From 04a783d3730888e544fd762bcfaa1a2c502ee720 Mon Sep 17 00:00:00 2001 From: Jeff Sloyer Date: Thu, 22 Dec 2016 10:35:51 -0500 Subject: [PATCH 001/113] added subject docs on allowing all users --- docs/admin/authorization.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/docs/admin/authorization.md b/docs/admin/authorization.md index 523dd256d9..0387a101ed 100644 --- a/docs/admin/authorization.md +++ b/docs/admin/authorization.md @@ -441,6 +441,28 @@ subjects: name: system:serviceaccounts ``` +For all authenticated users: +```yaml +subjects: +- kind: Group + name: system:authenticated +``` + +For all unauthenticated users: +```yaml +subjects: +- kind: Group + name: system:unauthenticated +``` + +For all users: +```yaml +subjects: +- kind: Group + name: system:authenticated +- kind: Group + name: system:unauthenticated + ## Webhook Mode When specified, mode `Webhook` causes Kubernetes to query an outside REST From f3aef1dbf2d532a8075707afe111638598aff468 Mon Sep 17 00:00:00 2001 From: Eric Hole Date: Fri, 30 Dec 2016 13:22:58 -0700 Subject: [PATCH 002/113] Added kubeadm to list of tools under kubectl. Updated _data/tools.yml to reflect kubeadm. --- _data/tools.yml | 2 ++ docs/tools/index.md | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/_data/tools.yml b/_data/tools.yml index 31c355e9b0..92764f795a 100644 --- a/_data/tools.yml +++ b/_data/tools.yml @@ -7,6 +7,8 @@ toc: section: - title: Kubectl path: /docs/user-guide/kubectl/ + - title: Kubeadm + path: /docs/getting-started-guides/kubeadm - title: Kubefed path: /docs/admin/federation/kubefed/ - title: Kubernetes Dashboard diff --git a/docs/tools/index.md b/docs/tools/index.md index 351b5968c1..8ab734c289 100644 --- a/docs/tools/index.md +++ b/docs/tools/index.md @@ -14,6 +14,10 @@ Kubernetes contains the following built-in tools: [`kubectl`](/docs/user-guide/kubectl/) is the command line tool for Kubernetes. It controls the Kubernetes cluster manager. +##### Kubeadm + +[`kubeadm`](/docs/getting-started-guides/kubeadm/) is the command line tool for easily provisioning a secure Kubernetes cluster on top of physical or cloud servers or virtual machines (currently in alpha). + ##### Kubefed [`kubefed`](/docs/admin/federation/kubefed/) is the command line tool From 67ce3155b3c643fa180eecd4f19b0cfd74a69971 Mon Sep 17 00:00:00 2001 From: Jess Frazelle Date: Thu, 15 Dec 2016 12:05:37 -0800 Subject: [PATCH 003/113] move community.html to community/index.html to be more consistent with the rest of the repo Signed-off-by: Jess Frazelle --- community.html => community/index.html | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename community.html => community/index.html (100%) diff --git a/community.html b/community/index.html similarity index 100% rename from community.html rename to community/index.html From 65a8beae339a333a96efe0606be54c813dafb73b Mon Sep 17 00:00:00 2001 From: Jess Frazelle Date: Thu, 15 Dec 2016 12:13:46 -0800 Subject: [PATCH 004/113] move case-study-styles.html to an actual css file and make it a class Signed-off-by: Jess Frazelle --- _includes/case-study-styles.html | 313 ------------------------------- _includes/head-header.html | 1 + case-studies/index.html | 2 +- case-studies/pearson.html | 2 +- case-studies/wikimedia.html | 2 +- css/gridpage.css | 310 ++++++++++++++++++++++++++++++ partners/index.html | 2 +- 7 files changed, 315 insertions(+), 317 deletions(-) delete mode 100644 _includes/case-study-styles.html create mode 100644 css/gridpage.css diff --git a/_includes/case-study-styles.html b/_includes/case-study-styles.html deleted file mode 100644 index 48058bd27b..0000000000 --- a/_includes/case-study-styles.html +++ /dev/null @@ -1,313 +0,0 @@ - - diff --git a/_includes/head-header.html b/_includes/head-header.html index fa859604d2..43e56595b4 100644 --- a/_includes/head-header.html +++ b/_includes/head-header.html @@ -7,6 +7,7 @@ + {% if page.class == "gridPage" %}{% endif %} diff --git a/case-studies/index.html b/case-studies/index.html index f593d73fb9..35082bbf2c 100644 --- a/case-studies/index.html +++ b/case-studies/index.html @@ -1,5 +1,6 @@ --- title: Case Studies +class: gridPage --- @@ -99,7 +100,6 @@ title: Case Studies {% include footer.html %} -{% include case-study-styles.html %} diff --git a/case-studies/pearson.html b/case-studies/pearson.html index 50f16ce7ae..9d0943392b 100644 --- a/case-studies/pearson.html +++ b/case-studies/pearson.html @@ -1,5 +1,6 @@ --- title: Pearson Case Study +class: gridPage --- @@ -82,7 +83,6 @@ title: Pearson Case Study {% include footer.html %} -{% include case-study-styles.html %} diff --git a/case-studies/wikimedia.html b/case-studies/wikimedia.html index 2d3b686128..ff019a3fd7 100644 --- a/case-studies/wikimedia.html +++ b/case-studies/wikimedia.html @@ -1,5 +1,6 @@ --- title: Wikimedia Case Study +class: gridPage --- @@ -97,7 +98,6 @@ title: Wikimedia Case Study {% include footer.html %} -{% include case-study-styles.html %} diff --git a/css/gridpage.css b/css/gridpage.css new file mode 100644 index 0000000000..96a39af9c6 --- /dev/null +++ b/css/gridpage.css @@ -0,0 +1,310 @@ +#caseStudyTitle { + margin-top: 1em !important; +} + +.gridPage p { + color: rgb(26,26,26) !important; + margin-left: 0 !important; + padding-left: 0 !important; + font-weight: 300 !important; +} + +.gridPage #mainContent { + padding: 0; +} + +.gridPage #mainContent .content { + padding-top: 0; +} + +.gridPage main { + max-width: 1100px !important; +} + +.gridPage .content { + position: relative; + margin: 0 auto 50px; + max-width: 90%; +} + +.gridPage .content p { + line-height: 24px !important; +} + +.gridPage .content h3 { + padding: 0 !important; +} + +.gridPage #hero h5 { + padding-left: 20px; + margin: 0; +} + +.case-studies { + position: relative; + display: flex; + justify-content: space-between; + flex-wrap: wrap; + margin-top: 50px; +} + +.case-study { + position: relative; + width: 50%; + padding: 0 40px 0 242px; + margin-bottom: 60px; + min-height: 152px; +} + +.case-study:nth-child(3), .case-study:nth-child(4) { + margin-bottom: 0; +} + +.case-study img { + position: absolute; + top: 0; + left: 0; +} + +.gridPage #mainContent .content .case-study p { + font-family: "Roboto", sans-serif; + font-size: 16px; + padding: 0; +} + +p.attrib { + font-style: italic; +} + +.gridPage #video { + background: #f9f9f9; + height: auto; + /*height: 340px;*/ +} + +.gridPage #video main { + position: relative; + max-width: 900px !important; + height: 100%; + display: flex; + justify-content: center; + align-items: center; + padding: 50px 20px; +} + +.gridPage #video main > div { + width: 50%; +} + +.gridPage #video main #zulilyLogo { + width: 100px; +} + +.gridPage #video main img { + max-width: 100%; +} + +.gridPage #video h3 { + font-size: 32px; + font-weight: 300; + line-height: 38px; + max-width: 80%; + margin: 0 0 1em 0; +} + +.gridPage #video p { + margin: 0; +} + +.gridPage #video p.attrib { + margin-bottom: 20px; +} + +.gridPage #video button > h6 { + font-size: 18px; + font-weight: 500; + margin: 1em 0; + color: #326de6; +} + +.gridPage #users { + padding: 50px; +} + +.gridPage #users main { + max-width: 1150px !important; +} + +.gridPage #users main h3 { + padding-left: 20px; + margin-bottom: 20px; +} + +.gridPage #usersGrid { + position: relative; + display: flex; + flex-wrap: wrap; + justify-content: center; +} + +.gridPage #usersGrid a { + display: inline-block; + margin: 5px; +} + +.gridPage #usersGrid a img { + box-shadow: 1px 1px 2px transparent; + transition: box-shadow 0.25s; +} + +.gridPage #usersGrid a img:hover { + box-shadow: 1px 1px 2px #cccccc; +} + +.gridPage #usersGrid a:last-child img, +.gridPage #usersGrid a:last-child img:hover { + box-shadow: 1px 1px 2px transparent; +} + +.tell-your-story { + border: 1px solid #dddddd; + border-radius: 6px; + box-shadow: 1px 2px 2px #dddddd; +} + +.gridPage .feature { + position: relative; + padding: 20px 0 20px 242px; +} + +.gridPage .feature img { + position: absolute; + top: 20px; + left: 0; +} + +section.bullets { + background-color: #eeeeee; + margin-bottom: 50px; +} + +section.bullets main { + position: relative; + max-width: 1100px; + padding: 50px 0; +} + +section.bullets .content { + position: relative; + display: flex; + flex-wrap: wrap; + margin-bottom: 0 !important; +} + +.bullet { + position: relative; + width: 50%; + padding: 15px 30px; +} + +.bullet h4 { + margin-bottom: 0.5em; +} + +.bullet li { + margin-left: 1.25em; + list-style: disc; + font-weight: 300; + color: rgb(26,26,26); + line-height: 1.5em; + margin-bottom: 0.5em; +} + +.details h4, p { + margin-bottom: 0.5em; +} + +.gridPage .feature p.quote { + font-size: 20px; + line-height: 28px !important; +} + +@media screen and (max-width: 1024px){ + .case-study { + padding: 0 10%; + margin-bottom: 50px; + } + + .case-study img { + position: relative; + } + + .case-study p.quote { + margin-top: 20px !important; + } + + .case-study p.attrib { + font-style: italic; + } +} + +@media screen and (max-width: 900px){ + .gridPage #video main { + flex-direction: column; + align-items: center; + } + + .gridPage #video main > div { + width: 400px; + } + + .gridPage #video main > div + div { + margin-top: 30px; + } + + .gridPage #video h3 { + max-width: 100%; + } +} + +@media screen and (max-width: 640px){ + .case-study { + width: 100%; + } + + .case-study:nth-child(3) { + margin-bottom: 60px; + } + + .case-study img { + left: 50%; + transform: translateX(-50%); + } + + .gridPage .feature { + margin-top: 50px; + padding: 180px 0 0; + } + + .gridPage .feature img { + top: 0; + left: 50%; + transform: translateX(-50%); + } +} + +@media screen and (max-width: 480px){ + .gridPage #hero { + padding-right: 20px; + padding-left: 20px; + } + + .gridPage #video main > div { + width: 80%; + min-width: 280px; + } + + .bullet { + width: 100%; + } +} diff --git a/partners/index.html b/partners/index.html index 5a8da670a9..a65be512ff 100644 --- a/partners/index.html +++ b/partners/index.html @@ -1,5 +1,6 @@ --- title: Partners +class: gridPage --- @@ -23,7 +24,6 @@ title: Partners {% include footer.html %} -{% include case-study-styles.html %} + + + + diff --git a/_layouts/docwithnav.html b/_layouts/docwithnav.html index 65418b3ece..454ccd69ce 100755 --- a/_layouts/docwithnav.html +++ b/_layouts/docwithnav.html @@ -75,57 +75,7 @@ {% include_cached footer.html %} +{% include footer-scripts.html %} - - - - - From 1c0a25bd12984084d22bf44f761bb279297dc3c5 Mon Sep 17 00:00:00 2001 From: Jess Frazelle Date: Thu, 15 Dec 2016 12:29:15 -0800 Subject: [PATCH 008/113] make it clearer where the {{content}} starts Signed-off-by: Jess Frazelle --- _layouts/docwithnav.html | 1 + 1 file changed, 1 insertion(+) diff --git a/_layouts/docwithnav.html b/_layouts/docwithnav.html index 454ccd69ce..073e1c9344 100755 --- a/_layouts/docwithnav.html +++ b/_layouts/docwithnav.html @@ -47,6 +47,7 @@ +

Edit This Page

From 354394bf5262e09a3c5a7507404ad0eb8134e408 Mon Sep 17 00:00:00 2001 From: Jess Frazelle Date: Thu, 15 Dec 2016 12:35:33 -0800 Subject: [PATCH 009/113] add basic layout Signed-off-by: Jess Frazelle --- _layouts/basic.html | 15 +++++++++++++++ case-studies/index.html | 14 ++------------ case-studies/pearson.html | 15 ++------------- case-studies/wikimedia.html | 15 ++------------- community/index.html | 17 +++-------------- partners/index.html | 15 ++------------- 6 files changed, 26 insertions(+), 65 deletions(-) create mode 100644 _layouts/basic.html diff --git a/_layouts/basic.html b/_layouts/basic.html new file mode 100644 index 0000000000..d2b684df52 --- /dev/null +++ b/_layouts/basic.html @@ -0,0 +1,15 @@ + + + + {% include head.html %} + + + {% include header.html %} + + {{ content }} + + {% include footer.html %} + + {% include footer-scripts.html %} + + diff --git a/case-studies/index.html b/case-studies/index.html index 9a09623206..e4e15111c5 100644 --- a/case-studies/index.html +++ b/case-studies/index.html @@ -1,16 +1,10 @@ --- title: Case Studies +layout: basic class: gridPage +cid: caseStudies --- - - -{% include head.html %} - - - -{% include header.html %} -

Kubernetes User Case Studies

A collection of users running Kubernetes in production.
@@ -103,7 +97,3 @@ class: gridPage
-{% include footer.html %} - - - diff --git a/case-studies/pearson.html b/case-studies/pearson.html index 34afa89522..45428b0bf3 100644 --- a/case-studies/pearson.html +++ b/case-studies/pearson.html @@ -1,16 +1,10 @@ --- title: Pearson Case Study +layout: basic class: gridPage +cid: caseStudies --- - - -{% include head.html %} - - - -{% include header.html %} -

Pearson Case Study

@@ -85,8 +79,3 @@ class: gridPage - -{% include footer.html %} - - - diff --git a/case-studies/wikimedia.html b/case-studies/wikimedia.html index 50a3910b75..7431c13650 100644 --- a/case-studies/wikimedia.html +++ b/case-studies/wikimedia.html @@ -1,16 +1,10 @@ --- title: Wikimedia Case Study +layout: basic class: gridPage +cid: caseStudies --- - - -{% include head.html %} - - - -{% include header.html %} -

Wikimedia Case Study

@@ -100,8 +94,3 @@ class: gridPage - -{% include footer.html %} - - - diff --git a/community/index.html b/community/index.html index b142585874..4686ebb442 100644 --- a/community/index.html +++ b/community/index.html @@ -1,17 +1,11 @@ --- title: Community +layout: basic +cid: community --- - - -{% include head.html %} - - - -{% include header.html %} -
-

Community

+

Community

@@ -65,8 +59,3 @@ title: Community
- -{% include footer.html %} - - - diff --git a/partners/index.html b/partners/index.html index 65127b8b3b..13ee6e2396 100644 --- a/partners/index.html +++ b/partners/index.html @@ -1,16 +1,10 @@ --- title: Partners +layout: basic class: gridPage +cid: partners --- - - -{% include head.html %} - - - -{% include header.html %} -

Kubernetes Partners

Growing the Kubernetes ecosystem.
