whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'kubernetes:main' into master

Browse Source
This commit is contained in:
Anyul Rivas
2021-08-02 21:12:41 +02:00
committed by GitHub
parent f1f300645b c2b38df06f
commit 925b3ed76d
13 changed files with 88 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
OWNERS_ALIASES
+1
View File
@@ -161,6 +161,7 @@ aliases:
- chenxuc
- howieyuen
- idealhack
- mengjiao-liu
- pigletfly
- SataQiu
- tanjunchen
content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md
+12 -1
View File
@@ -126,7 +126,18 @@ command. In that case, you should explicitly set `--certificate-renewal=true`.
You can renew your certificates manually at any time with the `kubeadm certs renew` command.
This command performs the renewal using CA (or front-proxy-CA) certificate and key stored in `/etc/kubernetes/pki`.
This command performs the renewal using CA (or front-proxy-CA) certificate and key stored in `/etc/kubernetes/pki`.
After running the command you should restart the control plane Pods. This is required since
dynamic certificate reload is currently not supported for all components and certificates.
[Static Pods](/docs/tasks/configure-pod-container/static-pod/) are managed by the local kubelet
and not by the API Server, thus kubectl cannot be used to delete and restart them.
To restart a static Pod you can temporarily remove its manifest file from `/etc/kubernetes/manifests/`
and wait for 20 seconds (see the `fileCheckFrequency` value in [KubeletConfiguration struct](/docs/
reference/config-api/kubelet-config.v1beta1/).
The kubelet will terminate the Pod if it's no longer in the manifest directory.
You can then move the file back and after another `fileCheckFrequency` period, the kubelet will recreate
the Pod and the certificate renewal for the component can complete.
{{< warning >}}
If you are running an HA cluster, this command needs to be executed on all the control-plane nodes.
content/en/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy.md
+39 -25
View File
@@ -24,45 +24,59 @@ For background on Cilium, read the [Introduction to Cilium](https://docs.cilium.
## Deploying Cilium on Minikube for Basic Testing
To get familiar with Cilium easily you can follow the
[Cilium Kubernetes Getting Started Guide](https://docs.cilium.io/en/stable/gettingstarted/minikube/)
[Cilium Kubernetes Getting Started Guide](https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/)
to perform a basic DaemonSet installation of Cilium in minikube.
To start minikube, minimal version required is >= v1.3.1, run the with the
To start minikube, minimal version required is >= v1.5.2, run the with the
following arguments:
```shell
minikube version
```
```
minikube version: v1.3.1
minikube version: v1.5.2
```
```shell
minikube start --network-plugin=cni --memory=4096
minikube start --network-plugin=cni
```
Mount the BPF filesystem:
For minikube you can install Cilium using its CLI tool. Cilium will
automatically detect the cluster configuration and will install the appropriate
components for a successful installation:
```shell
minikube ssh -- sudo mount bpffs -t bpf /sys/fs/bpf
```
For minikube you can deploy this simple ''all-in-one'' YAML file that includes
DaemonSet configurations for Cilium as well as appropriate RBAC settings:
```shell
kubectl create -f https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml
curl -LO https://github.com/cilium/cilium-cli/releases/latest/download/cilium-linux-amd64.tar.gz
sudo tar xzvfC cilium-linux-amd64.tar.gz /usr/local/bin
rm cilium-linux-amd64.tar.gz
cilium install
```
```
configmap/cilium-config created
serviceaccount/cilium created
serviceaccount/cilium-operator created
clusterrole.rbac.authorization.k8s.io/cilium created
clusterrole.rbac.authorization.k8s.io/cilium-operator created
clusterrolebinding.rbac.authorization.k8s.io/cilium created
clusterrolebinding.rbac.authorization.k8s.io/cilium-operator created
daemonset.apps/cilium create
deployment.apps/cilium-operator created
🔮 Auto-detected Kubernetes kind: minikube
✨ Running "minikube" validation checks
✅ Detected minikube version "1.20.0"
ℹ️ Cilium version not set, using default version "v1.10.0"
🔮 Auto-detected cluster name: minikube
🔮 Auto-detected IPAM mode: cluster-pool
🔮 Auto-detected datapath mode: tunnel
🔑 Generating CA...
