diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES index d78cc20a05..ea9761f277 100644 --- a/OWNERS_ALIASES +++ b/OWNERS_ALIASES @@ -161,6 +161,7 @@ aliases: - chenxuc - howieyuen - idealhack + - mengjiao-liu - pigletfly - SataQiu - tanjunchen diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md index 6d61184b52..9001997b01 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md @@ -126,7 +126,18 @@ command. In that case, you should explicitly set `--certificate-renewal=true`. You can renew your certificates manually at any time with the `kubeadm certs renew` command. -This command performs the renewal using CA (or front-proxy-CA) certificate and key stored in `/etc/kubernetes/pki`. +This command performs the renewal using CA (or front-proxy-CA) certificate and key stored in `/etc/kubernetes/pki`. + +After running the command you should restart the control plane Pods. This is required since +dynamic certificate reload is currently not supported for all components and certificates. +[Static Pods](/docs/tasks/configure-pod-container/static-pod/) are managed by the local kubelet +and not by the API Server, thus kubectl cannot be used to delete and restart them. +To restart a static Pod you can temporarily remove its manifest file from `/etc/kubernetes/manifests/` +and wait for 20 seconds (see the `fileCheckFrequency` value in [KubeletConfiguration struct](/docs/ +reference/config-api/kubelet-config.v1beta1/). +The kubelet will terminate the Pod if it's no longer in the manifest directory. +You can then move the file back and after another `fileCheckFrequency` period, the kubelet will recreate +the Pod and the certificate renewal for the component can complete. {{< warning >}} If you are running an HA cluster, this command needs to be executed on all the control-plane nodes. diff --git a/content/en/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy.md b/content/en/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy.md index 948893d3ea..74b8d2182e 100644 --- a/content/en/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy.md +++ b/content/en/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy.md @@ -24,45 +24,59 @@ For background on Cilium, read the [Introduction to Cilium](https://docs.cilium. ## Deploying Cilium on Minikube for Basic Testing To get familiar with Cilium easily you can follow the -[Cilium Kubernetes Getting Started Guide](https://docs.cilium.io/en/stable/gettingstarted/minikube/) +[Cilium Kubernetes Getting Started Guide](https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/) to perform a basic DaemonSet installation of Cilium in minikube. -To start minikube, minimal version required is >= v1.3.1, run the with the +To start minikube, minimal version required is >= v1.5.2, run the with the following arguments: ```shell minikube version ``` ``` -minikube version: v1.3.1 +minikube version: v1.5.2 ``` ```shell -minikube start --network-plugin=cni --memory=4096 +minikube start --network-plugin=cni ``` -Mount the BPF filesystem: +For minikube you can install Cilium using its CLI tool. Cilium will +automatically detect the cluster configuration and will install the appropriate +components for a successful installation: ```shell -minikube ssh -- sudo mount bpffs -t bpf /sys/fs/bpf -``` - -For minikube you can deploy this simple ''all-in-one'' YAML file that includes -DaemonSet configurations for Cilium as well as appropriate RBAC settings: - -```shell -kubectl create -f https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml +curl -LO https://github.com/cilium/cilium-cli/releases/latest/download/cilium-linux-amd64.tar.gz +sudo tar xzvfC cilium-linux-amd64.tar.gz /usr/local/bin +rm cilium-linux-amd64.tar.gz +cilium install ``` ``` -configmap/cilium-config created -serviceaccount/cilium created -serviceaccount/cilium-operator created -clusterrole.rbac.authorization.k8s.io/cilium created -clusterrole.rbac.authorization.k8s.io/cilium-operator created -clusterrolebinding.rbac.authorization.k8s.io/cilium created -clusterrolebinding.rbac.authorization.k8s.io/cilium-operator created -daemonset.apps/cilium create -deployment.apps/cilium-operator created +🔮 Auto-detected Kubernetes kind: minikube +✨ Running "minikube" validation checks +✅ Detected minikube version "1.20.0" +ℹ️ Cilium version not set, using default version "v1.10.0" +🔮 Auto-detected cluster name: minikube +🔮 Auto-detected IPAM mode: cluster-pool +🔮 Auto-detected datapath mode: tunnel +🔑 Generating CA... +2021/05/27 02:54:44 [INFO] generate received request +2021/05/27 02:54:44 [INFO] received CSR +2021/05/27 02:54:44 [INFO] generating key: ecdsa-256 +2021/05/27 02:54:44 [INFO] encoded CSR +2021/05/27 02:54:44 [INFO] signed certificate with serial number 48713764918856674401136471229482703021230538642 +🔑 Generating certificates for Hubble... +2021/05/27 02:54:44 [INFO] generate received request +2021/05/27 02:54:44 [INFO] received CSR +2021/05/27 02:54:44 [INFO] generating key: ecdsa-256 +2021/05/27 02:54:44 [INFO] encoded CSR +2021/05/27 02:54:44 [INFO] signed certificate with serial number 3514109734025784310086389188421560613333279574 +🚀 Creating Service accounts... +🚀 Creating Cluster roles... +🚀 Creating ConfigMap... +🚀 Creating Agent DaemonSet... +🚀 Creating Operator Deployment... +⌛ Waiting for Cilium to be installed... ``` The remainder of the Getting Started Guide explains how to enforce both L3/L4 @@ -85,14 +99,14 @@ Deploying a cluster with Cilium adds Pods to the `kube-system` namespace. To see this list of Pods run: ```shell -kubectl get pods --namespace=kube-system +kubectl get pods --namespace=kube-system -l k8s-app=cilium ``` You'll see a list of Pods similar to this: ```console -NAME READY STATUS RESTARTS AGE -cilium-6rxbd 1/1 Running 0 1m +NAME READY STATUS RESTARTS AGE +cilium-kkdhz 1/1 Running 0 3m23s ... ``` diff --git a/content/en/docs/tasks/network/validate-dual-stack.md b/content/en/docs/tasks/network/validate-dual-stack.md index bc90dea4ea..717bac27ad 100644 --- a/content/en/docs/tasks/network/validate-dual-stack.md +++ b/content/en/docs/tasks/network/validate-dual-stack.md @@ -16,7 +16,7 @@ This document shares how to validate IPv4/IPv6 dual-stack enabled Kubernetes clu * Provider support for dual-stack networking (Cloud provider or otherwise must be able to provide Kubernetes nodes with routable IPv4/IPv6 network interfaces) -* A [network plugin](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) that supports dual-stack (such as Kubenet or Calico) +* A [network plugin](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) that supports dual-stack (such as Calico, Cilium or Kubenet) * [Dual-stack enabled](/docs/concepts/services-networking/dual-stack/) cluster {{< version-check >}} diff --git a/content/en/docs/tasks/tools/install-kubectl-macos.md b/content/en/docs/tasks/tools/install-kubectl-macos.md index 1cd6cb043e..b46ab03640 100644 --- a/content/en/docs/tasks/tools/install-kubectl-macos.md +++ b/content/en/docs/tasks/tools/install-kubectl-macos.md @@ -185,7 +185,7 @@ Below are the procedures to set up autocompletion for Bash and Zsh. 1. Validate the binary (optional) - Download the kubectl checksum file: + Download the kubectl-convert checksum file: {{< tabs name="download_convert_checksum_macos" >}} {{< tab name="Intel" codelang="bash" >}} diff --git a/content/en/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html b/content/en/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html index 106365900c..5301c6b7a1 100644 --- a/content/en/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html +++ b/content/en/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html @@ -26,7 +26,7 @@ weight: 20
Home - Continue to Module 2 > + Continue to Module 2 >