@@ -27,8 +21,6 @@ class: gridPage
-{% include footer.html %} - @@ -36,6 +28,3 @@ class: gridPage - - - From 1aaa7920fee7ad33b68fb8618f4d322b768b9925 Mon Sep 17 00:00:00 2001 From: Jess Frazelle Date: Thu, 15 Dec 2016 12:37:53 -0800 Subject: [PATCH 010/113] add index to the basic layout as well Signed-off-by: Jess Frazelle --- index.html | 31 ++----------------------------- 1 file changed, 2 insertions(+), 29 deletions(-) diff --git a/index.html b/index.html index 902f16d644..5e860832d7 100644 --- a/index.html +++ b/index.html @@ -1,15 +1,8 @@ --- +layout: basic +cid: home --- - - - -{% include head.html %} - - - -{% include header.html %} -
@@ -186,23 +179,3 @@ - - - - - - From 956dcf8cd6a2eee39c6637d6607a0c10ece7d971 Mon Sep 17 00:00:00 2001 From: Brandon Cole Date: Wed, 7 Dec 2016 20:53:56 -0500 Subject: [PATCH 011/113] Updating downward-api/index.md for spec.nodeName There are a couple awesome enhancements that would benefit from being documented here: 1. `spec.nodeName` for obtaining the host name 2. `spec.serviceAccountName` for obtaining the name of the service account the pod is running under Right now these enhancements are documented only in a couple of issues and pull requests: 1. https://github.com/kubernetes/kubernetes/pull/27880 2. https://github.com/kubernetes/kubernetes/issues/24657 3. https://github.com/kubernetes/kubernetes/issues/21317 I have verified the functionality in the latest codebase: 1. https://github.com/kubernetes/kubernetes/blob/master/pkg/api/v1/conversion.go#L200 Also updating downward-api/dapi-pod.yaml to add a concrete example. --- docs/user-guide/downward-api/dapi-pod.yaml | 8 ++++++++ docs/user-guide/downward-api/index.md | 6 +++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/docs/user-guide/downward-api/dapi-pod.yaml b/docs/user-guide/downward-api/dapi-pod.yaml index 7d688aa0e9..5de0260bfc 100644 --- a/docs/user-guide/downward-api/dapi-pod.yaml +++ b/docs/user-guide/downward-api/dapi-pod.yaml @@ -8,6 +8,10 @@ spec: image: gcr.io/google_containers/busybox command: [ "/bin/sh", "-c", "env" ] env: + - name: MY_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName - name: MY_POD_NAME valueFrom: fieldRef: @@ -20,4 +24,8 @@ spec: valueFrom: fieldRef: fieldPath: status.podIP + - name: MY_POD_SERVICE_ACCOUNT + valueFrom: + fieldRef: + fieldPath: spec.serviceAccountName restartPolicy: Never diff --git a/docs/user-guide/downward-api/index.md b/docs/user-guide/downward-api/index.md index 00cef8f43e..33b2b06c49 100644 --- a/docs/user-guide/downward-api/index.md +++ b/docs/user-guide/downward-api/index.md @@ -22,9 +22,11 @@ the Pod's name, for example, and inject it into this well-known variable. The following information is available to a `Pod` through the downward API: -* The pod's name +* The node's name +*   The pod's name * The pod's namespace * The pod's IP +* The pod's service account name * A container's cpu limit * A container's cpu request * A container's memory limit @@ -101,10 +103,12 @@ In future, it will be possible to specify an output format option. Downward API volumes can expose: +* The node's name * The pod's name * The pod's namespace * The pod's labels * The pod's annotations +* The pod's service account name * A container's cpu limit * A container's cpu request * A container's memory limit From 4ef058c970cdc3b6d317d5931db03d257999028c Mon Sep 17 00:00:00 2001 From: Janet Kuo Date: Tue, 17 Jan 2017 16:13:42 -0800 Subject: [PATCH 012/113] Use {{page.version}} instead of hard-coded release number --- docs/admin/node-conformance.md | 2 +- docs/reference.md | 2 +- docs/user-guide/ingress.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/admin/node-conformance.md b/docs/admin/node-conformance.md index f53ba858b1..25114a8966 100644 --- a/docs/admin/node-conformance.md +++ b/docs/admin/node-conformance.md @@ -84,7 +84,7 @@ sudo docker run -it --rm --privileged --net=host \ gcr.io/google_containers/node-test:0.2 ``` -Node conformance test is a containerized version of [node e2e test](https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/devel/e2e-node-tests.md). +Node conformance test is a containerized version of [node e2e test](https://github.com/kubernetes/kubernetes/blob/{{page.version}}/docs/devel/e2e-node-tests.md). By default, it runs all conformance tests. Theoretically, you can run any node e2e test if you configure the container and diff --git a/docs/reference.md b/docs/reference.md index d4d7cdd183..f9f109e7a3 100644 --- a/docs/reference.md +++ b/docs/reference.md @@ -28,4 +28,4 @@ Explore the glossary of essential Kubernetes concepts. Some good starting points ## Design Docs -An archive of the design docs for Kubernetes functionality. Good starting points are [Kubernetes Architecture](https://github.com/kubernetes/kubernetes/blob/release-1.1/docs/design/architecture.md) and [Kubernetes Design Overview](https://github.com/kubernetes/kubernetes/tree/release-1.1/docs/design). +An archive of the design docs for Kubernetes functionality. Good starting points are [Kubernetes Architecture](https://github.com/kubernetes/kubernetes/blob/{{page.version}}/docs/design/architecture.md) and [Kubernetes Design Overview](https://github.com/kubernetes/kubernetes/tree/{{page.version}}/docs/design). diff --git a/docs/user-guide/ingress.md b/docs/user-guide/ingress.md index cc0bff8391..9a908637bb 100644 --- a/docs/user-guide/ingress.md +++ b/docs/user-guide/ingress.md @@ -220,7 +220,7 @@ Note that there is a gap between TLS features supported by various Ingress contr An Ingress controller is bootstrapped with some loadbalancing policy settings that it applies to all Ingress, such as the loadbalancing algorithm, backend weight scheme etc. More advanced loadbalancing concepts (e.g.: persistent sessions, dynamic weights) are not yet exposed through the Ingress. You can still get these features through the [service loadbalancer](https://github.com/kubernetes/contrib/tree/master/service-loadbalancer). With time, we plan to distill loadbalancing patterns that are applicable cross platform into the Ingress resource. -It's also worth noting that even though health checks are not exposed directly through the Ingress, there exist parallel concepts in Kubernetes such as [readiness probes](https://github.com/kubernetes/kubernetes/blob/release-1.0/docs/user-guide/production-pods.md#liveness-and-readiness-probes-aka-health-checks) which allow you to achieve the same end result. Please review the controller specific docs to see how they handle health checks ([nginx](https://github.com/kubernetes/contrib/blob/master/ingress/controllers/nginx/README.md), [GCE](https://github.com/kubernetes/contrib/blob/master/ingress/controllers/gce/README.md#health-checks)). +It's also worth noting that even though health checks are not exposed directly through the Ingress, there exist parallel concepts in Kubernetes such as [readiness probes](/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/) which allow you to achieve the same end result. Please review the controller specific docs to see how they handle health checks ([nginx](https://github.com/kubernetes/contrib/blob/master/ingress/controllers/nginx/README.md), [GCE](https://github.com/kubernetes/contrib/blob/master/ingress/controllers/gce/README.md#health-checks)). ## Updating an Ingress From 7dd6fe48c4147d54cec58674f87173f7a0ed1486 Mon Sep 17 00:00:00 2001 From: Janet Kuo Date: Tue, 17 Jan 2017 16:29:24 -0800 Subject: [PATCH 013/113] Bump links in navigation from 1.3 to 1.5 --- _data/guides.yml | 4 ++-- _data/reference.yml | 10 ++++----- _data/samples.yml | 52 ++++++++++++++++++++++----------------------- 3 files changed, 32 insertions(+), 34 deletions(-) diff --git a/_data/guides.yml b/_data/guides.yml index c1bdd99a4e..4cac45883c 100644 --- a/_data/guides.yml +++ b/_data/guides.yml @@ -95,7 +95,7 @@ toc: - docs/user-guide/connecting-to-applications-proxy.md - docs/user-guide/connecting-to-applications-port-forward.md - title: Using Explorer to Examine the Runtime Environment - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/explorer + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/explorer - title: Creating a Cluster section: @@ -202,7 +202,7 @@ toc: - docs/admin/networking.md - docs/admin/dns.md - title: Setting Up and Configuring DNS - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/cluster-dns + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/cluster-dns - docs/admin/master-node-communication.md - docs/admin/network-plugins.md - docs/admin/static-pods.md diff --git a/_data/reference.yml b/_data/reference.yml index de1dec2c14..0d7dc82db6 100644 --- a/_data/reference.yml +++ b/_data/reference.yml @@ -188,13 +188,13 @@ toc: - title: Kubernetes Design Docs section: - title: Kubernetes Architecture - path: https://github.com/kubernetes/kubernetes/blob/release-1.3/docs/design/architecture.md + path: https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/design/architecture.md - title: Kubernetes Design Overview - path: https://github.com/kubernetes/kubernetes/blob/release-1.3/docs/design/ + path: https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/design/ - title: Kubernetes Identity and Access Management - path: https://github.com/kubernetes/kubernetes/blob/release-1.3/docs/design/access.md + path: https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/design/access.md - docs/admin/ovs-networking.md - title: Security Contexts - path: https://github.com/kubernetes/kubernetes/blob/release-1.3/docs/design/security_context.md + path: https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/design/security_context.md - title: Security in Kubernetes - path: https://github.com/kubernetes/kubernetes/blob/release-1.3/docs/design/security.md + path: https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/design/security.md diff --git a/_data/samples.yml b/_data/samples.yml index e94f2b3223..012b00e2c7 100644 --- a/_data/samples.yml +++ b/_data/samples.yml @@ -6,72 +6,70 @@ toc: - title: Storage / Database / KV section: - title: Apache Cassandra Database - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/cassandra + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/cassandra - title: Ceph - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/rbd/ + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/volumes/rbd/ - title: CephFS - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/cephfs/ + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/volumes/cephfs/ - title: CockroachDB path: https://github.com/kubernetes/kubernetes/tree/release-1.4/examples/cockroachdb/ - title: GlusterFS - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/glusterfs/ + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/volumes/glusterfs/ - title: Hazelcast - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/hazelcast + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/hazelcast - title: iSCSI - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/iscsi/ + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/volumes/iscsi/ - title: MySQL Galera - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/mysql-galera + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/mysql-galera - title: NFS - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/nfs/ + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/volumes/nfs/ - title: Redis - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/redis/ + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/redis/ - title: RethinkDB - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/rethinkdb/ + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/rethinkdb/ - title: Vitess - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/vitess/ + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/vitess/ - title: Big Data section: - title: Apache Spark - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/spark + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/spark - title: Apache Storm - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/storm + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storm - title: Messaging / Queueing section: - - title: Celery + RabbitMQ - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/celery-rabbitmq - title: Hazelcast - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/hazelcast + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/hazelcast - title: Miscellaneous section: - title: Meteor Applications - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/meteor/ + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/meteor/ - title: OpenShift Origin - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/openshift-origin/ + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/openshift-origin/ - title: Selenium - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/selenium/ + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/selenium/ - title: Monitoring and Logging section: - title: Elasticsearch - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/elasticsearch/ + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/elasticsearch/ - title: NewRelic - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/newrelic + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/newrelic - title: Multi-tier Applications section: - title: Guestbook - Go Server - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/guestbook-go/ + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/guestbook-go/ - title: GuestBook - PHP Server - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/guestbook/ + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/guestbook/ - docs/getting-started-guides/meanstack.md - title: MySQL + Wordpress - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/mysql-wordpress-pd/ + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/mysql-wordpress-pd/ - title: MySQL + Phabricator Server - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/phabricator/ + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/phabricator/ - title: Nodejs + Mongo - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/nodesjs-mongodb + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/nodesjs-mongodb - title: Petstore - path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/k8petstore/ + path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/k8petstore/ From ecefdc9df22f20e83ab4caf5151bd1965a3c59c4 Mon Sep 17 00:00:00 2001 From: Jared Date: Wed, 18 Jan 2017 14:25:58 -0800 Subject: [PATCH 014/113] Add "Needs UX Review" tag I'd like to tag existing issues that are specifically UX related for triaging, since we have a graphic designer who can fix them. --- docs/contribute/review-issues.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/contribute/review-issues.md b/docs/contribute/review-issues.md index 8b16d450c6..38d4424c7b 100644 --- a/docs/contribute/review-issues.md +++ b/docs/contribute/review-issues.md @@ -4,7 +4,7 @@ title: Reviewing Documentation Issues {% capture overview %} -This page explains how you should review and prioritize documentation issues made for the [kubernetes/kubernetes.github.io](https://github.com/kubernetes/kubernetes.github.io){: target="_blank"} repository. The purpose is to provide a way to organize issues and make it easier to contribute to Kubernetes documentation. The following should be used as the standard way of prioritizing, labeling, and interacting with issues. +This page explains how documentation issues are reviewed and prioritized for the [kubernetes/kubernetes.github.io](https://github.com/kubernetes/kubernetes.github.io){: target="_blank"} repository. The purpose is to provide a way to organize issues and make it easier to contribute to Kubernetes documentation. The following should be used as the standard way of prioritizing, labeling, and interacting with issues. {% endcapture %} {% capture body %} @@ -26,6 +26,9 @@ Issues should be sorted into different buckets of work using the following label * Issues that are suggestions for better processes or site improvements that require community agreement to be implemented * Topics can be brought to SIG meetings as agenda items +#### Needs UX Review +* Issues that are suggestions for improving the user interface of the site or fixing a broken UX. + ### Prioritizing Issues The following labels and definitions should be used to prioritize issues. If you change the priority of an issues, please comment on the issue with your reasoning for the change. From a2deedd3f5ccf05f3cac627b24cd93a6b889fd33 Mon Sep 17 00:00:00 2001 From: Mik Vyatskov Date: Tue, 24 Jan 2017 11:20:59 +0100 Subject: [PATCH 015/113] Logging sidecar refactoring --- docs/user-guide/counter-pod.yaml | 12 -- docs/user-guide/logging/counter-pod.yaml | 12 -- .../logging/examples/counter-pod.yaml | 10 ++ .../examples/fluentd-sidecar-config.yaml | 25 ++++ .../two-files-counter-pod-agent-sidecar.yaml | 39 ++++++ ...o-files-counter-pod-streaming-sidecar.yaml | 38 +++++ .../examples/two-files-counter-pod.yaml | 26 ++++ docs/user-guide/logging/overview.md | 132 ++++++++++++++++-- docs/user-guide/logging/stackdriver.md | 12 +- ...car.png => logging-with-sidecar-agent.png} | Bin .../logging-with-streaming-sidecar.png | Bin 0 -> 37555 bytes 11 files changed, 261 insertions(+), 45 deletions(-) delete mode 100644 docs/user-guide/counter-pod.yaml delete mode 100644 docs/user-guide/logging/counter-pod.yaml create mode 100644 docs/user-guide/logging/examples/counter-pod.yaml create mode 100644 docs/user-guide/logging/examples/fluentd-sidecar-config.yaml create mode 100644 docs/user-guide/logging/examples/two-files-counter-pod-agent-sidecar.yaml create mode 100644 docs/user-guide/logging/examples/two-files-counter-pod-streaming-sidecar.yaml create mode 100644 docs/user-guide/logging/examples/two-files-counter-pod.yaml rename images/docs/user-guide/logging/{logging-with-sidecar.png => logging-with-sidecar-agent.png} (100%) create mode 100644 images/docs/user-guide/logging/logging-with-streaming-sidecar.png diff --git a/docs/user-guide/counter-pod.yaml b/docs/user-guide/counter-pod.yaml deleted file mode 100644 index c624b4d339..0000000000 --- a/docs/user-guide/counter-pod.