl-convert a una ubicación de archivo en su sistema `PATH`. + + ```bash + sudo mv ./kubectl-convert /usr/local/bin/kubectl-convert + sudo chown root: /usr/local/bin/kubectl-convert + ``` + + {{< note >}} + Asegúrese de que `/usr/local/bin` se encuentre definida en su variable de entorno PATH. + {{< /note >}} + +1. Verifique que el complemento se haya instalado correctamente + + ```shell + kubectl convert --help + ``` + + Si no ve algun error, significa que el complemento se instaló correctamente. + +## {{% heading "whatsnext" %}} + +{{< include "kubectl-whats-next.md" >}} \ No newline at end of file diff --git a/content/es/docs/tasks/tools/included/install-kubectl-windows.md b/content/es/docs/tasks/tools/included/install-kubectl-windows.md new file mode 100644 index 0000000000..427d0bcc75 --- /dev/null +++ b/content/es/docs/tasks/tools/included/install-kubectl-windows.md @@ -0,0 +1,190 @@ +--- +reviewers: +title: Instalar y configurar kubectl en Windows +content_type: task +weight: 10 +card: + name: tasks + weight: 20 + title: Instalar kubectl en Windows +--- + +## {{% heading "prerequisites" %}} + +Debes usar una versión de kubectl que este dentro de una diferencia de versión menor de tu clúster. Por ejemplo, un cliente v{{< skew latestVersion >}} puede comunicarse con versiones v{{< skew prevMinorVersion >}}, v{{< skew latestVersion >}}, y v{{< skew nextMinorVersion >}} del plano de control. + +El uso de la última versión de kubectl ayuda a evitar problemas imprevistos. + +## Instalar kubectl en Windows + +Existen los siguientes métodos para instalar kubectl en Windows: + +- [Instalar el binario de kubectl con curl en Windows](#install-kubectl-binary-with-curl-on-windows) +- [Instalar en Windows usando Chocolatey o Scoop](#install-on-windows-using-chocolatey-or-scoop) + + +### Instalar el binario de kubectl con curl en Windows + +1. Descarga la [última versión {{< param "fullversion" >}}](https://dl.k8s.io/release/{{< param "fullversion" >}}/bin/windows/amd64/kubectl.exe). + + O si tiene `curl` instalado, use este comando: + + ```powershell + curl -LO https://dl.k8s.io/release/{{< param "fullversion" >}}/bin/windows/amd64/kubectl.exe + ``` + + {{< note >}} + Para conocer la última versión estable (por ejemplo, para secuencias de comandos), eche un vistazo a [https://dl.k8s.io/release/stable.txt](https://dl.k8s.io/release/stable.txt). + {{< /note >}} + +1. Validar el binario (opcional) + + Descargue el archivo de comprobación de kubectl: + + ```powershell + curl -LO https://dl.k8s.io/{{< param "fullversion" >}}/bin/windows/amd64/kubectl.exe.sha256 + ``` + + Valide el binario kubectl con el archivo de comprobación: + + - Usando la consola del sistema para comparar manualmente la salida de `CertUtil` con el archivo de comprobación descargado: + + ```cmd + CertUtil -hashfile kubectl.exe SHA256 + type kubectl.exe.sha256 + ``` + + - Usando PowerShell puede automatizar la verificación usando el operador `-eq` para obtener un resultado de `True` o `False`: + + ```powershell + $($(CertUtil -hashfile .\kubectl.exe SHA256)[1] -replace " ", "") -eq $(type .\kubectl.exe.sha256) + ``` + +1. Agregue el binario a su `PATH`. + +1. Para asegurar que la versión de`kubectl` es la misma que descargada, ejecute: + + ```cmd + kubectl version --client + ``` + +{{< note >}} +[Docker Desktop para Windows](https://docs.docker.com/docker-for-windows/#kubernetes) agrega su propia versión de `kubectl` a el `PATH`. +Si ha instalado Docker Desktop antes, es posible que deba colocar su entrada en el `PATH` antes de la agregada por el instalador de Docker Desktop o elimine el `kubectl`. +{{< /note >}} + +### Instalar en Windows usando Chocolatey o Scoop + +1. Para instalar kubectl en Windows, puede usar [Chocolatey](https://chocolatey.org) +como administrador de paquetes o el instalador [Scoop](https://scoop.sh) desde línea de comandos. + + {{< tabs name="kubectl_win_install" >}} + {{% tab name="choco" %}} + ```powershell + choco install kubernetes-cli + ``` + {{% /tab %}} + {{% tab name="scoop" %}} + ```powershell + scoop install kubectl + ``` + {{% /tab %}} + {{< /tabs >}} + + +1. Para asegurarse de que la versión que instaló esté actualizada, ejecute: + + ```powershell + kubectl version --client + ``` + +1. Navegue a su directorio de inicio: + + ```powershell + # Si estas usando cmd.exe, correr: cd %USERPROFILE% + cd ~ + ``` + +1. Cree el directorio `.kube`: + + ```powershell + mkdir .kube + ``` + +1. Cambie al directorio `.kube` que acaba de crear: + + ```powershell + cd .kube + ``` + +1. Configure kubectl para usar un clúster de Kubernetes remoto: + + ```powershell + New-Item config -type file + ``` + +{{< note >}} +Edite el archivo de configuración con un editor de texto de su elección, como el Bloc de notas. +{{< /note >}} + +## Verificar la configuración de kubectl + +{{< include "verify-kubectl.md" >}} + +## Plugins y configuraciones opcionales de kubectl + +### Habilitar el autocompletado de shell + +kubectl proporciona soporte de autocompletado para Bash y Zsh, lo que puede ahorrarle mucho tiempo al escribir. + +A continuación se muestran los procedimientos para configurar el autocompletado para Zsh, si lo está ejecutando en Windows. + +{{< include "optional-kubectl-configs-zsh.md" >}} + +### Instalar el plugin `kubectl-convert` + +{{< include "kubectl-convert-overview.md" >}} + +1. Descargue la última versión con el comando: + + ```powershell + curl -LO https://dl.k8s.io/release/{{< param "fullversion" >}}/bin/windows/amd64/kubectl-convert.exe + ``` + +1. Validar el binario (opcional) + + Descargue el archivo de comprobación kubectl-convert: + + ```powershell + curl -LO https://dl.k8s.io/{{< param "fullversion" >}}/bin/windows/amd64/kubectl-convert.exe.sha256 + ``` + + Valide el binario kubectl-convert con el archivo de comprobación: + + - Usando la consola del sistema puede comparar manualmente la salida de `CertUtil` con el archivo de comprobación descargado: + + ```cmd + CertUtil -hashfile kubectl-convert.exe SHA256 + type kubectl-convert.exe.sha256 + ``` + + - Usando PowerShell puede automatizar la verificación usando el operador `-eq` + para obtener un resultado de `True` o `False`: + + ```powershell + $($(CertUtil -hashfile .\kubectl-convert.exe SHA256)[1] -replace " ", "") -eq $(type .\kubectl-convert.exe.sha256) + ``` + +1. Agregue el binario a su `PATH`. + +1. Verifique que el plugin se haya instalado correctamente + + ```shell + kubectl convert --help + ``` + + Si no ve un error, significa que el plugin se instaló correctamente. + +## {{% heading "whatsnext" %}} + +{{< include "kubectl-whats-next.md" >}} \ No newline at end of file diff --git a/content/es/docs/tasks/tools/included/kubectl-convert-overview.md b/content/es/docs/tasks/tools/included/kubectl-convert-overview.md new file mode 100644 index 0000000000..8a9da57c43 --- /dev/null +++ b/content/es/docs/tasks/tools/included/kubectl-convert-overview.md @@ -0,0 +1,9 @@ +--- +title: "Descripción general de kubectl-convert" +description: >- + Un plugin de kubectl que le permite convertir manifiestos de una versión +headless: true +--- + +Un plugin para la herramienta de línea de comandos de Kubernetes `kubectl`, que le permite convertir manifiestos entre diferentes versiones de la API. Esto puede ser particularmente útil para migrar manifiestos a una versión no obsoleta de la API con la versión más reciente de Kubernetes. +Para obtener más información, visite [migrar a APIs no obsoletas](/docs/reference/using-api/deprecation-guide/#migrate-to-non-deprecated-apis) \ No newline at end of file diff --git a/content/es/docs/tasks/tools/included/kubectl-whats-next.md b/content/es/docs/tasks/tools/included/kubectl-whats-next.md new file mode 100644 index 0000000000..87b3246f6e --- /dev/null +++ b/content/es/docs/tasks/tools/included/kubectl-whats-next.md @@ -0,0 +1,12 @@ +--- +title: "¿Que sigue?" +description: "¿Qué sigue después de instalar kubectl." +headless: true +--- + +* [Instalar Minikube](https://minikube.sigs.k8s.io/docs/start/) +* Consulte las [guías de introducción](/docs/setup/) para obtener más información sobre la creación de clústeres. +* [Aprenda a iniciar y exponer su aplicación.](/docs/tasks/access-application-cluster/service-access-application-cluster/) +* Si necesita acceso a un clúster que no creó, consulte la guia de + [Compartir el acceso al clúster](/docs/tasks/access-application-cluster/configure-access-multiple-clusters/). +* Lea los [documentos de referencia de kubectl](/docs/reference/kubectl/kubectl/) \ No newline at end of file diff --git a/content/es/docs/tasks/tools/included/optional-kubectl-configs-bash-linux.md b/content/es/docs/tasks/tools/included/optional-kubectl-configs-bash-linux.md new file mode 100644 index 0000000000..fd470c2633 --- /dev/null +++ b/content/es/docs/tasks/tools/included/optional-kubectl-configs-bash-linux.md @@ -0,0 +1,54 @@ +--- +title: "Autocompletar bash en Linux" +description: "Alguna configuración opcional para la finalización automática de bash en Linux." +headless: true +--- + +### Introducción + +El script de completado de kubectl para Bash se puede generar con el comando `kubectl completion bash`. Obtener el script de completado en su shell habilita el autocompletado de kubectl. + +Sin embargo, el script de completado depende de [**bash-completion**](https://github.com/scop/bash-completion), lo que significa que primero debe instalar este software (puedes probar si tienes bash-completion ya instalado ejecutando `type _init_completion`). + +### Instalar bash-complete + +El completado de bash es proporcionado por muchos administradores de paquetes (ver [aquí](https://github.com/scop/bash-completion#installation)). Puedes instalarlo con `apt-get install bash-completion` o `yum install bash-completion`, etc. + +Los comandos anteriores crean `/usr/share/bash-completion/bash_completion`, que es el script principal de bash-complete. Dependiendo de su administrador de paquetes, debe obtener manualmente este archivo de perfil en su `~/.bashrc`. + +Para averiguarlo, recargue su shell y ejecute `type _init_completion`. Si el comando tiene éxito, ya está configurado; de lo contrario, agregue lo siguiente a su archivo `~/.bashrc`: + +```bash +source /usr/share/bash-completion/bash_completion +``` + +Vuelva a cargar su shell y verifique que la finalización de bash esté correctamente instalada escribiendo `type _init_completion`. + +### Habilitar el autocompletado de kubectl + +Ahora debe asegurarse de que el script de completado de kubectl se obtenga en todas sus sesiones de shell. Hay dos formas de hacer esto: + +- Obtenga el script de completado en su perfil `~/.bashrc`: + + ```bash + echo 'source <(kubectl completion bash)' >>~/.bashrc + ``` + +- Agregue el script de completado al directorio de `/etc/bash_completion.d`: + + ```bash + kubectl completion bash >/etc/bash_completion.d/kubectl + ``` + +Si tiene un alias para kubectl, puede extender el completado del shell para trabajar con ese alias: + +```bash +echo 'alias k=kubectl' >>~/.bashrc +echo 'complete -F __start_kubectl k' >>~/.bashrc +``` + +{{< note >}} +El código fuente de bash-complete todos los scripts se encuentra en `/etc/bash_completion.d`. +{{< /note >}} + +Ambos enfoques son equivalentes. Después de recargar su shell, el autocompletado de kubectl debería estar funcionando. \ No newline at end of file diff --git a/content/es/docs/tasks/tools/included/optional-kubectl-configs-bash-mac.md b/content/es/docs/tasks/tools/included/optional-kubectl-configs-bash-mac.md new file mode 100644 index 0000000000..5c6dd3d8e6 --- /dev/null +++ b/content/es/docs/tasks/tools/included/optional-kubectl-configs-bash-mac.md @@ -0,0 +1,88 @@ +--- +title: "Autocompletar bash en macOS" +description: "Alguna configuración opcional para la finalización automática de bash en macOS." +headless: true +--- + +### Introducción + +El script de completado de kubectl para Bash se puede generar con `kubectl completion bash`. Obtener este script en su shell permite el completado de kubectl. + +Sin embargo, el script de finalización de kubectl depende de [**bash-completion**](https://github.com/scop/bash-completion) que, por lo tanto, debe instalar previamente. + +{{< warning>}} +Hay dos versiones de bash-complete, v1 y v2. V1 es para Bash 3.2 ( +que es el predeterminado en macOS), y v2 es para Bash 4.1+. El script de completado de kubectl **no funciona** correctamente con bash-complete v1 y Bash 3.2. Requiere **bash-complete v2** y **Bash 4.1+**. Por lo tanto, para poder usar correctamente la finalización de kubectl en macOS, debe instalar y usar Bash 4.1+ ([*instrucciones*](https://itnext.io/upgrading-bash-on-macos-7138bd1066ba)). Las siguientes instrucciones asumen que usa Bash 4.1+ (es decir, cualquier versión de Bash de 4.1 o posterior). +{{< /warning >}} + +### Actualizar Bash + +Las siguientes instrucciones asumen que usa Bash 4.1+. Puede verificar la versión de su Bash ejecutando: + +```bash +echo $BASH_VERSION +``` +Si es demasiado antiguo, puede instalarlo o actualizarlo usando Homebrew: + +```bash +brew install bash +``` +Vuelva a cargar su shell y verifique que se esté utilizando la versión deseada: + +```bash +echo $BASH_VERSION $SHELL +``` + +Homebrew generalmente lo instala en `/usr/local/bin/bash`. + +### Instalar bash-complete + +{{< note >}} +Como se mencionó antes, estas instrucciones asumen que usa Bash 4.1+, lo que significa que instalará bash-completacion v2 (a diferencia de Bash 3.2 y bash-deployment v1, en cuyo caso el completado de kubectl no funcionará). +{{< /note >}} + +Puede probar si ya tiene instalado bash-complete v2 con `type _init_completion`. Si no es así, puede instalarlo con Homebrew: + +```bash +brew install bash-completion@2 +``` + +Como se indica en el resultado de este comando, agregue lo siguiente a su archivo `~/.bash_profile`: + +```bash +export BASH_COMPLETION_COMPAT_DIR="/usr/local/etc/bash_completion.d" +[[ -r "/usr/local/etc/profile.d/bash_completion.sh" ]] && . "/usr/local/etc/profile.d/bash_completion.sh" +``` + +Vuelva a cargar su shell y verifique que bash-complete v2 esté instalado correctamente con `type _init_completion`. + +### Habilitar el autocompletado de kubectl + +Ahora debe asegurarse de que el script de completado de kubectl se obtenga en todas sus sesiones de shell. Hay varias formas de lograrlo: + +- Obtenga el script de finalización en su perfil `~/.bash_profile`: + + ```bash + echo 'source <(kubectl completion bash)' >>~/.bash_profile + ``` + +- Agregue el script de completado al directorio `/usr/local/etc/bash_completion.d`: + + ```bash + kubectl completion bash >/usr/local/etc/bash_completion.d/kubectl + ``` + +- Si tiene un alias para kubectl, puede extender el completado del shell para trabajar con ese alias: + + ```bash + echo 'alias k=kubectl' >>~/.bash_profile + echo 'complete -F __start_kubectl k' >>~/.bash_profile + ``` + +- Si instaló kubectl con Homebrew (como se explica [aquí](/docs/tasks/tools/install-kubectl-macos/#install-with-homebrew-on-macos)), entonces el script de completado de kubectl ya debería estar en `/usr/local/etc/bash_completion.d/kubectl`. En ese caso, no necesita hacer nada. + + {{< note >}} + La instalación de Homebrew de bash-completion v2 genera todos los archivos en el directorio `BASH_COMPLETION_COMPAT_DIR`, es por eso que los dos últimos métodos funcionan. + {{< /note >}} + +En cualquier caso, después de recargar su shell, el completado de kubectl debería estar funcionando. \ No newline at end of file diff --git a/content/es/docs/tasks/tools/included/optional-kubectl-configs-zsh.md b/content/es/docs/tasks/tools/included/optional-kubectl-configs-zsh.md new file mode 100644 index 0000000000..9a8d586c28 --- /dev/null +++ b/content/es/docs/tasks/tools/included/optional-kubectl-configs-zsh.md @@ -0,0 +1,29 @@ +--- +title: "Autocompletar zsh" +description: "Alguna configuración opcional para la finalización automática de zsh." +headless: true +--- + +El script de completado de kubectl para Zsh se puede generar con el comando `kubectl completion zsh`. Obtener el script de completado en su shell habilita el autocompletado de kubectl. + +Para hacerlo en todas sus sesiones de shell, agregue lo siguiente a su perfil `~/.zshrc`: + +```zsh +source <(kubectl completion zsh) +``` +Si tiene un alias para kubectl, puede extender el completado del shell para trabajar con ese alias: + +```zsh +echo 'alias k=kubectl' >>~/.zshrc +echo 'compdef __start_kubectl k' >>~/.zshrc +``` + +Después de recargar su shell, el autocompletado de kubectl debería estar funcionando. + +Si recibe un error como `complete:13: command not found: compdef`, +luego agregue lo siguiente al comienzo de su perfil `~/.zshrc`: + +```zsh +autoload -Uz compinit +compinit +``` \ No newline at end of file diff --git a/content/es/docs/tasks/tools/included/verify-kubectl.md b/content/es/docs/tasks/tools/included/verify-kubectl.md new file mode 100644 index 0000000000..15bd90692c --- /dev/null +++ b/content/es/docs/tasks/tools/included/verify-kubectl.md @@ -0,0 +1,31 @@ +--- +title: "verificar la instalación de kubectl" +description: "Cómo verificar kubectl." +headless: true +--- + +Para que kubectl encuentre y acceda a un clúster de Kubernetes, necesita un +[archivo kubeconfig](/docs/concepts/configuration/organize-cluster-access-kubeconfig/), que se crea automáticamente cuando creas un clúster usando +[kube-up.sh](https://github.com/kubernetes/kubernetes/blob/master/cluster/kube-up.sh) +o implementar con éxito un clúster de Minikube. +De forma predeterminada, la configuración de kubectl se encuentra en `~/.kube/config`. + +Verifique que kubectl esté configurado correctamente obteniendo el estado del clúster: + +```shell +kubectl cluster-info +``` +Si ve una respuesta de URL, kubectl está configurado correctamente para acceder a su clúster. + +Si ve un mensaje similar al siguiente, kubectl no está configurado correctamente o no puede conectarse a un clúster de Kubernetes. +``` +The connection to the server was refused - did you specify the right host or port? +``` + +Por ejemplo, si tiene la intención de ejecutar un clúster de Kubernetes en su computadora portátil (localmente), primero necesitará instalar una herramienta como Minikube y luego volver a ejecutar los comandos indicados anteriormente. + +Si kubectl cluster-info devuelve la respuesta de la URL pero no puede acceder a su clúster, para verificar si está configurado correctamente, use: + +```shell +kubectl cluster-info dump +``` \ No newline at end of file diff --git a/content/es/docs/tasks/tools/install-kubectl.md b/content/es/docs/tasks/tools/install-kubectl.md deleted file mode 100644 index acc140d425..0000000000 --- a/content/es/docs/tasks/tools/install-kubectl.md +++ /dev/null @@ -1,515 +0,0 @@ ---- -title: Instalar y Configurar kubectl -content_type: task -weight: 10 -card: - name: tasks - weight: 20 - title: Instalar kubectl ---- - - -Usa la herramienta de línea de comandos de Kubernetes, [kubectl](/docs/reference/kubectl/kubectl/), para desplegar y gestionar aplicaciones en Kubernetes. Usando kubectl, puedes inspeccionar recursos del clúster; crear, eliminar, y actualizar componentes; explorar tu nuevo clúster; y arrancar aplicaciones de ejemplo. Para ver la lista completa de operaciones de kubectl, se puede ver [el resumen de kubectl](/docs/reference/kubectl/overview/). - - -## {{% heading "prerequisites" %}} - -Debes usar una versión de kubectl que esté a menos de una versión menor de diferencia con tu clúster. Por ejemplo, un cliente v1.2 debería funcionar con un máster v1.1, v1.2, y v1.3. Usar la última versión de kubectl ayuda a evitar problemas inesperados. - - - - - -## Instalar kubectl en Linux - -### Instalar el binario de kubectl con curl en Linux - -1. Descargar la última entrega: - - ``` - curl -LO "https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl" - ``` - -Para descargar una versión específica, remplaza el comando `$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)` con la versión específica. - -Por ejemplo, para descarga la versión {{< param "fullversion" >}} en Linux, teclea: - - ``` - curl -LO https://storage.googleapis.com/kubernetes-release/release/{{< param "fullversion" >}}/bin/linux/amd64/kubectl - ``` - -2. Habilita los permisos de ejecución del binario `kubectl`. - - ``` - chmod +x ./kubectl - ``` - -3. Mueve el binario dentro de tu PATH. - - ``` - sudo mv ./kubectl /usr/local/bin/kubectl - ``` - -4. Comprueba que la versión que se ha instalado es la más reciente. - - ``` - kubectl version --client - ``` - - -## Instalar mediante el gestor de paquetes del sistema - -{{< tabs name="kubectl_install" >}} -{{< tab name="Ubuntu, Debian or HypriotOS" codelang="bash" >}} -sudo apt-get update && sudo apt-get install -y apt-transport-https gnupg2 curl -curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add - -echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee -a /etc/apt/sources.list.d/kubernetes.list -sudo apt-get update -sudo apt-get install -y kubectl -{{< /tab >}} - -{{< tab name="CentOS, RHEL or Fedora" codelang="bash" >}}cat <}} -{{< /tabs >}} - -### Instalar usando otro gestor de paquetes - -{{< tabs name="other_kubectl_install" >}} -{{% tab name="Snap" %}} -Si usas Ubuntu o alguna de las otras distribuciones de Linux que soportan el gestor de paquetes [snap](https://snapcraft.io/docs/core/install), kubectl está disponible como una aplicación [snap](https://snapcraft.io/). - -```shell -snap install kubectl --classic - -kubectl version --client -``` - -{{% /tab %}} - -{{% tab name="Homebrew" %}} -Si usas alguna de las otras distribuciones de Linux que soportan el gestor de paquetes [Homebrew](https://docs.brew.sh/Homebrew-on-Linux), kubectl está disponible como una aplicación de [Homebrew]((https://docs.brew.sh/Homebrew-on-Linux#install). - -```shell -brew install kubectl - -kubectl version --client -``` - -{{% /tab %}} - -{{< /tabs >}} - - -## Instalar kubectl en macOS - -### Instalar el binario de kubectl usando curl en macOS - -1. Descarga la última entrega: - - ```bash - curl -LO "https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/darwin/amd64/kubectl" - ``` - - Para descargar una versión específica, remplaza el comando `$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)` con la versión específica. - - Por ejemplo, para descargar la versión {{< param "fullversion" >}} en macOS, teclea: - - ```bash - curl -LO https://storage.googleapis.com/kubernetes-release/release/{{< param "fullversion" >}}/bin/darwin/amd64/kubectl - ``` - -2. Habilita los permisos de ejecución del binario `kubectl`. - - ```bash - chmod +x ./kubectl - ``` - -3. Mueve el binario dentro de tu PATH. - - ```bash - sudo mv ./kubectl /usr/local/bin/kubectl - ``` - -4. Para asegurar que la versión utilizada sea la más actual puedes probar: - - ```bash - kubectl version --client - ``` - -### Instalar con Homebrew en macOS - -Si estás usando macOS y el gestor de paquetes es [Homebrew](https://brew.sh/), puedes instalar `kubectl` con `brew`. - -1. Ejecuta el comando de instalación: - - ```bash - brew install kubectl - ``` - - o - - ```bash - brew install kubernetes-cli - ``` - -2. Para asegurar que la versión utilizada sea la más actual, puedes ejecutar: - - ```bash - kubectl version --client - ``` - -### Instalar con Macports en macOS - -Si estás en macOS y utilizas el gestor de paquetes [Macports](https://macports.org/), puedes instalar `kubectl` con `port`. - -1. Ejecuta los comandos de instalación: - - ```bash - sudo port selfupdate - sudo port install kubectl - ``` - -2. Para asegurar que la versión utilizada sea la más actual puedes ejecutar: - - ```bash - kubectl version --client - ``` - -# Instalar kubectl en Windows - -### Instalar el binario de kubectl con curl en Windows - -1. Descargar la última entrega {{< param "fullversion" >}} de [este link](https://storage.googleapis.com/kubernetes-release/release/{{< param "fullversion" >}}/bin/windows/amd64/kubectl.exe). - - o si tiene `curl` instalada, utiliza este comando: - - ```bash - curl -LO https://storage.googleapis.com/kubernetes-release/release/{{< param "fullversion" >}}/bin/windows/amd64/kubectl.exe - ``` - - Para averiguar la última versión estable (por ejemplo, para secuencias de comandos), echa un vistazo a [https://storage.googleapis.com/kubernetes-release/release/stable.txt](https://storage.googleapis.com/kubernetes-release/release/stable.txt). - -2. Añade el binario a tu PATH. - -3. Para asegurar que la versión utilizada sea la más actual, puedes ejecutar: - - ```bash - kubectl version --client - ``` - -{{< note >}} -[Docker Desktop para Windows](https://docs.docker.com/docker-for-windows/#kubernetes) añade su propia versión de `kubectl` a PATH. - -Si tienes Docker Desktop instalado, es posible que tengas que modificar tu PATH al PATH añadido por Docker Desktop o eliminar la versión de `kubectl` proporcionada por Docker Desktop. -{{< /note >}} - -### Instalar con Powershell desde PSGallery - -Si estás en Windows y utilizas el gestor de paquetes [Powershell Gallery](https://www.powershellgallery.com/), puedes instalar y actualizar kubectl con Powershell. - -1. Ejecuta los comandos de instalación (asegurándote de especificar una `DownloadLocation`): - - ```powershell - Install-Script -Name 'install-kubectl' -Scope CurrentUser -Force - install-kubectl.ps1 [-DownloadLocation ] - ``` - - {{< note >}}Si no especificas una `DownloadLocation`, `kubectl` se instalará en el directorio temporal del usuario.{{< /note >}} - - El instalador crea `$HOME/.kube` y crea un archivo de configuración - -2. Para asegurar que la versión utilizada sea la más actual puedes probar: - - ```powershell - kubectl version --client - ``` - -{{< note >}} -Actualizar la instalación se realiza mediante la re-ejecución de los dos comandos listados en el paso 1.{{< /note >}} - -### Instalar en Windows usando Chocolatey o scoop - -1. Para instalar kubectl en Windows puedes usar el gestor de paquetes [Chocolatey](https://chocolatey.org) o el instalador de línea de comandos [scoop](https://scoop.sh). - - {{< tabs name="kubectl_win_install" >}} - {{% tab name="choco" %}} -Using [Chocolatey](https://chocolatey.org). - - ```powershell - choco install kubernetes-cli - ``` - {{% /tab %}} - {{% tab name="scoop" %}} -Using [scoop](https://scoop.sh). - - ```powershell - scoop install kubectl - ``` - {{% /tab %}} - {{< /tabs >}} - -2. Para asegurar que la versión utilizada sea la más actual puedes probar: - - ```powershell - kubectl version --client - ``` - -3. Navega a tu directorio de inicio: - - ```powershell - # Si estas usando cmd.exe, ejecuta: cd %USERPROFILE% - cd ~ - ``` - -4. Crea el directorio `.kube`: - - ```powershell - mkdir .kube - ``` - -5. Cambia al directorio `.kube` que acabas de crear: - - ```powershell - cd .kube - ``` - -6. Configura kubectl para usar un clúster remoto de Kubernetes: - - ```powershell - New-Item config -type file - ``` - -{{< note >}}Edita el fichero de configuración con un editor de texto de tu elección, como Notepad.{{< /note >}} - -## Descarga como parte del Google Cloud SDK - -Puedes instalar kubectl como parte del Google Cloud SDK. - -1. Instala el [Google Cloud SDK](https://cloud.google.com/sdk/). -2. Ejecuta el comando de instalación de `kubectl`: - - ```shell - gcloud components install kubectl - ``` - -3. Para asegurar que la versión utilizada sea la más actual puedes probar: - - ```shell - kubectl version --client - ``` - -## Comprobar la configuración kubectl - -Para que kubectl pueda encontrar y acceder a un clúster de Kubernetes, necesita un [fichero kubeconfig](/docs/tasks/access-application-cluster/configure-access-multiple-clusters/), que se crea de forma automática cuando creas un clúster usando [kube-up.sh](https://github.com/kubernetes/kubernetes/blob/master/cluster/kube-up.sh) o despliegas de forma satisfactoria un clúster de Minikube. Revisa las [guías para comenzar](/docs/setup/) para más información acerca de crear clústers. Si necesitas acceso a un clúster que no has creado, ver el [documento de Compartir Acceso a un Clúster](/docs/tasks/access-application-cluster/configure-access-multiple-clusters/). -Por defecto, la configuración de kubectl se encuentra en `~/.kube/config`. - -Comprueba que kubectl está correctamente configurado obteniendo el estado del clúster: - -```shell -kubectl cluster-info -``` - -Si ves una respuesta en forma de URL, kubectl está correctamente configurado para acceder a tu clúster. - -Si ves un mensaje similar al siguiente, kubectl no está correctamente configurado o no es capaz de conectar con un clúster de Kubernetes. - -``` -The connection to the server was refused - did you specify the right host or port? -``` - -Por ejemplo, si intentas ejecutar un clúster de Kubernetes en tu portátil (localmente), necesitarás una herramienta como minikube que esté instalada primero y entonces volver a ejecutar los comandos indicados arriba. - -Si kubectl cluster-info devuelve la respuesta en forma de url, pero no puedes acceder a tu clúster, para comprobar si está configurado adecuadamente, usa: - -```shell -kubectl cluster-info dump -``` - -## kubectl configuraciones opcionales - -### Habilitar el auto-completado en el intérprete de comandos - -kubectl provee de soporte para auto-completado para Bash y Zsh, ¡que te puede ahorrar mucho uso del teclado! - -Abajo están los procedimientos para configurar el auto-completado para Bash (incluyendo la diferencia entre Linux y macOS) y Zsh. - -{{< tabs name="kubectl_autocompletion" >}} - -{{% tab name="Bash en Linux" %}} - -### Introducción - -La secuencia de comandos de completado de kubectl para Bash puede ser generado con el comando `kubectl completion bash`. Corriendo la secuencia de comandos de completado en tu intérprete de comandos habilita el auto-completado de kubectl. - -Sin embargo, la secuencia de comandos de completado depende de [*bash-completion**](https://github.com/scop/bash-completion), lo que significa que tienes que instalar primero este programa (puedes probar si ya tienes bash-completion instalado ejecutando `type _init_completion`). - -### Instalar bash-completion - -bash-completion es ofrecido por muchos gestores de paquetes (ver [aquí](https://github.com/scop/bash-completion#installation)). Puedes instalarlo con `apt-get install bash-completion` o `yum install bash-completion`, etc. - -Los comandos de arriba crean `/usr/share/bash-completion/bash_completion`, que es la secuencia de comandos principal de bash-completion. Dependiendo de tu gestor de paquetes, tienes que correr manualmente este archivo en tu `~/.bashrc`. - -Para averiguarlo, recarga tu intérprete de comandos y ejecuta `type _init_completion`. Si el comando tiene éxito, ya has terminado; si no, añade lo siguiente a tu `~/.bashrc`: - -```shell -source /usr/share/bash-completion/bash_completion -``` - -recarga tu intérprete de comandos y verifica que bash-completion está correctamente instalado tecleando `type _init_completion`. - -### Habilitar el auto-completado de kubectl - -Debes asegurarte que la secuencia de comandos de completado de kubectl corre en todas tus sesiones de tu intérprete de comandos. Hay dos formas en que puedes hacer esto: - -- Corre la secuencia de comandos de completado en tu `~/.bashrc`: - - ```bash - echo 'source <(kubectl completion bash)' >>~/.bashrc - ``` - -- Añade la secuencia de comandos de completado al directorio `/etc/bash_completion.d`: - - ```bash - kubectl completion bash >/etc/bash_completion.d/kubectl - ``` - -Si tienes un alias para `kubectl`, puedes extender los comandos de shell para funcionar con ese alias: - -```bash -echo 'alias k=kubectl' >>~/.bashrc -echo 'complete -F __start_kubectl k' >>~/.bashrc -``` - -{{< note >}} -bash-completion corre todas las secuencias de comandos de completado en `/etc/bash_completion.d`. -{{< /note >}} - -Ambas estrategias son equivalentes. Tras recargar tu intérprete de comandos, el auto-completado de kubectl debería estar funcionando. - -{{% /tab %}} - - -{{% tab name="Bash en macOS" %}} - -### Introducción - -La secuencia de comandos de completado de kubectl para Bash puede generarse con el comando `kubectl completion bash`. Corriendo la secuencia de comandos de completado en tu intérprete de comandos habilita el auto-completado de kubectl. - -Sin embargo, la secuencia de comandos de completado depende de [*bash-completion**](https://github.com/scop/bash-completion), lo que significa que tienes que instalar primero este programa (puedes probar si ya tienes bash-completion instalado ejecutando `type _init_completion`). - -{{< warning>}} -macOS incluye Bash 3.2 por defecto. La secuencia de comandos de completado de kubectl requiere Bash 4.1+ y no funciona con Bash 3.2. Una posible alternativa es instalar una nueva versión de Bash en macOS (ver instrucciones [aquí](https://itnext.io/upgrading-bash-on-macos-7138bd1066ba)). Las instrucciones de abajo sólo funcionan si estás usando Bash 4.1+. -{{< /warning >}} - -### Actualizar bash - -Las instrucciones asumen que usa Bash 4.1+. Puedes comprobar tu versión de bash con: - -```bash -echo $BASH_VERSION -``` - -Si no es 4.1+, puede actualizar bash con Homebrew: - -```bash -brew install bash -``` - -Recarga tu intérprete de comandos y verifica que estás usando la versión deseada: - -```bash -echo $BASH_VERSION $SHELL -``` - -Usualmente, Homebrew lo instala en `/usr/local/bin/bash`. - -### Instalar bash-completion - -Puedes instalar bash-completion con Homebrew: - -```bash -brew install bash-completion@2 -``` - -{{< note >}} -El `@2` simboliza bash-completion 2, que es requerido por la secuencia de comandos de completado de kubectl (no funciona con bash-completion 1). Luego, bash-completion 2 requiere Bash 4.1+, eso es por lo que necesitabas actualizar Bash. -{{< /note >}} - -Como se indicaba en la salida de `brew install` (sección "Caveats"), añade las siguientes líneas a tu `~/.bashrc` o `~/.bash_profile`: - -```bash -export BASH_COMPLETION_COMPAT_DIR="/usr/local/etc/bash_completion.d" -[[ -r "/usr/local/etc/profile.d/bash_completion.sh" ]] && . "/usr/local/etc/profile.d/bash_completion.sh" -``` - -Recarga tu intérprete de comandos y verifica que bash-completion está