2021/05/27 02:54:44 [INFO] generate received request
2021/05/27 02:54:44 [INFO] received CSR
2021/05/27 02:54:44 [INFO] generating key: ecdsa-256
2021/05/27 02:54:44 [INFO] encoded CSR
2021/05/27 02:54:44 [INFO] signed certificate with serial number 48713764918856674401136471229482703021230538642
🔑 Generating certificates for Hubble...
2021/05/27 02:54:44 [INFO] generate received request
2021/05/27 02:54:44 [INFO] received CSR
2021/05/27 02:54:44 [INFO] generating key: ecdsa-256
2021/05/27 02:54:44 [INFO] encoded CSR
2021/05/27 02:54:44 [INFO] signed certificate with serial number 3514109734025784310086389188421560613333279574
🚀 Creating Service accounts...
🚀 Creating Cluster roles...
🚀 Creating ConfigMap...
🚀 Creating Agent DaemonSet...
🚀 Creating Operator Deployment...
⌛ Waiting for Cilium to be installed...
```
The remainder of the Getting Started Guide explains how to enforce both L3/L4
@@ -85,14 +99,14 @@ Deploying a cluster with Cilium adds Pods to the `kube-system` namespace. To see
this list of Pods run:
```shell
kubectl get pods --namespace=kube-system
kubectl get pods --namespace=kube-system -l k8s-app=cilium
```
You'll see a list of Pods similar to this:
```console
NAME READY STATUS RESTARTS AGE
cilium-6rxbd 1/1 Running 0 1m
NAME READY STATUS RESTARTS AGE
cilium-kkdhz 1/1 Running 0 3m23s
...
```
content/en/docs/tasks/network/validate-dual-stack.md
+1 -1
View File
@@ -16,7 +16,7 @@ This document shares how to validate IPv4/IPv6 dual-stack enabled Kubernetes clu
* Provider support for dual-stack networking (Cloud provider or otherwise must be able to provide Kubernetes nodes with routable IPv4/IPv6 network interfaces)
* A [network plugin](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) that supports dual-stack (such as Kubenet or Calico)
* A [network plugin](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) that supports dual-stack (such as Calico, Cilium or Kubenet)
* [Dual-stack enabled](/docs/concepts/services-networking/dual-stack/) cluster
{{< version-check >}}
content/en/docs/tasks/tools/install-kubectl-macos.md
+1 -1
View File
@@ -185,7 +185,7 @@ Below are the procedures to set up autocompletion for Bash and Zsh.
1. Validate the binary (optional)
Download the kubectl checksum file:
Download the kubectl-convert checksum file:
{{< tabs name="download_convert_checksum_macos" >}}
{{< tab name="Intel" codelang="bash" >}}
content/en/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html
+1 -1
View File
@@ -26,7 +26,7 @@ weight: 20
<div class="row">
<div class="col-md-12">
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/" role="button">Home<span class=""></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro/" role="button">Continue to Module 2 &gt<span class=""></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro/" role="button">Continue to Module 2 &gt;<span class=""></span></a>
</div>
</div>
content/en/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html
+2 -2
View File
@@ -37,9 +37,9 @@ weight: 20
</div>
<div class="row">
<div class="col-md-12">
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/create-cluster/cluster-intro/" role="button"> &lt Return to Module 1<span class=""></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/create-cluster/cluster-intro/" role="button"> &lt; Return to Module 1<span class=""></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/" role="button">Home<span class=""></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/explore/explore-intro/" role="button">Continue to Module 3 &gt<span class=""></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/explore/explore-intro/" role="button">Continue to Module 3 &gt;<span class=""></span></a>
</div>
</div>
content/en/docs/tutorials/kubernetes-basics/explore/explore-interactive.html
+2 -2
View File
@@ -29,9 +29,9 @@ weight: 20
</div>
<div class="row">
<div class="col-md-12">
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro/" role="button">&lt Return to Module 2<span class="btn"></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro/" role="button">&lt; Return to Module 2<span class="btn"></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/" role="button">Home<span class=""></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/expose/expose-intro/" role="button">Continue to Module 4 &gt<span class="btn"></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/expose/expose-intro/" role="button">Continue to Module 4 &gt;<span class="btn"></span></a>