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Pod -metadata: - name: counter -spec: - containers: - - name: count - image: ubuntu:14.04 - args: [bash, -c, - 'for ((i = 0; ; i++)); do echo "$i: $(date)"; sleep 1; done'] - - diff --git a/docs/user-guide/logging/counter-pod.yaml b/docs/user-guide/logging/counter-pod.yaml deleted file mode 100644 index c624b4d339..0000000000 --- a/docs/user-guide/logging/counter-pod.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Pod -metadata: - name: counter -spec: - containers: - - name: count - image: ubuntu:14.04 - args: [bash, -c, - 'for ((i = 0; ; i++)); do echo "$i: $(date)"; sleep 1; done'] - - diff --git a/docs/user-guide/logging/examples/counter-pod.yaml b/docs/user-guide/logging/examples/counter-pod.yaml new file mode 100644 index 0000000000..f997886386 --- /dev/null +++ b/docs/user-guide/logging/examples/counter-pod.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Pod +metadata: + name: counter +spec: + containers: + - name: count + image: busybox + args: [/bin/sh, -c, + 'i=0; while true; do echo "$i: $(date)"; i=$((i+1)); sleep 1; done'] diff --git a/docs/user-guide/logging/examples/fluentd-sidecar-config.yaml b/docs/user-guide/logging/examples/fluentd-sidecar-config.yaml new file mode 100644 index 0000000000..6f7793c406 --- /dev/null +++ b/docs/user-guide/logging/examples/fluentd-sidecar-config.yaml @@ -0,0 +1,25 @@ +apiVersion: v1 +data: + fluentd.conf: | + + type tail + format none + path /var/log/1.log + pos_file /var/log/1.log.pos + tag count.format1 + + + + type tail + format none + path /var/log/2.log + pos_file /var/log/2.log.pos + tag count.format2 + + + + type google_cloud + +kind: ConfigMap +metadata: + name: fluentd-config \ No newline at end of file diff --git a/docs/user-guide/logging/examples/two-files-counter-pod-agent-sidecar.yaml b/docs/user-guide/logging/examples/two-files-counter-pod-agent-sidecar.yaml new file mode 100644 index 0000000000..9737f13493 --- /dev/null +++ b/docs/user-guide/logging/examples/two-files-counter-pod-agent-sidecar.yaml @@ -0,0 +1,39 @@ +apiVersion: v1 +kind: Pod +metadata: + name: counter +spec: + containers: + - name: count + image: busybox + args: + - /bin/sh + - -c + - > + i=0; + while true; + do + echo "$i: $(date)" >> /var/log/1.log; + echo "$(date) INFO $i" >> /var/log/2.log; + i=$((i+1)); + sleep 1; + done + volumeMounts: + - name: varlog + mountPath: /var/log + - name: count-agent + image: gcr.io/google_containers/fluentd-gcp:1.30 + env: + - name: FLUENTD_ARGS + value: -c /etc/fluentd-config/fluentd.conf + volumeMounts: + - name: varlog + mountPath: /var/log + - name: config-volume + mountPath: /etc/fluentd-config + volumes: + - name: varlog + emptyDir: {} + - name: config-volume + configMap: + name: fluentd-config diff --git a/docs/user-guide/logging/examples/two-files-counter-pod-streaming-sidecar.yaml b/docs/user-guide/logging/examples/two-files-counter-pod-streaming-sidecar.yaml new file mode 100644 index 0000000000..87bd198cfd --- /dev/null +++ b/docs/user-guide/logging/examples/two-files-counter-pod-streaming-sidecar.yaml @@ -0,0 +1,38 @@ +apiVersion: v1 +kind: Pod +metadata: + name: counter +spec: + containers: + - name: count + image: busybox + args: + - /bin/sh + - -c + - > + i=0; + while true; + do + echo "$i: $(date)" >> /var/log/1.log; + echo "$(date) INFO $i" >> /var/log/2.log; + i=$((i+1)); + sleep 1; + done + volumeMounts: + - name: varlog + mountPath: /var/log + - name: count-log-1 + image: busybox + args: [/bin/sh, -c, 'tail -n+1 -f /var/log/1.log'] + volumeMounts: + - name: varlog + mountPath: /var/log + - name: count-log-2 + image: busybox + args: [/bin/sh, -c, 'tail -n+1 -f /var/log/2.log'] + volumeMounts: + - name: varlog + mountPath: /var/log + volumes: + - name: varlog + emptyDir: {} diff --git a/docs/user-guide/logging/examples/two-files-counter-pod.yaml b/docs/user-guide/logging/examples/two-files-counter-pod.yaml new file mode 100644 index 0000000000..6ebeb717a1 --- /dev/null +++ b/docs/user-guide/logging/examples/two-files-counter-pod.yaml @@ -0,0 +1,26 @@ +apiVersion: v1 +kind: Pod +metadata: + name: counter +spec: + containers: + - name: count + image: busybox + args: + - /bin/sh + - -c + - > + i=0; + while true; + do + echo "$i: $(date)" >> /var/log/1.log; + echo "$(date) INFO $i" >> /var/log/2.log; + i=$((i+1)); + sleep 1; + done + volumeMounts: + - name: varlog + mountPath: /var/log + volumes: + - name: varlog + emptyDir: {} diff --git a/docs/user-guide/logging/overview.md b/docs/user-guide/logging/overview.md index 61c068a4d9..a9f00471cc 100644 --- a/docs/user-guide/logging/overview.md +++ b/docs/user-guide/logging/overview.md @@ -19,14 +19,17 @@ The guidance for cluster-level logging assumes that a logging backend is present ## Basic logging in Kubernetes -In this section, you can see an example of basic logging in Kubernetes that outputs data to the standard output stream. This demonstration uses a [pod specification](/docs/user-guide/logging/counter-pod.yaml) with a container that writes some text to standard output once per second. +In this section, you can see an example of basic logging in Kubernetes that +outputs data to the standard output stream. This demonstration uses +a [pod specification](/docs/user-guide/logging/examples/counter-pod.yaml) with +a container that writes some text to standard output once per second. -{% include code.html language="yaml" file="counter-pod.yaml" ghlink="/docs/user-guide/counter-pod.yaml" %} +{% include code.html language="yaml" file="examples/counter-pod.yaml" ghlink="/docs/user-guide/logging/examples/counter-pod.yaml" %} To run this pod, use the following command: ```shell -$ kubectl create -f http://k8s.io/docs/user-guide/counter-pod.yaml +$ kubectl create -f http://k8s.io/docs/user-guide/logging/examples/counter-pod.yaml pod "counter" created ``` @@ -34,12 +37,9 @@ To fetch the logs, use the `kubectl logs` command, as follows ```shell $ kubectl logs counter -0: Tue Jun 2 21:37:31 UTC 2015 -1: Tue Jun 2 21:37:32 UTC 2015 -2: Tue Jun 2 21:37:33 UTC 2015 -3: Tue Jun 2 21:37:34 UTC 2015 -4: Tue Jun 2 21:37:35 UTC 2015 -5: Tue Jun 2 21:37:36 UTC 2015 +0: Mon Jan 1 00:00:00 UTC 2001 +1: Mon Jan 1 00:00:01 UTC 2001 +2: Mon Jan 1 00:00:02 UTC 2001 ... ``` @@ -105,17 +105,119 @@ Kubernetes doesn't specify a logging agent, but two optional logging agents are ### Using a sidecar container with the logging agent -![Using a sidecar container with the logging agent](/images/docs/user-guide/logging/logging-with-sidecar.png) +You can use a sidecar container in one of the following ways: -You can implement cluster-level logging by including a dedicated logging agent for each application on your cluster. You can include this logging agent as a _sidecar container_ in the pod spec for each application; the sidecar container should contain only the logging agent. +* The sidecar container streams application logs to its own `stdout`. +* The sidecar container runs a logging agent, which is configured to pick up logs from an application container. -The concrete implementation of the logging agent, the interface between agent and the application, and the interface between the logging agent and the logs backend are completely up to a you. For an example implementation, see the [fluentd sidecar container](https://github.com/kubernetes/contrib/tree/b70447aa59ea14468f4cd349760e45b6a0a9b15d/logging/fluentd-sidecar-gcp) for the Stackdriver logging backend. +#### Streaming sidecar container -**Note:** Using a sidecar container for logging may lead to significant resource consumption. +![Sidecar container with a streaming container](/images/docs/user-guide/logging/logging-with-streaming-sidecar.png) + +By having your sidecar containers stream to their own `stdout` and `stderr` +streams, you can take advantage of the kubelet and the logging agent that +already run on each node. The sidecar containers read logs from a file, a socket, +or the journald. Each individual sidecar container prints log to its own `stdout` +or `stderr` stream. + +This approach allows you to separate several log streams from different +parts of your application, some of which can lack support +for writing to `stdout` or `stderr`. The logic behind redirecting logs +is minimal, so it's hardly a significant overhead. Additionally, because +`stdout` and `stderr` are handled by the kubelet, you can use built-in tools +like `kubectl logs`. + +Consider the following example. A pod runs a single container, and the container +writes to two different log files, using two different formats. Here's a +configuration file for the Pod: + +{% include code.html language="yaml" file="examples/two-files-counter-pod.yaml" ghlink="/docs/user-guide/logging/examples/two-files-counter-pod.yaml" %} + +It would be a mess to have log entries of different formats in the same log +stream, even if you managed to redirect both components to the `stdout` stream of +the container. Instead, you could introduce two sidecar containers. Each sidecar +container could tail a particular log file from a shared volume and then redirect +the logs to its own `stdout` stream. + +Here's a configuration file for a pod that has two sidecar containers: + +{% include code.html language="yaml" file="examples/two-files-counter-pod-streaming-sidecar.yaml" ghlink="/docs/user-guide/logging/examples/two-files-counter-pod-streaming-sidecar.yaml" %} + +Now when you run this pod, you can access each log stream separately by +running the following commands: + +```shell +$ kubectl logs counter count-log-1 +0: Mon Jan 1 00:00:00 UTC 2001 +1: Mon Jan 1 00:00:01 UTC 2001 +2: Mon Jan 1 00:00:02 UTC 2001 +... +``` + +```shell +$ kubectl logs counter count-log-2 +Mon Jan 1 00:00:00 UTC 2001 INFO 0 +Mon Jan 1 00:00:01 UTC 2001 INFO 1 +Mon Jan 1 00:00:02 UTC 2001 INFO 2 +... +``` + +The node-level agent installed in your cluster picks up those log streams +automatically without any further configuration. If you like, you can configure +the agent to parse log lines depending on the source container. + +Note, that despite low CPU and memory usage (order of couple of millicores +for cpu and order of several megabytes for memory), writing logs to a file and +then streaming them to `stdout` can double disk usage. If you have +an application that writes to a single file, it's generally better to set +`/dev/stdout` as destination rather than implementing the streaming sidecar +container approach. + +Sidecar containers can also be used to rotate log files that cannot be +rotated by the application itself. [An example](https://github.com/samsung-cnct/logrotate) +of this approach is a small container running logrotate periodically. +However, it's recommended to use `stdout` and `stderr` directly and leave rotation +and retention policies to the kubelet. + +#### Sidecar container with a logging agent + +![Sidecar container with a logging agent](/images/docs/user-guide/logging/logging-with-sidecar-agent.png) + +If the node-level logging agent is not flexible enough for your situation, you +can create a sidecar container with a separate logging agent that you have +configured specifically to run with your application. + +**Note**: Using a logging agent in a sidecar container can lead +to significant resource consumption. Moreover, you won't be able to access +those logs using `kubectl logs` command, because they are not controlled +by the kubelet. + +As an example, you could use [Stackdriver](/docs/user-guide/logging/stackdriver/), +which uses fluentd as a logging agent. Here are two configuration files that +you can use to implement this approach. The first file contains +a [ConfigMap](/docs/user-guide/configmap/) to configure fluentd. + +{% include code.html language="yaml" file="examples/fluentd-sidecar-config.yaml" ghlink="/docs/user-guide/logging/examples/fluentd-sidecar-config.yaml" %} + +**Note**: The configuration of fluentd is beyond the scope of this article. For +information about configuring fluentd, see the +[official fluentd documentation](http://docs.fluentd.org/). + +The second file describes a pod that has a sidecar container running fluentd. +The pod mounts a volume where fluentd can pick up its configuration data. + +{% include code.html language="yaml" file="examples/two-files-counter-pod-agent-sidecar.yaml" ghlink="/docs/user-guide/logging/examples/two-files-counter-pod-agent-sidecar.yaml" %} + +After some time you can find log messages in the Stackdriver interface. + +Remember, that this is just an example and you can actually replace fluentd +with any logging agent, reading from any source inside an application +container. ### Exposing logs directly from the application ![Exposing logs directly from the application](/images/docs/user-guide/logging/logging-from-application.png) -You can implement cluster-level logging by exposing or pushing logs directly from every application itself; however, the implementation for such a logging mechanism is outside the scope of Kubernetes. - +You can implement cluster-level logging by exposing or pushing logs directly from +every application; however, the implementation for such a logging mechanism +is outside the scope of Kubernetes. diff --git a/docs/user-guide/logging/stackdriver.md b/docs/user-guide/logging/stackdriver.md index eb3380ca5c..b71947ee1f 100644 --- a/docs/user-guide/logging/stackdriver.md +++ b/docs/user-guide/logging/stackdriver.md @@ -27,16 +27,16 @@ fluentd-gcp-v1.30-f02l5 1/1 Running 0 5d ``` To understand how logging with Stackdriver works, consider the following -synthetic log generator pod specification [counter-pod.yaml](/docs/user-guide/logging/counter-pod.yaml): +synthetic log generator pod specification [counter-pod.yaml](/docs/user-guide/logging/examples/counter-pod.yaml): -{% include code.html language="yaml" file="counter-pod.yaml" ghlink="/docs/user-guide/counter-pod.yaml" %} +{% include code.html language="yaml" file="examples/counter-pod.yaml" ghlink="/docs/user-guide/logging/examples/counter-pod.yaml" %} This pod specification has one container that runs a bash script that writes out the value of a counter and the date once per second, and runs indefinitely. Let's create this pod in the default namespace. ```shell -$ kubectl create -f counter-pod.yaml +$ kubectl create -f http://k8s.io/docs/user-guide/logging/examples/counter-pod.yaml pod "counter" created ``` @@ -68,14 +68,14 @@ by deleting the currently running counter container: ```shell $ kubectl delete pod counter -pods/counter +pod "counter" deleted ``` and then recreating it: ```shell -$ kubectl create -f counter-pod.yaml -pods/counter +$ kubectl create -f http://k8s.io/docs/user-guide/logging/examples/counter-pod.yaml +pod "counter" created ``` After some time, you can access logs from the counter pod again: diff --git a/images/docs/user-guide/logging/logging-with-sidecar.png b/images/docs/user-guide/logging/logging-with-sidecar-agent.png similarity index 100% rename from images/docs/user-guide/logging/logging-with-sidecar.png rename to images/docs/user-guide/logging/logging-with-sidecar-agent.png diff --git a/images/docs/user-guide/logging/logging-with-streaming-sidecar.png b/images/docs/user-guide/logging/logging-with-streaming-sidecar.png new file mode 100644 index 0000000000000000000000000000000000000000..75fbe10f73bbea621f9a51baf638412665e815d5 GIT binary patch literal 37555 zcmZ@=byStxw%-WS(t=2df^-SeB}jKkNQxlc2+}A>NJw`|DIgL`Nl8g5NF&k+NO!}V z-+kkb@&0*djC0QwVefCRwdS0^T7;>q%3Z^~iHky^t|`br)I_1s_TXP*Y)trytH$~j z_z#Awl!7)k{NscDG!*`f<0P-|3g179{EH^VoaPB%q;!+fbJKFPbn`HCu|RovcyL-f z*t(jVIazQzx;#tU5WR^)-9jlme4y=_zV_#ZVec^=*4AkCd+WNv3^$EDwh&T}w~9!#NI#6W#E_@~XPZ<2UZ@o}Ul!-%OC&&qxvf*=bHo zxSO$gc=|%XdTO_pCAHuI5yk_eAgef2Vbsf8*e`E2(kd*&S1{-?<)xV5&)7VYB*Mry zg`&mwrwq}<-@gh-g=I8w6%`d@ zCMG5b(gYk6H%H6p2I+}!mwfs})RV+jHd$ezBm?V9lv?nUmxlBKk-c1+$};SZrn-6! z5fM@L{^@3uD+A+W%jU~Qs)U)HfRZH9A~wypOX{C~nYU+HyIwnVj-NN1;E+B!WnlAeAfmT^w{_WuCXxXmU z6LJcrJ8bHPQ$Cwvk!X0F1+iNdu@9YvB1t`_=4Cs)Mg6wvXXElX8?91hot&H&FV0Wn z!o$P82Kml2SCXMB)a>u(XpvdmWn=R`?M`5GIXF1DQkJ0eOV6|FO4qnbS&Tq?-2k=T zzu{?JKl*jCN0}%6xb>U?(kH|1WYL|k($XF)7#dFI%+1Z=D0fN|1$o+#vgNCj<+Cy| zd6=z^lvdC&?Z(@2`i#VXvAKtZs&N=6ZXKTjRIeAE%p~ykJ0m6 zPBsO$j;<1xg-^)ZDm;cW9E3-~`Q2GC{XUt@z6G+=ZP8;)Zv1I9PaGT^zF79%d_U3o zm^B4m@@<@?#u(}2um`J(PIulpur)6m+g&tC+)vFU^6lv85cE5%iGcdn2+#eV4Q(Yg zL66BTJU3pSedL?{?=M|L#vu)iaY6xJX%n@grrYH%L2F!