correctamente instalado tecleando `type _init_completion`. - -### Habilitar el auto-completado de kubectl - -Debes asegurarte que la secuencia de comandos de completado de kubectl corre en todas tus sesiones de tu intérprete de comenados. Hay múltiples formas en que puedes hacer esto: - -- Corre la secuencia de comandos de completado en tu `~/.bashrc`: - - ```shell - echo 'source <(kubectl completion bash)' >>~/.bashrc - - ``` - -- Añade la secuencia de comandos de completado al directorio `/usr/local/etc/bash_completion.d`: - - ```shell - kubectl completion bash >/usr/local/etc/bash_completion.d/kubectl - ``` - -- Si has instalado kubectl con Homebrew (como se explica [aquí](#install-with-homebrew-on-macos)), entonces la secuencia de comandos de completado se instaló automáticamente en `/usr/local/etc/bash_completion.d/kubectl`. En este caso, no tienes que hacer nada. - -{{< note >}} -bash-completion (si se instaló con Homebrew) corre todas las secuencias de comandos de completado en el directorio que se ha puesto en la variable de entorno `BASH_COMPLETION_COMPAT_DIR`. -{{< /note >}} - -Todas las estrategias son equivalentes. Tras recargar tu intérprete de comandos, el auto-completado de kubectl debería funcionar. -{{% /tab %}} - -{{% tab name="Zsh" %}} - -La secuencia de comandos de completado de kubectl para Zsh puede ser generada con el comando `kubectl completion zsh`. Corriendo la secuencia de comandos de completado en tu intérprete de comandos habilita el auto-completado de kubectl. - -Para hacerlo en todas tus sesiones de tu intérprete de comandos, añade lo siguiente a tu `~/.zshrc`: - -```zsh -source <(kubectl completion zsh) -``` - -Si tienes alias para kubectl, puedes extender el completado de intérprete de comandos para funcionar con ese alias. - -```zsh -echo 'alias k=kubectl' >>~/.zshrc -echo 'compdef __start_kubectl k' >>~/.zshrc -``` - -Tras recargar tu intérprete de comandos, el auto-completado de kubectl debería funcionar. - -Si obtienes un error como `complete:13: command not found: compdef`, entonces añade lo siguiente al principio de tu `~/.zshrc`: - -```zsh -autoload -Uz compinit -compinit -``` -{{% /tab %}} -{{< /tabs >}} - -## {{% heading "whatsnext" %}} -* [Instalar Minikube](https://minikube.sigs.k8s.io/docs/start/) -* Ver las [guías](/docs/setup/) para ver mas información sobre como crear clusteres. -* [Aprender cómo lanzar y exponer tu aplicación.](/docs/tasks/access-application-cluster/service-access-application-cluster/). -* Si necesita acceso a un clúster que no se creó, ver el documento de [compartiendo acceso a clúster](/docs/tasks/access-application-cluster/configure-access-multiple-clusters/). -* Leer ´la documentación de kubectl reference](/docs/reference/kubectl/kubectl/) diff --git a/content/id/docs/tasks/administer-cluster/sysctl-cluster.md b/content/id/docs/tasks/administer-cluster/sysctl-cluster.md index 7120f087fa..42acb5d0f5 100644 --- a/content/id/docs/tasks/administer-cluster/sysctl-cluster.md +++ b/content/id/docs/tasks/administer-cluster/sysctl-cluster.md @@ -55,7 +55,8 @@ Sysctl berikut ini didukung dalam kelompok _safe_: - `kernel.shm_rmid_forced`, - `net.ipv4.ip_local_port_range`, - `net.ipv4.tcp_syncookies`, -- `net.ipv4.ping_group_range` (sejak Kubernetes 1.18). +- `net.ipv4.ping_group_range` (sejak Kubernetes 1.18), +- `net.ipv4.ip_unprivileged_port_start` (sejak Kubernetes 1.22). {{< note >}} Contoh `net.ipv4.tcp_syncookies` bukan merupakan Namespace pada kernel Linux versi 4.4 atau lebih rendah. diff --git a/content/id/docs/tasks/manage-kubernetes-objects/kustomization.md b/content/id/docs/tasks/manage-kubernetes-objects/kustomization.md index 2ca6535d90..7cca240991 100644 --- a/content/id/docs/tasks/manage-kubernetes-objects/kustomization.md +++ b/content/id/docs/tasks/manage-kubernetes-objects/kustomization.md @@ -80,10 +80,10 @@ Isinya seperti di bawah ini: apiVersion: v1 data: application.properties: | - FOO=Bar + FOO: Bar kind: ConfigMap metadata: - name: example-configmap-1-8mbdf7882g + name: example-configmap-1-42cfbf598f ``` ConfigMap juga dapat dibangkitkan dari pasangan _key-value_ literal. Untuk membangkitkan secara literal, tambahkan entri pada daftar `literals` di `configMapGenerator`. diff --git a/content/it/docs/concepts/cluster-administration/logging.md b/content/it/docs/concepts/cluster-administration/logging.md index ea7235d532..601dfcf365 100644 --- a/content/it/docs/concepts/cluster-administration/logging.md +++ b/content/it/docs/concepts/cluster-administration/logging.md @@ -88,7 +88,7 @@ la rotazione e ci sono due file, uno da 10 MB e uno vuoto, `kubectl logs` restituirà una risposta vuota. {{< /note >}} -[cosConfigureHelper]: https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/cluster/gce/gci/configure-helper.sh +[cosConfigureHelper]: https://github.com/kubernetes/kubernetes/blob/master/cluster/gce/gci/configure-helper.sh ### System component logs diff --git a/content/it/docs/concepts/cluster-administration/manage-deployment.md b/content/it/docs/concepts/cluster-administration/manage-deployment.md index 5e8886ec6f..24b2a76390 100644 --- a/content/it/docs/concepts/cluster-administration/manage-deployment.md +++ b/content/it/docs/concepts/cluster-administration/manage-deployment.md @@ -140,7 +140,7 @@ Se sei interessato a saperne di più su `kubectl`, vai avanti e leggi [Panoramic Gli esempi che abbiamo utilizzato fino ad ora si applicano al massimo una singola etichetta a qualsiasi risorsa. Esistono molti scenari in cui è necessario utilizzare più etichette per distinguere i set l'uno dall'altro. -Ad esempio, diverse applicazioni utilizzerebbero valori diversi per l'etichetta `app`, ma un'applicazione multilivello, come l'esempio [guestbook](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/guestbook/), avrebbe inoltre bisogno di distinguere ogni livello. Il frontend potrebbe contenere le seguenti etichette: +Ad esempio, diverse applicazioni utilizzerebbero valori diversi per l'etichetta `app`, ma un'applicazione multilivello, come l'esempio [guestbook](https://github.com/kubernetes/examples/tree/master/guestbook/), avrebbe inoltre bisogno di distinguere ogni livello. Il frontend potrebbe contenere le seguenti etichette: ```yaml labels: diff --git a/content/ja/docs/concepts/architecture/cri.md b/content/ja/docs/concepts/architecture/cri.md new file mode 100644 index 0000000000..9ca24e41f0 --- /dev/null +++ b/content/ja/docs/concepts/architecture/cri.md @@ -0,0 +1,39 @@ +--- +title: コンテナランタイムインターフェイス(CRI) +content_type: concept +weight: 50 +--- + + + +CRIは、クラスターコンポーネントを再コンパイルすることなく、kubeletがさまざまなコンテナランタイムを使用できるようにするプラグインインターフェイスです。 + +{{< glossary_tooltip text="kubelet" term_id="kubelet" >}}が{{< glossary_tooltip text="Pod" term_id="pod" >}}とそのコンテナを起動できるように、クラスター内の各ノードで動作する{{}}が必要です。 + +kubeletとContainerRuntime間の通信のメインプロトコルです。 + +Kubernetes Container Runtime Interface(CRI)は、[クラスターコンポーネント](/ja/docs/concepts/overview/components/#node-components){{< glossary_tooltip text="kubelet" term_id="kubelet" >}}と{{}}間の通信用のメイン[gRPC](/ja/docs/concepts/overview/components/#node-components)プロトコルを定義します。 + + + +## API {#api} + +{{< feature-state for_k8s_version="v1.23" state="stable" >}} + +kubeletは、gRPCを介してコンテナランタイムに接続するときにクライアントとして機能します。ランタイムおよびイメージサービスエンドポイントは、コンテナランタイムで使用可能である必要があります。コンテナランタイムは、`--image-service-endpoint`および`--container-runtime-endpoint`[コマンドラインフラグ](/ja/docs/reference/command-line-tools-reference/kubelet)を使用して、kubelet内で個別に設定できます。 + +Kubernetes v{{< skew currentVersion >}}の場合、kubeletはCRI `v1`の使用を優先します。 +コンテナランタイムがCRIの`v1`をサポートしていない場合、kubeletはサポートされている古いバージョンのネゴシエーションを試みます。 +kubelet v{{< skew currentVersion >}}はCRI `v1alpha2`をネゴシエートすることもできますが、このバージョンは非推奨と見なされます。 +kubeletがサポートされているCRIバージョンをネゴシエートできない場合、kubeletはあきらめて、ノードとして登録されません。 + +## アップグレード + +Kubernetesをアップグレードする場合、kubeletはコンポーネントの再起動時に最新のCRIバージョンを自動的に選択しようとします。 +それが失敗した場合、フォールバックは上記のように行われます。 +コンテナランタイムがアップグレードされたためにgRPCリダイヤルが必要な場合は、コンテナランタイムも最初に選択されたバージョンをサポートする必要があります。 +そうでない場合、リダイヤルは失敗することが予想されます。これには、kubeletの再起動が必要です。 + +## {{% heading "whatsnext" %}} + +- CRI[プロトコル定義](https://github.com/kubernetes/cri-api/blob/c75ef5b/pkg/apis/runtime/v1/api.proto)の詳細を学ぶ。 diff --git a/content/ja/docs/concepts/cluster-administration/manage-deployment.md b/content/ja/docs/concepts/cluster-administration/manage-deployment.md index d20709e133..d8919c2132 100644 --- a/content/ja/docs/concepts/cluster-administration/manage-deployment.md +++ b/content/ja/docs/concepts/cluster-administration/manage-deployment.md @@ -163,7 +163,7 @@ persistentvolumeclaim/my-pvc created これまで取り上げた例では、リソースに対して最大1つのラベルを適用してきました。リソースのセットを他のセットと区別するために、複数のラベルが必要な状況があります。 -例えば、異なるアプリケーション間では、異なる`app`ラベルを使用したり、[ゲストブックの例](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/guestbook/)のようなマルチティアーのアプリケーションでは、各ティアーを区別する必要があります。frontendというティアーでは下記のラベルを持ちます。: +例えば、異なるアプリケーション間では、異なる`app`ラベルを使用したり、[ゲストブックの例](https://github.com/kubernetes/examples/tree/master/guestbook/)のようなマルチティアーのアプリケーションでは、各ティアーを区別する必要があります。frontendというティアーでは下記のラベルを持ちます。: ```yaml labels: diff --git a/content/ja/docs/concepts/configuration/overview.md b/content/ja/docs/concepts/configuration/overview.md index 33adb3627c..911d078b80 100644 --- a/content/ja/docs/concepts/configuration/overview.md +++ b/content/ja/docs/concepts/configuration/overview.md @@ -58,7 +58,7 @@ weight: 10 ## ラベルの使用 -- `{ app: myapp, tier: frontend, phase: test, deployment: v3 }`のように、アプリケーションまたはデプロイメントの __セマンティック属性__ を識別する[ラベル](/ja/docs/concepts/overview/working-with-objects/labels/)を定義して使いましょう。これらのラベルを使用して、他のリソースに適切なPodを選択できます。例えば、すべての`tier：frontend`を持つPodを選択するServiceや、`app：myapp`に属するすべての`phase：test`コンポーネント、などです。このアプローチの例を知るには、[ゲストブック](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/guestbook/)アプリも合わせてご覧ください。 +- `{ app: myapp, tier: frontend, phase: test, deployment: v3 }`のように、アプリケーションまたはデプロイメントの __セマンティック属性__ を識別する[ラベル](/ja/docs/concepts/overview/working-with-objects/labels/)を定義して使いましょう。これらのラベルを使用して、他のリソースに適切なPodを選択できます。例えば、すべての`tier：frontend`を持つPodを選択するServiceや、`app：myapp`に属するすべての`phase：test`コンポーネント、などです。このアプローチの例を知るには、[ゲストブック](https://github.com/kubernetes/examples/tree/master/guestbook/)アプリも合わせてご覧ください。 セレクターからリリース固有のラベルを省略することで、Serviceを複数のDeploymentにまたがるように作成できます。 [Deployment](/ja/docs/concepts/workloads/controllers/deployment/)により、ダウンタイムなしで実行中のサービスを簡単に更新できます。 diff --git a/content/ja/docs/concepts/containers/container-environment.md b/content/ja/docs/concepts/containers/container-environment.md index 261f508ca2..9c40e3c054 100644 --- a/content/ja/docs/concepts/containers/container-environment.md +++ b/content/ja/docs/concepts/containers/container-environment.md @@ -43,7 +43,7 @@ FOO_SERVICE_HOST=<サービスが実行されているホスト> FOO_SERVICE_PORT=<サービスが実行されているポート> ``` -サービスは専用のIPアドレスを持ち、[DNSアドオン](http://releases.k8s.io/{{< param "githubbranch" >}}/cluster/addons/dns/)が有効の場合、DNSを介してコンテナで利用可能です。 +サービスは専用のIPアドレスを持ち、[DNSアドオン](http://releases.k8s.io/{{< param "fullversion" >}}/cluster/addons/dns/)が有効の場合、DNSを介してコンテナで利用可能です。 diff --git a/content/ja/docs/concepts/overview/kubernetes-api.md b/content/ja/docs/concepts/overview/kubernetes-api.md index 876cdac7fa..c5a7a06c89 100644 --- a/content/ja/docs/concepts/overview/kubernetes-api.md +++ b/content/ja/docs/concepts/overview/kubernetes-api.md @@ -65,7 +65,7 @@ Kubernetes APIサーバーは、`/openapi/v2`エンドポイントを介してOp -Kubernetesは、他の手段として主にクラスター間の連携用途向けのAPIに、Protocol buffersをベースにしたシリアライズフォーマットを実装しています。このフォーマットに関しては、[Kubernetes Protobuf serialization](https://github.com/kubernetes/community/blob/master/contributors/des ign-proposals/api-machinery/protobuf.md)デザイン提案を参照してください。また、各スキーマのInterface Definition Language（IDL）ファイルは、APIオブジェクトを定義しているGoパッケージ内に配置されています。 +Kubernetesは、他の手段として主にクラスター間の連携用途向けのAPIに、Protocol buffersをベースにしたシリアライズフォーマットを実装しています。このフォーマットに関しては、[Kubernetes Protobuf serialization](https://github.com/kubernetes/design-proposals-archive/blob/main/api-machinery/protobuf.md)デザイン提案を参照してください。また、各スキーマのInterface Definition Language（IDL）ファイルは、APIオブジェクトを定義しているGoパッケージ内に配置されています。 ## 永続性 diff --git a/content/ja/docs/concepts/services-networking/connect-applications-service.md b/content/ja/docs/concepts/services-networking/connect-applications-service.md index ca2b422113..86d7cd1b21 100644 --- a/content/ja/docs/concepts/services-networking/connect-applications-service.md +++ b/content/ja/docs/concepts/services-networking/connect-applications-service.md @@ -139,7 +139,7 @@ Service IPは完全に仮想的なもので、ホスト側のネットワーク ## Serviceにアクセスする Kubernetesは、環境変数とDNSの2つの主要なService検索モードをサポートしています。 -前者はそのまま使用でき、後者は[CoreDNSクラスタアドオン](https://releases.k8s.io/{{< param "githubbranch" >}}/cluster/addons/dns/coredns)を必要とします。 +前者はそのまま使用でき、後者は[CoreDNSクラスタアドオン](https://releases.k8s.io/{{< param "fullversion" >}}/cluster/addons/dns/coredns)を必要とします。 {{< note >}} サービス環境変数が望ましくない場合(予想されるプログラム変数と衝突する可能性がある、処理する変数が多すぎる、DNSのみを使用するなど)、[Pod仕様](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#pod-v1-core)で`enableServiceLinks`フラグを`false`に設定することでこのモードを無効にできます。 {{< /note >}} @@ -234,7 +234,7 @@ Address 1: 10.0.162.149 * 証明書を使用するように構成されたnginxサーバー * Podが証明書にアクセスできるようにする[Secret](/ja/docs/concepts/configuration/secret/) -これらはすべて[nginx httpsの例](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/https-nginx/)から取得できます。 +これらはすべて[nginx httpsの例](https://github.com/kubernetes/examples/tree/master/staging/https-nginx/)から取得できます。 これにはツールをインストールする必要があります。 これらをインストールしたくない場合は、後で手動の手順に従ってください。つまり: @@ -309,7 +309,7 @@ nginxsecret kubernetes.io/tls 2 1m nginx-secure-appマニフェストに関する注目すべき点: - 同じファイルにDeploymentとServiceの両方が含まれています。 -- [nginxサーバー](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/https-nginx/default.conf)はポート80のHTTPトラフィックと443のHTTPSトラフィックを処理し、nginx Serviceは両方のポートを公開します。 +- [nginxサーバー](https://github.com/kubernetes/examples/tree/master/staging/https-nginx/default.conf)はポート80のHTTPトラフィックと443のHTTPSトラフィックを処理し、nginx Serviceは両方のポートを公開します。 - 各コンテナは`/etc/nginx/ssl`にマウントされたボリュームを介してキーにアクセスできます。 これは、nginxサーバーが起動する*前に*セットアップされます。 diff --git a/content/ja/docs/concepts/services-networking/service.md b/content/ja/docs/concepts/services-networking/service.md index 8481f990aa..7506c3b4b6 100644 --- a/content/ja/docs/concepts/services-networking/service.md +++ b/content/ja/docs/concepts/services-networking/service.md @@ -280,7 +280,7 @@ Kubernetesは、Serviceオブジェクトを見つけ出すために2つの主 PodがNode上で稼働するとき、kubeletはアクティブな各Serviceに対して、環境変数のセットを追加します。 これは[Docker links互換性](https://docs.docker.com/userguide/dockerlinks/)のある変数( -[makeLinkVariables関数](https://releases.k8s.io/{{< param "githubbranch" >}}/pkg/kubelet/envvars/envvars.go#L72)を確認してください)や、より簡単な`{SVCNAME}_SERVICE_HOST`や、`{SVCNAME}_SERVICE_PORT`変数をサポートします。この変数名で使われるService名は大文字に変換され、`-`は`_`に変換されます。 +[makeLinkVariables関数](https://releases.k8s.io/{{< param "fullversion" >}}/pkg/kubelet/envvars/envvars.go#L72)を確認してください)や、より簡単な`{SVCNAME}_SERVICE_HOST`や、`{SVCNAME}_SERVICE_PORT`変数をサポートします。この変数名で使われるService名は大文字に変換され、`-`は`_`に変換されます。 例えば、TCPポート6379番を公開していて、さらにclusterIPが10.0.0.11に割り当てられている`redis-master`というServiceは、下記のような環境変数を生成します。 diff --git a/content/ja/docs/concepts/storage/projected-volumes.md b/content/ja/docs/concepts/storage/projected-volumes.md new file mode 100644 index 0000000000..5bb0a7be11 --- /dev/null +++ b/content/ja/docs/concepts/storage/projected-volumes.md @@ -0,0 +1,91 @@ +--- +title: 投影ボリューム +content_type: concept +weight: 21 # just after persistent volumes +--- + + + +このドキュメントでは、Kubernetesの*投影ボリューム*について説明します。[ボリューム](/docs/concepts/storage/volumes/)に精通していることをお勧めします。 + + + +## 概要 + +ボリュームは、いくつかの既存の`投影`ボリュームソースを同じディレクトリにマップします。 + +現在、次のタイプのボリュームソースを投影できます。 + +* [`secret`](/docs/concepts/storage/volumes/#secret) +* [`downwardAPI`](/docs/concepts/storage/volumes/#downwardapi) +* [`configMap`](/docs/concepts/storage/volumes/#configmap) +* `serviceAccountToken` + +すべてのソースは、Podと同じnamespaceにある必要があります。詳細は[all-in-one volume](https://github.com/kubernetes/design-proposals-archive/blob/main/node/all-in-one-volume.md)デザインドキュメントを参照してください。 + +### secret、downwardAPI、およびconfigMapを使用した構成例 {#example-configuration-secret-downwardapi-configmap} + +{{< codenew file="pods/storage/projected-secret-downwardapi-configmap.yaml" >}} + +### 構成例:デフォルト以外のアクセス許可モードが設定されたsecret {#example-configuration-secrets-nondefault-permission-mode} + +{{< codenew file="pods/storage/projected-secrets-nondefault-permission-mode.yaml" >}} + +各投影ボリュームソースは、specの`sources`にリストされています。パラメーターは、2つの例外を除いてほぼ同じです。 + +* secretについて、ConfigMapの命名と一致するように`secretName`フィールドが`name`に変更されました。 +* `defaultMode`はprojectedレベルでのみ指定でき、各ボリュームソースには指定できません。ただし上に示したように、個々の投影ごとに`mode`を明示的に設定できます。 + +`TokenRequestProjection`機能が有効になっている場合、現在の[サービスアカウントトークン](/ja/docs/reference/access-authn-authz/authentication/#service-account-token)を指定されたパスのPodに挿入できます。例えば: + +{{< codenew file="pods/storage/projected-service-account-token.yaml" >}} + +この例のPodには、挿入されたサービスアカウントトークンを含む投影ボリュームがあります。このトークンはPodのコンテナがKubernetes APIサーバーにアクセスするために使用できます。この`audience`フィールドにはトークンの受信対象者が含まれています。トークンの受信者は、トークンの`audience`フィールドで指定された識別子で自分自身であるかを識別します。そうでない場合はトークンを拒否します。このフィールドはオプションで、デフォルトではAPIサーバーの識別子が指定されます。 + +`expirationSeconds`はサービスアカウントトークンが有効であると予想される期間です。 +デフォルトは1時間で、最低でも10分(600秒)でなければなりません。 +管理者は、APIサーバーに`--service-account-max-token-expiration`オプションを指定することで、その最大値を制限することも可能です。 +`path`フィールドは、投影ボリュームのマウントポイントへの相対パスを指定します。 + + +{{< note >}} +投影ボリュームソースを[`subPath`](/docs/concepts/storage/volumes/#using-subpath)ボリュームマウントとして使用しているコンテナは、それらのボリュームソースの更新を受信しません。 +{{< /note >}} + +## SecurityContextの相互作用 + +サービスアカウントの投影ボリューム拡張でのファイル権限処理の[提案](https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/2451-service-account-token-volumes#proposal)により、正しい所有者権限が設定された投影ファイルが導入されました。 + +### Linux + +投影ボリュームがあり、Podの[`SecurityContext`](/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context)に`RunAsUser`が設定されているLinux Podでは、投影されたファイルには、コンテナユーザーの所有権を含む正しい所有権が設定されます。 + +### Windows + +投影ボリュームを持ち、Podの`SecurityContext`で`RunAsUsername`を設定したWindows Podでは、Windowsのユーザーアカウント管理方法により所有権が強制されません。 +Windowsは、ローカルユーザーとグループアカウントをセキュリティアカウントマネージャー(SAM)と呼ばれるデータベースファイルに保存し、管理します。 +各コンテナはSAMデータベースの独自のインスタンスを維持し、コンテナの実行中はホストはそのインスタンスを見ることができません。 +Windowsコンテナは、OSのユーザーモード部分をホストから分離して実行するように設計されており、そのため仮想SAMデータベースを維持することになります。 +そのため、ホスト上で動作するkubeletには、仮想化されたコンテナアカウントのホストファイル所有権を動的に設定する機能がありません。 +ホストマシン上のファイルをコンテナと共有する場合は、`C:\`以外の独自のボリュームマウントに配置することをお勧めします。 + +デフォルトでは、投影ボリュームファイルの例に示されているように、投影されたファイルには次の所有権があります。 +```powershell +PS C:\> Get-Acl C:\var\run\secrets\kubernetes.io\serviceaccount\..2021_08_31_22_22_18.318230061\ca.crt | Format-List + +Path : Microsoft.PowerShell.Core\FileSystem::C:\var\run\secrets\kubernetes.io\serviceaccount\..2021_08_31_22_22_18.318230061\ca.crt +Owner : BUILTIN\Administrators +Group : NT AUTHORITY\SYSTEM +Access : NT AUTHORITY\SYSTEM Allow FullControl + BUILTIN\Administrators Allow FullControl + BUILTIN\Users Allow ReadAndExecute, Synchronize +Audit : +Sddl : O:BAG:SYD:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU) +``` +これは、`ContainerAdministrator`のようなすべての管理者ユーザーが読み取り、書き込み、および実行アクセス権を持ち、非管理者ユーザーが読み取りおよび実行アクセス権を持つことを意味します。 + +{{< note >}} +一般に、コンテナにホストへのアクセスを許可することは、潜在的なセキュリティの悪用への扉を開く可能性があるため、お勧めできません。 + +Windows Podの`SecurityContext`に`RunAsUser`を指定して作成すると、Podは`ContainerCreating`で永久に固まります。したがって、Windows PodでLinux専用の`RunAsUser`オプションを使用しないことをお勧めします。 +{{< /note >}} diff --git a/content/ja/docs/concepts/workloads/controllers/statefulset.md b/content/ja/docs/concepts/workloads/controllers/statefulset.md index 160f831969..b69e46af52 100644 --- a/content/ja/docs/concepts/workloads/controllers/statefulset.md +++ b/content/ja/docs/concepts/workloads/controllers/statefulset.md @@ -29,7 +29,7 @@ StatefulSetは下記の1つ以上の項目を要求するアプリケーショ ## 制限事項 -* 提供されたPodのストレージは、要求された`storage class`にもとづいて[PersistentVolume Provisioner](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/persistent-volume-provisioning/README.md)によってプロビジョンされるか、管理者によって事前にプロビジョンされなくてはなりません。 +* 提供されたPodのストレージは、要求された`storage class`にもとづいて[PersistentVolume Provisioner](https://github.com/kubernetes/examples/tree/master/staging/persistent-volume-provisioning/README.md)によってプロビジョンされるか、管理者によって事前にプロビジョンされなくてはなりません。 * StatefulSetの削除もしくはスケールダウンをすることにより、StatefulSetに関連したボリュームは削除*されません* 。 これはデータ安全性のためで、関連するStatefulSetのリソース全てを自動的に削除するよりもたいてい有効です。 * StatefulSetは現在、Podのネットワークアイデンティティーに責務をもつために[Headless Service](/ja/docs/concepts/services-networking/service/#headless-service)を要求します。ユーザーはこのServiceを作成する責任があります。 * StatefulSetは、StatefulSetが削除されたときにPodの停止を行うことを保証していません。StatefulSetにおいて、規則的で安全なPodの停止を行う場合、削除のために事前にそのStatefulSetの数を0にスケールダウンさせることが可能です。 diff --git a/content/ja/docs/reference/access-authn-authz/authentication.md b/content/ja/docs/reference/access-authn-authz/authentication.md index 0aee169573..e2bd78316b 100644 --- a/content/ja/docs/reference/access-authn-authz/authentication.md +++ b/content/ja/docs/reference/access-authn-authz/authentication.md @@ -105,7 +105,7 @@ APIサーバーの`--enable-bootstrap-token-auth`フラグで、Bootstrap Token ブートストラップトークンの認証機能やコントローラーについての詳細な説明、`kubeadm`でこれらのトークンを管理する方法については、[ブートストラップトークン](/docs/reference/access-authn-authz/bootstrap-tokens/)を参照してください。 -### サービスアカウントトークン +### サービスアカウントトークン {#service-account-token} サービスアカウントは、自動的に有効化される認証機能で、署名されたBearerトークンを使ってリクエストを検証します。このプラグインは、オプションとして2つのフラグを取ります。 diff --git a/content/ja/docs/reference/kubectl/cheatsheet.md b/content/ja/docs/reference/kubectl/cheatsheet.md index d7a636348b..e4f8c70575 100644 --- a/content/ja/docs/reference/kubectl/cheatsheet.md +++ b/content/ja/docs/reference/kubectl/cheatsheet.md @@ -307,9 +307,9 @@ kubectl top pod POD_NAME --containers # 特定のPodとそのコ ## ノードおよびクラスターとの対話処理 ```bash -kubectl cordon my-node # my-nodeをスケーリングされないように設定します +kubectl cordon my-node # my-nodeをスケジューリング不能に設定します kubectl drain my-node # メンテナンスの準備としてmy-nodeで動作中のPodを空にします -kubectl uncordon my-node # my-nodeをスケーリングされるように設定します +kubectl uncordon my-node # my-nodeをスケジューリング可能に設定します kubectl top node my-node # 特定のノードのメトリクスを表示します kubectl cluster-info # Kubernetesクラスターのマスターとサービスのアドレスを表示します kubectl cluster-info dump # 現在のクラスター状態を標準出力にダンプします diff --git a/content/ja/docs/setup/best-practices/multiple-zones.md b/content/ja/docs/setup/best-practices/multiple-zones.md index 29370c78b6..4ba0583186 100644 --- a/content/ja/docs/setup/best-practices/multiple-zones.md +++ b/content/ja/docs/setup/best-practices/multiple-zones.md @@ -15,7 +15,7 @@ This page describes how to run a cluster in multiple zones. ## 始めに Kubernetes 1.2より、複数のゾーンにおいて単一のクラスターを運用するサポートが追加されました(GCEでは単純に"ゾーン"，AWSは"アベイラビリティゾーン"と呼びますが、ここでは"ゾーン"とします)。 -これは、より範囲の広いCluster Federationの軽量バージョンです(以前は["Ubernetes"](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/design-proposals/multicluster/federation.md)の愛称で言及されていました)。 +これは、より範囲の広いCluster Federationの軽量バージョンです(以前は["Ubernetes"](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/multicluster/federation.md)の愛称で言及されていました)。 完全なCluster Federationでは、異なるリージョンやクラウドプロバイダー(あるいはオンプレミスデータセンター)内の独立したKubernetesクラスターをまとめることが可能になります。しかしながら、多くのユーザーは単に1つのクラウドプロバイダーの複数のゾーンでより可用性の高いKubernetesクラスターを運用したいと考えており、バージョン1.2におけるマルチゾーンサポート(以前は"Ubernetes Lite"の愛称で使用されていました)ではこれが可能になります。 マルチゾーンサポートは故意に限定されています: 1つのKubernetesクラスターは複数のゾーンで運用することができますが、同じリージョン(あるいはクラウドプロバイダー)のみです。現在はGCEとAWSのみが自動的にサポートされています(他のクラウドプロバイダーやベアメタル環境においても、単にノードやボリュームに追加する適切なラベルを用意して同様のサポートを追加することは容易ではありますが)。 diff --git a/content/ja/docs/setup/production-environment/turnkey/aws.md b/content/ja/docs/setup/production-environment/turnkey/aws.md index 03246c1b06..f7ec4bd012 100644 --- a/content/ja/docs/setup/production-environment/turnkey/aws.md +++ b/content/ja/docs/setup/production-environment/turnkey/aws.md @@ -53,9 +53,9 @@ export PATH=/platforms/linux/amd64:$PATH 新しいクラスターを試すには、[簡単なnginxの例](/ja/docs/tasks/run-application/run-stateless-application-deployment/)を参照してください。 -"Guestbook"アプリケーションは、Kubernetesを始めるもう一つのポピュラーな例です: [guestbookの例](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/guestbook/) +"Guestbook"アプリケーションは、Kubernetesを始めるもう一つのポピュラーな例です: [guestbookの例](https://github.com/kubernetes/examples/tree/master/guestbook/) -より完全なアプリケーションについては、[examplesディレクトリ](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/)を参照してください。 +より完全なアプリケーションについては、[examplesディレクトリ](https://github.com/kubernetes/examples/tree/master/)を参照してください。 ## クラスターのスケーリング diff --git a/content/ja/docs/setup/production-environment/turnkey/gce.md b/content/ja/docs/setup/production-environment/turnkey/gce.md index dcd269446a..39e03efc94 100644 --- a/content/ja/docs/setup/production-environment/turnkey/gce.md +++ b/content/ja/docs/setup/production-environment/turnkey/gce.md @@ -146,7 +146,7 @@ Some of the pods may take a few seconds to start up (during this time they'll sh Then, see [a simple nginx example](/ja/docs/tasks/run-application/run-stateless-application-deployment/) to try out your new cluster. -For more complete applications, please look in the [examples directory](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/). The [guestbook example](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/guestbook/) is a good "getting started" walkthrough. +For more complete applications, please look in the [examples directory](https://github.com/kubernetes/examples/tree/master/). The [guestbook example](https://github.com/kubernetes/examples/tree/master/guestbook/) is a good "getting started" walkthrough. ## クラスターの解体 diff --git a/content/ja/docs/tasks/access-application-cluster/list-all-running-container-images.md b/content/ja/docs/tasks/access-application-cluster/list-all-running-container-images.md index b20a1d77d0..c1eb59241f 100644 --- a/content/ja/docs/tasks/access-application-cluster/list-all-running-container-images.md +++ b/content/ja/docs/tasks/access-application-cluster/list-all-running-container-images.md @@ -62,7 +62,7 @@ jsonpathは次のように解釈されます: `range`を使用して要素を個別に繰り返し処理することにより、フォーマットをさらに制御できます。 ```shell -kubectl get pods --all-namespaces -o=jsonpath='{range .items[*]}{"\n"}{.metadata.name}{":\t"}{range .spec.containers[*]}{.image}{", "}{end}{end}' |\ +kubectl get pods --all-namespaces -o jsonpath='{range .items[*]}{"\n"}{.metadata.name}{":\t"}{range .spec.containers[*]}{.image}{", "}{end}{end}' |\ sort ``` @@ -71,7 +71,7 @@ sort 特定のラベルに一致するPodのみを対象とするには、-lフラグを使用します。以下は、`app=nginx`に一致するラベルを持つPodのみに一致します。 ```shell -kubectl get pods --all-namespaces -o=jsonpath="{..image}" -l app=nginx +kubectl get pods --all-namespaces -o jsonpath="{..image}" -l app=nginx ``` ## Podの名前空間でコンテナイメージ一覧をフィルタリングする {#list-container-images-filtering-by-pod-namespace} diff --git a/content/ja/docs/tasks/administer-cluster/certificates.md b/content/ja/docs/tasks/administer-cluster/certificates.md new file mode 100644 index 0000000000..56a0d4349d --- /dev/null +++ b/content/ja/docs/tasks/administer-cluster/certificates.md @@ -0,0 +1,235 @@ +--- +title: 証明書 +content_type: task +weight: 20 +--- + + + + +クライアント証明書認証を使用する場合、`easyrsa`,`openssl`または`cfssl`を使って手動で証明書を生成することができます。 + + + +### easyrsa + +**easyrsa**はクラスターの証明書を手動で生成することができます。 + +1. パッチが適用されたバージョンのeasyrsa3をダウンロードし、解凍し、初期化します。 + + curl -LO https://storage.googleapis.com/kubernetes-release/easy-rsa/easy-rsa.tar.gz + tar xzf easy-rsa.tar.gz + cd easy-rsa-master/easyrsa3 + ./easyrsa init-pki +1. 新しい認証局(CA)を生成します。 + `req-cn`はCAの新しいルート証明書のコモンネーム(CN)を指定します。 + + ./easyrsa --batch "--req-cn=${MASTER_IP}@`date +%s`" build-ca nopass +1. サーバー証明書と鍵を生成します。 + 引数`--subject-alt-name`は、APIサーバーがアクセス可能なIPとDNS名を設定します。 + `MASTER_CLUSTER_IP`は通常、APIサーバーとコントローラーマネージャーコンポーネントの両方で`--service-cluster-ip-range`引数に指定したサービスCIDRの最初のIPとなります。 + 引数`--days`は、証明書の有効期限が切れるまでの日数を設定するために使用します。 + また、以下のサンプルでは、デフォルトのDNSドメイン名として`cluster.local`を使用することを想定しています。 + + ./easyrsa --subject-alt-name="IP:${MASTER_IP},"\ + "IP:${MASTER_CLUSTER_IP},"\ + "DNS:kubernetes,"\ + "DNS:kubernetes.default,"\ + "DNS:kubernetes.default.svc,"\ + "DNS:kubernetes.default.svc.cluster,"\ + "DNS:kubernetes.default.svc.cluster.local" \ + --days=10000 \ + build-server-full server nopass +1. `pki/ca.crt`,`pki/issued/server.crt`,`pki/private/server.key`を自分のディレクトリにコピーします。 +1. APIサーバーのスタートパラメーターに以下のパラメーターを記入し、追加します。 + + --client-ca-file=/yourdirectory/ca.crt + --tls-cert-file=/yourdirectory/server.crt + --tls-private-key-file=/yourdirectory/server.key + +### openssl + +**openssl**は、クラスター用の証明書を手動で生成することができます。 + +1. 2048bitのca.keyを生成します: + + openssl genrsa -out ca.key 2048 +1. ca.keyに従ってca.crtを生成します(-daysで証明書の有効期限を設定します)。 + + openssl req -x509 -new -nodes -key ca.key -subj "/CN=${MASTER_IP}" -days 10000 -out ca.crt +1. 2048bitでserver.keyを生成します: + + openssl genrsa -out server.key 2048 +1. 証明書署名要求(CSR)を生成するための設定ファイルを作成します。 + 角括弧で囲まれた値(例:``)は必ず実際の値に置き換えてから、ファイル(例:`csr.conf`)に保存してください。`MASTER_CLUSTER_IP`の値は、前のサブセクションで説明したように、APIサーバーのサービスクラスターのIPであることに注意してください。また、以下のサンプルでは、デフォルトのDNSドメイン名として`cluster.local`を使用することを想定しています。 + + [ req ] + default_bits = 2048 + prompt = no + default_md = sha256 + req_extensions = req_ext + distinguished_name = dn + + [ dn ] + C = + ST = + L = + O = + OU = + CN = + + [ req_ext ] + subjectAltName = @alt_names + + [ alt_names ] + DNS.1 = kubernetes + DNS.2 = kubernetes.default + DNS.3 = kubernetes.default.svc + DNS.4 = kubernetes.default.svc.cluster + DNS.5 = kubernetes.default.svc.cluster.local + IP.1 = + IP.2 = + + [ v3_ext ] + authorityKeyIdentifier=keyid,issuer:always + basicConstraints=CA:FALSE + keyUsage=keyEncipherment,dataEncipherment + extendedKeyUsage=serverAuth,clientAuth + subjectAltName=@alt_names +1. 設定ファイルに基づき、証明書署名要求を生成します: + + openssl req -new -key server.key -out server.csr -config csr.conf +1. ca.key、ca.crt、server.csrを使用して、サーバー証明書を生成します: + + openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \ + -CAcreateserial -out server.crt -days 10000 \ + -extensions v3_ext -extfile csr.conf +1. 証明書署名要求を表示します: + + openssl req -noout -text -in ./server.csr +1. 証明書を表示します: + + openssl x509 -noout -text -in ./server.crt + +最後に、同じパラメーターをAPIサーバーのスタートパラメーターに追加します。 + +### cfssl + +**cfssl**も証明書生を成するためのツールです。 + +1. 以下のように、コマンドラインツールをダウンロードし、解凍して準備してください。 + なお、サンプルのコマンドは、お使いのハードウェア・アーキテクチャやCFSSLのバージョンに合わせる必要があるかもしれません。 + + curl -L https://github.com/cloudflare/cfssl/releases/download/v1.5.0/cfssl_1.5.0_linux_amd64 -o cfssl + chmod +x cfssl + curl -L https://github.com/cloudflare/cfssl/releases/download/v1.5.0/cfssljson_1.5.0_linux_amd64 -o cfssljson + chmod +x cfssljson + curl -L https://github.com/cloudflare/cfssl/releases/download/v1.5.0/cfssl-certinfo_1.5.0_linux_amd64 -o cfssl-certinfo + chmod +x cfssl-certinfo +1. 成果物を格納するディレクトリを作成し、cfsslを初期化します: + + mkdir cert + cd cert + ../cfssl print-defaults config > config.json + ../cfssl print-defaults csr > csr.json +1. CAファイルを生成するためのJSON設定ファイル、例えば`ca-config.json`を作成します: + + { + "signing": { + "default": { + "expiry": "8760h" + }, + "profiles": { + "kubernetes": { + "usages": [ + "signing", + "key encipherment", + "server auth", + "client auth" + ], + "expiry": "8760h" + } + } + } + } +1. CA証明書署名要求(CSR)用のJSON設定ファイル(例:`ca-csr.json`)を作成します。 + 角括弧で囲まれた値は、必ず使用したい実際の値に置き換えてください。 + + { + "CN": "kubernetes", + "key": { + "algo": "rsa", + "size": 2048 + }, + "names":[{ + "C": "", + "ST": "", + "L": "", + "O": "", + "OU": "" + }] + } +1. CAキー(`ca-key.pem`)と証明書(`ca.pem`)を生成します: + + ../cfssl gencert -initca ca-csr.json | ../cfssljson -bare ca +1. APIサーバーの鍵と証明書を生成するためのJSON設定ファイル、例えば`server-csr.json`を作成します。 + 角括弧内の値は、必ず使用したい実際の値に置き換えてください。 + `MASTER_CLUSTER_IP`は、前のサブセクションで説明したように、APIサーバーのサービスクラスターのIPです。 + また、以下のサンプルでは、デフォルトのDNSドメイン名として`cluster.local`を使用することを想定しています。 + + { + "CN": "kubernetes", + "hosts": [ + "127.0.0.1", + "", + "", + "kubernetes", + "kubernetes.default", + "kubernetes.default.svc", + "kubernetes.default.svc.cluster", + "kubernetes.default.svc.cluster.local" + ], + "key": { + "algo": "rsa", + "size": 2048 + }, + "names": [{ + "C": "", + "ST": "", + "L": "", + "O": "", + "OU": "" + }] + } +1. APIサーバーの鍵と証明書を生成します。 + デフォルトでは、それぞれ`server-key.pem`と`server.pem`というファイルに保存されます: + + ../cfssl gencert -ca=ca.pem -ca-key=ca-key.pem \ + --config=ca-config.json -profile=kubernetes \ + server-csr.json | ../cfssljson -bare server + + +## 自己署名入りCA証明書を配布する + +クライアントノードが自己署名入りCA証明書を有効なものとして認識できない場合があります。 + +非プロダクション環境、または会社のファイアウォールの内側での開発環境であれば、自己署名入りCA証明書をすべてのクライアントに配布し、有効な証明書のローカルリストを更新することができます。 + +各クライアントで、次の操作を実行します: + +```bash +sudo cp ca.crt /usr/local/share/ca-certificates/kubernetes.crt +sudo update-ca-certificates +``` + +``` +Updating certificates in /etc/ssl/certs... +1 added, 0 removed; done. +Running hooks in /etc/ca-certificates/update.d.... +done. +``` + +## 証明書API + +認証に使用するx509証明書のプロビジョニングには`certificates.k8s.io` APIを使用することができます。[ここ](/docs/tasks/tls/managing-tls-in-a-cluster)に記述されています。 + diff --git a/content/ja/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md b/content/ja/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md index 68929ec5bb..08e48b9fa7 100644 --- a/content/ja/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md +++ b/content/ja/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md @@ -131,7 +131,7 @@ kubeletはコンテナが問題なく動いていると判断します。 200以上400未満のコードは成功とみなされ、その他のコードは失敗とみなされます。 -[server.go](https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/test/images/agnhost/liveness/server.go) +[server.go](https://github.com/kubernetes/kubernetes/blob/master/test/images/agnhost/liveness/server.go) にてサーバーのソースコードを確認することができます。 コンテナが生きている初めの10秒間は、`/healthz`ハンドラーが200ステータスを返します。 