diff --git a/content/en/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html b/content/en/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html index 5a645ea5d6..915304f912 100644 --- a/content/en/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html +++ b/content/en/docs/tutorials/kubernetes-basics/deploy-app/deploy-interactive.html @@ -37,9 +37,9 @@ weight: 20
- < Return to Module 1 + < Return to Module 1 Home - Continue to Module 3 > + Continue to Module 3 >
diff --git a/content/en/docs/tutorials/kubernetes-basics/explore/explore-interactive.html b/content/en/docs/tutorials/kubernetes-basics/explore/explore-interactive.html index 38c2acd8cc..ad79ec5d7f 100644 --- a/content/en/docs/tutorials/kubernetes-basics/explore/explore-interactive.html +++ b/content/en/docs/tutorials/kubernetes-basics/explore/explore-interactive.html @@ -29,9 +29,9 @@ weight: 20
- < Return to Module 2 + < Return to Module 2 Home - Continue to Module 4 > + Continue to Module 4 >
diff --git a/content/en/docs/tutorials/kubernetes-basics/expose/expose-interactive.html b/content/en/docs/tutorials/kubernetes-basics/expose/expose-interactive.html index f99bd50172..2b5d3aa365 100644 --- a/content/en/docs/tutorials/kubernetes-basics/expose/expose-interactive.html +++ b/content/en/docs/tutorials/kubernetes-basics/expose/expose-interactive.html @@ -26,9 +26,9 @@ weight: 20
- < Return to Module 3 + < Return to Module 3 Home - Continue to Module 5 > + Continue to Module 5 >
diff --git a/content/en/docs/tutorials/kubernetes-basics/scale/scale-interactive.html b/content/en/docs/tutorials/kubernetes-basics/scale/scale-interactive.html index 3f87e284c9..3fedf79782 100644 --- a/content/en/docs/tutorials/kubernetes-basics/scale/scale-interactive.html +++ b/content/en/docs/tutorials/kubernetes-basics/scale/scale-interactive.html @@ -26,9 +26,9 @@ weight: 20
- < Return to Module 4 + < Return to Module 4 Home - Continue to Module 6 > + Continue to Module 6 >
diff --git a/content/en/docs/tutorials/kubernetes-basics/update/update-interactive.html b/content/en/docs/tutorials/kubernetes-basics/update/update-interactive.html index b09aa1215c..2e70d61d74 100644 --- a/content/en/docs/tutorials/kubernetes-basics/update/update-interactive.html +++ b/content/en/docs/tutorials/kubernetes-basics/update/update-interactive.html @@ -26,7 +26,7 @@ weight: 20
- < Return to Module 5 + < Return to Module 5 Return to Kubernetes Basics
diff --git a/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md b/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md index ab0372b1a9..8bf1ddc28e 100644 --- a/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md +++ b/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md @@ -99,7 +99,7 @@ You can use the `check-expiration` subcommand to check when certificates expire: 你可以使用 `check-expiration` 子命令来检查证书何时过期 ```shell -kubeadm alpha certs check-expiration +kubeadm certs check-expiration ``` {{< note >}} -上面的列表中没有包含 `kubelet.conf` 因为 kubeadm 将 kubelet 配置为自动更新证书。 +上面的列表中没有包含 `kubelet.conf`，因为 kubeadm 将 kubelet 配置为 +[自动更新证书](/docs/tasks/tls/certificate-rotation/)。 +轮换的证书位于目录 `/var/lib/kubelet/pki`。 +要修复过期的 kubelet 客户端证书，请参阅 +[kubelet 客户端证书轮换失败](/zh/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm/#kubelet-client-cert)。 {{< /note >}} ## 手动更新证书 -你能随时通过 `kubeadm alpha certs renew` 命令手动更新你的证书。 +你能随时通过 `kubeadm certs renew` 命令手动更新你的证书。 `kubeadm certs renew`提供以下选项： @@ -303,10 +311,10 @@ Kubernetes 证书颁发机构不是开箱即用。 要激活内置签名者，请传递 `--cluster-signing-cert-file` 和 `--cluster-signing-key-file` 参数。 如果你正在创建一个新的集群，你可以使用 kubeadm 的 -[配置文件](https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta2)。 +[配置文件](/docs/reference/config-api/kubeadm-config.v1beta2/)。 ```yaml apiVersion: kubeadm.k8s.io/v1beta2 @@ -331,7 +339,7 @@ See [Create CertificateSigningRequest](/docs/reference/access-authn-authz/certif ## 通过外部 CA 更新证书 @@ -349,7 +357,7 @@ CSR 表示向 CA 请求客户的签名证书。 ### 创建证书签名请求 (CSR) -你可以通过 `kubeadm alpha certs renew --csr-only` 命令创建证书签名请求。 +你可以通过 `kubeadm certs renew --csr-only` 命令创建证书签名请求。 CSR 和随附的私钥都在输出中给出。 你可以传入一个带有 `--csr-dir` 的目录，将 CRS 输出到指定位置。 @@ -444,7 +452,7 @@ serverTLSBootstrap: true