{ul!T_uVfNQY;0^exw|Kr zRgUwfLAxVWV3bsyFVLQ6lE)6e z8<*hGiz;Fh6ubc^{d-rJnQ*+NnVnq(@f}(D?(g5(p9+)1YJ`m4b(4{4H+j~V%J{yt zv`^vyme1S#>goG+kqV+^hTu1N3nBE-savk{#*FqgrmEyhWFo z*uGc!jTmR%KEm5mFTPzb$`{aPn7G`E_>Pi23>AvF&3B!ekQq_sd3+B$uF~zm8(zZ|2ifE`D<6mbJ zf=XAg$8~*wOzg|1KY;2q{|Ki1q z8mN3$Rs+A|Eoj!FFLv?Dm ziFyU6;Z`C}gHio+v^#Q9WZ(aOPWys(Yb+!3V4ayvx4-6eO?u8(OL^D!U(#lioFYGk zAuab*t?;a>li9qC*&ycU;I(4fVWb99xIE>1=bkv)UB@hCyFOOa-cn>;UnV3h{B2-> zSofo0U}K|rL_|dPyLaepY-|gQi}Y-4cq1bt$gl|xzPh)!=QR86DoRpE=QMVSk)FJUTPQyl0k{ zLgM4e@Ne>A|M>CaZ9+o(!TN6=j}61GUi-L#fq~Ft1K{svqiG{yBF^=u@LoCexx5e~ zpcTc2XV=r$zt0l&;1%Wr6_smCKeIZIcb9VV^Mh9g3+G`bpSji;ayB0SrLvoDq%rS^ zc%ZFKMnElyx^w3a1{Rh%jLR#B>D*>l;5|cTTSM*$3*UsM*b0ZzX}Le=Zj(fAP%iV) z$%!WP!Rh}T+gvs3!;Q6PmX?p+0~XLao#|AnFL>&@{Uu0NLPS8L zuG!qRCdEBC#tfIEKAEw7!TA>r)OURKJHH8Yym@D_2Mq;}uX^Y(4+$*S( zXGnW`m^L=tf1Ql%_0j1m8~@^DCzq$^0avs{_xaovp2dt zzWSaf`cF+Yc+<16garfy-0kFc{j2N;Bg)#^S~-;uXLG7ST2T=fb?fe3%-Go2WC{Pq z=FfKgRAy#oo^U)=GlZ|AYMkdWFB?Cnq@}eE4}b1*4!fzVs~aC5pR7Ta-+wd?X!9DJ z?;n-&1Ja&o``DEM5E!b& zct%fAwe{794bj=TL)QdBN|WGQOwThKx-Vb!%&Q4i@|d=CNPZ%Bc+XTrj8`1obX!45 zNm^F6U~1H6G?{8{b2IwwTcWk!)r4_(RldPAR5vz`DmU-k`C038e6K0dNE!-nrZzTK zGsC-beAvX&Mz)ZGoILkH81>m%aCjcmCUF5kc2Hg(gI-BpDfRlqXWP9c5({BrVK+-l z%X3Gv2Sg7^!;GZ3xVUr&2Z#-e-{su&ij3PH&RE>v4@q0CXkNT8rh#{AxC3LjWptE6 zE{eKkcj>3|(Uw`!`}a8qx4w;y={eQDG$+W*ze>^G)zdRCurhkIl;w{?@$>Vekop$& z+AEq8tf;I+Lw))31%(n35n;G{cMkf)(GgxsO$pH`k*}{W3u>K84B-HzZ6CT|oIlsm zNl;c9bdFR_&AK$l6e=&bVZdr}SQG9#lbZ0pkm7Sx!f0YY(o?$qJuFfm{ohAiCiad< zDy-Ck?M^!X8Th1Ihle5YLm>`OSXZI5;)#koT!-rN%s8bLa=}2E+S^~t_A+?n?92lt z^)J2NaatTjN8)w3@dphRLP$q0SeBbBWtyEO_-k-*ULKGn@T4|f;^H6z$;bNowduJS zwq3F&Z~M_R@=T{=+Oxi4Y9E%>e`Idy*1CQcZ1viKU1n@{M|jk4*W?L>EPxznWaxe; zD@@utIyijQ0>jYj%Hd7>`68i#vFm+8jh2~o&b7bEDKTtV`VRkxo{1@hMXLb$FsKiO z73T-P9mncDxK0k%@n8{A&47PRt*yiIm6GPx#w$?)a43(CkGE|v<`m`R{_V&w@}-c28NJenb9tO5qT3H!?<4-*n6n#xiP4na=HC=Vy^2*9A%&eN{>o+-#>M*3GrH_t| zZb?Yc(bCeYYiXV4>IKuhX}=<)F?UccPxO$@mY42!psMEnNG{c!HT}^Dp9NaVyvGOb zwnpLi{^oa%yKJ==B>cD1tE)X4I=v4!BB7Oz3IVz{cD#r6;q-&W)2EF^wGFQm5_IAo zB?7#+-=X$kVPUDMtHbRT8~ydmW(W5>qh_dr#U_*6<{fN@q+g0)U5?hBZOmubwe9IHp0T0*1USDW^M;~pJO z`#bOcRiPGiLWbQF3C4(9p=Ht<@qsBR1SeS z*vrApT(q;lf6gQza5!~-dUy$yRj)GW)>^N1U&_Q}+DJvkKD463#ajpdv9Pd6&?$bz zVr^^NgLDC_orSLU{QP_v8L$$tgTZQ9;$q2ZY2L8~*4vXuIbjpZQq@DxS`3pIKM^ZQ z*X*AqZB@N(8y`{=$RTtkIwLX7o^pz-^N${(;jn~kp z^bPd&&%Xk9sRt}?t|UxOK_OyP<7B3+tv$pmB2vGLgM(wnr;@~exZ0&Bw>rxtG*;?ZksYaj12FqC9l3pZIy-acwn3kLZ^|1HC1QPp=lo_uURR4MLt^Jk%zsri{XIwb^=$k%2GsViEwBrJVGToYK zQP*7gxlK0dy_i}0@s0JIT{ zi?id8f9l+SJHrBAyLP`zi!9&H+`O`FdU_hcjT!6f>k_ut?89?sHa0ltH#Qu$cNUf2 zgocLFL-(E2<&AA;+}46e&)M8O>3fl2P3#B-{)e6b@;^_g#B-ojYR zrDi|M4fev!C}1Ya`Xk%Tjk$3i4b0bBMGd6(Js`61IM21QL8-f#36o2C!XO{dSE7*M z;NTFDk&)3Sf5Ui8mlzZjv;a~CE&t+h6FfF^d*miHVtm)s$(UFz^S1EIQIJ7`kHuB)P8*y=Qz4o_eTYn?7 zTyfCtT@S~^_;@M6y@MKHZSW?1Hg@OYm7jc8<$^Oay z>VDd4kMuPK1%(p*%8r@uF?X6o1O@lP-@Hj1AwL=YZFr3aHIn{b(oJ!GaF~m;sQR)% z;h^KuFy*2{{?Bg{0R@}Bs#VwWUaR_)NQV$0`^DCHe(?CWS?g;SKhgHe_fSkBTU%RS zVJ=TMfQHfm=v!{oBlF$6`5a&)1pkJMb>H|(>O6Y%WT;4k@S|bvTw!4$1-IF^pstpd zmVc2Z$L^qjwPoD1=-yXK;=Gn`ed4Z^)S1VxuaiE{agFV~qlx(S8W&bl$Xzv$`rV*6 z6v2F&E;a74LP}SXSMPl7X(7RA5rr;_=izZ!DRFtWYcen}z}Xr?csci!00lD2(Z%WJ z?<@)bDc943b-9zh71!Wg=D>_Zpg+$zOd8M95|#f-?*CN@A)xtZV{7Ye0UV#cG^Q7= zd2B2h$P~+xaf264A+utMYo^|%Q&t6kz@U{TaGP)DIyeVykNhgssEbrj%tE?(Y+S7y z&exhwT(k2TCaJ24Fj}bD*ov)rEqg=5qM{CNh&;EePtCwiLzmIm+TME=o$uoC52wd3hKhUwj8( zE9QH$X9VTf70;rjh;%eyW`kqUgzWiLM#s@>fV@pRPE>UThds@Vi$nMIJ%7aZb7JBq ztZ?b0sX}H})^BZXc_K0z+Dc^-(-ZPim*3xRXx{i`ge!Ep<8*xC{gtJ_S@`|z-=oY7 zeePfJ0SUCl`X^l;>l4ABK5>8V?nWLTKs7fv_tC#o5)*)@SGKpeu?Y#~WMwh$s-}m+ z7|aP=WWgcM%gz1O*V}8i0esVziipT`vf9z)x%s=^#f1e^J3D-Hb8{TPY!*IxsY8OW zAB)iArms=nTTp;SZmFuO;^0%!h2HVQW}?b^dVl?QQp}|&VB(IW?fJ*0UlXY*wisVu zqq3wXB^{(_wkR;Se#EEprVl;fT}p~R8pq3>ogFJjM@LYqQ&kld%!H|Pi9zXdb8_PT zQ*JJI0?^jPz3lsUc>@)d^?Mu`{?hjQIYmWQYYPi*!lI&QI>5H)o2s~o=;%!DKWPi) z9!7sQ`FH-jtL0E4JKi9zton0nGl`5SA6{^W@hGqckk}3t*<+u z9@xWva?_9uV8cYRoBB#A@_bEFU7biZOT5obzKtTAS@Hd|pP8r7FZ~zKj(4ZD3Y0bG zoeV5*6_=KlF62mu^xnR6r%8a1uSykQO^i!w?q|$zIBd|$larJ6)X5khy-QS(qPPOh zC7`T~%kONvlm9a0u8pCgq0>w=n$O`MkEbQCLV38kmj&#`K2a5_Wzk+ICm%63sB_0m zp`xPFdi=$%Wq)EyIgug*#eYK1ffei1s8q>1_}x|V*VFCCoQkA zltX?MMcdMGA*7z;;7x?2BBziFsNoW2g+ii!%o@+VitKfk#-a8~vCb51_vrxGy$ zWn=#5`?^2%D=lSUtUiRFOqNTDygUz2%nEm?mpYgt zn^WftAT%`ydu*^9x)x!}BK6sxzkwOTPLAjLw|7AN`Pvx6vu8^;!gC*5w&29}Q^u#J z;(|0-(0VI1?DOaQ8&eHEZZ{r^v9q&}fO=3vdGlth%JtB@1H;4l(7q=|+uIkZWi)n_ zI|s=aa(IhMO7JTxO6yjL23{^KET|h#9laKNxO$JDpOzm+oCZjZCQU(i1`3Lbi|5D6 z%^UtqPW}K`_1#T0k{)s5%4Ia-Kg7iihJ%>+xqIq&&=GiFEdWEj1Vu#Xo(Ly)APhBV z?BBqWc%KLpNL4}SGaJa2@dcUnE-y__;eWnI?^l2Sr=7z?4*&%YXHQ>R1r-+; z8v>a73ywsG8~ZhS9HWT5r>^BpUr1O?K50=u2&KZqd*iNEs5<-xMAXZd%K0e zpfg_(gB!6<+*jNB)C*c~^J1ckrmsJ2F$NNy1gXuT+4JJy>=4WG(LopWeDPu&Fl(n9 z`#$|Hk4*n}m3+_rk6!0X6^b|St^G^Dy;QdHOdE~2bEvf2R3yr6?(Sx_`xbn#^3*(?Wnu1?nOz6Iej_Ig?<`TX46?ZV>XRrDF^!SW$lk~(bcag&CVF=K7t zVc)TZYLzN9psjy~hJv1364PUX?3@EGYUYZdxUBeGu%Y?8;nF>Q>@^O?egV)eORMi@ zrT1O0Z*d05zC2R;o9U+zsFE;ViErE(Q`8_<{sqU#=8XO2kuWfJR^`quo?juH3op~h zKH1ztE5n;HwJ!~H5V-e&v?gC1&lX+q#@|~yOQ~AEN+tCxTrslTwMVw*W@ z)HKW6i}qUFfp*3`oIQDE721lNi@4ZWlDdXp$f7Jz3}sLfFK9P7Yxgl9Ong3C04wft)x(6Uf9u&}pGSXK z9C0IFw){5>(38j^4f6;d@00uLqp^vJ+z%gcQ&Lj4_V*DF*7@?n7la8@SO-)p7Enh?L^XdUBg`uRhlo)_2c(PAGM@I#$|E_KYu@X^}W?Ehm6A__M z-+O!80Alf2_1~JTbH_vEL>PD)`ubs2ReXR!F=5XUwHDfWBp_Va@7emz#?}Z*UU0V# z)}y%Snwycwi2oVDQJ3xS{^wG0@^CduQgh@iLpYC7D<*R_~8sI=zkUYoC0z zIJ1Ls+GCH;@b+l0RjewWf%|8Ok)w&%ix)y5)B$0811B5gCVH?hP+N2Dc!mvL*Ny7j z0<*H{42_IS76jXU;p5G38Zx%mKC^?3R&WAKC0?fZRP_It4`yTh9Xi+ExaOdO%{`#evF8YE5G7ihX ztGO<}wzWMJ^*+EyfpKEI*?^t1`?viK#ZxV>+;)IBWV|%3o$_(@*jl`y+&E_nq7Qm}9L-_QfC2<$9w^ngD>>(k&BE6UCe@XvyW zK~zZapCFZS77`wg3+MRij|R6D5+HWXi!N75+#MV^p~s@3Dk@%Tg|9wNUjf7C#(f(y zuYB!cJ_CFLeup_+=ti_(I)Tt)zjKxN{b{eNL;Kt9 z+mdPn;e-D3#hNTO&ojt!~nG<+l|0c@1#)(je;7;dN>C;>A7Y-crTPvGFdxt(X)K05N;TOEzQ zy!x8Rk4#3xj{i5Sh{)sDU{r5E-=1s#1+L2ae?R)yl02dXZGrbp&s?{+gw#wG(^kVt z((6yn-u^DRuv>nwcnb(>y8r6kd}xg%l~9QPg70K%ZjKILhwmYS z^97!cY{3byF=*Pcv2U_)%m zo!iKuMtnN=M`6F8zbCQ1Obcmb`Vu=mjmSVKC50OI;)~&phAAhBvt?s<+sk6zvW}k; zm-rxLe$x9a`-6!|`q3kDSQu$&l>Umkksuk)f%XHq^X%zv6+H6ujma=*o$?C4%+qac zNK=%uuwWdsgwuZ<|MCkFw1G3-`)ZSbIPZJXS7SBuzWkaG0%|qzP&vP3+&qqzAqC}w)VZ6 zt%_M!@fy?wdWTf2_KyWqMzfhebousOOVALB;lD29yX<8ZmAaSICRs%go~sR@g7{)S zTB0tBNHU}qr zYj^h*G$|5NQp9Gz5Q2#l3K$i(55&aaii&$*eU3@sdpjWAg~-RsY5dn@Wo40KfPF!n z9{>fnMMS8eXD5q!e`&roj1)I0j7XLOPy;gV5#GzD`;n~2;RDd-$y!&e=g*&`k;&K> zSf8x&k6Bsf5gL7eVIa?6vu7I#p^~F>L&huoNsyD!dDS(kn6=-&TEoV|vR&xy+dDL* zZQ3sI(#ipRJc+ZN9LBQSzz*9H2nD?T zbG-5y;pF5b*gaQ3DU6_#poR7C1b_8-3CP4vbS#30urB}uXIEF>r0_nQgU|pfK)`Xz zbiO0*q_WdpWnRh{cJ_wm;KsO~}@*!qA9B4E6 zxuO!XpJAA3{Pt2XuSPx^+1lINpOX%5`$Pa|L5Kou^VofTOnyw03$|i?yVtiKh6M+= z7Xc{f-P+r;)56=))z&usm8XC-P!LIjz_q_6CPo9NDOucC7^Kauf5U9bnWB_ne6;~s zMcy2!?=C5?x)}P?mX}xcn*0zCJQ#{$9;(svU`_v(mWb`g-xU^kh|gd8xcUk3v(T`x z*`Mq<`1qi1U!@iG3;@6}2Y}^lqektIuJ&-mD5waMU=ip|O- z`~%hDcO(8Zj9Q!8{4a^*;E+banj2A)k>$0xv6phd1OLpDK)~QJx;7&N12+U8k-!7A z4tW6dGBUxEefn~8Sbyq0mL!^9?B4YhrA2ZLouIt~-a75t0n=u7Wu?pCxU%L~y~n1y zwssKAZpdTofd4RlgU_me^m0b32oN}u+NiP~JnAIpG%VVjnNjzbV33xVqA-W0uBnkE zSiK^+Jf0Hl{`tA(9c;5gKy*tR8;!OwN4%6fzXe4^;G>EvX1C~a z(PsL|P^Q=p4-E|ssu@Q5x&9&9eUL$u1srKDe`ZD!&hD)ax&>%Mf^N%15DCF}q;h5ma(hU1 zwLnB$8>m!tHZ%a*#v^Ox{m!E1G(bAJ0Qs+~Bvn zaXAUka)XNM4xlg43qhS1h@z9={FKxJu>v!5^HO&L8kTDBMk@3m+;9#6Y(^r!wKZM|39L*CV&=(dj5C~)^R3)=spH4pUmmIRO!!%WV7_3~vh!8;k?t^)wib41*hB|F>Od1zGMghxdch>3|w zoYwtc?eyCgMAV!kBO=(3*90oAf!uffeD|lsAaY>LMQNkIR8-_jOG#O!7OX&Z!Cw!% zJ!lDu?tsx_psSlS1ucsrsljHLRajiycxDVZpA}RWS7TujE)LEMe970AM~)$TIiwsm zz$cI-kBh4-kHe(kS3eFn5dsn^SrwJiXgHL1^Up}YFw?7l&H*bHf(%`NIWU;`5tE&c zj_yK8;^OGe%U7>rK-L6MiKK@>76xi^Iag6;So;!$$hoqn3n@#>yI&msgaZ)`WO1`^ zhYi{X#qX4t21{Z2;hW>dBon8d1%-?36p#X1e*PrfoNjVlP|W2pFW39<*<5>^e>uYTLnc$))8Z_^rI@kWw{{k&TM-ED}`veEG zF13Qd{~whZ_elcafHn`uUO9w*N03@|@XOjA42W~^35P0aYF5a|W>+shHGXw6)OP+z zibVJo=z(BGqnF#fjFU3yBLobYTGDaOj-e+{nh1&OySwwlQ-zd~SYzyOmIa zo96X*HXs=#A3nT{CmXK}AfoxEF3p6KVdm%Or&sY5$Dc}CL%_5-KzO$g8Ytpi+fCLG z1B}3z8L5C;!61JV42cYGn(*&Ey}hC?u;Rp=oSaW|wbbP0i+1zXfcF8OM^ZmIIcAlK z0c0orzg(Ty5@_wzm<-`3wgsx$C3;beJdxc_b%iKG&6LI_~P zGc8!bSvc?!@qHMY(oD^kmF3TV(jxH}U<;*{-o*5iP$b-zy*HH81!MNI1V~d0*nqNS zUEu}^H<1Kp7HEe%Suln%;V0Vv_NA5ko<9G3h<=QNJa7L65rHy+v@mV}cQ4 z-WKuLxW&MLG3~Q^?aGxa&%JTPcAvm>Hq-+)0m1A1e8!W*O+s)+VCDlYOIX=zR0MVgcmz~E zBY-!6ku?HAvqBPNur!FSg;3ziXKDq~q$1F7sJ?ys_IhKyvQPzIQPBTF6nSzGJGP@~ zAoK+S41jKFkZPPDJpxb*LX9}y2Wx0321dq~@o|vwZvr7~h5%4GwE3q`pGv|)W=BBt z28Cm56HA-$$^Q0sU}h%mYkbO=(1q>()Ln;ATp-v#s9U0<)PO&~!MU1+FfCwlbAYE~ zpKU4p%~QaHzr)Us59qDGzhCn5;+!6;1-KKr_fI5d3G(CTv2%$|5b<`P65Zg?G1qxr zb1RqBh(}B{Wdnm$lEHExMA@8$4-S>^K*M!8`K_})#yhW z{~w+(&0($)-Mkro-*#l{=l;RLYZ&KXYIIBRLxS$1tn3`%SriK11u`v2J`I>SDyb*9 zwpIv0{?>2DCcrqjkPu70XMu}|a)3AyCPF3?*g4+<;v_8e+0FYZgW$)rbDA_pfC>Dn z&r%vB4?|80sJz#($FS>mc6Qk?Dl4D;M8GgY=3$6-(`|V`Eh07b;K2hJ)E;lXCJ8u9 zHp9W>fpDtZzoGXs-Bzsr{+Cn$8Q1!(h~S{*EG#c$%gN1-eJvCc6c(O?(yf6MWp7_! z3PA`FF(A#!)tMP?ShewLOA2mh9-ATN8>W!Q1%wwoTpw>r{y^Fa!*N z*postI9mc<*#;DAW@aV;c5C-gp=`w*R#^@XPKI2cgFQ-IDEl*rO3Ykbov;vBqegwq ztdKbZ*?nH*U;=lpGN?rnUB8|H6K8d`)W8ZIuF@F<*F-uo8T^Ewc?TBg@9E#aMJ}@Z zFNm`qNYDv^42}YEfCQ!?@c$NYTW2>m2q1?FPw!{q0WBEGHo(CKSp;YD+1~QN5rCSb zpPxT}Ml8_F^G$#Fx!FTk4*(%x=C?(i{ns z$(Vuo4?WfFDVlCFe31(o4TSD~DJW z8mwZ(rrrMiN2LbsbnK7**AYNkd8K9FOSlpd@b4jV;|q|8q^2eb0Io%@Ax#4VT+m@T39#0q`#e%?#d@?`PV63S{deYF(F}K*kNAuJu3# z^mt9jKXvz;WblshAsR&#BoA`z*+}W*)&iBZFL(I(;vd)R>uZCRx_c<}{pU|P&=#Ph z&8)3OBq!e}F=@*5-vEpQyAnm`e@09t;1KlY4Ib#|2+N&5vx0L8x2+z+Mj?S+=yA6= zIin>0)dSPx=H;EA-i51lAx%vZP4^L3M9}wy51MW{5DFL>ra*y_z|-+4VoHIGenlb# z*pB}{Ds?e?dx*P%I@1my5NWSh@yNOFVJGG?vzs(h1IGAEc*_n4_}nuyxKpB;S`chG zOLWgZ(#jcHX^sD-xWm-fFfhbe8PCbV{8GPnl+)0o)Ma6STaavUPu z<`5G@G;w&w*B}YJ13~M@F&y-e_wV(ty=6+3hb|5Jf(%^Yz$Bm^D>=MaDa@*X$GV@d z?>K>vTr`zpa9bU*AA(N94Q)g%yI5UUmjZZV>ETUhn?MF}697xlbS5oTmYtoQ7h(MW zF@Xv9`)IuM4NwgX`aNL3&Tejoe>XR$t6~i3KH9#2i%mScwl-;J+hYPq$`hJ={rvnq z#r>XZX_UYViitY=^g~C?EiCT8070eqO++&Wix()#INE7Y=1;S;Q0dw%o z-F&+WIN*X>8|b}sa5>f6NK^CImyR-1xS=ccp{C{rjEg7bzBb@cfKOKbV%HMP3?7;v z6vgA>!;t*RJFebeUS6(wzVa*Bhl-(5QHzZX`ZZiT8m@$|Cj*x2&9|;wd{k&{nb&3X z9T*Kl`(c7CaplWnhk$zu4gorBXb6bFiCiW>rk%sBgzWg!+THMjmgAC=ZiuVtY>teALO>xtR!GujS!y1B8XE_v1rp~(AhUzodqLZo%Lz9>fH5Zv zyR+6kU++dZ0Ss$+AkI3E%_sn|ICeA&d|au@cbQTHV`7N!@$#;om5O`qVFQ@s%6<2a zP7GMSv4g|LG=A{WFo;E0KyLyX5d{29Q%j2;5=w6JeX5fu{gB`Z1>JBSMj7aHh`lzu zu+ZkF_auzLEmsI(?|`cQ{rd-rZ$EDkW&MGxX8m1UG=eLAf{KGx{TyVwwa6R5?Gz-7 z?&&Ewm_w9hz3@E-aw5$@3u8c_g!oZ`G>HhDkUj_j5db3e#Fzm%Jpp9>@w4dRM-NGa zTOmh@0Kkhcp}CwK9M^bwc&>B;{%W4z{^Yu(YGq}$6-`A+3700SKTF#^2izyXg${fclf`@*EaqVn2UCx2qPM8w)E8lvc2!tK9kP*Y~RXx$VbCN6np`AuHV2Jcw@sVT2K1 zs4#KRj+Db!Jh5jfh>5pZSy-&;;e9bRr77;fok!2@DE1FBq16yMq69_!O{2>qF6Adl zACjb=c97X);hK38A`%CJ7MTG4d!}9sn$#%ol=)DBX3a)9vTw*yxX^L8%uzZ$O6wm{%e8rrPN{49ig-y ze}^K@z!F{2wMhG;SEZlgU&q?@I7R`n6ngmZA$P?ULn|w007V83hA$}rP(3cr%X4ED z7xzH_sp-J+DEhDvb`qDNZ=$*=v@`2EC; z0>NDzx$0#4ep+1qEL@Zf*IjyFX#`-B2jEMG`zKnf>2FK_5u%oigd5HH`oGcQg& z2Cv^iPjBo!j4YW_1MXJnau3$-UW}+RHFU1z5sphd^?y;xxR02na2X1Yf;1p!pnnm| z%T_mT-h`whI@n3F0FhD8wa z3KUnMV&A5x>A+OzfG{wk#TYjFPy#$hULRR>&$^&Xc?-Dk1RS#` zA3)2EOiN1xI-Z%Eo=*K3v~ZB8W}E~)Pxe?q@l!W6#E0{WPa_<^_H6nkB5HlWIfsdO zL&EPY61ns9h)o;rb#Y$Ntf-a$G5f7un}o`o^=j&G30>FWepeTlYzX9l0sxnBZiBi8 zq8DO50}cjJ>D9u*Q!t9RbzggfeU6N5$nc;fAvDI<`2CY3kO1B!p^+L1+FE1~+hT012h=xLJ6*!ta z_7i-l;rdqMxp$DIy59U0mCf9Z9gqrLummn&=DvLSGPbJ9O~lCP&x@Ftm;qF9ppvf>!Lr!Om_?GPPh@z%SSnqJ9`~8y~CRY1d0j=*Io&gSg^HrQbjX zHhuaO0}cVQyGUyK$KbDDb6mSONl9P9V#DKanUob3HA5~H-N?uY*;Jl~jm!CnVbOsq| zZ*80u^)@*f8y5X%odEp==(N$0=dXvqaD4&=`rYt=oQ#f+P*-=9oa0r2HEbZ`OK4wP7@PjVlC_6g3}@ z>R7%avNZHuI90gt+z`@`Mv^d!ioh9(tvJg75(Pmg0~B`+!J7!(he1XQiUeGq2I~$Z zt*-;x0Akj_uVL}miP)zUc4PKCT^FDRjSO^q5eU_pEGc2rU%+&K1`(1)a((Y63jk%? z1};tEu=^jYs}D0&z>ii`R!*Nzj1$`OKiClCT-x=YIa(bwTFE0~8Bi!m#@%*j4Z(jS zlttNkqwmBlQnLR>Q zk3A;|_iH7xex5ff9iF-xWvzOd+{@9$&M?Hg``4jwZ)KxE&9K7MCX->EmnkJ5>;9jf zT{*JMAy+Z^7YDcbKr!k7nF((80w`$xV*eY7`hi^o+~2Y{Ik2|&MdQReYeG0c2|%(B zKoNxN*`{#q1g`Ldng*fzLKx5hm|ub8Yen&KduJyXT={?kaUYQQs+QbbTymkw9Upj~ zx$pW-1H*-~?t|0A!^>+9>=A+}ODX;Yn(Yih>U5yz^#in&4tm?3+>N*!keK(j{ zBQ*fpgy!bvXLM(~$?)Hj!zu60Zb)n;o*W;$*SIc48CKs=XC3snl+l>rv!8HNg9a3w z{0hAHCMURrivTpHjp{v9;WX91bkojGb(Xjz{W2_VcX376bdE85UW^qdOMJt2=XXof z^<;ahEGI4drOZGqs_AS858C>~12-Cx=TAWinqYDHX%3kIxQ7}54nzEM4ag?<{LYSA z%gf8Jj;1Aa$CsAc<2gERy2H=DQ3BfGMnixC*gI7ESa;M+v>FKgeZTH_ma?{vj!XzH zr$X$Nfr+Uw=Za)YE?@YbY|q^a~p(ffTK9{nmx>CxC&F! zT%8w!2@0BZ%x`j*~K}0LfS4;!JvK@_YF@P;JjrR*Z*g2Z-;R&k52=BJ&Gh;_^$<(4Nh1tTx5hO*orWN zLMQx6rQ2jOE0b`2U>%&*_5SP!=owStK1&%MdS5+x;D-h+Zv0$?j`AKRViVcHB+#^T zw9Cm&xZsBt1$cJ@Y?LSAD>wFXQM$t6@(FRMBf#2XX-zH&JRkF zFapi8-cRqw$_l@^rIZHh<<77-Gl|^U<1^GRjCS+fv5E5;JzlzRj)NmoIYl z@j9BB%?KTrf3fx=dBBUaK^AZyH1Sq@^#6|ldF$cOwP8gYz!_RogBv=Fms_d z(m3EZr}~FqaI-qznf#d{(pjXT22>iHL?`gvD2QUTb#UloRnrA|W}7b09hbl^+5}zS zNJ@W5#?ugPC0`!@^ml+0;64xP)PMtA!Z`(E%hsly2dXd_Ki)ggPDtHolyn$3b97Ow zQP-8b;R6<&Cw5o2My8x8-oM+V>D1jf-&69^QaCNmXvL%x&P4RYXS_$hBBG-Ui(-(n zhU+n=R#wa%1GM7C4J%Gbm(@>838|@yHa4tK?5tac@EZ|=uUCVU zUkFYP<3}kb9U5SSqX8R$4lWImu|Qvdx+c$4RNHQRWpL(E2DwoE4C&f(szMA#{GpFqL?*EA3b`5kZO2`KQabpk{&jiJ8W^PUj#ySMSsK7PI1DaN%SAHb`fKVKyGIzIT zrH#E-7%lr!gNuvVkRJou2e=ui+7B2+it9`CI;ya6Oo7DVxy$R*O-pkv$U1 z$ja7`kv$Sw*^-nk>;JevzjMxYopYV*jPLdB^SSC1-uHdK?&s_Ie5{wX>ufDgT#p1~ z8hYrHLW>`#@IRp~i{3kBT2oGEnaH@6^Zjm5*%!yxyQ*~Gr5Ie-N;~Y}?YZ_(1f-K}RZL7%``{GFdS9jNqy>iHfjB&2LUB_)#hfKYl<5q;`9;Db0@Irf7S#y9%6OL6F#npPz;AU*} zfG3uurCD@Uv|Llq=qN?dLMNWAloU7j8Ty+oB9YBUyo23X?SI~n`g)Q7D;{(GmsE}t zUAMqoZ?oPX0|Ul}UTaQrV$1^K;?Gf`cQP|q0imL3IJOV6hZEQ&(6IqGP6B*P0+DD7 z`j2u9E&~y8Gsf7P5K-}CdRo=e@`pkK2+&~gi?9T}|N8YQNJK`&#{fUZ9z=QUO(Gt^ z3|1Hk%U0j~WGOeZ&c)7|+Gs_YfW+q%X{R*a#(qcF`hiK|??h)-e#Ki7h1UiUp1Xl3&k5_B?qzzW-TuH+Vf0qkHTN6xJq~q6&Q{tonIEz4;E+CG6G((0 zAp-&O*t{<5v9nuz%jN=k*7`V6_?KZxCgJ#qiHS*^6i;piPR;+uBz7!%5gXJrlpAq^ zxMRu!4Gz!Rfo-cp|Kx0fea^r{R9Kc@j~rZjXE8G&^B%8NaFeWX9cnK9#gii|JEK1R zTcb%*pRzB^%S%RkO29qdP_4o$0bVN}%NPyUwr0mKQ(d{#s;W&qu}!G*uLUkden)k0 zgR&C{+ZWWTx@J(YMdtXUh`ZS>&|g*p~24t&;-`u`|f>`MYhA1&(@3(L8B z(%J1Y>r2-^2Xm_8ZbA5viaJsH?`H-w3leG^KnD^nK8&F?)ST{>7#MD&V>qXz#C7=a zecY4)NuFps4HJ9maghK1RyblRO`u0~(g$rmu_ z0tPH4t8_;B0cMKkmjc4tc*T~M$KtMczR`0zEG~Xq`P#L?2+=zt6J4}i{2g$i{8~pF zc}5`{8wiXU<2NKu@Jgwy&bYXhTUV^c2o<}>aO0QeK+#*c7Y-p2YX7xs*S6m5ukfmP zXFn3)tY>fkRvb$`v>%S!E5P0^({P<3lka{*x+CcQQU8bECDiJ(zfb9F=!L!eLP1Q|Js)TX$Q}z5r8_&)?LUr%^gWWYt zALQiN-GkEPX0*ulv!Ada6f6K9GRm&aX`Ba&u>ch6yGG}iygF&LVLySg z9|7RzVH44?;)jN30|^KLADe_9_3t#zPBkhnm6X?Sor;op>tX;jvlvu!DOG`XOQ9St zJ2z28!}XgY*ZWF9;y37L-5lTO=IeHU`_`UcP>^W_Ucd~$puaO!&o#S{1n{pO9KkT& z{C51xgSw&w7JV16v$hMZDJpsxS%oM6Nh=-FnAqh8>PZ%Bb(Za@vD`@6Lm@3T^a`J< zs#r-^iytebOZhUWRhAOXWy>Z@(s7?CsB$wRfx&FnpdRlN#Nk3kfduRkT|mBRSTm7g_J_%gh}Hmv(wXGNRIukHkI z4nHF~p0_GvCn;)+Db$D=6eV>+{7PZz0m_lhaA}>$)GPd*kU4aljY!9lmv>^nuc?fG z^VPl@LSO9Rw7v=THR$^EZGsJ^?e5TH7+!8u*eofSMtZH=r={dZ@Ba%7t;V|06`qrGZPh z*y<#p3i0N7G_jn}|EEn}O1=>u5>lyWQ&t7xmReeD`BDSgFoHOKt@~zuev2=Ul5Rj^ zJEiBAeco}*3OOy-XVfjy^Jv-S-e_l)*bSYnN40QdR}MwS#g!uaLztk4(XSWNEAl5m z)c}xC4)4|kOpqFjI@nCnz$;;1nx^3z9-y7@gXxm<8)a#9Zta$DiM-0odO7FZ4o65N z&~d$GWMu4*J$jX_?C6-6`H?RS3Q&v|i2!^B3`;LxG|ku#hFBh3$kAiR1Qx8HG|8+8 z%wqp$@nb0YA}*!m)}tK1cKy5Vrb$PJKus$C-a!FB>_Cy7Xc1i?fw9o#c-BM<~DMktMwP)lAsf4&(O zg>S3a!+1S|E-Ja5MWFzu%-vt?G?|J*GEw|kG2M+xA%`^M+2=w1Xp`rr!(+WV+JdjY z@z2M(IR_UHTc{@2>i6(TvuYZ#V ziS?AK>2R;m6W1!8lwA_u41?+@L0^t&zZS>7QWy>cnZW~YEi%mVJ0ZMRLN&@l|K@c# zU0vrnw~~a~2=PS+ghWJICV{(H_4f8Yf#B7VJxo&xOo13$`bTO>XL~OwD_aWtE@^a% zD1~Vr*R1uWk8+#F(zNM?xZop1RjEYhH-Y}T&FQlGmIA9zA*e$+0fud8f~);P_NOa; zjMqFpsqXNcJ~r+zcm=0mKkw8+gkGAF$Gn!dvT{J?$8=2qZT=6_O4~94bDT!!#zBvE zat=S@9{vlS=*-VcVaY7%bv%wFu1{r1R=B8q@#3u+Pl^muOW8f{YNRDBSPT|IK~A%_*1e$L+S0^`yvn1 z;X^32$Kl7{^S!$}-NfQ6Pheo6Jk5K+xJN#9Pftut072Nv!4d0>et!-XlMwAi0|nN_jB}?Vd3G9n41q$`q$6C!-msp?HD%a&ZKaK^89A)tz4fc zBskLMYIeKP(r^uWi^tFOZ1aRO=G3NlBLb{!@sqc?vC|yvN)N}sla=KTJ1T`?XV`2) ze)fO!2kE-QdHKr9|IdHv|I4?rmt7o@no~ae|LZ%|A*yBD)-E$dTOK;ZSe&eZWEj2xQAB_3U{**=;8j+P zPfO(8n9*wv}AqW08A6lLToBf83cHB@tWejSHpCR3WD46i8Wnp`cn{t@Q-q^_VA=1pJu-8+HdfTmjb5A)w?Mw`EG_!xv}ZiSo965X4Y@BANq);^O%=h6G^Aug?q4VfGTe{dGojghf;bS)*)3XtpFqW zd^1Y(M5w`U+)XW&-%@ioW6p9#NZ{jR!KLjAp*7%t7QnmFEpUUQ7~gMh51y&LqFVUB z$^ddK8+GaG-H)MIm<+?bE=pqn3Q46~^*4P@WS#2MR|{V-PyZA|Sx*|0s(wexqVU?v zm3btfbx-z|?!>e$Mw`sH-((`|d->Q9kCMlP&Y+b~K~2DCi}~oY3g5%7M(F5l2NdIF zqQbK8IXs@At*3ariOzmBu8_2w!o^|1C}P&>F!8ayZ{oQ;-L{8<(R<2#Yr`>04jL{3 zw4^HK_N_rEM`8V>@%~*6t8?d!X>8fPars`(UhX`&Z{y39oCCOG!-ZAFsB_mIL zE>N=Z1`KZgMg0;N$2xxhrRU1oV~b5~&H9^0W!POm5ye-TftF66&Q8Ky~F<10kej0kUH z?V>dQU;Y3Od#pUVK)bd^?f17E4hR2tEkGD|gnuIMeQ(K2JF*c{mJ93G(GI)I>LMtd zu4XrGB&DWyeyyn)FJW2k1{#|N$*P(hQxt#jX|jJf3#+{8VMZ(z)f8T3r+6LU)`~!3 zoB-XPzJKrDCTvwyP>-JFk5FD%&|*N$*(iFEyj#89Nl4@45T42RV*tB);5gKVL)fvP z_3TXsm{kq2Rp+J`z6^H4qOo=Vm8XDYUghKR@*fxB=#!nDnb`##OKiF;mj`h3XH{8U z{$NnagbNTD{}?=(o-M*zq{F9nVC?XYi!-W*qP76T*@g>j3;i(hdGP2>HJvroQVG-K zMSPMc!j=j#`Y*UbQ|^TRcNV+&RSS!>$>wC`M0})eoHEg95Tc-GuYHXVzk&Ip?7F$R z_{Gi~tuv?;Vd25(i__93qJibT?uAo-3UtSFq}WVK2&9GO0)fIuK8(FC>#CL23WU~O z$_i>G!uJ33prFg^fIfH)0_Oe_+aGt8{u}hdG^>tTeSHM&;`0KVeotF8dcphw*Agb5 z^KW&XKd2P;6c$2VD9@&G*?af0vHcWy{AZ=BT~zC+n0jn^t|oWBZV+&oa%*%}BuLHd zLF7z1BaaMEMa^+T3}lo9MCl?P7}t9+be5nxHMtSQdO_#_znovftO&+xR+&=xw6smi0rt%A*Le``DYjJ+0|+cRP+=W?=Zoi`1% zHS&qxVc^kNbaHeY#`sq{-oN$)ol+aXrD2F+-zc3scU!OXZ@3HYq3OlLb2F-H;X**9 zx||V#EoNmkxr>u?U&81w!Q)=BjR*MNj5mc#jBd>;o*bG=48G3Zz+N%2w@sY&-`r=N zTq^#=n~6N60xEa_M#d&pPo6*b$1wr+CMLt5paaP- zew-@xgm!I<8dDW*cAL{ai5anh&F3k}PWx1@DD5Igw>U90k=2-_9UNvSL0Oi_2Xja( zJN^R0@O9~iOxq;e&m+fjIu7m^@Dg>&%urnU{O=5pN$w(9+h@qrz1RQQ-dC{`$1~D_ z@XY=$nYJeoxh9adxi`B+(Z8hJs|gqbd35{E9a%`cGlf(0m@gcjV}Zl&Mn9-=!xpD~ z#ecr)*#J`74t*urlwEKQ6T$=Q{_@__opw@mSid=#iRpmytChX0j;3iCYzvx5VN*Q9 z!#sO`_pjg59`X&KUo3PDA$Qy#q|*5Ke|@%oH0<){sai+_#WmntV&zt#WAkcRma3(S9Ds#IWK%6GI7dt? z&4qincW1mpBnUAek|0I64)y{;U|ToiSNrxh6FYd?RxuF~)?