diff --git a/content/ja/docs/tasks/configure-pod-container/configure-projected-volume-storage.md b/content/ja/docs/tasks/configure-pod-container/configure-projected-volume-storage.md index c67c826c4d..4c70662d42 100644 --- a/content/ja/docs/tasks/configure-pod-container/configure-projected-volume-storage.md +++ b/content/ja/docs/tasks/configure-pod-container/configure-projected-volume-storage.md @@ -79,5 +79,5 @@ kubectl delete secret user pass ## {{% heading "whatsnext" %}} * [`projected`](/docs/concepts/storage/volumes/#projected)ボリュームについてさらに学ぶ -* [all-in-oneボリューム](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/design-proposals/node/all-in-one-volume.md)のデザインドキュメントを読む +* [all-in-oneボリューム](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node/all-in-one-volume.md)のデザインドキュメントを読む diff --git a/content/ja/docs/tutorials/stateful-application/basic-stateful-set.md b/content/ja/docs/tutorials/stateful-application/basic-stateful-set.md index 6b9d8da5a8..093962f2ce 100644 --- a/content/ja/docs/tutorials/stateful-application/basic-stateful-set.md +++ b/content/ja/docs/tutorials/stateful-application/basic-stateful-set.md @@ -15,7 +15,7 @@ weight: 10 * [Cluster DNS](/ja/docs/concepts/services-networking/dns-pod-service/) * [Headless Service](/ja/docs/concepts/services-networking/service/#headless-services) * [PersistentVolume](/ja/docs/concepts/storage/persistent-volumes/) -* [PersistentVolumeのプロビジョニング](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/persistent-volume-provisioning/) +* [PersistentVolumeのプロビジョニング](https://github.com/kubernetes/examples/tree/master/staging/persistent-volume-provisioning/) * [StatefulSet](/ja/docs/concepts/workloads/controllers/statefulset/) * [kubectl](/docs/reference/kubectl/kubectl/)コマンドラインツール diff --git a/content/ja/examples/application/job/cronjob.yaml b/content/ja/examples/application/job/cronjob.yaml index 34ab2a3f06..5691950410 100644 --- a/content/ja/examples/application/job/cronjob.yaml +++ b/content/ja/examples/application/job/cronjob.yaml @@ -3,7 +3,7 @@ kind: CronJob metadata: name: hello spec: - schedule: "*/1 * * * *" + schedule: "* * * * *" jobTemplate: spec: template: diff --git a/content/ja/examples/pods/storage/projected-secret-downwardapi-configmap.yaml b/content/ja/examples/pods/storage/projected-secret-downwardapi-configmap.yaml new file mode 100644 index 0000000000..270db99dcd --- /dev/null +++ b/content/ja/examples/pods/storage/projected-secret-downwardapi-configmap.yaml @@ -0,0 +1,35 @@ +apiVersion: v1 +kind: Pod +metadata: + name: volume-test +spec: + containers: + - name: container-test + image: busybox + volumeMounts: + - name: all-in-one + mountPath: "/projected-volume" + readOnly: true + volumes: + - name: all-in-one + projected: + sources: + - secret: + name: mysecret + items: + - key: username + path: my-group/my-username + - downwardAPI: + items: + - path: "labels" + fieldRef: + fieldPath: metadata.labels + - path: "cpu_limit" + resourceFieldRef: + containerName: container-test + resource: limits.cpu + - configMap: + name: myconfigmap + items: + - key: config + path: my-group/my-config diff --git a/content/ja/examples/pods/storage/projected-secrets-nondefault-permission-mode.yaml b/content/ja/examples/pods/storage/projected-secrets-nondefault-permission-mode.yaml new file mode 100644 index 0000000000..f69b43161e --- /dev/null +++ b/content/ja/examples/pods/storage/projected-secrets-nondefault-permission-mode.yaml @@ -0,0 +1,27 @@ +apiVersion: v1 +kind: Pod +metadata: + name: volume-test +spec: + containers: + - name: container-test + image: busybox + volumeMounts: + - name: all-in-one + mountPath: "/projected-volume" + readOnly: true + volumes: + - name: all-in-one + projected: + sources: + - secret: + name: mysecret + items: + - key: username + path: my-group/my-username + - secret: + name: mysecret2 + items: + - key: password + path: my-group/my-password + mode: 511 diff --git a/content/ja/examples/pods/storage/projected-service-account-token.yaml b/content/ja/examples/pods/storage/projected-service-account-token.yaml new file mode 100644 index 0000000000..3ad06b5dc7 --- /dev/null +++ b/content/ja/examples/pods/storage/projected-service-account-token.yaml @@ -0,0 +1,21 @@ +apiVersion: v1 +kind: Pod +metadata: + name: sa-token-test +spec: + containers: + - name: container-test + image: busybox + volumeMounts: + - name: token-vol + mountPath: "/service-account" + readOnly: true + serviceAccountName: default + volumes: + - name: token-vol + projected: + sources: + - serviceAccountToken: + audience: api + expirationSeconds: 3600 + path: token diff --git a/content/ko/_index.html b/content/ko/_index.html index e5c54b6a8a..0925f2ef7e 100644 --- a/content/ko/_index.html +++ b/content/ko/_index.html @@ -30,7 +30,7 @@ Google이 일주일에 수십억 개의 컨테이너들을 운영하게 해준 {{% blocks/feature image="suitcase" %}} #### K8s를 어디서나 실행 -쿠버네티스는 오픈소스로서 온-프레미스, 하이브리드, 또는 퍼블릭 클라우드 인프라스트럭처를 활용하는데 자유를 제공하며, 워크로드를 사용자에게 관건이 되는 곳으로 손쉽게 이동시켜 줄 수 있습니다. +쿠버네티스는 오픈소스로서 온-프레미스, 하이브리드, 또는 퍼블릭 클라우드 인프라스트럭처를 활용하는 데 자유를 제공하며, 워크로드를 사용자에게 관건이 되는 곳으로 손쉽게 이동시켜 줄 수 있습니다. {{% /blocks/feature %}} @@ -43,12 +43,12 @@ Google이 일주일에 수십억 개의 컨테이너들을 운영하게 해준

- Attend KubeCon Europe on May 17-20, 2022 + KubeCon Europe (2022년 5월 17~20일) 참가하기



- Attend KubeCon North America on October 24-28, 2022 + KubeCon North America (2022년 10월 24~28일) 참가하기
diff --git a/content/ko/community/_index.html b/content/ko/community/_index.html index 9666cd4a14..30ede236bc 100644 --- a/content/ko/community/_index.html +++ b/content/ko/community/_index.html @@ -19,6 +19,7 @@ cid: community
+기여자 커뮤니티      커뮤니티 가치      행동 강령       비디오      diff --git a/content/ko/docs/concepts/architecture/cloud-controller.md b/content/ko/docs/concepts/architecture/cloud-controller.md index e5e7d315c5..eccfe091ce 100644 --- a/content/ko/docs/concepts/architecture/cloud-controller.md +++ b/content/ko/docs/concepts/architecture/cloud-controller.md @@ -44,10 +44,10 @@ weight: 40 ### 노드 컨트롤러 노드 컨트롤러는 클라우드 인프라스트럭처에 새 서버가 생성될 때 {{< glossary_tooltip text="노드" term_id="node" >}} -오브젝트를 생성하는 역할을 한다. 노드 컨트롤러는 클라우드 공급자의 사용자 +오브젝트를 업데이트하는 역할을 한다. 노드 컨트롤러는 클라우드 공급자의 사용자 테넌시 내에서 실행되는 호스트에 대한 정보를 가져온다. 노드 컨트롤러는 다음 기능들을 수행한다. -1. 컨트롤러가 클라우드 공급자 API를 통해 찾아내는 각 서버에 대해 노드 오브젝트를 초기화한다. +1. 클라우드 공급자 API를 통해 획득한 해당 서버의 고유 ID를 노드 오브젝트에 업데이트한다. 2. 클라우드 관련 정보(예를 들어, 노드가 배포되는 지역과 사용 가능한 리소스(CPU, 메모리 등))를 사용해서 노드 오브젝트에 어노테이션과 레이블을 작성한다. 3. 노드의 호스트 이름과 네트워크 주소를 가져온다. diff --git a/content/ko/docs/concepts/architecture/cri.md b/content/ko/docs/concepts/architecture/cri.md new file mode 100644 index 0000000000..69175432d1 --- /dev/null +++ b/content/ko/docs/concepts/architecture/cri.md @@ -0,0 +1,50 @@ +--- +title: 컨테이너 런타임 인터페이스(CRI) +content_type: concept +weight: 50 +--- + + + +컨테이너 런타임 인터페이스(CRI)는 클러스터 컴포넌트를 다시 컴파일하지 않아도 Kubelet이 다양한 +컨테이너 런타임을 사용할 수 있도록 하는 플러그인 인터페이스다. + +클러스터의 모든 노드에 동작 중인 +{{}}이 존재해야, +{{< glossary_tooltip text="kubelet" term_id="kubelet" >}}이 +{{< glossary_tooltip text="파드" term_id="pod" >}}들과 컨테이너들을 +구동할 수 있다. + +{{< glossary_definition term_id="container-runtime-interface" length="all" >}} + + + +## API {#api} + +{{< feature-state for_k8s_version="v1.23" state="stable" >}} + +Kubelet은 gRPC를 통해 컨테이너 런타임과 연결할 때 클라이언트의 역할을 수행한다. +런타임과 이미지 서비스 엔드포인트는 컨테이너 런타임 내에서 사용 가능해야 하며, +이는 각각 Kubelet 내에서 `--image-service-endpoint`와 `--container-runtime-endpoint` +[커맨드라인 플래그](/docs/reference/command-line-tools-reference/kubelet) +를 통해 설정할 수 있다. + +쿠버네티스 v{{< skew currentVersion >}}에서는, Kubelet은 CRI `v1`을 사용하는 것을 권장한다. +컨테이너 런타임이 CRI `v1` 버전을 지원하지 않는다면, +Kubelet은 지원 가능한 이전 지원 버전으로 협상을 시도한다. +또한 v{{< skew currentVersion >}} Kubelet은 CRI `v1alpha2`버전도 협상할 수 있지만, +해당 버전은 사용 중단(deprecated)으로 간주한다. +Kubelet이 지원되는 CRI 버전을 협상할 수 없는 경우, +Kubelet은 협상을 포기하고 노드로 등록하지 않는다. + +## 업그레이드 + +쿠버네티스를 업그레이드할 때, Kubelet은 컴포넌트의 재시작 시점에서 최신 CRI 버전을 자동으로 선택하려고 시도한다. +이 과정이 실패하면 위에서 언급한 대로 이전 버전을 선택하는 과정을 거친다. +컨테이너 런타임이 업그레이드되어 gRPC 재다이얼이 필요하다면, +컨테이너 런타임도 처음에 선택된 버전을 지원해야 하며, +그렇지 못한 경우 재다이얼은 실패하게 될 것이다. 이 과정은 Kubelet의 재시작이 필요하다. + +## {{% heading "whatsnext" %}} + +- CRI [프로토콜 정의](https://github.com/kubernetes/cri-api/blob/c75ef5b/pkg/apis/runtime/v1/api.proto)를 자세히 알아보자. diff --git a/content/ko/docs/concepts/architecture/nodes.md b/content/ko/docs/concepts/architecture/nodes.md index c71462d9b3..86a9856b47 100644 --- a/content/ko/docs/concepts/architecture/nodes.md +++ b/content/ko/docs/concepts/architecture/nodes.md @@ -385,7 +385,7 @@ kubelet은 노드의 `.status` 생성과 업데이트 및 자세한 내용은 [노드의 컨트롤 토폴로지 관리 정책](/docs/tasks/administer-cluster/topology-manager/)을 본다. -## 그레이스풀(Graceful) 노드 셧다운 {#graceful-node-shutdown} +## 그레이스풀(Graceful) 노드 셧다운(shutdown) {#graceful-node-shutdown} {{< feature-state state="beta" for_k8s_version="v1.21" >}} @@ -402,7 +402,7 @@ Kubelet은 노드가 종료되는 동안 파드가 일반 [파드 종료 프로 제어된다. 기본적으로, 아래 설명된 두 구성 옵션, -`ShutdownGracePeriod` 및 `ShutdownGracePeriodCriticalPods` 는 모두 0으로 설정되어 있으므로, +`shutdownGracePeriod` 및 `shutdownGracePeriodCriticalPods` 는 모두 0으로 설정되어 있으므로, 그레이스풀 노드 셧다운 기능이 활성화되지 않는다. 기능을 활성화하려면, 두 개의 kubelet 구성 설정을 적절하게 구성하고 0이 아닌 값으로 설정해야 한다. @@ -412,32 +412,116 @@ Kubelet은 노드가 종료되는 동안 파드가 일반 [파드 종료 프로 2. 노드에서 실행 중인 [중요(critical) 파드](/ko/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#파드를-중요-critical-로-표시하기)를 종료시킨다. 그레이스풀 노드 셧다운 기능은 두 개의 [`KubeletConfiguration`](/docs/tasks/administer-cluster/kubelet-config-file/) 옵션으로 구성된다. -* `ShutdownGracePeriod`: +* `shutdownGracePeriod`: * 노드가 종료를 지연해야 하는 총 기간을 지정한다. 이것은 모든 일반 및 [중요 파드](/ko/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#파드를-중요-critical-로-표시하기)의 파드 종료에 필요한 총 유예 기간에 해당한다. -* `ShutdownGracePeriodCriticalPods`: - * 노드 종료 중에 [중요 파드](/ko/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#파드를-중요-critical-로-표시하기)를 종료하는 데 사용되는 기간을 지정한다. 이 값은 `ShutdownGracePeriod` 보다 작아야 한다. +* `shutdownGracePeriodCriticalPods`: + * 노드 종료 중에 [중요 파드](/ko/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#파드를-중요-critical-로-표시하기)를 종료하는 데 사용되는 기간을 지정한다. 이 값은 `shutdownGracePeriod` 보다 작아야 한다. -예를 들어, `ShutdownGracePeriod=30s`, -`ShutdownGracePeriodCriticalPods=10s` 인 경우, kubelet은 노드 종료를 30초까지 +예를 들어, `shutdownGracePeriod=30s`, +`shutdownGracePeriodCriticalPods=10s` 인 경우, kubelet은 노드 종료를 30초까지 지연시킨다. 종료하는 동안 처음 20(30-10)초는 일반 파드의 유예 종료에 할당되고, 마지막 10초는 [중요 파드](/ko/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#파드를-중요-critical-로-표시하기)의 종료에 할당된다. {{< note >}} -그레이스풀 노드 셧다운 과정에서 축출된 파드는 `Failed` 라고 표시된다. -`kubectl get pods` 명령을 실행하면 축출된 파드의 상태가 `Shutdown`으로 표시된다. +그레이스풀 노드 셧다운 과정에서 축출된 파드는 셧다운(shutdown)된 것으로 표시된다. +`kubectl get pods` 명령을 실행하면 축출된 파드의 상태가 `Terminated`으로 표시된다. 그리고 `kubectl describe pod` 명령을 실행하면 노드 셧다운으로 인해 파드가 축출되었음을 알 수 있다. ``` -Status: Failed -Reason: Shutdown -Message: Node is shutting, evicting pods +Reason: Terminated +Message: Pod was terminated in response to imminent node shutdown. ``` -실패한 파드 오브젝트는 명시적으로 삭제하거나 [가비지 콜렉션에 의해 정리](/ko/docs/concepts/workloads/pods/pod-lifecycle/#pod-garbage-collection)되기 전까지는 보존된다. -이는 갑작스러운 노드 종료의 경우와 비교했을 때 동작에 차이가 있다. {{< /note >}} +### 파드 우선순위 기반 그레이스풀 노드 셧다운 {#pod-priority-graceful-node-shutdown} + +{{< feature-state state="alpha" for_k8s_version="v1.23" >}} + +그레이스풀 노드 셧다운 시 파드 셧다운 순서에 더 많은 유연성을 제공할 수 있도록, +클러스터에 프라이어리티클래스(PriorityClass) 기능이 활성화되어 있으면 +그레이스풀 노드 셧다운 과정에서 파드의 프라이어리티클래스가 고려된다. +이 기능으로 그레이스풀 노드 셧다운 시 파드가 종료되는 순서를 클러스터 관리자가 +[프라이어리티클래스](/ko/docs/concepts/scheduling-eviction/pod-priority-preemption/#프라이어리티클래스) +기반으로 명시적으로 정할 수 있다. + +위에서 기술된 것처럼, [그레이스풀 노드 셧다운](#graceful-node-shutdown) 기능은 파드를 +중요하지 않은(non-critical) 파드와 +중요한(critical) 파드 2단계(phase)로 구분하여 종료시킨다. +셧다운 시 파드가 종료되는 순서를 명시적으로 더 상세하게 정해야 한다면, +파드 우선순위 기반 그레이스풀 노드 셧다운을 사용할 수 있다. + +그레이스풀 노드 셧다운 과정에서 파드 우선순위가 고려되기 때문에, +그레이스풀 노드 셧다운이 여러 단계로 일어날 수 있으며, +각 단계에서 특정 프라이어리티 클래스의 파드를 종료시킨다. +정확한 단계와 단계별 셧다운 시간은 kubelet에 설정할 수 있다. + +다음과 같이 클러스터에 커스텀 파드 +[프라이어리티 클래스](/ko/docs/concepts/scheduling-eviction/pod-priority-preemption/#프라이어리티클래스)가 있다고 +가정하자. + +|파드 프라이어리티 클래스 이름|파드 프라이어리티 클래스 값| +|-------------------------|------------------------| +|`custom-class-a` | 100000 | +|`custom-class-b` | 10000 | +|`custom-class-c` | 1000 | +|`regular/unset` | 0 | + +[kubelet 환경 설정](/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) 안의 +`shutdownGracePeriodByPodPriority` 설정은 다음과 같을 수 있다. + +|파드 프라이어리티 클래스 값|종료 대기 시간| +|------------------------|---------------| +| 100000 |10 seconds | +| 10000 |180 seconds | +| 1000 |120 seconds | +| 0 |60 seconds | + +이를 나타내는 kubelet 환경 설정 YAML은 다음과 같다. + +```yaml +shutdownGracePeriodByPodPriority: + - priority: 100000 + shutdownGracePeriodSeconds: 10 + - priority: 10000 + shutdownGracePeriodSeconds: 180 + - priority: 1000 + shutdownGracePeriodSeconds: 120 + - priority: 0 + shutdownGracePeriodSeconds: 60 +``` + +위의 표에 의하면 우선순위 값이 100000 이상인 파드는 종료까지 10초만 주어지며, +10000 이상 ~ 100000 미만이면 180초, +1000 이상 ~ 10000 미만이면 120초가 주어진다. +마지막으로, 다른 모든 파드는 종료까지 60초가 주어질 것이다. + +모든 클래스에 대해 값을 명시할 필요는 없다. +예를 들어, 대신 다음과 같은 구성을 사용할 수도 있다. + +|파드 프라이어리티 클래스 값|종료 대기 시간| +|------------------------|---------------| +| 100000 |300 seconds | +| 1000 |120 seconds | +| 0 |60 seconds | + + +위의 경우, custom-class-b에 속하는 파드와 custom-class-c에 속하는 파드는 +동일한 종료 대기 시간을 갖게 될 것이다. + +특정 범위에 해당되는 파드가 없으면, +kubelet은 해당 범위에 해당되는 파드를 위해 기다려 주지 않는다. +대신, kubelet은 즉시 다음 프라이어리티 클래스 값 범위로 넘어간다. + +기능이 활성화되어 있지만 환경 설정이 되어 있지 않으면, +순서 지정 동작이 수행되지 않을 것이다. + +이 기능을 사용하려면 `GracefulNodeShutdownBasedOnPodPriority` 기능 게이트를 활성화해야 하고, +kubelet 환경 설정의 `ShutdownGracePeriodByPodPriority`를 +파드 프라이어리티 클래스 값과 +각 값에 대한 종료 대기 시간을 명시하여 지정해야 한다. + ## 스왑(swap) 메모리 관리 {#swap-memory} {{< feature-state state="alpha" for_k8s_version="v1.22" >}} @@ -451,6 +535,11 @@ kubelet은 노드에서 스왑을 발견하지 못한 경우 시작과 동시에 [구성 설정](/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration)에서 `failSwapOn`가 false로 지정되어야 한다. +{{< warning >}} +메모리 스왑 기능이 활성화되면, 시크릿 오브젝트의 내용과 같은 +tmpfs에 기록되었던 쿠버네티스 데이터가 디스크에 스왑될 수 있다. +{{< /warning >}} + 사용자는 또한 선택적으로 `memorySwap.swapBehavior`를 구성할 수 있으며, 이를 통해 노드가 스왑 메모리를 사용하는 방식을 명시한다. 예를 들면, diff --git a/content/ko/docs/concepts/cluster-administration/addons.md b/content/ko/docs/concepts/cluster-administration/addons.md index 2c06588988..75ccfabb2d 100644 --- a/content/ko/docs/concepts/cluster-administration/addons.md +++ b/content/ko/docs/concepts/cluster-administration/addons.md @@ -25,7 +25,7 @@ content_type: concept * [Contrail](https://www.juniper.net/us/en/products-services/sdn/contrail/contrail-networking/)은 [Tungsten Fabric](https://tungsten.io)을 기반으로 하며, 오픈소스이고, 멀티 클라우드 네트워크 가상화 및 폴리시 관리 플랫폼이다. Contrail과 Tungsten Fabric은 쿠버네티스, OpenShift, OpenStack 및 Mesos와 같은 오케스트레이션 시스템과 통합되어 있으며, 가상 머신, 컨테이너/파드 및 베어 메탈 워크로드에 대한 격리 모드를 제공한다. * [Flannel](https://github.com/flannel-io/flannel#deploying-flannel-manually)은 쿠버네티스와 함께 사용할 수 있는 오버레이 네트워크 제공자이다. * [Knitter](https://github.com/ZTE/Knitter/)는 쿠버네티스 파드에서 여러 네트워크 인터페이스를 지원하는 플러그인이다. -* Multus 는 쿠버네티스에서 SRIOV, DPDK, OVS-DPDK 및 VPP 기반 워크로드 외에 모든 CNI 플러그인(예: Calico, Cilium, Contiv, Flannel)을 지원하기 위해 쿠버네티스에서 다중 네트워크 지원을 위한 멀티 플러그인이다. +* Multus는 쿠버네티스의 다중 네트워크 지원을 위한 멀티 플러그인이며, 모든 CNI 플러그인(예: Calico, Cilium, Contiv, Flannel)과 쿠버네티스 상의 SRIOV, DPDK, OVS-DPDK 및 VPP 기반 워크로드를 지원한다. * [OVN-Kubernetes](https://github.com/ovn-org/ovn-kubernetes/)는 Open vSwitch(OVS) 프로젝트에서 나온 가상 네트워킹 구현인 [OVN(Open Virtual Network)](https://github.com/ovn-org/ovn/)을 기반으로 하는 쿠버네티스용 네트워킹 제공자이다. OVN-Kubernetes는 OVS 기반 로드 밸런싱과 네트워크 폴리시 구현을 포함하여 쿠버네티스용 오버레이 기반 네트워킹 구현을 제공한다. * [OVN4NFV-K8S-Plugin](https://github.com/opnfv/ovn4nfv-k8s-plugin)은 OVN 기반의 CNI 컨트롤러 플러그인으로 클라우드 네이티브 기반 서비스 기능 체인(Service function chaining(SFC)), 다중 OVN 오버레이 네트워킹, 동적 서브넷 생성, 동적 가상 네트워크 생성, VLAN 공급자 네트워크, 직접 공급자 네트워크와 멀티 클러스터 네트워킹의 엣지 기반 클라우드 등 네이티브 워크로드에 이상적인 멀티 네티워크 플러그인이다. * [NSX-T](https://docs.vmware.com/en/VMware-NSX-T/2.0/nsxt_20_ncp_kubernetes.pdf) 컨테이너 플러그인(NCP)은 VMware NSX-T와 쿠버네티스와 같은 컨테이너 오케스트레이터 간의 통합은 물론 NSX-T와 PKS(Pivotal 컨테이너 서비스) 및 OpenShift와 같은 컨테이너 기반 CaaS/PaaS 플랫폼 간의 통합을 제공한다. @@ -45,6 +45,11 @@ content_type: concept ## 인프라스트럭처 * [KubeVirt](https://kubevirt.io/user-guide/#/installation/installation)는 쿠버네티스에서 가상 머신을 실행하기 위한 애드온이다. 일반적으로 베어 메탈 클러스터에서 실행한다. +* [node problem detector](https://github.com/kubernetes/node-problem-detector)는 + 리눅스 노드에서 실행되며, + 시스템 이슈를 + [이벤트](/docs/reference/kubernetes-api/cluster-resources/event-v1/) 또는 + [노드 컨디션](/ko/docs/concepts/architecture/nodes/#condition) 형태로 보고한다. ## 레거시 애드온 diff --git a/content/ko/docs/concepts/cluster-administration/networking.md b/content/ko/docs/concepts/cluster-administration/networking.md index 5922bf3ef3..d916a09105 100644 --- a/content/ko/docs/concepts/cluster-administration/networking.md +++ b/content/ko/docs/concepts/cluster-administration/networking.md @@ -64,7 +64,7 @@ weight: 50 VM 내의 프로세스와 동일하다. 이것을 "IP-per-pod(파드별 IP)" 모델이라고 한다. -이것이 어떻게 구현되는 지는 사용 중인 특정 컨테이너 런타임의 세부 사항이다. +이것이 어떻게 구현되는 지는 사용 중인 특정 컨테이너 런타임의 세부 사항이다. 비슷하게, 사용자가 선택한 네트워킹 옵션이 [IPv4/IPv6 이중 스택](/ko/docs/concepts/services-networking/dual-stack/)을 지원할 수도 있으며, 구현 방법은 다양할 수 있다. `Pod` 로 전달하는 `Node` 자체의 포트(호스트 포트라고 함)를 요청할 수 있지만, 이는 매우 틈새 작업이다. 전달이 구현되는 방법은 @@ -169,49 +169,6 @@ Coil은 베어메탈에 비해 낮은 오버헤드로 작동하며, 외부 네 충족하는 매우 간단한 오버레이 네트워크이다. 많은 경우에 쿠버네티스와 플라넬은 성공적으로 적용이 가능하다. -### Google 컴퓨트 엔진(GCE) - -Google 컴퓨트 엔진 클러스터 구성 스크립트의 경우, [고급 -라우팅](https://cloud.google.com/vpc/docs/routes)을 사용하여 -각 VM에 서브넷을 할당한다(기본값은 `/24` - 254개 IP). 해당 서브넷에 바인딩된 -모든 트래픽은 GCE 네트워크 패브릭에 의해 VM으로 직접 라우팅된다. 이는 -아웃 바운드 인터넷 접근을 위해 NAT로 구성된 VM에 할당된 "기본" -IP 주소에 추가된다. 리눅스 브릿지(`cbr0`)는 해당 서브넷에 존재하도록 -구성되며, 도커의 `--bridge` 플래그로 전달된다. - -도커는 다음의 설정으로 시작한다. - -```shell -DOCKER_OPTS="--bridge=cbr0 --iptables=false --ip-masq=false" -``` - -이 브릿지는 노드의 `.spec.podCIDR`에 따라 Kubelet(`--network-plugin=kubenet` -플래그로 제어되는)에 의해 생성된다. - -도커는 이제 `cbr-cidr` 블록에서 IP를 할당한다. 컨테이너는 `cbr0` 브릿지를 -통해 서로 `Node` 에 도달할 수 있다. 이러한 IP는 모두 GCE 프로젝트 네트워크 -내에서 라우팅할 수 있다. - -그러나, GCE 자체는 이러한 IP에 대해 전혀 알지 못하므로, 아웃 바운드 인터넷 트래픽을 위해 -IP를 NAT하지 않는다. 그것을 달성하기 위해 iptables 규칙을 사용하여 -GCE 프로젝트 네트워크(10.0.0.0/8) 외부의 IP에 바인딩된 트래픽을 -마스커레이드(일명 SNAT - 마치 패킷이 `Node` 자체에서 온 것처럼 -보이게 함)한다. - -```shell -iptables -t nat -A POSTROUTING ! -d 10.0.0.0/8 -o eth0 -j MASQUERADE -``` - -마지막으로 커널에서 IP 포워딩이 활성화되어 있으므로, 커널은 브릿지된 컨테이너에 -대한 패킷을 처리한다. - -```shell -sysctl net.ipv4.ip_forward=1 -``` - -이 모든 것의 결과는 모든 `Pod` 가 서로에게 도달할 수 있고 인터넷으로 트래픽을 -송신할 수 있다는 것이다. - ### 재규어(Jaguar) [재규어](https://gitlab.com/sdnlab/jaguar)는 OpenDaylight 기반의 쿠버네티스 네트워크를 위한 오픈소스 솔루션이다. 