</div>
</div>
content/en/docs/tutorials/kubernetes-basics/expose/expose-interactive.html
+2 -2
View File
@@ -26,9 +26,9 @@ weight: 20
</div>
<div class="row">
<div class="col-md-12">
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/explore/explore-intro/" role="button">&lt Return to Module 3<span class=""></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/explore/explore-intro/" role="button">&lt; Return to Module 3<span class=""></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/" role="button">Home<span class=""></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/scale/scale-intro/" role="button">Continue to Module 5 &gt<span class=""></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/scale/scale-intro/" role="button">Continue to Module 5 &gt;<span class=""></span></a>
</div>
</div>
content/en/docs/tutorials/kubernetes-basics/scale/scale-interactive.html
+2 -2
View File
@@ -26,9 +26,9 @@ weight: 20
</div>
<div class="row">
<div class="col-md-12">
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/expose/expose-interactive/" role="button">&lt Return to Module 4<span class=""></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/expose/expose-interactive/" role="button">&lt; Return to Module 4<span class=""></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/" role="button">Home<span class=""></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/update/update-intro/" role="button">Continue to Module 6 &gt<span class=""></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/update/update-intro/" role="button">Continue to Module 6 &gt;<span class=""></span></a>
</div>
</div>
content/en/docs/tutorials/kubernetes-basics/update/update-interactive.html
+1 -1
View File
@@ -26,7 +26,7 @@ weight: 20
</div>
<div class="row">
<div class="col-md-12">
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/scale/scale-interactive/" role="button">&lt Return to Module 5<span class=""></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/scale/scale-interactive/" role="button">&lt; Return to Module 5<span class=""></span></a>
<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/" role="button">Return to Kubernetes Basics<span class=""></span></a>
</div>
</div>
content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md
+22 -14
View File
@@ -99,7 +99,7 @@ You can use the `check-expiration` subcommand to check when certificates expire:
你可以使用 `check-expiration` 子命令来检查证书何时过期
```shell
kubeadm alpha certs check-expiration
kubeadm certs check-expiration
```
<!--
@@ -147,10 +147,18 @@ Additionally, kubeadm informs the user if the certificate is externally managed;
{{< /warning >}}
<!--
`kubelet.conf` is not included in the list above because kubeadm configures kubelet for automatic certificate renewal.
`kubelet.conf` is not included in the list above because kubeadm configures kubelet
for [automatic certificate renewal](/docs/tasks/tls/certificate-rotation/)
with rotatable certificates under `/var/lib/kubelet/pki`.
To repair an expired kubelet client certificate see
[Kubelet client certificate rotation fails](/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm/#kubelet-client-cert).
-->
{{< note >}}
上面的列表中没有包含 `kubelet.conf` 因为 kubeadm 将 kubelet 配置为自动更新证书。
上面的列表中没有包含 `kubelet.conf`，因为 kubeadm 将 kubelet 配置为
[自动更新证书](/docs/tasks/tls/certificate-rotation/)。
轮换的证书位于目录 `/var/lib/kubelet/pki`。
要修复过期的 kubelet 客户端证书，请参阅
[kubelet 客户端证书轮换失败](/zh/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm/#kubelet-client-cert)。
{{< /note >}}
<!--
@@ -219,11 +227,11 @@ kubeadm 在 1.17 版本之前有一个[缺陷](https://github.com/kubernetes/kub
<!--
## Manual certificate renewal
You can renew your certificates manually at any time with the `kubeadm alpha certs renew` command.
You can renew your certificates manually at any time with the `kubeadm certs renew` command.
-->
## 手动更新证书
你能随时通过 `kubeadm alpha certs renew` 命令手动更新你的证书。
你能随时通过 `kubeadm certs renew` 命令手动更新你的证书。
<!--
This command performs the renewal using CA (or front-proxy-CA) certificate and key stored in `/etc/kubernetes/pki`.