-k=8xZcNa%`r!vNE`goj%b*`_?5V85&|ZI2i@?3Wh*R`nA49$#^S~+f zPP=d&tZsGYm%PdwaNNk)`CcIh7iqGoHZ!$Ukwq<8#P*BhXs)6*$%XJ5dEB*NvH}yB;gLE6I&@02zvu`gR;SfXFRl-PTCnIUpm$!L=FE^Hb=ZTW?K6|7%me z{8H#c__3StQ5p>gjlan0T3yvSTW+0Hwryf4t?3@Ok375dHBK{))MAc|wb|*hTUj4I zUeq$ab5*Fn_H)MxukV9`obpr~83Sv*rHfyw^U^ObdZn~pMP?l7+c@zd4m+l4c76Zu z07Q^-K8a$=k+nHIavyBdf!i+d*L-el%&ckhuAWv4p1xVrToA==dG&SLqI5^0Ze#hC zGd$-1MilR`iq@&*_5-_p`9^i9ry)@>MOZTW{o+B6{7)Mv8=v2IqI2e0x086{%hWLc zz`;QJ%2-(daA`3rWy8kot=MDL)1V~%2>%~S?SVz8g-r-=fS)JT ztK6$?wTfEZJyTlUCNeH}BxD@I{zg7|&7QZ=Vs-!B_l%?Mo!oy7`%?xWBRIYuS-*E? z_|`0{XWT7!$E?z96OKKZqZ-p0lY(Ui0T3UOcqxvbJ^{g3WF)hLcOPKt zy1CUjj|EmRAAB7SqpNWdy<&bu^X3FQ0dkp{qq1Y7qX~N?hFA&z^Zc3linA^eV_ywq zcczcZ{Yg3#Cu!c$dr|CCUx)UrjpgU0*wumWs&QhT2QKCaC4V|5>qrG`&ggP@|uv4n&1=i9aDWh?cBD_yM#?^&UUd<>fYGypcA7#g2xYb z@BP!zI2hr-eVfMYdRCfhPwJIT%(IG88*)WhW)8@^L*4X4aGvuD$epet2Oa?MDWH`Q z0&6aO9!ivYI6p2xa|3Y&B#pc7+_{5|2xW!nGSCKaA_W{{@}n0o_F_YCi7m+_{zbuZ(ltsr+IJj{OoE#@{Rp^+am|9 zAwp~10n?EnpCEuB{4l~63EK7s&_)u@O^5+8NBGw6)3et>9YwfI077irdjiK+5Jwh$ zfPrrbNj?n(m5H1oD9+kB`hn{sS+@bH5c$BwvO0kI2y&*j3}7Zl^A`n} z=q*Ba0P?&H5-xl_gS>|29}hSQ-hbf)ku<*Ns4)>xegkN4=|Z=ax0!)szU~E3$O(2t z9|jD1CnskU_QvN@uA=cp<91F?rpP}4wbhbmp#il7btNzh7(@vA0Wz0h;P$eM(<=Nj z=*sKDp$i8g3&A`U)`h`?gUs^hxZeEfp)k+SuzDG`<-WxNYl~sqytJu-Zu#ziZ{=A9 zB$Fo!n%KEn_N=?l)>W|ITAhoDC4&74_yTA(;M@<;A2+B7mwmbs=kfXO7CO8k+X>+d z3EVRk(R`hck%)j?qcv5P6EAb1K;158W(6d2LEnoD%SQYlkiswcp34;*E3yPLr~Bq} zU0r(f5O_ulc;#>n)nJeil5YO&*cy`OEjrR8PL#uIXAheci7?d=+zSc@#ckk3T@_xk zc+9}N|Dt#ktm(Du*K^*!g}5*Vq{S@M0KtHi`~5zLfjD|*tIpq<7DGtpB9A#8H$xFgZ-g%zc9`5JK$18BX#!kkm(9u zJ!$nVuzyh!6QE{D^=L*^E@GB8EOIQQ#qhoW>-9%D31svp*3rk`+;)*<&dP7rC%MbE zp5qD3&@a6m3g{Bd45b`+2J`k;JArz!KqCvCoMMU1?@qi@5IxC%_qb(j9FlcJItz@3 zu}N~#p-Uys){srY@-hMxygSn_LYYv6k_dYh)HR9dHcOXBUw~L_g=q-ju{Rt-S>^xu zE%QgoIF9C3^O9Vfv<%@-L#U>m-BsKWz+YEZ-0}8PTjVfghTKoJ|LK5g%z0$t&Fqa@nYvDLzE*iw1#O4_*}Kr-eet< ztE9~MXu|x}R6x_nt*q9ISH3UXJfR$0ihqz$;C$z|T=8JN7PYvG#s#|SF+J+uk00;B z7H(d_LbgQ@h+zp9KNycRS9J` ziuM;_{%XV$A$cSBgGJad897p`b8V{iFHQ#Itp;&<7uZ)ZZ*9s-wX zA#FqHBT3!<6W<*7MDqlJXQh3k{Mg=|IiIgccd=uuzz^k{dsTOP73=)^IA-)H#dUVn z`=tV4a3fD-ZDJ1wu*?ea97>esw8#eDw_~?@_B0DfO4#&C5mZ0nXob&T<=ERYuZ?y0 zm8n7^3w8Oi&A04?0u}ZF5IfH!BZ+t#9HOy|%cVdLNg^&C66iP-B#k$^$FYjl;yv=|s5@~Mm zcfpb>?KWo&auz8i-gw&qnr4xj;TnZnL3wtxftH450Ih!2I;&EXs&kP_*jx{qg?15P z*R-!$)K*kQtb1joPsylqv07PKS)W|Nb0t_{G=VU{g`sXzBN)}noau!5#t$vq4cA~zB{5Qb^l{>mqj7twi1yjwBdF8>Z1TU$p&Mhdo&?jeW) z&p|@7^-~uzS_vx+YS$Tj!ZfXn-4Hh%JaB*#W-6KGVa9bh1ancYu@$6CS0^hyG4Duc zCf+CPxsa%Jr1`xA0s4A7e-ITM>)a`JP5*Yw zsIN_FrTNjR%kAc=S*_}IF?jv_{eFxv$Rmm6c#fuW4Z7J{Gy?mQ7J#xV=J z@58!apg<5+!RQRhYt#wrIw+>phX0cNDWyr!li|MmK#W8Y6}VYJZ3&Xg*dYU!3u;V2 z?&%ymC%bXo%Y>MciCo|ABrp>6%l;WRUtG`I%&Pe%%>w;!M}b^W1xePBX}A;5oq}zSkv80+_c2|I3eO8z5VjLtlOJ93gGh zl5lLJQ?TeOEh?x{wtIxQG3>#zvw!1R6FhOgA<=FrrwoGgZ>BdsLWjEeq4`f$)0vRi z7y_|kHa1HR3D;izZkK<4wvabY`~2wN_YSJ*a@2o>$Hw;d8tS97?IsHaXBbt;V9C3V zIsorSr!{axhT|CXp1^>typfAODf}d^I_q2&(!?*Z|ym&a+8Cy>D&_* z!$wMnL``ZK@IpLcnbAf2@Dg1J5mhH#zH}Gw$(iqNpg!oay#0g{boC((fRNuFO2yW# zSNJJ*lnfU7E4s28FGYKJ{C4J-`Kjf2MaO_CAv8JQEb2g$32Lsmq@)ARG64$I1s^{g zFU9mK{D*!o@Izj^#j=>?aG{&Nq2N9(RsBuUHrtoxmPNC2>a6*DS6`ueT)eKBrvh(k7KEs&uDvVh`+G0Qj$=Jm~tU}q5ogBv6 z{qlD2xW?C)%&+#GwDI4WUmw5`u^v~gJA^5QwOl-<*`t5Pb$!bf?lk@o+Ol1eIJ**{ zQ#HKzXcI7DzA^a5g_2oD!l{$_5lPSV97h1%+Hq`6h$fA73epXkfXsw9(&%#Z+wBB>Zn@y-ZN zjWEr9Gr}oh#qhWSgo1SY5sIem+CL|v*+o6c%izXq9)u>T4aZ#KiatY5a0(4ns8hNF ztZ^;S?w}2l*VGIz@N`rI`_GD_wQywIFf`fwq;4}HYXSNbwO?mS5bOZ#unH;e&{zK# z)PjvC1(NJ;9|sJu#sK+b7^?r>;}D{k-`P;G+K6J{B$;zYWB7wE1o&%r zojN$d16b-9+gVYViBI-AU4u|wvaww=F-czgrv%+P5q{b4xgvZr!JX@^tSCN}fgSGgJ}g>i)58{|)eAzdxYP+Ce#YQ`E!Zfe2zHK4;trx?k| z??H$5D2P*wG6p+cWMpvh8G^XP&Zokp^7~&iR#H=8Z%vIqq@Jl9aUmgcFc`sj;8{L} zN0)+e9Frgfm1NMvKBtQDm`73Z4h0k*1%B-gAv+E_5Ch0KCS#;9cq?mgD)atozYhw|MZ;R(5e7CG{2)a#k|z3fOPWe5SBe z$0w~kr!a1GpSCWVo1dT6%0>*WQF+lokrn&1Gw$wEcu|Be{cP>%h`@4?o?q&D?^Z-- zI-IWkh7H?|e2O~enH@|5kyqYy&+d2yL{)pg49!gTqH5U2@v{ow991KB}QK!9#gkv0ui#tWk4)=F( zHUb{#D)*4Yth6%MKSOGc?T-T#zJQ&tzqaGdrh9CKK9hPVWn-o zw_M!s+nI*7zkqYHJfG;BH#qOO!%Us}qRvD}sp)h9o(Wj--GaKG2mvrQ(KNk6Ap|fG z6A6s9>?Cwsgi#vX_%c*(wQz`F%0XYrJRac1F72sVq*d*0wL042ykF*SbofU^431U^apVc7&rPe)IxPTQ$WWj)|NUhH56gY&$Af4|7kYS|;j)~m`Z+p!KQ1nAA+{LO zXaqlX@3uq#1P46{=0Rf2M7P-rG}e9W75ZktIOur^mo-9VE@vB4K=yoAHEStG4G6~= z!il-|@893Q0N-3&v6B@NtzPM5aUk9jM>j`cdth1ViFlaxfTEm(YF}Bp($7OzE)}7#9;IgZpHv8RHh1`@1vDNrqIOEw>O4{hq;N$ye1hd5v8T4H-q>K z)}FiAJ`tLu0{1T0ALYjDlnifpmA5g_`jRAlG|2upjP7PqX1_^Ged4Eyd6IxpabFH$ zf#GZ&7LI$GqKFuUt}zPm*DTi2ERi6F-QM7VRsvS6-ziB+Vk?B@s0tmod4IVy+J2F~ zzP@7msmS_R=@(!Mk-=1r6iwm?3=DwrXbqbj%Q-!ld{D;i(bFN-I=_vCt!}1a8sTB4 z*f4iu0$XDKLwfBaA*T_4s+sXNi+|md;Z5EKa^4JyOCBBS323n8u)_lK6mFSfR$7GJ zm%uuK>VPXk_(aNN2){sNbB4H>m>8&&3%DIl?8<4tOj-@QM zG|;CJqXlrCORyj#M(-icd3k~TY*He6s|ti8Zj`8N(4^11S2+d9(}a?KHMznm8o=Dl zahute@@6yla)CGHw#_os*X+aGH{0$J-|zcwzH~a}?Z43%HiU-EhayhBY6gJT(9fUB zpkIBqK2!fo(Ala)Y=`=(V1_}V>_cM|h?-oGQ#`iVH|1SyUOeeg!g`iu=UV*JCZXt@ zI3bgZsN{bK4bmU@+9o8nO`MvT1W7p606)1Y+3PI9(b7XP=6(Fs4yJ}rJ@5{bC%Keb z#h%a_gz@J@hyL*zmLfqVNHM;-lyHncMSJ816&(?r?~Q~nVxzSVb8&P`Mu9@FSG)Bl zZY4g5lGgdg=mjHaYH;SChbuPQ&)A2sS#!d`3{?6fUQdj5Lx?mX3FsAULnXjlm6M;J zg7*(NL?CwYVZHsSiGfN?zjo9m+NgK{u@R(6yB3O%mM)HH3UKQ{iaQ#|8td!1@&1G6 z2Nsg@=8D%y9rF~wBhe1v5G6#y5m$-%gcuJ#eoQ*^rQ@eE=rnIzr}FOEJCtHqhT>|| z53&N+Y*sRGQ*zTL)|RHXj}OKFCh_dH2CNV*edj5vYC^uy@9i1Y!Ti_!ZfC0}6tCz9T+kCbCqa2#*;!Aw3h zKK?3qanLL^^};xuTvMH{>?P@DpGS{T6^I&7wQOtbts7n0dDisp{Sxj7Dnc6MW_H}N zJsuAX4t@C&K^&NjXM&F6BkDlD;4-ZBBs5uy*rpK{_!2(}$!0%>hU8%`#2h+ADWklg@inD3Stvs9zq^)>rwGR;1F*N&TO|ktCg5IZ?1lm3BUgrzoxK5- zm2?^N4I1_q`eIn+2eEZjeffeBGjQxN-=b&HgP4Hh8z#HE4+v*I+goEI6ruXx_a226 zglH(xh-@P62Bv+&^^b||;iE^xxD{xz?#0LNClT-*wq&f+1bliRjL!jEwt%46RpEJS zm(j;rLFwtMS!6BG`;_O@Wr*)R_W@lf0bxZQv-m)Os^(|EQd3b`Dt<-l?Eo(k^anLS z1W3fe%{X%LklUM%byn4zp(m~46ZOQH(I|9V`&|7=)|Vy7Y{xC<=3-LD4iJlAN&4!8kdxm1uQS{J4b&pc^~`8y=krAXWRO;x7qji z6ADf5g98I`7IyKczcLN5B`dE*n_3|F2$p;es1fAw3!XGX@BkAYum?m0A#tm&B1O~~ zD-q2b_QNKpST*)-Te;^-0X`oqC~YeHN_Ob^@x`z3&qjHeU*VTFuXzMMg8mA^Ktd#S zVTw*N;JSs~9CA^Aa0TKGDjr#1!w{rzZI?j<=S19{NJj(e{mg>2$ zWe?IDT@;!tJ$XI%uh7}YY~r^20dFDOI}(*32N;PbMEk_BfNG7VnjW$XBDtGj4!Jg? zUmVKFDko-oELI}!5M{U;F5(*SPDJt#(c>crI062hNBd6gLPv#nY@#EBCC+_@7J4Zl z-<&5;7E;nm11W}h$P-aKY{$$iK?2p{1c*je*|kqN7?e<9;D%s2i9v0dX;I`P&L@X6 zy$U(>#IfU8dpN$25e~FF(`D7@k!z73LEK54HHsh%CX{Hbmb*|M(0W;^E7kh0-=*OS z^Z6jl3{@RtQPTI5`5p(FNl8oRkeDP&%;1e+h z5t{+NG2!+h=v?Hw0bM_hl|~pdNyJP|NZ%3aiF=Jl_5c~TXeu#w5y&@q2Udh0AV;@7 zLuUuxVw4PZ{#@o{9%9o>Rz9*{zkzMz?!oUyPQt56O}&N$_*?%i`g2Z3R3HV=h=Tk% z?^W6|@!EX@s9ECT;+JsYat?d(9esd~gGfx7y8jhcL{D~RX1@my9xUv`p}!dZnZ#ZC zJTOdv*I90)ZAP^sR8h#1gKw1-5A*_uOax=Fuv=ZS!&E{<$5`e^;p*_-Ck1uZ*3uq4 zc){jAz5oP5x1T$BphE0c0PnlQDgay@6q{W(V>*WfK;v^^+#@^Lo?KAo>ysmfKDa?4 zH=~T&j9Jwm0~nfCB8A4=j5L76Q;ORo5juI_6UKMDU7d*)o6bRWGW1T2oSebl10=d*=*y`HTUCq+J55KVq+vCiCqs+-3CKK70jli`(Hcs0*D z9ldSYL39cP8V3rt32SBr8ae@F)0VmWz;6T78L`Ey%Z7AHZ zd%U|mU4)kp(>swCi(!$7PKMo`FFOv6B=Huar-$_XKHhe~(nJbXB8|@kN4p8UumS$lfZ&e z#KUa*sv~&N4HG)FG2Eb-@jloO*X+cX!7Mn2cVf#Rv{0-7&ds2I13fmd@x5f@`Qf%r z^aK4^RLyoO=2dE0T9HWRx&yLMgQmdI0lDDiCKqf>)MXCtXtxdQ1E z5Aux-kngvgJJ5dKrRDq6bF_W!3HD#8@*f>+uPRtIw^;eL!}Al_kHfZf?eE%Zs>gSC zt|*(hF^|5n(>HGL;NTGw3H$>Y@ptuRVwm0^piMfRqJ9;(7KbLV0$T9<``6CV#pODh zf)H+6!uPQJ3obn(>yu==JY!0@y_4pcE6F^G*^9M`8KXTa8^6BLt~&qxoA+5!D6X?# zS|b0ZWoWc)+risjW~vIHBPrlDU05yw?D>9jo`^LvM_T@$KS#k?H+OXS&CJ;E*+xag z>%v)JZfQyB9a(j2S|)1;38sb3M~i5LaWXhKi$88o4H+KPc%*@fdBye}qalHovjsi5xE^c1oZbA8_t)Bd%Er!x zxg?9YpB50XetgiE$)%{{Y+7n$6Y>fQ z5*~gWqU)jTBm+}3#!*Qg3mrSoASW9Md6$fgcEntyzV|-cKkl(M8(ob5 zhi)AYj@2J@&-y!K=UlUgP97A0rE_&USkqr!wNJywefR^*#$0^A#A4raldR!VxobS4 zy>W!t#9}^9KtuGaz)y$3fB*!{`P>cz1>{GY_UJhPIOhbwH@m+)`RY3r{YwqDMO#-Dad z>{Q^M=dX8Nkdh2KXt&j1Ujk%6eiXYUcJ5T$gKPOe{YI@uoj*cG(O=yhv56tv7C-1} zh4DB2Uc(E61BS@I_vD>-b8`!M`t-2NqmU{xPk_E5mv4yVCv~`>DkmJTnVX;c&6~Fk zisZ5AS()$cvRy^h13T$rc<*l46L{(uyob(SB8DFMO7_+9rpBU?y9MUZxQdXzMkq1q zULHRa`sLb*7bA_?CP=1xm7Y%aS3Pm26eoWZCn&j@S)b z9gor1S>ch7JkI4VD=Q;**+*v&0=*e|EZ={(b5a4Bb$E4k_4LNdzT(orST|w}+Tq9W z@d%TMiLLKNrUYLGj-a!%&k71o6eS5<=mbAozWFbTlzF zl^VpA-k*PPz!M$tGt=Lk#BJ%iS)l=%qxVE-t zub9M#t2_LJNI@lX{tdH`Z7G7xKOE>>IIsc`Gv>sLso*0F$GPq5@J*G%m{MEJ1;C$1 zA?mwmNMLVLi$Acx#EcB$yJ#O_QJ~)BNA|%}9e0$#|CyMW_QPKtzldDc10o`J^|uOb zn8|aV)oSusv%DWH^1J)l0c*0%&(E_J*dke>sXcgLY*V13sT6UbgGN-8#llY`wik~Lww(3(W2bVk{62@car47 zl6PQCT~|Z4x;scG&n}*>{K7(_chi3G@$V+CPu@MQciA`EcH!^RT+RJHC5fYk)?FaL z2HLpB};K^Y@TX1{i?Y>mQKc*UIQVXP~@y?;Z~QI{Kmk z=e}n)n24t3>rVB*(YBKImbH^G|BJVb>8MgzJIOOqJ45!XW&XrgzXM&9^M~D}IP!bC zc$fH?0%%jzmxCBSAboDeCbeyurc#>g)2p7Y4-_b1{=D04W0Bm!yNxJX{vSyH^Jo8W dzp31yaG$xqPmN)`pM?J@DO^00NjARwzX10w8{7Z@ literal 0 HcmV?d00001 From 5e77cd1825c652c63fa5b3891cd1a7860ad49c03 Mon Sep 17 00:00:00 2001 From: Justin Nauman Date: Wed, 28 Dec 2016 14:54:52 -0600 Subject: [PATCH 016/113] Updates on the PV zone affinity documentation Updates docs around the PV distribution process per the linked issues --- docs/admin/multiple-zones.md | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/docs/admin/multiple-zones.md b/docs/admin/multiple-zones.md index e215b31716..b6421e71c2 100644 --- a/docs/admin/multiple-zones.md +++ b/docs/admin/multiple-zones.md @@ -51,7 +51,7 @@ admission controller automatically adds zone labels to them. The scheduler (via `VolumeZonePredicate` predicate) will then ensure that pods that claim a given volume are only placed into the same zone as that volume, as volumes cannot be attached across zones. - + ## Limitations There are some important limitations of the multizone support: @@ -158,8 +158,7 @@ kubernetes-minion-wf8i Ready 2m beta.kubernetes.io ### Volume affinity -Create a volume (only PersistentVolumes are supported for zone -affinity), using the new dynamic volume creation: +Create a volume using the dynamic volume creation (only PersistentVolumes are supported for zone affinity): ```json kubectl create -f - < kubectl get pv --show-labels From d7ce58eacca7fccdebfd5c9f7d29dfa32d54c8f0 Mon Sep 17 00:00:00 2001 From: sallydeng Date: Mon, 23 Jan 2017 16:47:37 +0800 Subject: [PATCH 017/113] Update ui.md I installed gcr.io/google_containers/kubernetes-dashboard-amd64:v1.5.0. When I deploy a containerized app through dashboad ui, the appname can be "dxltest1" . The "dxltest1" can be deployed successfully. so the appname can be end with a number. --- docs/user-guide/ui.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/ui.md b/docs/user-guide/ui.md index 818573e0da..da2b2e611c 100644 --- a/docs/user-guide/ui.md +++ b/docs/user-guide/ui.md @@ -66,7 +66,7 @@ The deploy wizard expects that you provide the following information: - **App name** (mandatory): Name for your application. A [label](/docs/user-guide/labels/) with the name will be added to the Deployment and Service, if any, that will be deployed. - The application name must be unique within the selected Kubernetes [namespace](/docs/admin/namespaces/). It must start and end with a lowercase character, and contain only lowercase letters, numbers and dashes (-). It is limited to 24 characters. Leading and trailing spaces are ignored. + The application name must be unique within the selected Kubernetes [namespace](/docs/admin/namespaces/). It must start with a lowercase character, and end with a lowercase character or a number, and contain only lowercase letters, numbers and dashes (-). It is limited to 24 characters. Leading and trailing spaces are ignored. - **Container image** (mandatory): The URL of a public Docker [container image](/docs/user-guide/images/) on any registry, or a private image (commonly hosted on the Google Container Registry or Docker Hub). The container image specification must end with a colon. From 4bbd9ba6ce31884d692abd54316b178f205f1abe Mon Sep 17 00:00:00 2001 From: scjane Date: Fri, 20 Jan 2017 16:22:22 +0800 Subject: [PATCH 018/113] Update index.md --- docs/user-guide/update-demo/index.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/user-guide/update-demo/index.md b/docs/user-guide/update-demo/index.md index 7f0952348c..f2e3f8a0f2 100644 --- a/docs/user-guide/update-demo/index.md +++ b/docs/user-guide/update-demo/index.md @@ -1,9 +1,9 @@ ---- -assignees: -- mikedanese -title: Rolling Update Demo ---- - +--- +assignees: +- mikedanese +title: Rolling Update Demo +--- + This example demonstrates the usage of Kubernetes to perform a [rolling update](/docs/user-guide/kubectl/kubectl_rolling-update/) on a running group of [pods](/docs/user-guide/pods/). See [here](/docs/user-guide/managing-deployments/#updating-your-application-without-a-service-outage) to understand why you need a rolling update. Also check [rolling update design document](https://github.com/kubernetes/kubernetes/blob/{{page.githubbranch}}/docs/design/simple-rolling-update.md) for more information. The files for this example are viewable in [our docs repo @@ -67,7 +67,7 @@ The rolling-update command in kubectl will do 2 things: Watch the [demo website](http://localhost:8001/static/index.html), it will update one pod every 10 seconds until all of the pods have the new image. Note that the new replication controller definition does not include the replica count, so the current replica count of the old replication controller is preserved. -But if the replica count had been specified, the final replica count of the new replication controller will be equal this number. +But if the replica count had been specified, the final replica count of the new replication controller will be equal to this number. ### Step Five: Bring down the pods From 0fd32489a85bcfd77639c54bddf18609dbbafe39 Mon Sep 17 00:00:00 2001 From: scjane Date: Tue, 24 Jan 2017 16:24:57 +0800 Subject: [PATCH 019/113] Update ha-master-gce.md --- docs/admin/ha-master-gce.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/admin/ha-master-gce.md b/docs/admin/ha-master-gce.md index 91e0019272..3eb2918655 100644 --- a/docs/admin/ha-master-gce.md +++ b/docs/admin/ha-master-gce.md @@ -84,7 +84,7 @@ The following sample commands demonstrate this process: $ KUBE_DELETE_NODES=false KUBE_GCE_ZONE=replica_zone KUBE_REPLICA_NAME=replica_name ./cluster/kube-down.sh ``` -2. Add a new replica in place of the old one: +
  1. Add a new replica in place of the old one:
```shell $ KUBE_GCE_ZONE=replica-zone KUBE_REPLICATE_EXISTING_MASTER=true ./cluster/kube-up.sh @@ -102,7 +102,7 @@ A two-replica cluster is thus inferior, in terms of HA, to a single replica clus * When you add a master replica, cluster state (etcd) is copied to a new instance. If the cluster is large, it may take a long time to duplicate its state. -This operation may be speed up by migrating etcd data directory, as described [here](https://coreos.com/etcd/docs/latest/admin_guide.html#member-migration) here +This operation may be speed up by migrating etcd data directory, as described [here](https://coreos.com/etcd/docs/latest/admin_guide.html#member-migration) (we are considering adding support for etcd data dir migration in future). ## Implementation notes From f99d34ff1ab2afb9c6cb1f129ce07c7d7d11c329 Mon Sep 17 00:00:00 2001 From: Cemalettin Koc Date: Wed, 18 Jan 2017 19:32:34 +0200 Subject: [PATCH 020/113] Align kubeconfig resolution with the rest of documentation It seems that this part has a missing documentation. Here is the reference of `kubectl` configuration. https://kubernetes.io/docs/user-guide/kubectl/kubectl_config/ --- docs/user-guide/sharing-clusters.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/user-guide/sharing-clusters.md b/docs/user-guide/sharing-clusters.md index c21acca84a..4faf7d9826 100644 --- a/docs/user-guide/sharing-clusters.md +++ b/docs/user-guide/sharing-clusters.md @@ -105,8 +105,7 @@ and/or run `kubectl config -h`. 1. `--kubeconfig=/path/to/.kube/config` command line flag 2. `KUBECONFIG=/path/to/.kube/config` env variable -3. `$PWD/.kube/config` -4. `$HOME/.kube/config` +3. `$HOME/.kube/config` If you create clusters A, B on host1, and clusters C, D on host2, you can make all four clusters available on both hosts by running From d890d8f97a653562ea0094e9c4a4da3085d36668 Mon Sep 17 00:00:00 2001 From: Andrew Chen Date: Tue, 24 Jan 2017 15:40:00 -0800 Subject: [PATCH 021/113] Fixed typo changed "speed" to "sped" for proper tense --- docs/admin/ha-master-gce.