재규어는 vxlan을 사용하여 오버레이 네트워크를 제공하고 재규어 CNI 플러그인은 파드별로 하나의 IP 주소를 제공한다. @@ -246,7 +203,7 @@ Lars Kellogg-Stedman이 제공하는 ### Multus(멀티 네트워크 플러그인) -Multus 는 쿠버네티스의 CRD 기반 네트워크 오브젝트를 사용하여 쿠버네티스에서 멀티 네트워킹 기능을 지원하는 멀티 CNI 플러그인이다. +Multus는 쿠버네티스의 CRD 기반 네트워크 오브젝트를 사용하여 쿠버네티스에서 멀티 네트워킹 기능을 지원하는 멀티 CNI 플러그인이다. Multus는 CNI 명세를 구현하는 모든 [레퍼런스 플러그인](https://github.com/containernetworking/plugins)(예: [플라넬](https://github.com/containernetworking/cni.dev/blob/main/content/plugins/v0.9/meta/flannel.md), [DHCP](https://github.com/containernetworking/plugins/tree/master/plugins/ipam/dhcp), [Macvlan](https://github.com/containernetworking/plugins/tree/master/plugins/main/macvlan)) 및 써드파티 플러그인(예: [캘리코](https://github.com/projectcalico/cni-plugin), [위브(Weave)](https://github.com/weaveworks/weave), [실리움](https://github.com/cilium/cilium), [콘티브](https://github.com/contiv/netplugin))을 지원한다. 또한, Multus는 쿠버네티스의 클라우드 네이티브 애플리케이션과 NFV 기반 애플리케이션을 통해 쿠버네티스의 [SRIOV](https://github.com/hustcat/sriov-cni), [DPDK](https://github.com/Intel-Corp/sriov-cni), [OVS-DPDK 및 VPP](https://github.com/intel/vhost-user-net-plugin) 워크로드를 지원한다. @@ -260,12 +217,6 @@ Multus는 CNI 명세를 구현하는 모든 [레퍼런스 플러그인](https:// [NSX-T 컨테이너 플러그인(NCP)](https://docs.vmware.com/en/VMware-NSX-T/2.0/nsxt_20_ncp_kubernetes.pdf)은 NSX-T와 쿠버네티스와 같은 컨테이너 오케스트레이터 사이의 통합은 물론, NSX-T와 Pivotal 컨테이너 서비스(PKS) 및 OpenShift와 같은 컨테이너 기반 CaaS/PaaS 플랫폼 간의 통합을 제공한다. -### OpenVSwitch - -[OpenVSwitch](https://www.openvswitch.org/)는 다소 성숙하지만 -오버레이 네트워크를 구축하는 복잡한 방법이다. 이것은 네트워킹 분야의 몇몇 -"대형 벤더"에 의해 승인되었다. - ### OVN(오픈 버추얼 네트워킹) OVN은 Open vSwitch 커뮤니티에서 개발한 오픈소스 네트워크 @@ -274,10 +225,6 @@ OVN은 Open vSwitch 커뮤니티에서 개발한 오픈소스 네트워크 [ovn-kubernetes](https://github.com/openvswitch/ovn-kubernetes)에 특정 쿠버네티스 플러그인 및 문서가 있다. -### 로마나 - -[로마나](https://romana.io)는 오버레이 네트워크 없이 쿠버네티스를 배포할 수 있는 오픈소스 네트워크 및 보안 자동화 솔루션이다. 로마나는 쿠버네티스 [네트워크 폴리시](/ko/docs/concepts/services-networking/network-policies/)를 지원하여 네트워크 네임스페이스에서 격리를 제공한다. - ### Weaveworks의 위브넷 [위브넷](https://www.weave.works/products/weave-net/)은 diff --git a/content/ko/docs/concepts/configuration/manage-resources-containers.md b/content/ko/docs/concepts/configuration/manage-resources-containers.md index fa7ec69fc9..78e7ecfba6 100644 --- a/content/ko/docs/concepts/configuration/manage-resources-containers.md +++ b/content/ko/docs/concepts/configuration/manage-resources-containers.md @@ -74,8 +74,7 @@ CPU와 메모리를 통칭하여 *컴퓨트 리소스* 또는 *리소스* 라고 수량이다. 이것은 [API 리소스](/ko/docs/concepts/overview/kubernetes-api/)와는 다르다. 파드 및 [서비스](/ko/docs/concepts/services-networking/service/)와 같은 API 리소스는 -쿠버네티스 API 서버를 통해 읽고 수정할 수 -있는 오브젝트이다. +쿠버네티스 API 서버를 통해 읽고 수정할 수 있는 오브젝트이다. ## 파드와 컨테이너의 리소스 요청 및 제한 @@ -100,9 +99,10 @@ CPU와 메모리를 통칭하여 *컴퓨트 리소스* 또는 *리소스* 라고 CPU 리소스에 대한 제한 및 요청은 *cpu* 단위로 측정된다. 쿠버네티스의 CPU 1개는 클라우드 공급자용 **vCPU/Core 1개** 와 베어메탈 인텔 프로세서에서의 **1개 하이퍼스레드** 에 해당한다. -분수의 요청이 허용된다. -`0.5` 의 `spec.containers[].resources.requests.cpu` 요청을 가진 -컨테이너는 CPU 1개를 요구하는 컨테이너의 절반만큼 CPU를 보장한다. `0.1` 이라는 표현은 +요청량을 소수점 형태로 명시할 수도 있다. 컨테이너의 +`spec.containers[].resources.requests.cpu`를 `0.5`로 설정한다는 것은, +`1.0` CPU를 요청했을 때와 비교하여 절반의 CPU 타임을 요청한다는 의미이다. +CPU 자원의 단위와 관련하여, `0.1` 이라는 표현은 "백 밀리cpu"로 읽을 수 있는 `100m` 표현과 동일하다. 어떤 사람들은 "백 밀리코어"라고 말하는데, 같은 것을 의미하는 것으로 이해된다. `0.1` 과 같이 소수점이 있는 요청은 API에 의해 `100m` 으로 변환되며, @@ -115,12 +115,12 @@ CPU는 항상 절대 수량으로 요청되며, 상대적 수량은 아니다. ### 메모리의 의미 `memory` 에 대한 제한 및 요청은 바이트 단위로 측정된다. -E, P, T, G, M, K와 같은 접미사 중 하나를 사용하여 메모리를 +E, P, T, G, M, k, m(millis) 와 같은 접미사 중 하나를 사용하여 메모리를 일반 정수 또는 고정 소수점 숫자로 표현할 수 있다. Ei, Pi, Ti, Gi, Mi, Ki와 같은 2의 거듭제곱을 사용할 수도 있다. 예를 들어, 다음은 대략 동일한 값을 나타낸다. ```shell -128974848, 129e6, 129M, 123Mi +128974848, 129e6, 129M, 128974848000m, 123Mi ``` 다음은 예제이다. diff --git a/content/ko/docs/concepts/configuration/overview.md b/content/ko/docs/concepts/configuration/overview.md index 64b6bc3395..8b33e3322e 100644 --- a/content/ko/docs/concepts/configuration/overview.md +++ b/content/ko/docs/concepts/configuration/overview.md @@ -55,7 +55,7 @@ DNS 서버는 새로운 `서비스`를 위한 쿠버네티스 API를 Watch하며 만약 오직 디버깅의 목적으로 포트에 접근해야 한다면, [apiserver proxy](/ko/docs/tasks/access-application-cluster/access-cluster/#수작업으로-apiserver-proxy-url을-구축) 또는 [`kubectl port-forward`](/ko/docs/tasks/access-application-cluster/port-forward-access-application-cluster/)를 사용할 수 있다. - 만약 파드의 포트를 노드에서 명시적으로 노출해야 한다면, `hostPort`에 의존하기 전에 [NodePort](/ko/docs/concepts/services-networking/service/#nodeport) 서비스를 사용하는 것을 고려할 수 있다. + 만약 파드의 포트를 노드에서 명시적으로 노출해야 한다면, `hostPort`에 의존하기 전에 [NodePort](/ko/docs/concepts/services-networking/service/#type-nodeport) 서비스를 사용하는 것을 고려할 수 있다. - `hostPort`와 같은 이유로, `hostNetwork`를 사용하는 것을 피한다. diff --git a/content/ko/docs/concepts/configuration/secret.md b/content/ko/docs/concepts/configuration/secret.md index 73d48cd18b..d27faddc20 100644 --- a/content/ko/docs/concepts/configuration/secret.md +++ b/content/ko/docs/concepts/configuration/secret.md @@ -244,7 +244,7 @@ kubectl create secret docker-registry secret-tiger-docker \ `kubernetes.io/basic-auth` 타입은 기본 인증을 위한 자격 증명을 저장하기 위해 제공된다. 이 시크릿 타입을 사용할 때는 시크릿의 `data` 필드가 -다음의 두 키를 포함해야 한다. +다음의 두 키 중 하나를 포함해야 한다. - `username`: 인증을 위한 사용자 이름 - `password`: 인증을 위한 암호나 토큰 diff --git a/content/ko/docs/concepts/containers/images.md b/content/ko/docs/concepts/containers/images.md index 5ab09dd64a..d0c1d4bf7a 100644 --- a/content/ko/docs/concepts/containers/images.md +++ b/content/ko/docs/concepts/containers/images.md @@ -54,13 +54,15 @@ weight: 10 컨테이너에 대한 `imagePullPolicy`와 이미지의 태그는 [kubelet](/docs/reference/command-line-tools-reference/kubelet/)이 특정 이미지를 풀(다운로드)하려고 할 때 영향을 준다. -다음은 `imagePullPolicy`에 설정할 수 있는 값의 목록과 효과이다. +다음은 `imagePullPolicy`에 설정할 수 있는 값의 목록과 +효과이다. `IfNotPresent` : 이미지가 로컬에 없는 경우에만 내려받는다. `Always` -: kubelet이 컨테이너를 기동할 때마다, kubelet이 컨테이너 이미지 레지스트리에 이름과 이미지의 +: kubelet이 컨테이너를 기동할 때마다, kubelet이 컨테이너 + 이미지 레지스트리에 이름과 이미지의 [다이제스트](https://docs.docker.com/engine/reference/commandline/pull/#pull-an-image-by-digest-immutable-identifier)가 있는지 질의한다. 일치하는 다이제스트를 가진 컨테이너 이미지가 로컬에 있는 경우, kubelet은 캐시된 이미지를 사용한다. 이외의 경우, kubelet은 검색된 다이제스트를 가진 이미지를 내려받아서 @@ -78,7 +80,8 @@ weight: 10 {{< note >}} 프로덕션 환경에서 컨테이너를 배포하는 경우 `:latest` 태그 사용을 지양해야 하는데, -이미지의 어떤 버전이 기동되고 있는지 추적이 어렵고 제대로 롤백하기 어렵게 되기 때문이다. +이미지의 어떤 버전이 기동되고 있는지 추적이 어렵고 +제대로 롤백하기 어렵게 되기 때문이다. 대신, `v1.42.0`과 같이 의미있는 태그를 명기한다. {{< /note >}} @@ -90,7 +93,8 @@ weight: 10 이미지 태그를 사용하는 경우, 이미지 레지스트리에서 한 이미지를 나타내는 태그에 코드를 변경하게 되면, 기존 코드와 신규 코드를 구동하는 파드가 섞이게 되고 만다. 이미지 다이제스트를 통해 이미지의 특정 버전을 유일하게 식별할 수 있기 때문에, 쿠버네티스는 매번 해당 이미지 이름과 다이제스트가 명시된 컨테이너를 기동해서 같은 코드를 구동한다. 이미지를 명시하는 것은 구동할 코드를 고정시켜서 레지스트리에서의 변경으로 인해 버전이 섞이는 일이 발생하지 않도록 해준다. -파드(및 파드 템플릿)가 생성될 때 구동 중인 워크로드가 태그가 아닌 이미지 다이제스트를 통해 정의되도록 조작해주는 +파드(및 파드 템플릿)가 생성될 때 구동 중인 워크로드가 +태그가 아닌 이미지 다이제스트를 통해 정의되도록 조작해주는 서드-파티 [어드미션 컨트롤러](/docs/reference/access-authn-authz/admission-controllers/)가 있다. 이는 레지스트리에서 태그가 변경되는 일이 발생해도 구동 중인 워크로드가 모두 같은 코드를 사용하고 있다는 것을 보장하기를 원하는 경우 유용할 것이다. @@ -104,7 +108,9 @@ weight: 10 `:latest`인 경우, `imagePullPolicy`는 자동으로 `Always`로 설정된다. - `imagePullPolicy` 필드를 생략하고 컨테이너 이미지의 태그를 명기하지 않은 경우, `imagePullPolicy`는 자동으로 `Always`로 설정된다. -- `imagePullPolicy` 필드를 생략하고, 명기한 컨테이너 이미지의 태그가 `:latest`가 아니면, `imagePullPolicy`는 자동으로 `IfNotPresent`로 설정된다. +- `imagePullPolicy` 필드를 생략하고, + 명기한 컨테이너 이미지의 태그가 `:latest`가 아니면, + `imagePullPolicy`는 자동으로 `IfNotPresent`로 설정된다. {{< note >}} 컨테이너의 `imagePullPolicy` 값은 오브젝트가 처음 _created_ 일 때 항상 @@ -127,6 +133,7 @@ weight: 10 그러면 사용자가 파드를 요청할 때 쿠버네티스가 정책을 `Always`로 설정한다. - [AlwaysPullImages](/docs/reference/access-authn-authz/admission-controllers/#alwayspullimages) 어드미션 컨트롤러를 활성화 한다. + ### 이미지풀백오프(ImagePullBackOff) kubelet이 컨테이너 런타임을 사용하여 파드의 컨테이너 생성을 시작할 때, @@ -258,6 +265,73 @@ kubectl describe pods/private-image-test-1 | grep 'Failed' 프라이빗 레지스트리 키가 `.docker/config.json`에 추가되고 나면 모든 파드는 프라이빗 레지스트리의 이미지에 읽기 접근 권한을 가지게 될 것이다. +### config.json 파일 해석 {#config-json} + +`config.json` 파일의 해석에 있어서, 기존 도커의 구현과 쿠버네티스의 구현에 차이가 있다. +도커에서는 `auths` 키에 특정 루트 URL만 기재할 수 있으나, +쿠버네티스에서는 glob URL과 접두사-매칭 경로도 기재할 수 있다. +이는 곧 다음과 같은 `config.json`도 유효하다는 뜻이다. + +```json +{ + "auths": { + "*my-registry.io/images": { + "auth": "…" + } + } +} +``` + +루트 URL(`*my-registry.io`)은 다음 문법을 사용하여 매치된다. + +``` +pattern: + { term } + +term: + '*' 구분자가 아닌 모든 문자와 매치됨 + '?' 구분자가 아닌 문자 1개와 매치됨 + '[' [ '^' ] { character-range } ']' + 문자 클래스 (비어 있으면 안 됨)) + c 문자 c에 매치됨 (c != '*', '?', '\\', '[') + '\\' c 문자 c에 매치됨 + +character-range: + c 문자 c에 매치됨 (c != '\\', '-', ']') + '\\' c 문자 c에 매치됨 + lo '-' hi lo <= c <= hi 인 문자 c에 매치됨 +``` + +이미지 풀 작업 시, 모든 유효한 패턴에 대해 크리덴셜을 CRI 컨테이너 런타임에 제공할 것이다. +예를 들어 다음과 같은 컨테이너 이미지 이름은 +성공적으로 매치될 것이다. + +- `my-registry.io/images` +- `my-registry.io/images/my-image` +- `my-registry.io/images/another-image` +- `sub.my-registry.io/images/my-image` +- `a.sub.my-registry.io/images/my-image` + +kubelet은 인식된 모든 크리덴셜을 순차적으로 이용하여 이미지 풀을 수행한다. 즉, +`config.json`에 다음과 같이 여러 항목을 기재할 수도 있다. + +```json +{ + "auths": { + "my-registry.io/images": { + "auth": "…" + }, + "my-registry.io/images/subpath": { + "auth": "…" + } + } +} +``` + +이제 컨테이너가 `my-registry.io/images/subpath/my-image` +이미지를 풀 해야 한다고 명시하면, +kubelet은 크리덴셜을 순차적으로 사용하여 풀을 시도한다. + ### 미리 내려받은 이미지 {#pre-pulled-images} {{< note >}} @@ -383,3 +457,4 @@ Kubelet은 모든 `imagePullSecrets` 파일을 하나의 가상 `.docker/config. * [OCI 이미지 매니페스트 명세](https://github.com/opencontainers/image-spec/blob/master/manifest.md) 읽어보기. * [컨테이너 이미지 가비지 수집(garbage collection)](/docs/concepts/architecture/garbage-collection/#container-image-garbage-collection)에 대해 배우기. +* [프라이빗 레지스트리에서 이미지 받아오기](/ko/docs/tasks/configure-pod-container/pull-image-private-registry) diff --git a/content/ko/docs/concepts/extend-kubernetes/_index.md b/content/ko/docs/concepts/extend-kubernetes/_index.md index 79466e8df3..f6be1ea390 100644 --- a/content/ko/docs/concepts/extend-kubernetes/_index.md +++ b/content/ko/docs/concepts/extend-kubernetes/_index.md @@ -77,7 +77,7 @@ no_list: true 웹훅 모델에서 쿠버네티스는 원격 서비스에 네트워크 요청을 한다. *바이너리 플러그인* 모델에서 쿠버네티스는 바이너리(프로그램)를 실행한다. 바이너리 플러그인은 kubelet(예: -[Flex Volume 플러그인](/ko/docs/concepts/storage/volumes/#flexVolume)과 +[Flex Volume 플러그인](/ko/docs/concepts/storage/volumes/#flexvolume)과 [네트워크 플러그인](/ko/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/))과 kubectl에서 사용한다. @@ -145,7 +145,7 @@ API를 추가해도 기존 API(예: 파드)의 동작에 직접 영향을 미치 ### 인가 -[인가](/docs/reference/access-authn-authz/webhook/)는 특정 사용자가 API 리소스에서 읽고, 쓰고, 다른 작업을 수행할 수 있는지를 결정한다. 전체 리소스 레벨에서 작동하며 임의의 오브젝트 필드를 기준으로 구별하지 않는다. 빌트인 인증 옵션이 사용자의 요구를 충족시키지 못하면 [인가 웹훅](/docs/reference/access-authn-authz/webhook/)을 통해 사용자가 제공한 코드를 호출하여 인증 결정을 내릴 수 있다. +[인가](/docs/reference/access-authn-authz/authorization/)는 특정 사용자가 API 리소스에서 읽고, 쓰고, 다른 작업을 수행할 수 있는지를 결정한다. 전체 리소스 레벨에서 작동하며 임의의 오브젝트 필드를 기준으로 구별하지 않는다. 빌트인 인증 옵션이 사용자의 요구를 충족시키지 못하면 [인가 웹훅](/docs/reference/access-authn-authz/webhook/)을 통해 사용자가 제공한 코드를 호출하여 인증 결정을 내릴 수 있다. ### 동적 어드미션 컨트롤 @@ -163,6 +163,8 @@ API를 추가해도 기존 API(예: 파드)의 동작에 직접 영향을 미치 Kubelet이 바이너리 플러그인을 호출하여 볼륨을 마운트하도록 함으로써 빌트인 지원 없이 볼륨 유형을 마운트 할 수 있다. +FlexVolume은 쿠버네티스 v1.23부터 사용 중단(deprecated)되었다. Out-of-tree CSI 드라이버가 쿠버네티스에서 볼륨 드라이버를 작성할 때 추천하는 방식이다. 자세한 정보는 [스토리지 업체를 위한 쿠버네티스 볼륨 플러그인 FAQ](https://github.com/kubernetes/community/blob/master/sig-storage/volume-plugin-faq.md#kubernetes-volume-plugin-faq-for-storage-vendors)에서 찾을 수 있다. + ### 장치 플러그인 diff --git a/content/ko/docs/concepts/extend-kubernetes/api-extension/custom-resources.md b/content/ko/docs/concepts/extend-kubernetes/api-extension/custom-resources.md index e6e0203eb9..d5179790aa 100644 --- a/content/ko/docs/concepts/extend-kubernetes/api-extension/custom-resources.md +++ b/content/ko/docs/concepts/extend-kubernetes/api-extension/custom-resources.md @@ -37,7 +37,8 @@ _선언적(declarative) API_ 를 제공하게 된다. 쿠버네티스 [선언적 API](/ko/docs/concepts/overview/kubernetes-api/)는 책임의 분리를 강제한다. 사용자는 리소스의 의도한 상태를 선언한다. -쿠버네티스 컨트롤러는 쿠버네티스 오브젝트의 현재 상태가 선언한 의도한 상태에 동기화 되도록 한다. +쿠버네티스 컨트롤러는 쿠버네티스 오브젝트의 현재 상태가 +선언한 의도한 상태에 동기화 되도록 한다. 이는 서버에 무엇을 해야할지 *지시하는* 명령적인 API와는 대조된다. 클러스터 라이프사이클과 관계없이 실행 중인 클러스터에 커스텀 컨트롤러를 배포하고 @@ -146,9 +147,9 @@ CRD 오브젝트의 이름은 유효한 일반적으로 쿠버네티스 API의 각 리소스에는 REST 요청을 처리하고 오브젝트의 퍼시스턴트 스토리지를 관리하는 코드가 필요하다. 주요 쿠버네티스 API 서버는 *파드* 및 *서비스* 와 같은 빌트인 리소스를 처리하고, 일반적으로 [CRD](#커스텀리소스데피니션)를 통해 커스텀 리소스를 처리할 수 ​​있다. -[애그리게이션 레이어](/ko/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/)를 사용하면 자체 독립형 API 서버를 +[애그리게이션 레이어](/ko/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/)를 사용하면 자체 API 서버를 작성하고 배포하여 커스텀 리소스에 대한 특수한 구현을 제공할 수 있다. -기본 API 서버는 처리하는 커스텀 리소스에 대한 요청을 사용자에게 위임하여 +주(main) API 서버는 사용자의 커스텀 리소스에 대한 요청을 사용자의 자체 API 서버에 위임하여 모든 클라이언트가 사용할 수 있게 한다. ## 커스텀 리소스를 추가할 방법 선택 diff --git a/content/ko/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md b/content/ko/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md index 9d4ad5525c..1d9b23b3aa 100644 --- a/content/ko/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md +++ b/content/ko/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md @@ -197,6 +197,8 @@ service PodResourcesLister { } ``` +### `List` gRPC 엔드포인트 {#grpc-endpoint-list} + `List` 엔드포인트는 실행 중인 파드의 리소스에 대한 정보를 제공하며, 독점적으로 할당된 CPU의 ID, 장치 플러그인에 의해 보고된 장치 ID, 이러한 장치가 할당된 NUMA 노드의 ID와 같은 세부 정보를 함께 제공한다. 또한, NUMA 기반 머신의 경우, 컨테이너를 위해 예약된 메모리와 hugepage에 대한 정보를 포함한다. @@ -246,10 +248,35 @@ message ContainerDevices { TopologyInfo topology = 3; } ``` +{{< note >}} +`List` 엔드포인트의 `ContainerResources` 내부에 있는 cpu_ids은 특정 컨테이너에 할당된 +독점 CPU들에 해당한다. 만약 공유 풀(shared pool)에 있는 CPU들을 확인(evaluate)하는 것이 목적이라면, 해당 `List` +엔드포인트는 다음에 설명된 것과 같이, `GetAllocatableResources` 엔드포인트와 함께 사용되어야 +한다. +1. `GetAllocatableResources`를 호출하여 할당 가능한 모든 CPU 목록을 조회 +2. 시스템의 모든 `ContainerResources`에서 `GetCpuIds`를 호출 +3. `GetAllocateableResources` 호출에서 `GetCpuIds` 호출로 얻은 모든 CPU를 빼기 +{{< /note >}} + +### `GetAllocatableResources` gRPC 엔드포인트 {#grpc-endpoint-getallocatableresources} + +{{< feature-state state="beta" for_k8s_version="v1.23" >}} GetAllocatableResources는 워커 노드에서 처음 사용할 수 있는 리소스에 대한 정보를 제공한다. kubelet이 APIServer로 내보내는 것보다 더 많은 정보를 제공한다. +{{< note >}} +`GetAllocatableResources`는 [할당 가능(allocatable)](/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable) 리소스를 확인(evaluate)하기 위해서만 +사용해야 한다. 만약 목적이 free/unallocated 리소스를 확인하기 위한 것이라면 +List() 엔드포인트와 함께 사용되어야 한다. `GetAllocableResources`로 얻은 결과는 kubelet에 +노출된 기본 리소스가 변경되지 않는 한 동일하게 유지된다. 이러한 변경은 드물지만, 발생하게 된다면 +(예를 들면: hotplug/hotunplug, 장치 상태 변경) 클라이언트가 `GetAlloctableResources` 엔드포인트를 +호출할 것으로 가정한다. +그러나 CPU 및/또는 메모리가 갱신된 경우 `GetAllocateableResources` 엔드포인트를 호출하는 것만으로는 +충분하지 않으며, Kubelet을 다시 시작하여 올바른 리소스 용량과 할당 가능(allocatable) 리소스를 반영해야 한다. +{{< /note >}} + + ```gRPC // AllocatableResourcesResponses에는 kubelet이 알고 있는 모든 장치에 대한 정보가 포함된다. message AllocatableResourcesResponse { @@ -259,6 +286,13 @@ message AllocatableResourcesResponse { } ``` +쿠버네티스 v1.23부터, `GetAllocatableResources`가 기본으로 활성화된다. +이를 비활성화하려면 `KubeletPodResourcesGetAllocatable` [기능 게이트(feature gate)](/docs/reference/command-line-tools-reference/feature-gates/)를 +끄면 된다. + +쿠버네티스 v1.23 이전 버전에서 이 기능을 활성화하려면 `kubelet`이 다음 플래그를 가지고 시작되어야 한다. + +`--feature-gates=KubeletPodResourcesGetAllocatable=true` `ContainerDevices` 는 장치가 어떤 NUMA 셀과 연관되는지를 선언하는 토폴로지 정보를 노출한다. NUMA 셀은 불분명한(opaque) 정수 ID를 사용하여 식별되며, 이 값은 diff --git a/content/ko/docs/concepts/extend-kubernetes/operator.md b/content/ko/docs/concepts/extend-kubernetes/operator.md index d3ac7a4212..36b217db9c 100644 --- a/content/ko/docs/concepts/extend-kubernetes/operator.md +++ b/content/ko/docs/concepts/extend-kubernetes/operator.md @@ -31,9 +31,7 @@ weight: 30 및 실행을 자동화할 수 있고, *또한* 쿠버네티스가 수행하는 방식을 자동화할 수 있다. -쿠버네티스의 {{< glossary_tooltip text="컨트롤러" term_id="controller" >}} -개념을 통해 쿠버네티스 코드 자체를 수정하지 않고도 클러스터의 동작을 -확장할 수 있다. +쿠버네티스의 {{< glossary_tooltip text="오퍼레이터 패턴" term_id="operator-pattern" >}} 개념을 통해 쿠버네티스 코드 자체를 수정하지 않고도 {{< glossary_tooltip text="컨트롤러" term_id="controller" >}}를 하나 이상의 사용자 정의 리소스(custom resource)에 연결하여 클러스터의 동작을 확장할 수 있다. 오퍼레이터는 [사용자 정의 리소스](/ko/docs/concepts/extend-kubernetes/api-extension/custom-resources/)의 컨트롤러 역할을 하는 쿠버네티스 API의 클라이언트이다. diff --git a/content/ko/docs/concepts/extend-kubernetes/service-catalog.md b/content/ko/docs/concepts/extend-kubernetes/service-catalog.md index 8d1cb3ee05..fa3d50aeb6 100644 --- a/content/ko/docs/concepts/extend-kubernetes/service-catalog.md +++ b/content/ko/docs/concepts/extend-kubernetes/service-catalog.md @@ -227,7 +227,7 @@ spec: ## {{% heading "whatsnext" %}} -* 만약 당신이 {{< glossary_tooltip text="Helm Charts" term_id="helm-chart" >}}에 익숙하다면, 당신의 쿠버네티스 클러스터에 [Helm을 이용하여 서비스 카탈로그를 설치](/docs/tasks/service-catalog/install-service-catalog-using-helm/)할 수 있다. 다른 방법으로 [SC tool을 이용하여 서비스 카탈로그를 설치](/docs/tasks/service-catalog/install-service-catalog-using-sc/)할 수 있다. +* 만약 당신이 {{< glossary_tooltip text="Helm Charts" term_id="helm-chart" >}}에 익숙하다면, 당신의 쿠버네티스 클러스터에 [Helm을 이용하여 서비스 카탈로그를 설치](/docs/tasks/service-catalog/install-service-catalog-using-helm/)할 수 있다. 다른 방법으로 [SC tool을 이용하여 서비스 카탈로그를 설치](/ko/docs/tasks/service-catalog/install-service-catalog-using-sc/)할 수 있다. * [샘플 서비스 브로커](https://github.com/openservicebrokerapi/servicebroker/blob/master/gettingStarted.md#sample-service-brokers) 살펴보기 * [kubernetes-sigs/service-catalog](https://github.com/kubernetes-sigs/service-catalog) 프로젝트 탐색 * [svc-cat.io](https://svc-cat.io/docs/) 살펴보기 diff --git a/content/ko/docs/concepts/overview/kubernetes-api.md b/content/ko/docs/concepts/overview/kubernetes-api.md index 919d59b459..cc043139c4 100644 --- a/content/ko/docs/concepts/overview/kubernetes-api.md +++ b/content/ko/docs/concepts/overview/kubernetes-api.md @@ -1,4 +1,6 @@ --- + + title: 쿠버네티스 API content_type: concept weight: 30 @@ -35,36 +37,39 @@ card: 완전한 API 상세 내용은 [OpenAPI](https://www.openapis.org/)를 활용해서 문서화했다. -OpenAPI 규격은 `/openapi/v2` 엔드포인트에서만 제공된다. -다음과 같은 요청 헤더를 사용해서 응답 형식을 요청할 수 있다. +### OpenAPI V2 + +쿠버네티스 API 서버는 `/openapi/v2` 엔드포인트를 통해 +통합된(aggregated) OpenAPI v2 스펙을 제공한다. +요청 헤더에 다음과 같이 기재하여 응답 형식을 지정할 수 있다. - + - - - + + + - + - + - + - +