@@ -246,7 +254,7 @@ If you are running an HA cluster, this command needs to be executed on all the c
{{< /note >}}
<!--
`kubeadm alpha certs renew` provides the following options:
`kubeadm certs renew` provides the following options:
-->
`kubeadm certs renew`提供以下选项：
@@ -303,10 +311,10 @@ Kubernetes 证书颁发机构不是开箱即用。
要激活内置签名者，请传递 `--cluster-signing-cert-file` 和 `--cluster-signing-key-file` 参数。
<!--
If you're creating a new cluster, you can use a kubeadm [configuration file](https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta2):
If you're creating a new cluster, you can use a kubeadm [configuration file](/docs/reference/config-api/kubeadm-config.v1beta2/):
-->
如果你正在创建一个新的集群，你可以使用 kubeadm 的
[配置文件](https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta2)。
[配置文件](/docs/reference/config-api/kubeadm-config.v1beta2/)。
```yaml
apiVersion: kubeadm.k8s.io/v1beta2
@@ -331,7 +339,7 @@ See [Create CertificateSigningRequest](/docs/reference/access-authn-authz/certif
<!--
## Renew certificates with external CA
This section provide more details about how to execute manual certificate renewal using an external CA.
This section provides more details about how to execute manual certificate renewal using an external CA.
-->
## 通过外部 CA 更新证书
@@ -349,7 +357,7 @@ CSR 表示向 CA 请求客户的签名证书。
<!--
### Create certificate signing requests (CSR)
You can create certificate signing requests with `kubeadm alpha certs renew --csr-only`.
You can create certificate signing requests with `kubeadm certs renew --csr-only`.
Both the CSR and the accompanying private key are given in the output.
You can pass in a directory with `--csr-dir` to output the CSRs to the specified location.
@@ -357,7 +365,7 @@ If `--csr-dir` is not specified, the default certificate directory (`/etc/kubern
-->
### 创建证书签名请求 (CSR)
你可以通过 `kubeadm alpha certs renew --csr-only` 命令创建证书签名请求。
你可以通过 `kubeadm certs renew --csr-only` 命令创建证书签名请求。
CSR 和随附的私钥都在输出中给出。
你可以传入一个带有 `--csr-dir` 的目录，将 CRS 输出到指定位置。
@@ -444,7 +452,7 @@ serverTLSBootstrap: true
<!--
If you have already created the cluster you must adapt it by doing the following:
- Find and edit the `kubelet-config-{{< skew latestVersion >}}` ConfigMap in the `kube-system` namespace.
In that ConfigMap, the `config` key has a
In that ConfigMap, the `kubelet` key has a
[KubeletConfiguration](/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration)
document as its value. Edit the KubeletConfiguration document to set `serverTLSBootstrap: true`.
- On each node, add the `serverTLSBootstrap: true` field in `/var/lib/kubelet/config.yaml`
@@ -454,7 +462,7 @@ and restart the kubelet with `systemctl restart kubelet`
- 找到 `kube-system` 名字空间中名为 `kubelet-config-{{< skew latestVersion >}}`
的 ConfigMap 并编辑之。
在该 ConfigMap 中，`config` 键下面有一个
在该 ConfigMap 中，`kubelet` 键下面有一个
[KubeletConfiguration](/zh/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration)
文档作为其取值。编辑该 KubeletConfiguration 文档以设置
`serverTLSBootstrap: true`。
@@ -467,7 +475,7 @@ The field `serverTLSBootstrap: true` will enable the bootstrap of kubelet servin
certificates by requesting them from the `certificates.k8s.io` API. One known limitation
is that the CSRs (Certificate Signing Requests) for these certificates cannot be automatically
approved by the default signer in the kube-controller-manager -
[`kubernetes.io/kubelet-serving`](https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/#kubernetes-signers).
[`kubernetes.io/kubelet-serving`](/docs/reference/access-authn-authz/certificate-signing-requests/#kubernetes-signers).
This will require action from the user or a third party controller.
These CSRs can be viewed using:
content/zh/examples/application/job/redis/worker.py
+2 -2
View File
@@ -8,11 +8,11 @@ host="redis"
# import os
# host = os.getenv("REDIS_SERVICE_HOST")
q = rediswq.RedisWQ(name="job2", host="redis")
q = rediswq.RedisWQ(name="job2", host=host)
print("Worker with sessionID: " + q.sessionID())
print("Initial queue state: empty=" + str(q.empty()))
while not q.empty():
item = q.lease(lease_secs=10, block=True, timeout=2)
item = q.lease(lease_secs=10, block=True, timeout=2)
if item is not None:
itemstr = item.decode("utf-8")
print("Working on " + itemstr)