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/ha-master-gce.md b/docs/admin/ha-master-gce.md index 3eb2918655..025035cca7 100644 --- a/docs/admin/ha-master-gce.md +++ b/docs/admin/ha-master-gce.md @@ -102,7 +102,7 @@ A two-replica cluster is thus inferior, in terms of HA, to a single replica clus * When you add a master replica, cluster state (etcd) is copied to a new instance. If the cluster is large, it may take a long time to duplicate its state. -This operation may be speed up by migrating etcd data directory, as described [here](https://coreos.com/etcd/docs/latest/admin_guide.html#member-migration) +This operation may be sped up by migrating etcd data directory, as described [here](https://coreos.com/etcd/docs/latest/admin_guide.html#member-migration) (we are considering adding support for etcd data dir migration in future). ## Implementation notes From 7abcc6c8540a7b0a4f6712e77e0f5cb134271bed Mon Sep 17 00:00:00 2001 From: Michael Fraenkel Date: Tue, 24 Jan 2017 06:31:10 -0700 Subject: [PATCH 022/113] Document new optional support for ConfigMap and Secret Corresponds to proposal https://github.com/kubernetes/community/pull/175 --- docs/user-guide/configmap/index.md | 70 ++++++++++++++++++++++++++-- docs/user-guide/secrets/index.md | 74 +++++++++++++++++++++++++++--- 2 files changed, 134 insertions(+), 10 deletions(-) diff --git a/docs/user-guide/configmap/index.md b/docs/user-guide/configmap/index.md index d630ed2aa8..2e80ec8d9b 100644 --- a/docs/user-guide/configmap/index.md +++ b/docs/user-guide/configmap/index.md @@ -291,6 +291,37 @@ SPECIAL_LEVEL_KEY=very SPECIAL_TYPE_KEY=charm ``` +#### Optional ConfigMap in environment variables + +There might be situations where environment variables are not +always required. These environment variables can be marked as optional in a +pod like so: + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: dapi-test-pod +spec: + containers: + - name: test-container + image: gcr.io/google_containers/busybox + command: [ "/bin/sh", "-c", "env" ] + env: + - name: SPECIAL_LEVEL_KEY + valueFrom: + configMapKeyRef: + name: a-config + key: akey + optional: true + restartPolicy: Never +``` + +When this pod is run, its output will include the lines: + +```shell +``` + ### Use-Case: Set command-line arguments with ConfigMap ConfigMaps can also be used to set the value of the command or arguments in a container. This is @@ -422,6 +453,38 @@ very You can project keys to specific paths and specific permissions on a per-file basis. The [Secrets](/docs/user-guide/secrets/) user guide explains the syntax. +#### Optional ConfigMap via volume plugin + +Volumes and files provided by a ConfigMap can be also be marked as optional. +The ConfigMap or the key specified does not have to exist. The mount path for +such items will always be created. + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: dapi-test-pod +spec: + containers: + - name: test-container + image: gcr.io/google_containers/busybox + command: [ "/bin/sh", "-c", "ls /etc/config" ] + volumeMounts: + - name: config-volume + mountPath: /etc/config + volumes: + - name: config-volume + configMap: + name: no-config + optional: true + restartPolicy: Never +``` + +When this pod is run, the output will be: + +```shell +``` + ## Real World Example: Configuring Redis Let's take a look at a real-world example: configuring redis using ConfigMap. Say we want to inject @@ -517,9 +580,10 @@ $ kubectl exec -it redis redis-cli ## Restrictions -ConfigMaps must be created before they are consumed in pods. Controllers may be written to tolerate -missing configuration data; consult individual components configured via ConfigMap on a case-by-case -basis. +ConfigMaps must be created before they are consumed in pods unless they are +marked as optional. Controllers may be written to tolerate missing +configuration data; consult individual components configured via ConfigMap on +a case-by-case basis. ConfigMaps reside in a namespace. They can only be referenced by pods in the same namespace. diff --git a/docs/user-guide/secrets/index.md b/docs/user-guide/secrets/index.md index 6942b52ff3..7da0f446fd 100644 --- a/docs/user-guide/secrets/index.md +++ b/docs/user-guide/secrets/index.md @@ -372,6 +372,41 @@ files. When a secret being already consumed in a volume is updated, projected keys are eventually updated as well. The update time depends on the kubelet syncing period. +#### Optional Secrets as Files from a Pod + +Volumes and files provided by a Secret can be also be marked as optional. +The Secret or the key within a Secret does not have to exist. The mount path for +such items will always be created. + +```json +{ + "apiVersion": "v1", + "kind": "Pod", + "metadata": { + "name": "mypod", + "namespace": "myns" + }, + "spec": { + "containers": [{ + "name": "mypod", + "image": "redis", + "volumeMounts": [{ + "name": "foo", + "mountPath": "/etc/foo" + }] + }], + "volumes": [{ + "name": "foo", + "secret": { + "secretName": "mysecret", + "defaultMode": 256, + "optional": true + } + }] + } +} +``` + #### Using Secrets as Environment Variables To use a secret in an environment variable in a pod: @@ -418,6 +453,30 @@ $ echo $SECRET_PASSWORD 1f2d1e2e67df ``` +#### Optional Secrets from Environment Variables + +You may not want to require all your secrets to exist. They can be marked as +optional as shown in the pod: + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: optional-secret-env-pod +spec: + containers: + - name: mycontainer + image: redis + env: + - name: OPTIONAL_SECRET + valueFrom: + secretKeyRef: + name: mysecret + key: username + optional: true + restartPolicy: Never +``` + #### Using imagePullSecrets An imagePullSecret is a way to pass a secret that contains a Docker (or other) image registry @@ -449,7 +508,8 @@ can be automatically attached to pods based on their service account. Secret volume sources are validated to ensure that the specified object reference actually points to an object of type `Secret`. Therefore, a secret -needs to be created before any pods that depend on it. +needs to be created before any pods that depend on it, unless it is marked as +optional. Secret API objects reside in a namespace. They can only be referenced by pods in that same namespace. @@ -469,12 +529,12 @@ not common ways to create pods.) When a pod is created via the API, there is no check whether a referenced secret exists. Once a pod is scheduled, the kubelet will try to fetch the -secret value. If the secret cannot be fetched because it does not exist or -because of a temporary lack of connection to the API server, kubelet will -periodically retry. It will report an event about the pod explaining the -reason it is not started yet. Once the secret is fetched, the kubelet will -create and mount a volume containing it. None of the pod's containers will -start until all the pod's volumes are mounted. +secret value. If a required secret cannot be fetched because it does not +exist or because of a temporary lack of connection to the API server, the +kubelet will periodically retry. It will report an event about the pod +explaining the reason it is not started yet. Once the secret is fetched, the +kubelet will create and mount a volume containing it. None of the pod's +containers will start until all the pod's volumes are mounted. ## Use cases From 324451c3378b4ba01d27e3db6117f86d0517a598 Mon Sep 17 00:00:00 2001 From: Michael Fraenkel Date: Tue, 24 Jan 2017 16:54:22 -0700 Subject: [PATCH 023/113] mend --- docs/user-guide/configmap/index.md | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/docs/user-guide/configmap/index.md b/docs/user-guide/configmap/index.md index 2e80ec8d9b..3227e416c0 100644 --- a/docs/user-guide/configmap/index.md +++ b/docs/user-guide/configmap/index.md @@ -317,10 +317,7 @@ spec: restartPolicy: Never ``` -When this pod is run, its output will include the lines: - -```shell -``` +When this pod is run, the output will be empty. ### Use-Case: Set command-line arguments with ConfigMap From 220352d117c4bf774d7e2f2d766979fd077ba361 Mon Sep 17 00:00:00 2001 From: Scott Collier Date: Thu, 12 Jan 2017 17:11:24 -0600 Subject: [PATCH 024/113] removing word that doesn't flow correctly --- docs/admin/federation/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/federation/index.md b/docs/admin/federation/index.md index 59a0199d7b..b9cd397514 100644 --- a/docs/admin/federation/index.md +++ b/docs/admin/federation/index.md @@ -249,7 +249,7 @@ http://kubernetes.io/docs/user-guide/configmap/. ### Kubernetes 1.4 and earlier: Setting federations flag on kube-dns-rc -If your cluster is running Kubernetes version 1.4 or earlier, you must to restart +If your cluster is running Kubernetes version 1.4 or earlier, you must restart KubeDNS and pass it a `--federations` flag, which tells it about valid federation DNS hostnames. The flag uses the following format: From f331ebe332f0be66dd6d3f63ab78c504c6e15b44 Mon Sep 17 00:00:00 2001 From: divyenpatel Date: Mon, 16 Jan 2017 12:14:57 -0800 Subject: [PATCH 025/113] Updated known issues in docs/getting-started-guides/vsphere.md --- docs/getting-started-guides/vsphere.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started-guides/vsphere.md b/docs/getting-started-guides/vsphere.md index 36372144c6..ba07d14890 100644 --- a/docs/getting-started-guides/vsphere.md +++ b/docs/getting-started-guides/vsphere.md @@ -79,7 +79,7 @@ Sample Config: #### Known issues * [Volumes are not removed from a VM configuration if the VM is down](https://github.com/kubernetes/kubernetes/issues/33061). The workaround is to manually remove the disk from VM settings before powering it up. -* [FS groups are not supported in 1.4.7](https://github.com/kubernetes/kubernetes/issues/34039) +* [FS groups are not supported in 1.4.7](https://github.com/kubernetes/kubernetes/issues/34039) - This issue is fixed in 1.4.8 ### Kube-up (Deprecated) From 6afde69458e2c6878250fdcb9d564dfb053188df Mon Sep 17 00:00:00 2001 From: Andrew Chen Date: Wed, 11 Jan 2017 16:35:00 -0800 Subject: [PATCH 026/113] fixed broken link re: issue #1687 Updated link to go to https://github.com/kubernetes/kubernetes/tree/master/examples/guestbook which is a redis example mentioned in https://kubernetes.io/docs/samples/ --- docs/user-guide/jobs/work-queue-2/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/jobs/work-queue-2/index.md b/docs/user-guide/jobs/work-queue-2/index.md index 98d327d9a9..621be7f795 100644 --- a/docs/user-guide/jobs/work-queue-2/index.md +++ b/docs/user-guide/jobs/work-queue-2/index.md @@ -31,7 +31,7 @@ Here is an overview of the steps in this example: ## Starting Redis For this example, for simplicitly, we will start a single instance of Redis. -See the [Redis Example](https://github.com/kubernetes/kubernetes/tree/{{page.githubbranch}}/examples/redis/README.md) for an example +See the [Redis Example](https://github.com/kubernetes/kubernetes/tree/master/examples/guestbook) for an example of deploying Redis scalably and redundantly. Start a temporary Pod running Redis and a service so we can find it. From e93bb9dc275120dfbe0b565f742ca55eec020a7f Mon Sep 17 00:00:00 2001 From: Hugues Malphettes Date: Wed, 25 Jan 2017 07:05:09 +0800 Subject: [PATCH 027/113] Format JSON: missing comma --- docs/user-guide/pods/pod-spec-common.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/pods/pod-spec-common.json b/docs/user-guide/pods/pod-spec-common.json index c449c34de5..8621593d07 100644 --- a/docs/user-guide/pods/pod-spec-common.json +++ b/docs/user-guide/pods/pod-spec-common.json @@ -24,7 +24,7 @@ } ], "resources": { - "cpu": "" + "cpu": "", "memory": "" } } From 0e1670ccb827891e451c224a1f670fa0adb0cb8a Mon Sep 17 00:00:00 2001 From: Scott Collier Date: Thu, 12 Jan 2017 17:04:08 -0600 Subject: [PATCH 028/113] looks like a couple of words got swapped when describing the ConfigMap for kube-dns, just fixing that up --- docs/admin/federation/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/federation/index.md b/docs/admin/federation/index.md index b9cd397514..bb15fe09ff 100644 --- a/docs/admin/federation/index.md +++ b/docs/admin/federation/index.md @@ -236,7 +236,7 @@ metadata: name: kube-dns namespace: kube-system data: - federations: = + federations: = ``` where `` should be replaced by the name you want to give to your From 27d0048498cbef12631e35d2608b0a25349a54e6 Mon Sep 17 00:00:00 2001 From: scjane Date: Wed, 25 Jan 2017 17:25:31 +0800 Subject: [PATCH 029/113] Update master-node-communication.md --- docs/admin/master-node-communication.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/master-node-communication.md b/docs/admin/master-node-communication.md index 91ecff7ef9..d654fd5173 100644 --- a/docs/admin/master-node-communication.md +++ b/docs/admin/master-node-communication.md @@ -91,7 +91,7 @@ HTTP connections and are therefore neither authenticated nor encrypted. They can be run over a secure HTTPS connection by prefixing `https:` to the node, pod, or service name in the API URL, but they will not validate the certificate provided by the HTTPS endpoint nor provide client credentials so while the -connection will by encrypted, it will not provide any guarantees of integrity. +connection will be encrypted, it will not provide any guarantees of integrity. These connections **are not currently safe** to run over untrusted and/or public networks. From b10426383e8ed88ce8173980fd2c011faf6f5de9 Mon Sep 17 00:00:00 2001 From: Bogdan Dobrelya Date: Wed, 25 Jan 2017 10:24:59 +0100 Subject: [PATCH 030/113] Fix the tool link for Kargo docs Signed-off-by: Bogdan Dobrelya --- docs/getting-started-guides/kargo.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started-guides/kargo.md b/docs/getting-started-guides/kargo.md index 93f1373c75..0a2e1d1c44 100644 --- a/docs/getting-started-guides/kargo.md +++ b/docs/getting-started-guides/kargo.md @@ -38,7 +38,7 @@ to [kubeadm](../kubeadm) and [kops](../kops). A way to achieve that is to use the [kargo-cli tool](https://github.com/kubernetes-incubator/kargo/blob/master/docs/getting-started.md). * Or provision baremetal hosts with a tool-of-your-choice or launch cloud instances, - then create an inventory file for Ansible with this [tool](https://github.com/kubernetes-incubator/kargo/blob/master/contrib/inventory_generator/inventory_generator.py). + then create an inventory file for Ansible with this [tool](https://github.com/kubernetes-incubator/kargo/blob/master/contrib/inventory_builder/inventory.py). ### (2/4) Compose the deployment From 94e3c350f538224229c7b573426332415a42ad72 Mon Sep 17 00:00:00 2001 From: Bilgin Ibryam Date: Wed, 25 Jan 2017 09:42:02 +0100 Subject: [PATCH 031/113] Typo fixed --- docs/user-guide/node-selection/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/node-selection/index.md b/docs/user-guide/node-selection/index.md index b2f13bd5ae..0f45c1f809 100644 --- a/docs/user-guide/node-selection/index.md +++ b/docs/user-guide/node-selection/index.md @@ -91,7 +91,7 @@ rather than against labels on the node itself, which allows rules about which po The affinity feature consists of two types of affinity, "node affinity" and "inter-pod affinity/anti-affinity." Node affinity is like the existing `nodeSelector` (but with the first two benefits listed above), while inter-pod affinity/anti-affinity constrains against pod labels rather than node labels, as -described in the three item listed above, in addition to having the first and second properties listed above. +described in the third item listed above, in addition to having the first and second properties listed above. `nodeSelector` continues to work as usual, but will eventually be deprecated, as node affinity can express everything that `nodeSelector` can express. From 8521bdc2b831c00b2c97a65cc0b537f75a150f80 Mon Sep 17 00:00:00 2001 From: scjane Date: Wed, 25 Jan 2017 16:00:22 +0800 Subject: [PATCH 032/113] Update dns.md --- docs/admin/dns.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/admin/dns.md b/docs/admin/dns.md index 4ac5bf0ddb..7f1c3c4641 100644 --- a/docs/admin/dns.md +++ b/docs/admin/dns.md @@ -69,7 +69,7 @@ is no longer supported. When enabled, pods are assigned a DNS A record in the form of `pod-ip-address.my-namespace.pod.cluster.local`. -For example, a pod with ip `1.2.3.4` in the namespace `default` with a DNS name of `cluster.local` would have an entry: `1-2-3-4.default.pod.cluster.local`. +For example, a pod with IP `1.2.3.4` in the namespace `default` with a DNS name of `cluster.local` would have an entry: `1-2-3-4.default.pod.cluster.local`. #### A Records and hostname based on Pod's hostname and subdomain fields @@ -308,7 +308,7 @@ If you have created the service or in the case it should be created by default b #### Are DNS endpoints exposed? -You can verify that dns endpoints are exposed by using the `kubectl get endpoints` command. +You can verify that DNS endpoints are exposed by using the `kubectl get endpoints` command. ``` kubectl get ep kube-dns --namespace=kube-system From 246a87b77cf472b7add6f4428d75f7cdb683b21d Mon Sep 17 00:00:00 2001 From: scjane Date: Wed, 25 Jan 2017 14:45:42 +0800 Subject: [PATCH 033/113] Update multiple-schedulers.md --- docs/admin/multiple-schedulers.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/admin/multiple-schedulers.md b/docs/admin/multiple-schedulers.md index 5548f32904..bf7386e492 100644 --- a/docs/admin/multiple-schedulers.md +++ b/docs/admin/multiple-schedulers.md @@ -107,6 +107,7 @@ scheduler as an annotation in that pod spec. Let's look at three examples. ```shell kubectl create -f pod1.yaml ``` + 2. Pod spec with `default-scheduler` annotation {% include code.html language="yaml" file="multiple-schedulers/pod2.yaml" ghlink="/docs/admin/multiple-schedulers/pod2.yaml" %} @@ -120,6 +121,7 @@ scheduler as an annotation in that pod spec. Let's look at three examples. ```shell kubectl create -f pod2.yaml ``` + 3. Pod spec with `my-scheduler` annotation {% include code.html language="yaml" file="multiple-schedulers/pod3.yaml" ghlink="/docs/admin/multiple-schedulers/pod3.yaml" %} From b556ee60d635725c7889f23205552d3a8af68e15 Mon Sep 17 00:00:00 2001 From: scjane Date: Wed, 25 Jan 2017 14:03:15 +0800 Subject: [PATCH 034/113] Update multi-cluster.md --- docs/admin/multi-cluster.