Valid request header values for OpenAPI v2 queries OpenAPI v2 질의에 사용할 수 있는 유효한 요청 헤더 값
HeaderPossible valuesNotes헤더사용할 수 있는 값참고
Accept-Encoding gzipnot supplying this header is also acceptable이 헤더를 제공하지 않는 것도 가능
Accept application/com.github.proto-openapi.spec.v2@v1.0+protobufmainly for intra-cluster use주로 클러스터 내부 용도로 사용
application/jsondefault기본값
*serves application/jsonJSON으로 응답
@@ -75,6 +80,55 @@ Protobuf에 기반한 직렬화 형식을 구현한다. 이 형식에 대한 API 오브젝트를 정의하는 Go 패키지에 들어있는 각각의 스키마에 대한 IDL(인터페이스 정의 언어) 파일을 참고한다. +### OpenAPI V3 + +{{< feature-state state="alpha" for_k8s_version="v1.23" >}} + +쿠버네티스 v1.23은 OpenAPI v3 API 발행(publishing)에 대한 초기 지원을 제공한다. +이는 알파 기능이며 기본적으로 비활성화되어 있다. +kube-apiserver 구성 요소에 +`OpenAPIV3` [기능 게이트](/ko/docs/reference/command-line-tools-reference/feature-gates/)를 이용하여 +이 알파 기능을 활성화할 수 있다. + +이 기능이 활성화되면, 쿠버네티스 API 서버는 +통합된(aggregated) OpenAPI v3 스펙을 쿠버네티스 그룹 버전별로 +`/openapi/v3/apis//` 엔드포인트에 제공한다. +사용할 수 있는 요청 헤더는 아래의 표를 참고한다. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
OpenAPI v3 질의에 사용할 수 있는 유효한 요청 헤더 값
헤더사용할 수 있는 값참고
Accept-Encodinggzip이 헤더를 제공하지 않는 것도 가능
Acceptapplication/com.github.proto-openapi.spec.v3@v1.0+protobuf주로 클러스터 내부 용도로 사용
application/json기본값
*JSON으로 응답
+ +`/openapi/v3` 디스커버리 엔드포인트는 사용 가능한 모든 +그룹/버전의 목록을 제공한다. 이 엔드포인트는 JSON 만을 반환한다. + ## 지속성 쿠버네티스는 오브젝트의 직렬화된 상태를 diff --git a/content/ko/docs/concepts/scheduling-eviction/kube-scheduler.md b/content/ko/docs/concepts/scheduling-eviction/kube-scheduler.md index 1c4424a047..0ab5b4b76f 100644 --- a/content/ko/docs/concepts/scheduling-eviction/kube-scheduler.md +++ b/content/ko/docs/concepts/scheduling-eviction/kube-scheduler.md @@ -85,7 +85,7 @@ _스코어링_ 단계에서 스케줄러는 목록에 남아있는 노드의 순 * [스케줄러 성능 튜닝](/ko/docs/concepts/scheduling-eviction/scheduler-perf-tuning/)에 대해 읽기 * [파드 토폴로지 분배 제약 조건](/ko/docs/concepts/workloads/pods/pod-topology-spread-constraints/)에 대해 읽기 * kube-scheduler의 [레퍼런스 문서](/docs/reference/command-line-tools-reference/kube-scheduler/) 읽기 -* [kube-scheduler 구성(v1beta2)](/docs/reference/config-api/kube-scheduler-config.v1beta2/) 레퍼런스 읽기 +* [kube-scheduler 구성(v1beta3)](/docs/reference/config-api/kube-scheduler-config.v1beta3/) 레퍼런스 읽기 * [멀티 스케줄러 구성하기](/docs/tasks/extend-kubernetes/configure-multiple-schedulers/)에 대해 배우기 * [토폴로지 관리 정책](/docs/tasks/administer-cluster/topology-manager/)에 대해 배우기 * [파드 오버헤드](/ko/docs/concepts/scheduling-eviction/pod-overhead/)에 대해 배우기 diff --git a/content/ko/docs/concepts/scheduling-eviction/scheduler-perf-tuning.md b/content/ko/docs/concepts/scheduling-eviction/scheduler-perf-tuning.md index e2fb1cdcf9..5fd12dc521 100644 --- a/content/ko/docs/concepts/scheduling-eviction/scheduler-perf-tuning.md +++ b/content/ko/docs/concepts/scheduling-eviction/scheduler-perf-tuning.md @@ -43,7 +43,7 @@ kube-scheduler 의 `percentageOfNodesToScore` 설정을 통해 마치 100을 설정한 것처럼 작동한다. 값을 변경하려면, -[kube-scheduler 구성 파일](/docs/reference/config-api/kube-scheduler-config.v1beta2/)을 +[kube-scheduler 구성 파일](/docs/reference/config-api/kube-scheduler-config.v1beta3/)을 편집한 다음 스케줄러를 재시작한다. 대부분의 경우, 구성 파일은 `/etc/kubernetes/config/kube-scheduler.yaml` 에서 찾을 수 있다. @@ -161,4 +161,4 @@ percentageOfNodesToScore: 50 ## {{% heading "whatsnext" %}} -* [kube-scheduler 구성 레퍼런스(v1beta2)](/docs/reference/config-api/kube-scheduler-config.v1beta2/) 확인 +* [kube-scheduler 구성 레퍼런스(v1beta3)](/docs/reference/config-api/kube-scheduler-config.v1beta3/) 확인 diff --git a/content/ko/docs/concepts/scheduling-eviction/taint-and-toleration.md b/content/ko/docs/concepts/scheduling-eviction/taint-and-toleration.md index f6d8c13a19..f6321e4aa7 100644 --- a/content/ko/docs/concepts/scheduling-eviction/taint-and-toleration.md +++ b/content/ko/docs/concepts/scheduling-eviction/taint-and-toleration.md @@ -203,7 +203,7 @@ tolerations: * `tolerationSeconds` 가 지정된 테인트를 용인하는 파드는 지정된 시간 동안 바인딩된 상태로 유지된다. -노드 컨트롤러는 특정 조건이 참일 때 자동으로 +노드 컨트롤러는 특정 컨디션이 참일 때 자동으로 노드를 테인트시킨다. 다음은 빌트인 테인트이다. * `node.kubernetes.io/not-ready`: 노드가 준비되지 않았다. 이는 NodeCondition @@ -264,19 +264,19 @@ tolerations: 이렇게 하면 이러한 문제로 인해 데몬셋 파드가 축출되지 않는다. -## 조건(condition)을 기준으로 노드 테인트하기 +## 컨디션(condition)을 기준으로 노드 테인트하기 컨트롤 플레인은 노드 {{}}를 이용하여 -[노드 조건](/ko/docs/concepts/scheduling-eviction/node-pressure-eviction/#node-conditions)에 대한 `NoSchedule` 효과를 사용하여 자동으로 테인트를 생성한다. +[노드 컨디션](/ko/docs/concepts/scheduling-eviction/node-pressure-eviction/#node-conditions)에 대한 `NoSchedule` 효과를 사용하여 자동으로 테인트를 생성한다. -스케줄러는 스케줄링 결정을 내릴 때 노드 조건을 확인하는 것이 아니라 테인트를 확인한다. -이렇게 하면 노드 조건이 스케줄링에 직접적인 영향을 주지 않는다. -예를 들어 `DiskPressure` 노드 조건이 활성화된 경우 +스케줄러는 스케줄링 결정을 내릴 때 노드 컨디션을 확인하는 것이 아니라 테인트를 확인한다. +이렇게 하면 노드 컨디션이 스케줄링에 직접적인 영향을 주지 않는다. +예를 들어 `DiskPressure` 노드 컨디션이 활성화된 경우 컨트롤 플레인은 `node.kubernetes.io/disk-pressure` 테인트를 추가하고 영향을 받는 노드에 새 파드를 할당하지 않는다. -`MemoryPressure` 노드 조건이 활성화되면 +`MemoryPressure` 노드 컨디션이 활성화되면 컨트롤 플레인이 `node.kubernetes.io/memory-pressure` 테인트를 추가한다. -새로 생성된 파드에 파드 톨러레이션을 추가하여 노드 조건을 무시하도록 할 수 있다. +새로 생성된 파드에 파드 톨러레이션을 추가하여 노드 컨디션을 무시하도록 할 수 있다. 또한 컨트롤 플레인은 `BestEffort` 이외의 {{< glossary_tooltip text="QoS 클래스" term_id="qos-class" >}}를 가지는 파드에 `node.kubernetes.io/memory-pressure` 톨러레이션을 추가한다. diff --git a/content/ko/docs/concepts/services-networking/connect-applications-service.md b/content/ko/docs/concepts/services-networking/connect-applications-service.md index bb7a9154c3..b7e5b26056 100644 --- a/content/ko/docs/concepts/services-networking/connect-applications-service.md +++ b/content/ko/docs/concepts/services-networking/connect-applications-service.md @@ -1,4 +1,8 @@ --- + + + + title: 서비스와 애플리케이션 연결하기 content_type: concept weight: 30 @@ -50,7 +54,7 @@ kubectl get pods -l run=my-nginx -o yaml | grep podIP 클러스터의 모든 노드로 ssh 접속하고 두 IP로 curl을 할수 있어야 한다. 컨테이너는 노드의 포트 80을 사용하지 *않으며* , 트래픽을 파드로 라우팅하는 특별한 NAT 규칙도 없다는 것을 참고한다. 이것은 동일한 containerPort를 사용해서 동일한 노드에서 여러 nginx 파드를 실행하고 IP를 사용해서 클러스터의 다른 파드나 노드에서 접근할 수 있다는 의미이다. 도커와 마찬가지로 포트는 여전히 호스트 노드의 인터페이스에 게시될 수 있지만, 네트워킹 모델로 인해 포트의 필요성이 크게 줄어든다. -만약 궁금하다면 [우리가 이것을 달성하는 방법](/ko/docs/concepts/cluster-administration/networking/#쿠버네티스-네트워크-모델의-구현-방법)을 자세히 읽어본다. +만약 궁금하다면 [쿠버네티스 네트워킹 모델](/ko/docs/concepts/cluster-administration/networking/#쿠버네티스-네트워크-모델)을 자세히 읽어본다. ## 서비스 생성하기 diff --git a/content/ko/docs/concepts/services-networking/dns-pod-service.md b/content/ko/docs/concepts/services-networking/dns-pod-service.md index 3544d7e745..c23556172b 100644 --- a/content/ko/docs/concepts/services-networking/dns-pod-service.md +++ b/content/ko/docs/concepts/services-networking/dns-pod-service.md @@ -39,7 +39,7 @@ DNS 쿼리는 그것을 생성하는 파드의 네임스페이스에 따라 다 DNS 쿼리는 파드의 `/etc/resolv.conf` 를 사용하여 확장될 수 있을 것이다. Kubelet은 각 파드에 대해서 파일을 설정한다. 예를 들어, `data` 만을 위한 쿼리는 -`data.test.cluster.local` 로 확장된다. `search` 옵션의 값은 +`data.test.svc.cluster.local` 로 확장된다. `search` 옵션의 값은 쿼리를 확장하기 위해서 사용된다. DNS 쿼리에 대해 더 자세히 알고 싶은 경우, [`resolv.conf` 설명 페이지.](https://www.man7.org/linux/man-pages/man5/resolv.conf.5.html)를 참고한다. diff --git a/content/ko/docs/concepts/services-networking/dual-stack.md b/content/ko/docs/concepts/services-networking/dual-stack.md index 821ca34989..c77bba06c8 100644 --- a/content/ko/docs/concepts/services-networking/dual-stack.md +++ b/content/ko/docs/concepts/services-networking/dual-stack.md @@ -1,4 +1,9 @@ --- + + + + + title: IPv4/IPv6 이중 스택 feature: title: IPv4/IPv6 이중 스택 @@ -11,7 +16,7 @@ weight: 70 -{{< feature-state for_k8s_version="v1.21" state="beta" >}} +{{< feature-state for_k8s_version="v1.23" state="stable" >}} IPv4/IPv6 이중 스택 네트워킹을 사용하면 {{< glossary_tooltip text="파드" term_id="pod" >}}와 {{< glossary_tooltip text="서비스" term_id="service" >}}에 IPv4와 IPv6 주소를 모두 할당할 수 있다. @@ -42,8 +47,6 @@ IPv4/IPv6 이중 스택 쿠버네티스 클러스터를 활용하려면 다음 ## IPv4/IPv6 이중 스택 구성 -IPv4/IPv6 이중 스택을 사용하려면, 클러스터의 관련 구성 요소에 대해 `IPv6DualStack` [기능 게이트](/ko/docs/reference/command-line-tools-reference/feature-gates/)를 활성화한다. (1.21부터 IPv4/IPv6 이중 스택이 기본적으로 활성화된다.) - IPv4/IPv6 이중 스택을 구성하려면, 이중 스택 클러스터 네트워크 할당을 설정한다. * kube-apiserver: @@ -60,9 +63,6 @@ IPv4 CIDR의 예: `10.244.0.0/16` (자신의 주소 범위를 제공하더라도 IPv6 CIDR의 예: `fdXY:IJKL:MNOP:15::/64` (이 형식으로 표시되지만, 유효한 주소는 아니다 - [RFC 4193](https://tools.ietf.org/html/rfc4193)을 본다.) -1.21부터, IPv4/IPv6 이중 스택은 기본적으로 활성화된다. -필요한 경우 kube-apiserver, kube-controller-manager, kubelet 및 kube-proxy 커맨드 라인에 -`--feature-gates="IPv6DualStack=false"` 를 지정하여 비활성화할 수 있다. {{< /note >}} ## 서비스 @@ -76,7 +76,7 @@ IPv4, IPv6 또는 둘 다를 사용할 수 있는 {{< glossary_tooltip text="서 * `SingleStack`: 단일 스택 서비스. 컨트롤 플레인은 첫 번째로 구성된 서비스 클러스터 IP 범위를 사용하여 서비스에 대한 클러스터 IP를 할당한다. * `PreferDualStack`: - * 서비스에 IPv4 및 IPv6 클러스터 IP를 할당한다. (클러스터에 `--feature-gates="IPv6DualStack=false"` 가 있는 경우, 이 설정은 `SingleStack` 과 동일한 동작을 따른다.) + * 서비스에 IPv4 및 IPv6 클러스터 IP를 할당한다. * `RequireDualStack`: IPv4 및 IPv6 주소 범위 모두에서 서비스 `.spec.ClusterIPs`를 할당한다. * `.spec.ipFamilies` 배열의 첫 번째 요소의 주소 계열을 기반으로 `.spec.ClusterIPs` 목록에서 `.spec.ClusterIP`를 선택한다. @@ -119,7 +119,7 @@ IPv4, IPv6 또는 둘 다를 사용할 수 있는 {{< glossary_tooltip text="서 #### 기존 서비스의 이중 스택 기본값 -이 예제는 서비스가 이미 있는 클러스터에서 이중 스택이 새로 활성화된 경우의 기본 동작을 보여준다. (`--feature-gates="IPv6DualStack=false"` 가 설정되지 않은 경우 기존 클러스터를 1.21로 업그레이드하면 이중 스택이 활성화된다.) +이 예제는 서비스가 이미 있는 클러스터에서 이중 스택이 새로 활성화된 경우의 기본 동작을 보여준다. (기존 클러스터를 1.21 이상으로 업그레이드하면 이중 스택이 활성화된다.) 1. 클러스터에서 이중 스택이 활성화된 경우 기존 서비스 (`IPv4` 또는 `IPv6`)는 컨트롤 플레인이 `.spec.ipFamilyPolicy`를 `SingleStack`으로 지정하고 `.spec.ipFamilies`를 기존 서비스의 주소 계열로 설정한다. 기존 서비스 클러스터 IP는 `.spec.ClusterIPs`에 저장한다. diff --git a/content/ko/docs/concepts/services-networking/ingress-controllers.md b/content/ko/docs/concepts/services-networking/ingress-controllers.md index c66a9b6e84..a8b2cf1d5f 100644 --- a/content/ko/docs/concepts/services-networking/ingress-controllers.md +++ b/content/ko/docs/concepts/services-networking/ingress-controllers.md @@ -28,6 +28,7 @@ weight: 40 컨트롤러다. * [Apache APISIX 인그레스 컨트롤러](https://github.com/apache/apisix-ingress-controller)는 [Apache APISIX](https://github.com/apache/apisix) 기반의 인그레스 컨트롤러이다. * [Avi 쿠버네티스 오퍼레이터](https://github.com/vmware/load-balancer-and-ingress-services-for-kubernetes)는 [VMware NSX Advanced Load Balancer](https://avinetworks.com/)을 사용하는 L4-L7 로드 밸런싱을 제공한다. +* [BFE Ingress Controller](https://github.com/bfenetworks/ingress-bfe)는 [BFE](https://www.bfe-networks.net) 기반 인그레스 컨트롤러다. * [Citrix 인그레스 컨트롤러](https://github.com/citrix/citrix-k8s-ingress-controller#readme)는 Citrix 애플리케이션 딜리버리 컨트롤러에서 작동한다. * [Contour](https://projectcontour.io/)는 [Envoy](https://www.envoyproxy.io/) 기반 인그레스 컨트롤러다. diff --git a/content/ko/docs/concepts/services-networking/ingress.md b/content/ko/docs/concepts/services-networking/ingress.md index bafb216014..cccd947bb9 100644 --- a/content/ko/docs/concepts/services-networking/ingress.md +++ b/content/ko/docs/concepts/services-networking/ingress.md @@ -51,7 +51,7 @@ graph LR; 인그레스는 외부에서 서비스로 접속이 가능한 URL, 로드 밸런스 트래픽, SSL / TLS 종료 그리고 이름-기반의 가상 호스팅을 제공하도록 구성할 수 있다. [인그레스 컨트롤러](/ko/docs/concepts/services-networking/ingress-controllers)는 일반적으로 로드 밸런서를 사용해서 인그레스를 수행할 책임이 있으며, 트래픽을 처리하는데 도움이 되도록 에지 라우터 또는 추가 프런트 엔드를 구성할 수도 있다. 인그레스는 임의의 포트 또는 프로토콜을 노출시키지 않는다. HTTP와 HTTPS 이외의 서비스를 인터넷에 노출하려면 보통 -[Service.Type=NodePort](/ko/docs/concepts/services-networking/service/#nodeport) 또는 +[Service.Type=NodePort](/ko/docs/concepts/services-networking/service/#type-nodeport) 또는 [Service.Type=LoadBalancer](/ko/docs/concepts/services-networking/service/#loadbalancer) 유형의 서비스를 사용한다. ## 전제 조건들 @@ -219,20 +219,98 @@ Events: {{< codenew file="service/networking/external-lb.yaml" >}} -IngressClass 리소스에는 선택적인 파라미터 필드가 있다. 이 클래스에 대한 -추가 구현 별 구성을 참조하는데 사용할 수 있다. +인그레스클래스의 `.spec.parameters` 필드를 사용하여 +해당 인그레스클래스와 연관있는 환경 설정을 제공하는 다른 리소스를 참조할 수 있다. -#### 네임스페이스 범위의 파라미터 +사용 가능한 파라미터의 상세한 타입은 +인그레스클래스의 `.spec.parameters` 필드에 명시한 인그레스 컨트롤러의 종류에 따라 다르다. -{{< feature-state for_k8s_version="v1.22" state="beta" >}} +### 인그레스클래스 범위 -`Parameters` 필드에는 인그레스 클래스 구성을 위해 네임스페이스 별 리소스를 참조하는 데 -사용할 수 있는 `scope` 및 `namespace` 필드가 있다. -`Scope` 필드의 기본값은 `Cluster` 이다. 즉, 기본값은 클러스터 범위의 -리소스이다. `Scope` 를 `Namespace` 로 설정하고 `Namespace` 필드를 -설정하면 특정 네임스페이스의 파라미터 리소스를 참조한다. +인그레스 컨트롤러의 종류에 따라, 클러스터 범위로 설정한 파라미터의 사용이 가능할 수도 있고, +또는 한 네임스페이스에서만 사용 가능할 수도 있다. -{{< codenew file="service/networking/namespaced-params.yaml" >}} +{{< tabs name="tabs_ingressclass_parameter_scope" >}} +{{% tab name="클러스터" %}} +인그레스클래스 파라미터의 기본 범위는 클러스터 범위이다. + +`.spec.parameters` 필드만 설정하고 `.spec.parameters.scope` 필드는 지정하지 않거나, +`.spec.parameters.scope` 필드를 `Cluster`로 지정하면, +인그레스클래스는 클러스터 범위의 리소스를 참조한다. +파라미터의 `kind`(+`apiGroup`)는 +클러스터 범위의 API (커스텀 리소스일 수도 있음) 를 참조하며, +파라미터의 `name`은 +해당 API에 대한 특정 클러스터 범위 리소스를 가리킨다. + +예시는 다음과 같다. +```yaml +--- +apiVersion: networking.k8s.io/v1 +kind: IngressClass +metadata: + name: external-lb-1 +spec: + controller: example.com/ingress-controller + parameters: + # 이 인그레스클래스에 대한 파라미터는 "external-config-1" 라는 + # ClusterIngressParameter(API 그룹 k8s.example.net)에 기재되어 있다. + # 이 정의는 쿠버네티스가 + # 클러스터 범위의 파라미터 리소스를 검색하도록 한다. + scope: Cluster + apiGroup: k8s.example.net + kind: ClusterIngressParameter + name: external-config-1 +``` +{{% /tab %}} +{{% tab name="네임스페이스" %}} +{{< feature-state for_k8s_version="v1.23" state="stable" >}} + +`.spec.parameters` 필드를 설정하고 +`.spec.parameters.scope` 필드를 `Namespace`로 지정하면, +인그레스클래스는 네임스페이스 범위의 리소스를 참조한다. +사용하고자 하는 파라미터가 속한 네임스페이스를 +`.spec.parameters` 의 `namespace` 필드에 설정해야 한다. + +파라미터의 `kind`(+`apiGroup`)는 +네임스페이스 범위의 API (예: 컨피그맵) 를 참조하며, +파라미터의 `name`은 +`namespace`에 명시한 네임스페이스의 특정 리소스를 가리킨다. + +네임스페이스 범위의 파라미터를 이용하여, +클러스터 운영자가 워크로드에 사용되는 환경 설정(예: 로드 밸런서 설정, API 게이트웨이 정의)에 대한 제어를 위임할 수 있다. +클러스터 범위의 파라미터를 사용했다면 다음 중 하나에 해당된다. + +- 다른 팀의 새로운 환경 설정 변경을 적용하려고 할 때마다 + 클러스터 운영 팀이 매번 승인을 해야 한다. 또는, +- 애플리케이션 팀이 클러스터 범위 파라미터 리소스를 변경할 수 있게 하는 + [RBAC](/docs/reference/access-authn-authz/rbac/) 롤, 바인딩 등의 특별 접근 제어를 + 클러스터 운영자가 정의해야 한다. + +인그레스클래스 API 자신은 항상 클러스터 범위이다. + +네임스페이스 범위의 파라미터를 참조하는 인그레스클래스 예시가 +다음과 같다. +```yaml +--- +apiVersion: networking.k8s.io/v1 +kind: IngressClass +metadata: + name: external-lb-2 +spec: + controller: example.com/ingress-controller + parameters: + # 이 인그레스클래스에 대한 파라미터는 + # "external-configuration" 환경 설정 네임스페이스에 있는 + # "external-config" 라는 IngressParameter(API 그룹 k8s.example.com)에 기재되어 있다. + scope: Namespace + apiGroup: k8s.example.com + kind: IngressParameter + namespace: external-configuration + name: external-config +``` + +{{% /tab %}} +{{< /tabs >}} ### 사용중단(Deprecated) 어노테이션 @@ -559,12 +637,12 @@ Events: 사용자는 인그레스 리소스를 직접적으로 포함하지 않는 여러가지 방법으로 서비스를 노출할 수 있다. * [Service.Type=LoadBalancer](/ko/docs/concepts/services-networking/service/#loadbalancer) 사용. -* [Service.Type=NodePort](/ko/docs/concepts/services-networking/service/#nodeport) 사용. +* [Service.Type=NodePort](/ko/docs/concepts/services-networking/service/#type-nodeport) 사용. ## {{% heading "whatsnext" %}} -* [인그레스 API](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#ingress-v1beta1-networking-k8s-io)에 대해 배우기 +* [인그레스](/docs/reference/kubernetes-api/service-resources/ingress-v1/) API에 대해 배우기 * [인그레스 컨트롤러](/ko/docs/concepts/services-networking/ingress-controllers/)에 대해 배우기 * [NGINX 컨트롤러로 Minikube에서 인그레스 구성하기](/ko/docs/tasks/access-application-cluster/ingress-minikube/) diff --git a/content/ko/docs/concepts/services-networking/service-traffic-policy.md b/content/ko/docs/concepts/services-networking/service-traffic-policy.md index f658cd6cfa..8088d05366 100644 --- a/content/ko/docs/concepts/services-networking/service-traffic-policy.md +++ b/content/ko/docs/concepts/services-networking/service-traffic-policy.md @@ -68,6 +68,6 @@ kube-proxy는 `spec.internalTrafficPolicy` 의 설정에 따라서 라우팅되 ## {{% heading "whatsnext" %}} -* [토폴로지 인식 힌트 활성화](/ko/docs/tasks/administer-cluster/enabling-topology-aware-hints/)에 대해서 읽기 +* [토폴로지 인식 힌트](/docs/concepts/services-networking/topology-aware-hints/)에 대해서 읽기 * [서비스 외부 트래픽 정책](/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip)에 대해서 읽기 * [서비스와 애플리케이션 연결하기](/ko/docs/concepts/services-networking/connect-applications-service/) 읽기 diff --git a/content/ko/docs/concepts/services-networking/service.md b/content/ko/docs/concepts/services-networking/service.md index 798c0b4e97..db1c510ed0 100644 --- a/content/ko/docs/concepts/services-networking/service.md +++ b/content/ko/docs/concepts/services-networking/service.md @@ -550,7 +550,7 @@ API에서 `엔드포인트` 레코드를 생성하고, DNS 구성을 수정하 * `ClusterIP`: 서비스를 클러스터-내부 IP에 노출시킨다. 이 값을 선택하면 클러스터 내에서만 서비스에 도달할 수 있다. 