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/admin/multi-cluster.md b/docs/admin/multi-cluster.md index 67a2589d40..085a9afa9f 100644 --- a/docs/admin/multi-cluster.md +++ b/docs/admin/multi-cluster.md @@ -8,7 +8,7 @@ You may want to set up multiple Kubernetes clusters, both to have clusters in different regions to be nearer to your users, and to tolerate failures and/or invasive maintenance. This document describes some of the issues to consider when making a decision about doing so. -If you decide to have multiple clusters, Kubernetes provides a way to [federate them](/docs/admin/federation/) +If you decide to have multiple clusters, Kubernetes provides a way to [federate them](/docs/admin/federation/). ## Scope of a single cluster @@ -40,7 +40,7 @@ Reasons to have multiple clusters include: ## Selecting the right number of clusters The selection of the number of Kubernetes clusters may be a relatively static choice, only revisited occasionally. -By contrast, the number of nodes in a cluster and the number of pods in a service may be change frequently according to +By contrast, the number of nodes in a cluster and the number of pods in a service may change frequently according to load and growth. To pick the number of clusters, first, decide which regions you need to be in to have adequate latency to all your end users, for services that will run From f5206300102ad248b954e1f02ab29ea47e88f759 Mon Sep 17 00:00:00 2001 From: scjane Date: Wed, 25 Jan 2017 11:56:55 +0800 Subject: [PATCH 035/113] Update cluster-components.md --- docs/admin/cluster-components.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/cluster-components.md b/docs/admin/cluster-components.md index 8519a199f4..a3d4f37779 100644 --- a/docs/admin/cluster-components.md +++ b/docs/admin/cluster-components.md @@ -107,7 +107,7 @@ the Kubernetes runtime environment. or via local configuration file) and: * Mounts the pod's required volumes * Downloads the pod's secrets -* Run the pod's containers via docker (or, experimentally, rkt). +* Runs the pod's containers via docker (or, experimentally, rkt). * Periodically executes any requested container liveness probes. * Reports the status of the pod back to the rest of the system, by creating a "mirror pod" if necessary. From 9ba738b6ca59f490d662c00c303cc94bc548ee44 Mon Sep 17 00:00:00 2001 From: scjane Date: Wed, 25 Jan 2017 11:24:25 +0800 Subject: [PATCH 036/113] Update rescheduler.md --- docs/admin/rescheduler.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/admin/rescheduler.md b/docs/admin/rescheduler.md index 1d81ac63f2..9e3fc61c39 100644 --- a/docs/admin/rescheduler.md +++ b/docs/admin/rescheduler.md @@ -31,10 +31,10 @@ To avoid situation when another pod is scheduled into the space prepared for the the chosen node gets a temporary taint "CriticalAddonsOnly" before the eviction(s) (see [more details](https://github.com/kubernetes/kubernetes/blob/master/docs/design/taint-toleration-dedicated.md)). Each critical add-on has to tolerate it, -the other pods shouldn't tolerate the taint. The tain is removed once the add-on is successfully scheduled. +while the other pods shouldn't tolerate the taint. The taint is removed once the add-on is successfully scheduled. *Warning:* currently there is no guarantee which node is chosen and which pods are being killed -in order to schedule critical pods, so if rescheduler is enabled you pods might be occasionally +in order to schedule critical pods, so if rescheduler is enabled your pods might be occasionally killed for this purpose. ## Config From 9ec7921a3e2cf5d1a10bb8b93d8de886fe563935 Mon Sep 17 00:00:00 2001 From: Viet Hung Nguyen Date: Tue, 17 Jan 2017 12:12:48 +0700 Subject: [PATCH 037/113] Update dead link --- docs/tutorials/stateful-application/basic-stateful-set.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/tutorials/stateful-application/basic-stateful-set.md b/docs/tutorials/stateful-application/basic-stateful-set.md index 25621354af..ef15bf3607 100644 --- a/docs/tutorials/stateful-application/basic-stateful-set.md +++ b/docs/tutorials/stateful-application/basic-stateful-set.md @@ -25,6 +25,7 @@ following Kubernetes concepts. * [Cluster DNS](/docs/admin/dns/) * [Headless Services](/docs/user-guide/services/#headless-services) * [PersistentVolumes](/docs/user-guide/volumes/) +* [PersistentVolume Provisioning](http://releases.k8s.io/{{page.githubbranch}}/examples/persistent-volume-provisioning/) * [StatefulSets](/docs/concepts/abstractions/controllers/statefulsets/) * [kubectl CLI](/docs/user-guide/kubectl) From e7e7515d7388f047254796d9e85438154e1f7e0d Mon Sep 17 00:00:00 2001 From: Maciej Szulik Date: Thu, 12 Jan 2017 13:08:41 +0100 Subject: [PATCH 038/113] Update API groups description --- docs/api.md | 42 ++++++++++++++++++++++++++---------------- 1 file changed, 26 insertions(+), 16 deletions(-) diff --git a/docs/api.md b/docs/api.md index 7c6ae95e73..b52e55a298 100644 --- a/docs/api.md +++ b/docs/api.md @@ -72,28 +72,38 @@ in more detail in the [API Changes documentation](https://github.com/kubernetes/ ## API groups -To make it easier to extend the Kubernetes API, we are in the process of implementing [*API -groups*](https://github.com/kubernetes/kubernetes/blob/{{page.githubbranch}}/docs/proposals/api-group.md). These are simply different interfaces to read and/or modify the -same underlying resources. The API group is specified in a REST path and in the `apiVersion` field -of a serialized object. +To make it easier to extend the Kubernetes API, we implemented [*API groups*](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-group.md). +The API group is specified in a REST path and in the `apiVersion` field of a serialized object. Currently there are several API groups in use: -1. the "core" group, which is at REST path `/api/v1` and is not specified as part of the `apiVersion` field, e.g. - `apiVersion: v1`. -1. the "extensions" group, which is at REST path `/apis/extensions/$VERSION`, and which uses - `apiVersion: extensions/$VERSION` (e.g. currently `apiVersion: extensions/v1beta1`). - This holds types which will probably move to another API group eventually. -1. the "componentconfig" and "metrics" API groups. +1. the "core" (oftentimes called "legacy", due to not having explicit group name) group, which is at + REST path `/api/v1` and is not specified as part of the `apiVersion` field, e.g. `apiVersion: v1`. +1. the named groups are at REST path `/apis/$GROUP_NAME/$VERSION`, and use `apiVersion: $GROUP_NAME/$VERSION` + (e.g. `apiVersion: batch/v1`). Full list of supported API groups can be seen in [Kubernetes API reference](/docs/reference/). -In the future we expect that there will be more API groups, all at REST path `/apis/$API_GROUP` and -using `apiVersion: $API_GROUP/$VERSION`. We expect that there will be a way for [third parties to -create their own API groups](https://github.com/kubernetes/kubernetes/blob/{{page.githubbranch}}/docs/design/extending-api.md), and to avoid naming collisions. +There are two supported paths to extending the API. +1. [Third Party Resources](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/extending-api.md) + are for users with very basic CRUD needs. +1. Coming soon: users needing the full set of Kubernetes API semantics can implement their own apiserver + and use the [aggregator](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/aggregated-api-servers.md) + to make it seamless for clients. -## Enabling resources in the extensions group + +## Enabling API groups + +Certain resources and API groups are enabled by default. They can be enabled or disabled by setting `--runtime-config` +on apiserver. `--runtime-config` accepts comma separated values. For ex: to disable batch/v1, set +`--runtime-config=batch/v1=false`, to enable batch/v2alpha1, set `--runtime-config=batch/v2alpha1`. +The flag accepts comma separated set of key=value pairs describing runtime configuration of the apiserver. + +IMPORTANT: Enabling or disabling groups or resources requires restarting apiserver and controller-manager +to pick up the `--runtime-config` changes. + +## Enabling resources in the groups DaemonSets, Deployments, HorizontalPodAutoscalers, Ingress, Jobs and ReplicaSets are enabled by default. -Other extensions resources can be enabled by setting runtime-config on -apiserver. runtime-config accepts comma separated values. For ex: to disable deployments and jobs, set +Other extensions resources can be enabled by setting `--runtime-config` on +apiserver. `--runtime-config` accepts comma separated values. For ex: to disable deployments and jobs, set `--runtime-config=extensions/v1beta1/deployments=false,extensions/v1beta1/jobs=false` From b26190b58b148f75e9f7db91680c60ac1a8747cf Mon Sep 17 00:00:00 2001 From: Michael Nelson Date: Tue, 17 Jan 2017 18:05:32 +1100 Subject: [PATCH 039/113] Note about the need to fix permissions for a hostPath volume mount #2260 This is a work-around for #2260 until the underlying problem is addressed (https://github.com/kubernetes/kubernetes/issues/2630). --- .../stateful-application/basic-stateful-set.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/tutorials/stateful-application/basic-stateful-set.md b/docs/tutorials/stateful-application/basic-stateful-set.md index ef15bf3607..2a72070ac8 100644 --- a/docs/tutorials/stateful-application/basic-stateful-set.md +++ b/docs/tutorials/stateful-application/basic-stateful-set.md @@ -285,6 +285,16 @@ web-0 web-1 ``` +Note, if you instead see 403 Forbidden responses for the above curl command, +you will need to fix the permissions of the directory mounted by the `volumeMounts` +(due to a [bug when using hostPath volumes](https://github.com/kubernetes/kubernetes/issues/2630)) with: + +```shell +for i in 0 1; do kubectl exec web-$i -- chmod 755 /usr/share/nginx/html; done +``` + +before retrying the curl command above. + In one terminal, watch the StatefulSet's Pods. ```shell From d166363fe34bd72c2ebb6f16da353f277e4a244e Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Mon, 19 Dec 2016 10:02:32 -0500 Subject: [PATCH 040/113] Update ABAC examples to use authenticated/unauthenticated groups --- docs/admin/authorization.md | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/docs/admin/authorization.md b/docs/admin/authorization.md index 8f2b60472c..11b7cabeb2 100644 --- a/docs/admin/authorization.md +++ b/docs/admin/authorization.md @@ -85,8 +85,8 @@ properties: - `kind`, type string: valid values are "Policy". Allows versioning and conversion of the policy format. - `spec` property set to a map with the following properties: - Subject-matching properties: - - `user`, type string; the user-string from `--token-auth-file`. If you specify `user`, it must match the username of the authenticated user. `*` matches all requests. - - `group`, type string; if you specify `group`, it must match one of the groups of the authenticated user. `*` matches all requests. + - `user`, type string; the user-string from `--token-auth-file`. If you specify `user`, it must match the username of the authenticated user. + - `group`, type string; if you specify `group`, it must match one of the groups of the authenticated user. `system:authenticated` matches all authenticated requests. `system:unauthenticated` matches all unauthenticated requests. - `readonly`, type boolean, when true, means that the policy only applies to get, list, and watch operations. - Resource-matching properties: - `apiGroup`, type string; an API group, such as `extensions`. `*` matches all API groups. @@ -115,8 +115,11 @@ The tuple of attributes is checked for a match against every policy in the policy file. If at least one line matches the request attributes, then the request is authorized (but may fail later validation). -To permit any user to do something, write a policy with the user property set to -`"*"`. +To permit any authenticated user to do something, write a policy with the +group property set to `"system:authenticated"`. + +To permit any unauthenticated user to do something, write a policy with the +group property set to `"system:unauthenticated"`. To permit a user to do anything, write a policy with the apiGroup, namespace, resource, and nonResourcePath properties set to `"*"`. @@ -165,7 +168,8 @@ up the verbosity: 5. Anyone can make read-only requests to all non-resource paths: ```json - {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "*", "readonly": true, "nonResourcePath": "*"}} + {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group": "system:authenticated", "readonly": true, "nonResourcePath": "*"}} + {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group": "system:unauthenticated", "readonly": true, "nonResourcePath": "*"}} ``` [Complete file example](http://releases.k8s.io/{{page.githubbranch}}/pkg/auth/authorizer/abac/example_policy_file.jsonl) @@ -504,7 +508,7 @@ An example request body: "resourceAttributes": { "namespace": "kittensandponies", "verb": "GET", - "group": "*", + "group": "unicorn.example.org", "resource": "pods" }, "user": "jane", @@ -627,7 +631,7 @@ __EOF__ --- snip lots of output --- -I0913 08:12:31.362873 27425 request.go:908] Response Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"resourceAttributes":{"namespace":"kittensandponies","verb":"GET","group":"*","resource":"pods"},"user":"jane","group":["group1","group2"]},"status":{"allowed":true}} +I0913 08:12:31.362873 27425 request.go:908] Response Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"resourceAttributes":{"namespace":"kittensandponies","verb":"GET","group":"unicorn.example.org","resource":"pods"},"user":"jane","group":["group1","group2"]},"status":{"allowed":true}} subjectaccessreview "" created ``` From e1a55e327e7b198e7937599ddbb6330b51096acb Mon Sep 17 00:00:00 2001 From: s0rc3r3r01 Date: Thu, 5 Jan 2017 15:29:13 +0000 Subject: [PATCH 041/113] corrected container name the container name is "kubedns" and not "kube-dns" --- docs/admin/dns.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/dns.md b/docs/admin/dns.md index 7f1c3c4641..7a845c9f3f 100644 --- a/docs/admin/dns.md +++ b/docs/admin/dns.md @@ -280,7 +280,7 @@ If you see that no pod is running or that the pod has failed/completed, the DNS Use `kubectl logs` command to see logs for the DNS daemons. ``` -kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name) -c kube-dns +kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name) -c kubedns kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name) -c dnsmasq kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name) -c healthz ``` From bb802690a5e23689ae7ceba17b6e48fc81c3e7cc Mon Sep 17 00:00:00 2001 From: Drinky Pool Date: Fri, 6 Jan 2017 10:00:48 +0800 Subject: [PATCH 042/113] modify get pods to be more accurate modify the "kubectl get pods" to "kubectl get pods -l purpose=demonstrate-envars" --- .../define-environment-variable-container.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/tasks/configure-pod-container/define-environment-variable-container.md b/docs/tasks/configure-pod-container/define-environment-variable-container.md index 7faba40522..214142fa80 100644 --- a/docs/tasks/configure-pod-container/define-environment-variable-container.md +++ b/docs/tasks/configure-pod-container/define-environment-variable-container.md @@ -38,7 +38,7 @@ Pod: 1. List the running Pods: - kubectl get pods + kubectl get pods -l purpose=demonstrate-envars The output is similar to this: From 018f51074edbb5fc91cc24ca087017735efd1779 Mon Sep 17 00:00:00 2001 From: sandeepveldi Date: Wed, 21 Dec 2016 00:35:46 -0500 Subject: [PATCH 043/113] Add Windows version details Adding windows version related download path. --- docs/user-guide/prereqs.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/user-guide/prereqs.md b/docs/user-guide/prereqs.md index 19e6d8612b..6e630ec0ea 100644 --- a/docs/user-guide/prereqs.md +++ b/docs/user-guide/prereqs.md @@ -17,6 +17,9 @@ curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s htt # Linux curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl + +# Windows +curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/windows/amd64/kubectl.exe ``` If you want to download a specific version of kubectl you can replace the nested curl command from above with the version you want. (e.g. v1.4.6, v1.5.0-beta.2) From 2f814b83adb05b4d2a2094e5f1500b654389e6dd Mon Sep 17 00:00:00 2001 From: Michal Gebauer Date: Thu, 26 Jan 2017 10:51:23 +0100 Subject: [PATCH 044/113] Typo in pod.md --- docs/concepts/abstractions/pod.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/concepts/abstractions/pod.md b/docs/concepts/abstractions/pod.md index 33637168db..07f0d18934 100644 --- a/docs/concepts/abstractions/pod.md +++ b/docs/concepts/abstractions/pod.md @@ -31,7 +31,7 @@ Each Pod is meant to run a single instance of a given application. If you want t ### How Pods Manage Multiple Containers -Pods are designed to support multiple cooperating processes (as containers) that form a cohesive unit of service. The containers in a Pod are automatically co-located and co-scheduled on the same phyiscal or virtual machine in the cluster. The containers can share resources and dependencies, communicate with one another, and coordinate when and how they are terminated. +Pods are designed to support multiple cooperating processes (as containers) that form a cohesive unit of service. The containers in a Pod are automatically co-located and co-scheduled on the same physical or virtual machine in the cluster. The containers can share resources and dependencies, communicate with one another, and coordinate when and how they are terminated. Note that grouping multiple co-located and co-managed containers in a single Pod is a relatively advanced use case. You should use this pattern only in specific instances in which your containers are tightly coupled. For example, you might have a container that acts as a web server for files in a shared volume, and a separate "sidecar" container that updates those files from a remote source, as in the following diagram: From e1369ecc4ffac45179aee3ce17118e9ef416d7e3 Mon Sep 17 00:00:00 2001 From: scjane Date: Thu, 26 Jan 2017 11:04:36 +0800 Subject: [PATCH 045/113] Update node-problem.md --- docs/admin/node-problem.