이것은 `ServiceTypes`의 기본 값이다. -* [`NodePort`](#nodeport): 고정 포트 (`NodePort`)로 각 노드의 IP에 서비스를 +* [`NodePort`](#type-nodeport): 고정 포트 (`NodePort`)로 각 노드의 IP에 서비스를 노출시킨다. `NodePort` 서비스가 라우팅되는 `ClusterIP` 서비스가 자동으로 생성된다. `:`를 요청하여, 클러스터 외부에서 @@ -568,7 +568,7 @@ API에서 `엔드포인트` 레코드를 생성하고, DNS 구성을 수정하 [인그레스](/ko/docs/concepts/services-networking/ingress/)를 사용하여 서비스를 노출시킬 수도 있다. 인그레스는 서비스 유형이 아니지만, 클러스터의 진입점 역할을 한다. 동일한 IP 주소로 여러 서비스를 노출시킬 수 있기 때문에 라우팅 규칙을 단일 리소스로 통합할 수 있다. -### NodePort 유형 {#nodeport} +### NodePort 유형 {#type-nodeport} `type` 필드를 `NodePort`로 설정하면, 쿠버네티스 컨트롤 플레인은 `--service-node-port-range` 플래그로 지정된 범위에서 포트를 할당한다 (기본값 : 30000-32767). diff --git a/content/ko/docs/concepts/storage/persistent-volumes.md b/content/ko/docs/concepts/storage/persistent-volumes.md index 4bc8926e3b..c249864c96 100644 --- a/content/ko/docs/concepts/storage/persistent-volumes.md +++ b/content/ko/docs/concepts/storage/persistent-volumes.md @@ -10,14 +10,13 @@ feature: title: 스토리지 오케스트레이션 description: > 로컬 스토리지, GCP나 AWS와 같은 퍼블릭 클라우드 공급자 또는 NFS, iSCSI, Gluster, Ceph, Cinder나 Flocker와 같은 네트워크 스토리지 시스템에서 원하는 스토리지 시스템을 자동으로 마운트한다. - content_type: concept weight: 20 --- -이 페이지는 쿠버네티스의 _퍼시스턴트 볼륨_ 의 현재 상태를 설명한다. [볼륨](/ko/docs/concepts/storage/volumes/)에 대해 익숙해지는 것을 추천한다. +이 페이지에서는 쿠버네티스의 _퍼시스턴트 볼륨_ 에 대해 설명한다. [볼륨](/ko/docs/concepts/storage/volumes/)에 대해 익숙해지는 것을 추천한다. @@ -221,19 +220,19 @@ spec: {{< feature-state for_k8s_version="v1.11" state="beta" >}} -이제 퍼시스턴트볼륨클레임(PVC) 확장 지원이 기본적으로 활성화되어 있다. 다음 유형의 +퍼시스턴트볼륨클레임(PVC) 확장 지원은 기본적으로 활성화되어 있다. 다음 유형의 볼륨을 확장할 수 있다. -* gcePersistentDisk +* azureDisk +* azureFile * awsElasticBlockStore -* Cinder +* cinder (deprecated) +* {{< glossary_tooltip text="csi" term_id="csi" >}} +* flexVolume (deprecated) +* gcePersistentDisk * glusterfs * rbd -* Azure File -* Azure Disk -* Portworx -* FlexVolumes -* {{< glossary_tooltip text="CSI" term_id="csi" >}} +* portworxVolume 스토리지 클래스의 `allowVolumeExpansion` 필드가 true로 설정된 경우에만 PVC를 확장할 수 있다. @@ -270,7 +269,7 @@ CSI 볼륨 확장 지원은 기본적으로 활성화되어 있지만 볼륨 확 경우에만 파일시스템의 크기가 조정된다. 파일시스템 확장은 파드가 시작되거나 파드가 실행 중이고 기본 파일시스템이 온라인 확장을 지원할 때 수행된다. -FlexVolumes는 `RequiresFSResize` 기능으로 드라이버가 `true`로 설정된 경우 크기 조정을 허용한다. +FlexVolumes(쿠버네티스 v1.23부터 사용 중단됨)는 드라이버의 `RequiresFSResize` 기능이 `true`로 설정된 경우 크기 조정을 허용한다. FlexVolume은 파드 재시작 시 크기를 조정할 수 있다. #### 사용 중인 퍼시스턴트볼륨클레임 크기 조정 @@ -299,6 +298,11 @@ EBS 볼륨 확장은 시간이 많이 걸리는 작업이다. 또한 6시간마 #### 볼륨 확장 시 오류 복구 +사용자가 기반 스토리지 시스템이 제공할 수 있는 것보다 더 큰 사이즈를 지정하면, 사용자 또는 클러스터 관리자가 조치를 취하기 전까지 PVC 확장을 계속 시도한다. 이는 바람직하지 않으며 따라서 쿠버네티스는 이러한 오류 상황에서 벗어나기 위해 다음과 같은 방법을 제공한다. + +{{< tabs name="recovery_methods" >}} +{{% tab name="클러스터 관리자 접근 권한을 이용하여 수동으로" %}} + 기본 스토리지 확장에 실패하면, 클러스터 관리자가 수동으로 퍼시스턴트 볼륨 클레임(PVC) 상태를 복구하고 크기 조정 요청을 취소할 수 있다. 그렇지 않으면, 컨트롤러가 관리자 개입 없이 크기 조정 요청을 계속해서 재시도한다. 1. 퍼시스턴트볼륨클레임(PVC)에 바인딩된 퍼시스턴트볼륨(PV)을 `Retain` 반환 정책으로 표시한다. @@ -307,6 +311,30 @@ EBS 볼륨 확장은 시간이 많이 걸리는 작업이다. 또한 6시간마 4. PV 보다 작은 크기로 PVC를 다시 만들고 PVC의 `volumeName` 필드를 PV 이름으로 설정한다. 이것은 새 PVC를 기존 PV에 바인딩해야 한다. 5. PV의 반환 정책을 복원하는 것을 잊지 않는다. +{{% /tab %}} +{{% tab name="더 작은 크기로의 확장을 요청하여" %}} +{{% feature-state for_k8s_version="v1.23" state="alpha" %}} + +{{< note >}} +PVC 확장 실패의 사용자에 의한 복구는 쿠버네티스 1.23부터 제공되는 알파 기능이다. 이 기능이 작동하려면 `RecoverVolumeExpansionFailure` 기능이 활성화되어 있어야 한다. 더 많은 정보는 [기능 게이트](/ko/docs/reference/command-line-tools-reference/feature-gates/) 문서를 참조한다. +{{< /note >}} + +클러스터에 `ExpandPersistentVolumes`와 `RecoverVolumeExpansionFailure` +기능 게이트가 활성화되어 있는 상태에서 PVC 확장이 실패하면 +이전에 요청했던 값보다 작은 크기로의 확장을 재시도할 수 있다. +더 작은 크기를 지정하여 확장 시도를 요청하려면, +이전에 요청했던 값보다 작은 크기로 PVC의 `.spec.resources` 값을 수정한다. +이는 총 용량 제한(capacity constraint)으로 인해 큰 값으로의 확장이 실패한 경우에 유용하다. +만약 확장이 실패했다면, 또는 실패한 것 같다면, 기반 스토리지 공급자의 용량 제한보다 작은 값으로 확장을 재시도할 수 있다. +`.status.resizeStatus`와 PVC의 이벤트를 감시하여 리사이즈 작업의 상태를 모니터할 수 있다. + +참고: +이전에 요청했던 값보다 작은 크기를 요청했더라도, +새로운 값이 여전히 `.status.capacity`보다 클 수 있다. +쿠버네티스는 PVC를 현재 크기보다 더 작게 축소하는 것은 지원하지 않는다. +{{% /tab %}} +{{% /tabs %}} + ## 퍼시스턴트 볼륨의 유형 @@ -318,7 +346,6 @@ EBS 볼륨 확장은 시간이 많이 걸리는 작업이다. 또한 6시간마 * [`cephfs`](/ko/docs/concepts/storage/volumes/#cephfs) - CephFS 볼륨 * [`csi`](/ko/docs/concepts/storage/volumes/#csi) - 컨테이너 스토리지 인터페이스 (CSI) * [`fc`](/ko/docs/concepts/storage/volumes/#fc) - Fibre Channel (FC) 스토리지 -* [`flexVolume`](/ko/docs/concepts/storage/volumes/#flexVolume) - FlexVolume * [`gcePersistentDisk`](/ko/docs/concepts/storage/volumes/#gcepersistentdisk) - GCE Persistent Disk * [`glusterfs`](/ko/docs/concepts/storage/volumes/#glusterfs) - Glusterfs 볼륨 * [`hostPath`](/ko/docs/concepts/storage/volumes/#hostpath) - HostPath 볼륨 @@ -336,6 +363,8 @@ EBS 볼륨 확장은 시간이 많이 걸리는 작업이다. 또한 6시간마 * [`cinder`](/ko/docs/concepts/storage/volumes/#cinder) - Cinder (오픈스택 블록 스토리지) (v1.18에서 **사용 중단**) +* [`flexVolume`](/ko/docs/concepts/storage/volumes/#flexvolume) - FlexVolume + (v1.23에서 **사용 중단**) * [`flocker`](/ko/docs/concepts/storage/volumes/#flocker) - Flocker 스토리지 (v1.22에서 **사용 중단**) * [`quobyte`](/ko/docs/concepts/storage/volumes/#quobyte) - Quobyte 볼륨 @@ -415,10 +444,13 @@ spec: 접근 모드는 다음과 같다. `ReadWriteOnce` -: 하나의 노드에서 해당 볼륨이 읽기-쓰기로 마운트 될 수 있다. ReadWriteOnce 접근 모드에서도 파트가 동일 노드에서 구동되는 경우에는 복수의 파드에서 볼륨에 접근할 수 있다. +: 하나의 노드에서 해당 볼륨이 읽기-쓰기로 마운트 될 수 있다. ReadWriteOnce 접근 모드에서도 파드가 동일 노드에서 구동되는 경우에는 복수의 파드에서 볼륨에 접근할 수 있다. + +`ReadOnlyMany` +: 볼륨이 다수의 노드에서 읽기 전용으로 마운트 될 수 있다. `ReadWriteMany` -: 볼륨이 다수의 노드에서 읽기 전용으로 마운트 될 수 있다. +: 볼륨이 다수의 노드에서 읽기-쓰기로 마운트 될 수 있다. `ReadWriteOncePod` : 볼륨이 단일 파드에서 읽기-쓰기로 마운트될 수 있다. 전체 클러스터에서 단 하나의 파드만 해당 PVC를 읽거나 쓸 수 있어야하는 경우 ReadWriteOncePod 접근 모드를 사용한다. 이 기능은 CSI 볼륨과 쿠버네티스 버전 1.22+ 에서만 지원된다. diff --git a/content/ko/docs/concepts/storage/storage-capacity.md b/content/ko/docs/concepts/storage/storage-capacity.md index 4aeb1ba8c1..86c95ae13a 100644 --- a/content/ko/docs/concepts/storage/storage-capacity.md +++ b/content/ko/docs/concepts/storage/storage-capacity.md @@ -7,7 +7,7 @@ title: 스토리지 용량 content_type: concept -weight: 45 +weight: 70 --- @@ -16,7 +16,6 @@ weight: 45 예를 들어, 일부 노드에서 NAS(Network Attached Storage)에 접근할 수 없는 경우가 있을 수 있으며, 또는 각 노드에 종속적인 로컬 스토리지를 사용하는 경우일 수도 있다. -{{< feature-state for_k8s_version="v1.19" state="alpha" >}} {{< feature-state for_k8s_version="v1.21" state="beta" >}} 이 페이지에서는 쿠버네티스가 어떻게 스토리지 용량을 추적하고 diff --git a/content/ko/docs/concepts/storage/storage-classes.md b/content/ko/docs/concepts/storage/storage-classes.md index c915b65fad..c47f053a31 100644 --- a/content/ko/docs/concepts/storage/storage-classes.md +++ b/content/ko/docs/concepts/storage/storage-classes.md @@ -470,14 +470,14 @@ parameters: vSphere 스토리지 클래스에는 두 가지 유형의 프로비저닝 도구가 있다. -- [CSI 프로비저닝 도구](#csi-프로비저닝-도구): `csi.vsphere.vmware.com` +- [CSI 프로비저닝 도구](#vsphere-provisioner-csi): `csi.vsphere.vmware.com` - [vCP 프로비저닝 도구](#vcp-프로비저닝-도구): `kubernetes.io/vsphere-volume` 인-트리 프로비저닝 도구는 [사용 중단](/blog/2019/12/09/kubernetes-1-17-feature-csi-migration-beta/#why-are-we-migrating-in-tree-plugins-to-csi)되었다. CSI 프로비저닝 도구에 대한 자세한 내용은 [쿠버네티스 vSphere CSI 드라이버](https://vsphere-csi-driver.sigs.k8s.io/) 및 [vSphereVolume CSI 마이그레이션](/ko/docs/concepts/storage/volumes/#csi-마이그레이션)을 참고한다. #### CSI 프로비저닝 도구 {#vsphere-provisioner-csi} -vSphere CSI 스토리지클래스 프로비저닝 도구는 Tanzu 쿠버네티스 클러스터에서 작동한다. 예시는 [vSphere CSI 리포지터리](https://raw.githubusercontent.com/kubernetes-sigs/vsphere-csi-driver/master/example/vanilla-k8s-file-driver/example-sc.yaml)를 참조한다. +vSphere CSI 스토리지클래스 프로비저닝 도구는 Tanzu 쿠버네티스 클러스터에서 작동한다. 예시는 [vSphere CSI 리포지터리](https://github.com/kubernetes-sigs/vsphere-csi-driver/blob/master/example/vanilla-k8s-RWM-filesystem-volumes/example-sc.yaml)를 참조한다. #### vCP 프로비저닝 도구 diff --git a/content/ko/docs/concepts/storage/volume-pvc-datasource.md b/content/ko/docs/concepts/storage/volume-pvc-datasource.md index e9857885d7..365f780230 100644 --- a/content/ko/docs/concepts/storage/volume-pvc-datasource.md +++ b/content/ko/docs/concepts/storage/volume-pvc-datasource.md @@ -1,7 +1,12 @@ --- + + + + + title: CSI 볼륨 복제하기 content_type: concept -weight: 30 +weight: 60 --- diff --git a/content/ko/docs/concepts/storage/volume-snapshot-classes.md b/content/ko/docs/concepts/storage/volume-snapshot-classes.md index 862c900fee..594d100772 100644 --- a/content/ko/docs/concepts/storage/volume-snapshot-classes.md +++ b/content/ko/docs/concepts/storage/volume-snapshot-classes.md @@ -8,7 +8,7 @@ title: 볼륨 스냅샷 클래스 content_type: concept -weight: 30 +weight: 41 # just after volume snapshots --- diff --git a/content/ko/docs/concepts/storage/volume-snapshots.md b/content/ko/docs/concepts/storage/volume-snapshots.md index b01a8affa4..d54ed5c45c 100644 --- a/content/ko/docs/concepts/storage/volume-snapshots.md +++ b/content/ko/docs/concepts/storage/volume-snapshots.md @@ -1,7 +1,14 @@ --- + + + + + + + title: 볼륨 스냅샷 content_type: concept -weight: 20 +weight: 40 --- diff --git a/content/ko/docs/concepts/storage/volumes.md b/content/ko/docs/concepts/storage/volumes.md index 5983c37647..a4245a7daa 100644 --- a/content/ko/docs/concepts/storage/volumes.md +++ b/content/ko/docs/concepts/storage/volumes.md @@ -44,12 +44,21 @@ weight: 10 볼륨을 사용하려면, `.spec.volumes` 에서 파드에 제공할 볼륨을 지정하고 `.spec.containers[*].volumeMounts` 의 컨테이너에 해당 볼륨을 마운트할 위치를 선언한다. -컨테이너의 프로세스는 도커 이미지와 볼륨으로 구성된 파일시스템 -뷰를 본다. [도커 이미지](https://docs.docker.com/userguide/dockerimages/)는 -파일시스템 계층의 루트에 있다. 볼륨은 이미지 내에 지정된 경로에 -마운트된다. 볼륨은 다른 볼륨에 마운트할 수 없거나 다른 볼륨에 대한 하드 링크를 -가질 수 없다. 파드 구성의 각 컨테이너는 각 볼륨을 마운트할 위치를 독립적으로 -지정해야 한다. +컨테이너의 프로세스는 +{{< glossary_tooltip text="컨테이너 이미지" term_id="image" >}}의 최초 내용물과 +컨테이너 안에 마운트된 볼륨(정의된 경우에 한함)으로 구성된 파일시스템을 보게 된다. +프로세스는 컨테이너 이미지의 최초 내용물에 해당되는 루트 파일시스템을 +보게 된다. +쓰기가 허용된 경우, 해당 파일시스템에 쓰기 작업을 하면 +추후 파일시스템에 접근할 때 변경된 내용을 보게 될 것이다. +볼륨은 이미지의 [특정 경로](#using-subpath)에 +마운트된다. +파드에 정의된 각 컨테이너에 대해, +컨테이너가 사용할 각 볼륨을 어디에 마운트할지 명시해야 한다. + +볼륨은 다른 볼륨 안에 마운트될 수 없다 +(하지만, [서브패스 사용](#using-subpath)에서 관련 메커니즘을 확인한다). +또한, 볼륨은 다른 볼륨에 있는 내용물을 가리키는 하드 링크를 포함할 수 없다. ## 볼륨 유형들 {#volume-types} @@ -802,142 +811,7 @@ spec: ### projected `Projected` 볼륨은 여러 기존 볼륨 소스를 동일한 디렉터리에 매핑한다. - -현재, 다음 유형의 볼륨 소스를 프로젝티드한다. - -* [`secret`](#secret) -* [`downwardAPI`](#downwardapi) -* [`configMap`](#configmap) -* `serviceAccountToken` - -모든 소스는 파드와 동일한 네임스페이스에 있어야 한다. 더 자세한 내용은 -[올인원 볼륨 디자인 문서](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node/all-in-one-volume.md)를 본다. - -#### 시크릿, 다운워드 API 그리고 컨피그맵이 있는 구성 예시 {#example-configuration-secret-downwardapi-configmap} - -```yaml -apiVersion: v1 -kind: Pod -metadata: - name: volume-test -spec: - containers: - - name: container-test - image: busybox - volumeMounts: - - name: all-in-one - mountPath: "/projected-volume" - readOnly: true - volumes: - - name: all-in-one - projected: - sources: - - secret: - name: mysecret - items: - - key: username - path: my-group/my-username - - downwardAPI: - items: - - path: "labels" - fieldRef: - fieldPath: metadata.labels - - path: "cpu_limit" - resourceFieldRef: - containerName: container-test - resource: limits.cpu - - configMap: - name: myconfigmap - items: - - key: config - path: my-group/my-config -``` - -#### 구성 예시: 기본값이 아닌 소유권 모드 설정의 시크릿 {#example-configuration-secrets-nondefault-permission-mode} - -```yaml -apiVersion: v1 -kind: Pod -metadata: - name: volume-test -spec: - containers: - - name: container-test - image: busybox - volumeMounts: - - name: all-in-one - mountPath: "/projected-volume" - readOnly: true - volumes: - - name: all-in-one - projected: - sources: - - secret: - name: mysecret - items: - - key: username - path: my-group/my-username - - secret: - name: mysecret2 - items: - - key: password - path: my-group/my-password - mode: 511 -``` - -각각의 projected 볼륨 소스는 `source` 아래 사양 목록에 있다. -파라미터는 두 가지 예외를 제외하고 거의 동일하다. - -* 시크릿의 경우 `secretName` 필드는 컨피그맵 이름과 일치하도록 - `name` 으로 변경되었다. -* `defaultMode` 는 각각의 볼륨 소스에 대해 projected 수준에서만 - 지정할 수 있다. 그러나 위에서 설명한 것처럼 각각의 개별 projection 에 대해 `mode` - 를 명시적으로 설정할 수 있다. - -`TokenRequestProjection` 기능이 활성화 되면, 현재 -[서비스 어카운트](/docs/reference/access-authn-authz/authentication/#service-account-tokens)에 -대한 토큰을 파드의 지정된 경로에 주입할 수 있다. 예를 들면 다음과 같다. - -```yaml -apiVersion: v1 -kind: Pod -metadata: - name: sa-token-test -spec: - containers: - - name: container-test - image: busybox - volumeMounts: - - name: token-vol - mountPath: "/service-account" - readOnly: true - volumes: - - name: token-vol - projected: - sources: - - serviceAccountToken: - audience: api - expirationSeconds: 3600 - path: token -``` - -예시 파드에 주입된 서비스 어카운트 토큰이 포함된 projected 볼륨이 -있다. 이 토큰은 파드의 컨테이너에서 쿠버네티스 API 서버에 접근하는데 -사용할 수 있다. `audience` 필드는 토큰에 의도하는 대상을 -포함한다. 토큰 수령은 토큰 대상에 지정된 식별자로 자신을 식별해야 하며, -그렇지 않으면 토큰을 거부해야 한다. 이 필드는 -선택 사항이며 기본값은 API 서버의 식별자이다. - -`expirationSeconds` 는 서비스 어카운트 토큰의 예상 유효 -기간이다. 기본값은 1시간이며 최소 10분(600초)이어야 한다. 관리자는 -API 서버에 대해 `--service-account-max-token-expiration` 옵션을 지정해서 -최대 값을 제한할 수도 있다. `path` 필드는 projected 볼륨의 마운트 위치에 대한 -상대 경로를 지정한다. - -{{< note >}} -projected 볼륨 소스를 [`subPath`](#subpath-사용하기) 볼륨으로 마운트해서 사용하는 컨테이너는 -해당 볼륨 소스의 업데이트를 수신하지 않는다. -{{< /note >}} +더 자세한 사항은 [projected volumes](/docs/concepts/storage/projected-volumes/)를 참고한다. ### quobyte (사용 중단됨) {#quobyte} @@ -975,6 +849,38 @@ RBD는 읽기-쓰기 모드에서 단일 고객만 마운트할 수 있다. 더 자세한 내용은 [RBD 예시](https://github.com/kubernetes/examples/tree/master/volumes/rbd)를 참고한다. +#### RBD CSI 마이그레이션 {#rbd-csi-migration} + +{{< feature-state for_k8s_version="v1.23" state="alpha" >}} + +`RBD`를 위한 `CSIMigration` 기능이 활성화되어 있으면, +사용 중이 트리 내(in-tree) 플러그인의 모든 플러그인 동작을 +`rbd.csi.ceph.com` {{< glossary_tooltip text="CSI" term_id="csi" >}} +드라이버로 리다이렉트한다. +이 기능을 사용하려면, 클러스터에 +[Ceph CSI 드라이버](https://github.com/ceph/ceph-csi)가 설치되어 있고 +`CSIMigration`, `CSIMigrationRBD` +[기능 게이트](/ko/docs/reference/command-line-tools-reference/feature-gates/)가 활성화되어 있어야 한다. + +{{< note >}} + +스토리지를 관리하는 쿠버네티스 클러스터 관리자는, +RBD CSI 드라이버로의 마이그레이션을 시도하기 전에 +다음의 선행 사항을 완료해야 한다. + +* 쿠버네티스 클러스터에 Ceph CSI 드라이버 (`rbd.csi.ceph.com`) v3.5.0 + 이상을 설치해야 한다. +* CSI 드라이버가 동작하기 위해 `clusterID` 필드가 필수이지만 + 트리 내(in-tree) 스토리지클래스는 `monitors` 필드가 필수임을 감안하여, + 쿠버네티스 저장소 관리자는 monitors 값의 + 해시(예: `#echo -n '' | md5sum`) + 기반으로 clusterID를 CSI 컨피그맵 내에 만들고 + 이 clusterID 환경 설정 아래에 monitors 필드를 유지해야 한다. +* 또한, 트리 내(in-tree) 스토리지클래스의 + `adminId` 값이 `admin`이 아니면, 트리 내(in-tree) 스토리지클래스의 + `adminSecretName` 값이 `adminId` 파라미터 값의 + base64 값으로 패치되어야 하며, 아니면 이 단계를 건너뛸 수 있다. + ### secret `secret` 볼륨은 암호와 같은 민감한 정보를 파드에 전달하는데 @@ -1144,6 +1050,16 @@ vSphere CSI 드라이버에서 생성된 새 볼륨은 이러한 파라미터를 `vsphereVolume` 플러그인이 컨트롤러 관리자와 kubelet에 의해 로드되지 않도록 기능을 비활성화하려면, `InTreePluginvSphereUnregister` 기능 플래그를 `true` 로 설정해야 한다. 이를 위해서는 모든 워커 노드에 `csi.vsphere.vmware.com` {{< glossary_tooltip text="CSI" term_id="csi" >}} 드라이버를 설치해야 한다. +#### Portworx CSI 마이그레이션 +{{< feature-state for_k8s_version="v1.23" state="alpha" >}} + +Portworx를 위한 `CSIMigration` 기능이 쿠버네티스 1.23에 추가되었지만 +알파 상태이기 때문에 기본적으로는 비활성화되어 있다. +이 기능은 사용 중이 트리 내(in-tree) 플러그인의 모든 플러그인 동작을 +`pxd.portworx.com` CSI 드라이버로 리다이렉트한다. +이 기능을 사용하려면, 클러스터에 [Portworx CSI 드라이버](https://docs.portworx.com/portworx-install-with-kubernetes/storage-operations/csi/)가 +설치되어 있고, kube-controller-manager와 kubelet에 `CSIMigrationPortworx=true`로 설정해야 한다. + ## subPath 사용하기 {#using-subpath} 때로는 단일 파드에서 여러 용도의 한 볼륨을 공유하는 것이 유용하다. @@ -1239,8 +1155,7 @@ spec: ## 아웃-오브-트리(out-of-tree) 볼륨 플러그인 아웃-오브-트리 볼륨 플러그인에는 -{{< glossary_tooltip text="컨테이너 스토리지 인터페이스" term_id="csi" >}}(CSI) 그리고 -FlexVolume이 포함된다. 이러한 플러그인을 사용하면 스토리지 벤더들은 플러그인 소스 코드를 쿠버네티스 리포지터리에 +{{< glossary_tooltip text="컨테이너 스토리지 인터페이스" term_id="csi" >}}(CSI) 그리고 FlexVolume(사용 중단됨)이 포함된다. 이러한 플러그인을 사용하면 스토리지 벤더들은 플러그인 소스 코드를 쿠버네티스 리포지터리에 추가하지 않고도 사용자 정의 스토리지 플러그인을 만들 수 있다. 이전에는 모든 볼륨 플러그인이 "인-트리(in-tree)"에 있었다. "인-트리" 플러그인은 쿠버네티스 핵심 바이너리와 @@ -1373,13 +1288,21 @@ CSI 드라이버로 전환할 때 기존 스토리지 클래스, 퍼시스턴트 ### flexVolume -FlexVolume은 버전 1.2(CSI 이전) 이후 쿠버네티스에 존재하는 -아웃-오브-트리 플러그인 인터페이스이다. 이것은 exec 기반 모델을 사용해서 드라이버에 -접속한다. FlexVolume 드라이버 바이너리 파일은 각각의 노드와 일부 경우에 컨트롤 플레인 노드의 -미리 정의된 볼륨 플러그인 경로에 설치해야 한다. +{{< feature-state for_k8s_version="v1.23" state="deprecated" >}} + +FlexVolume은 스토리지 드라이버와 인터페이싱하기 위해 exec 기반 모델을 사용하는 아웃-오브-트리 플러그인 인터페이스이다. +FlexVolume 드라이버 바이너리 파일은 각 노드의 미리 정의된 볼륨 플러그인 경로에 설치되어야 하며, +일부 경우에는 컨트롤 플레인 노드에도 설치되어야 한다. 파드는 `flexvolume` 인-트리 볼륨 플러그인을 통해 FlexVolume 드라이버와 상호 작용한다. -더 자세한 내용은 [FlexVolume](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-storage/flexvolume.md) 예제를 참고한다. +더 자세한 내용은 FlexVolume [README](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-storage/flexvolume.md#readme) 문서를 참고한다. + +{{< note >}} +FlexVolume은 사용 중단되었다. 쿠버네티스에 외부 스토리지를 연결하려면 아웃-오브-트리 CSI 드라이버를 사용하는 것을 권장한다. + +FlexVolume 드라이버 메인테이너는 CSI 드라이버를 구현하고 사용자들이 FlexVolume 드라이버에서 CSI로 마이그레이트할 수 있도록 지원해야 한다. +FlexVolume 사용자는 워크로드가 동등한 CSI 드라이버를 사용하도록 이전해야 한다. +{{< /note >}} ## 마운트 전파(propagation) diff --git a/content/ko/docs/concepts/workloads/controllers/cron-jobs.md b/content/ko/docs/concepts/workloads/controllers/cron-jobs.md index 3ae5659806..34ac547b73 100644 --- a/content/ko/docs/concepts/workloads/controllers/cron-jobs.md +++ b/content/ko/docs/concepts/workloads/controllers/cron-jobs.md @@ -17,8 +17,6 @@ _크론잡은_ 반복 일정에 따라 {{< glossary_tooltip term_id="job" text=" 하나의 크론잡 오브젝트는 _크론탭_ (크론 테이블) 파일의 한 줄과 같다. 크론잡은 잡을 [크론](https://ko.wikipedia.org/wiki/Cron) 형식으로 쓰여진 주어진 일정에 따라 주기적으로 동작시킨다. -추가로, 크론잡 스케줄은 타임존(timezone) 처리를 지원해서, 크론잡 스케줄 시작 부분에 "CRON_TZ=