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/admin/node-problem.md b/docs/admin/node-problem.md index b4f3e6ee31..08ca3208dd 100644 --- a/docs/admin/node-problem.md +++ b/docs/admin/node-problem.md @@ -31,7 +31,7 @@ See more information kernel log now. It doesn't support log tools like journald. * The kernel issue detection of node problem detector has assumption on kernel -log format, now it only works on Ubuntu and Debian. However, it is easy to extend +log format, and now it only works on Ubuntu and Debian. However, it is easy to extend it to [support other log format](/docs/admin/node-problem/#support-other-log-format). ## Enable/Disable in GCE cluster @@ -194,7 +194,7 @@ and detects known kernel issues following predefined rules. The Kernel Monitor matches kernel issues according to a set of predefined rule list in [`config/kernel-monitor.json`](https://github.com/kubernetes/node-problem-detector/blob/v0.1/config/kernel-monitor.json). -The rule list is extensible, you can always extend it by [overwriting the +The rule list is extensible, and you can always extend it by [overwriting the configuration](/docs/admin/node-problem/#overwrite-the-configuration). ### Add New NodeConditions From 9b59945b0ce504e79da9aa63dcf8013907ca009d Mon Sep 17 00:00:00 2001 From: scjane Date: Thu, 26 Jan 2017 10:45:44 +0800 Subject: [PATCH 046/113] Update salt.md It seems that the ordered list in the "Best Practices" section is unnecessary as there is only one item "1". So can we delete the list? --- docs/admin/salt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/salt.md b/docs/admin/salt.md index ab495521bd..05d0ae9250 100644 --- a/docs/admin/salt.md +++ b/docs/admin/salt.md @@ -92,7 +92,7 @@ In addition, a cluster may be running a Debian based operating system or Red Hat ## Best Practices -1. When configuring default arguments for processes, it's best to avoid the use of EnvironmentFiles (Systemd in Red Hat environments) or init.d files (Debian distributions) to hold default values that should be common across operating system environments. This helps keep our Salt template files easy to understand for editors who may not be familiar with the particulars of each distribution. +When configuring default arguments for processes, it's best to avoid the use of EnvironmentFiles (Systemd in Red Hat environments) or init.d files (Debian distributions) to hold default values that should be common across operating system environments. This helps keep our Salt template files easy to understand for editors who may not be familiar with the particulars of each distribution. ## Future enhancements (Networking) From 8a299b94cfb4000d6e5eec30f9a5d973f0728cd9 Mon Sep 17 00:00:00 2001 From: scjane Date: Thu, 26 Jan 2017 10:18:24 +0800 Subject: [PATCH 047/113] Update garbage-collection.md --- docs/admin/garbage-collection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/garbage-collection.md b/docs/admin/garbage-collection.md index 082480ebac..a960172426 100644 --- a/docs/admin/garbage-collection.md +++ b/docs/admin/garbage-collection.md @@ -24,7 +24,7 @@ threshold has been met. ### Container Collection The policy for garbage collecting containers considers three user-defined variables. `MinAge` is the minimum age at which a container can be garbage collected. `MaxPerPodContainer` is the maximum number of dead containers any single -pod (UID, container name) pair is allowed to have. `MaxContainers` is the maximum number of total dead containers. These variables can be individually disabled by setting 'Min Age' to zero and setting 'MaxPerPodContainer' and 'MaxContainers' respectively to less than zero. +pod (UID, container name) pair is allowed to have. `MaxContainers` is the maximum number of total dead containers. These variables can be individually disabled by setting 'MinAge' to zero and setting 'MaxPerPodContainer' and 'MaxContainers' respectively to less than zero. Kubelet will act on containers that are unidentified, deleted, or outside of the boundaries set by the previously mentioned flags. The oldest containers will generally be removed first. 'MaxPerPodContainer' and 'MaxContainer' may potentially conflict with each other in situations where retaining the maximum number of containers per pod ('MaxPerPodContainer') would go outside the allowable range of global dead containers ('MaxContainers'). 'MaxPerPodContainer' would be adjusted in this situation: A worst case scenario would be to downgrade 'MaxPerPodContainer' to 1 and evict the oldest containers. Additionally, containers owned by pods that have been deleted are removed once they are older than `MinAge`. From ae656cc45237eb19c72a1890bf01c6796c12d90c Mon Sep 17 00:00:00 2001 From: leonliao Date: Mon, 16 Jan 2017 18:05:54 +0800 Subject: [PATCH 048/113] Instruct beginners to start minikube cluster with proxy Beginners don't know the details for troubleshooting, better instruction will save time for beginners to trouble shoot logs in minikube complaining gcr.io not reachable and etc. --- .../stateless-application/hello-minikube.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/docs/tutorials/stateless-application/hello-minikube.md b/docs/tutorials/stateless-application/hello-minikube.md index 9e6a93e5c3..772561444a 100644 --- a/docs/tutorials/stateless-application/hello-minikube.md +++ b/docs/tutorials/stateless-application/hello-minikube.md @@ -70,12 +70,23 @@ curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s htt chmod +x ./kubectl sudo mv ./kubectl /usr/local/bin/kubectl ``` +Determine whether you can access sites like https://cloud.google.com/container-registry/ directly without a proxy, by opening a new terminal and using +```shell +export http_proxy="" +export https_proxy="" +curl https://cloud.google.com/container-registry/ +``` -Start the Minikube cluster: +If NO proxy is required, start the Minikube cluster: ```shell minikube start --vm-driver=xhyve ``` +If a proxy server is required, use below way to start Minikube cluster with proxy setting: + +```shell +minikube start --vm-driver=xhyve --docker-env HTTP_PROXY=http://your-http-proxy-host:your-http-proxy-port --docker-env HTTPS_PROXY=http(s)://your-https-proxy-host:your-https-proxy-port +``` The `--vm-driver=xyhve` flag specifies that you are using Docker for Mac. The default VM driver is VirtualBox. From 48af43f282f60318ad6627d24bc7c523cff23a22 Mon Sep 17 00:00:00 2001 From: leonliao Date: Thu, 19 Jan 2017 12:10:17 +0800 Subject: [PATCH 049/113] Rephrase the sentence Rephrase the `use the below way` to use `the following method` --- docs/tutorials/stateless-application/hello-minikube.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/tutorials/stateless-application/hello-minikube.md b/docs/tutorials/stateless-application/hello-minikube.md index 772561444a..31348aa586 100644 --- a/docs/tutorials/stateless-application/hello-minikube.md +++ b/docs/tutorials/stateless-application/hello-minikube.md @@ -82,7 +82,7 @@ If NO proxy is required, start the Minikube cluster: ```shell minikube start --vm-driver=xhyve ``` -If a proxy server is required, use below way to start Minikube cluster with proxy setting: +If a proxy server is required, use the following method to start Minikube cluster with proxy setting: ```shell minikube start --vm-driver=xhyve --docker-env HTTP_PROXY=http://your-http-proxy-host:your-http-proxy-port --docker-env HTTPS_PROXY=http(s)://your-https-proxy-host:your-https-proxy-port From ef79cdc518af9d1f9cfdff02f8dfb520857af214 Mon Sep 17 00:00:00 2001 From: Jared Date: Thu, 26 Jan 2017 10:39:39 -0800 Subject: [PATCH 050/113] Update hello-minikube.md --- docs/tutorials/stateless-application/hello-minikube.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/tutorials/stateless-application/hello-minikube.md b/docs/tutorials/stateless-application/hello-minikube.md index 31348aa586..36b92dd97a 100644 --- a/docs/tutorials/stateless-application/hello-minikube.md +++ b/docs/tutorials/stateless-application/hello-minikube.md @@ -70,7 +70,7 @@ curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s htt chmod +x ./kubectl sudo mv ./kubectl /usr/local/bin/kubectl ``` -Determine whether you can access sites like https://cloud.google.com/container-registry/ directly without a proxy, by opening a new terminal and using +Determine whether you can access sites like [https://cloud.google.com/container-registry/](https://cloud.google.com/container-registry/) directly without a proxy, by opening a new terminal and using ```shell export http_proxy="" export https_proxy="" From f59094324eee014cd548d477e3721df3d71fd5ed Mon Sep 17 00:00:00 2001 From: Jared Date: Thu, 26 Jan 2017 12:08:42 -0800 Subject: [PATCH 051/113] grammar issue Fixed https://github.com/kubernetes/kubernetes.github.io/pull/2348 --- docs/getting-started-guides/centos/centos_manual_config.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started-guides/centos/centos_manual_config.md b/docs/getting-started-guides/centos/centos_manual_config.md index f51aacf477..7f8f5ea7f2 100644 --- a/docs/getting-started-guides/centos/centos_manual_config.md +++ b/docs/getting-started-guides/centos/centos_manual_config.md @@ -17,7 +17,7 @@ This is a getting started guide for CentOS. It is a manual configuration so you The Kubernetes package provides a few services: kube-apiserver, kube-scheduler, kube-controller-manager, kubelet, kube-proxy. These services are managed by systemd and the configuration resides in a central location: /etc/kubernetes. We will break the services up between the hosts. The first host, centos-master, will be the Kubernetes master. This host will run the kube-apiserver, kube-controller-manager and kube-scheduler. In addition, the master will also run _etcd_. The remaining hosts, centos-minion-n will be the nodes and run kubelet, proxy, cadvisor and docker. -All of then run flanneld as networking overlay. +All of them run flanneld as networking overlay. **System Information:** From 2fc014494fd32e91f6879db13a6e80521a48e7d3 Mon Sep 17 00:00:00 2001 From: Steve Lasker Date: Wed, 25 Jan 2017 16:31:23 -0800 Subject: [PATCH 052/113] Update user-guide/quick-start.md to include Azure Added Azure as a target --- docs/user-guide/quick-start.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/quick-start.md b/docs/user-guide/quick-start.md index 6ad7940526..e1b0829843 100644 --- a/docs/user-guide/quick-start.md +++ b/docs/user-guide/quick-start.md @@ -13,7 +13,7 @@ This guide will help you get oriented to Kubernetes and running your first conta ## Launching a simple application, and exposing it to the Internet Once your application is packaged into a container and pushed to an image registry, you're ready to deploy it to Kubernetes. -Through integration with some cloud providers (for example Google Compute Engine and AWS EC2), Kubernetes also enables you to request it to provision a public IP address for your application. +Through integration with some cloud providers (for example Google Compute Engine, AWS EC2, Azure ACS), Kubernetes also enables you to request it to provision a public IP address for your application. For example, [nginx](http://wiki.nginx.org/Main) is a popular HTTP server, with a [pre-built container on Docker hub](https://registry.hub.docker.com/_/nginx/). The [`kubectl run`](/docs/user-guide/kubectl/kubectl_run) commands below will create two nginx replicas, listening on port 80, and a public IP address for your application. From 4fb74447e003debc13e819f89559b28087a563c9 Mon Sep 17 00:00:00 2001 From: Jared Date: Thu, 26 Jan 2017 14:09:44 -0800 Subject: [PATCH 053/113] Update quick-start.md --- docs/user-guide/quick-start.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/user-guide/quick-start.md b/docs/user-guide/quick-start.md index e1b0829843..6cef04810d 100644 --- a/docs/user-guide/quick-start.md +++ b/docs/user-guide/quick-start.md @@ -13,7 +13,7 @@ This guide will help you get oriented to Kubernetes and running your first conta ## Launching a simple application, and exposing it to the Internet Once your application is packaged into a container and pushed to an image registry, you're ready to deploy it to Kubernetes. -Through integration with some cloud providers (for example Google Compute Engine, AWS EC2, Azure ACS), Kubernetes also enables you to request it to provision a public IP address for your application. +Through integration with some cloud providers (for example Google Compute Engine, AWS EC2, and Azure ACS), Kubernetes also enables you to request it to provision a public IP address for your application. For example, [nginx](http://wiki.nginx.org/Main) is a popular HTTP server, with a [pre-built container on Docker hub](https://registry.hub.docker.com/_/nginx/). The [`kubectl run`](/docs/user-guide/kubectl/kubectl_run) commands below will create two nginx replicas, listening on port 80, and a public IP address for your application. @@ -70,4 +70,4 @@ service "my-nginx" deleted ## What's next? -[Learn about how to configure common container parameters, such as commands and environment variables.](/docs/user-guide/configuring-containers) +* [Learn about how to configure common container parameters, such as commands and environment variables.](/docs/user-guide/configuring-containers) From ed5fe607f3edc45a0c4db432385bc1ef1c761765 Mon Sep 17 00:00:00 2001 From: Rudi C Date: Thu, 26 Jan 2017 06:12:33 -0500 Subject: [PATCH 054/113] Document cross-region ECR support Fetching images from a registry hosted in a different region has been supported since 1.3 with https://github.com/kubernetes/kubernetes/pull/24369 --- docs/user-guide/images.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/images.md b/docs/user-guide/images.md index 37cfd53b9d..8daaeaeb7c 100644 --- a/docs/user-guide/images.md +++ b/docs/user-guide/images.md @@ -89,7 +89,7 @@ The kubelet will fetch and periodically refresh ECR credentials. It needs the f Requirements: - You must be using kubelet version `v1.2.0` or newer. (e.g. run `/usr/bin/kubelet --version=true`). -- Your nodes must be in the same region as the registry you are using +- If your nodes are in region A and your registry in a different region B, you need version `v1.3.0`. - ECR must be offered in your region Troubleshooting: From 3a474df151b79b761f1a55227e824b60124e6e21 Mon Sep 17 00:00:00 2001 From: Rudi C Date: Thu, 26 Jan 2017 08:38:39 -0500 Subject: [PATCH 055/113] Update images.md --- docs/user-guide/images.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/images.md b/docs/user-guide/images.md index 8daaeaeb7c..4ce0043a7b 100644 --- a/docs/user-guide/images.md +++ b/docs/user-guide/images.md @@ -89,7 +89,7 @@ The kubelet will fetch and periodically refresh ECR credentials. It needs the f Requirements: - You must be using kubelet version `v1.2.0` or newer. (e.g. run `/usr/bin/kubelet --version=true`). -- If your nodes are in region A and your registry in a different region B, you need version `v1.3.0`. +- If your nodes are in region A and your registry in a different region B, you need version `v1.3.0` or newer. - ECR must be offered in your region Troubleshooting: From cef61c8ba9d6d33a9cdf9a3a060784c2f5bbae51 Mon Sep 17 00:00:00 2001 From: Andrew Chen Date: Thu, 26 Jan 2017 14:16:28 -0800 Subject: [PATCH 056/113] Fix small grammar issue add 'is' --- docs/user-guide/images.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/images.md b/docs/user-guide/images.md index 4ce0043a7b..5b523e5615 100644 --- a/docs/user-guide/images.md +++ b/docs/user-guide/images.md @@ -89,7 +89,7 @@ The kubelet will fetch and periodically refresh ECR credentials. It needs the f Requirements: - You must be using kubelet version `v1.2.0` or newer. (e.g. run `/usr/bin/kubelet --version=true`). -- If your nodes are in region A and your registry in a different region B, you need version `v1.3.0` or newer. +- If your nodes are in region A and your registry is in a different region B, you need version `v1.3.0` or newer. - ECR must be offered in your region Troubleshooting: From f7254169cc9e939bef9988132906e5a156048cb4 Mon Sep 17 00:00:00 2001 From: Jared Date: Thu, 26 Jan 2017 14:40:34 -0800 Subject: [PATCH 057/113] Add meetup resources to community pages --- community/index.html | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/community/index.html b/community/index.html index 4686ebb442..dea7b0ccb1 100644 --- a/community/index.html +++ b/community/index.html @@ -17,9 +17,12 @@ cid: community community meeting takes place via video conference to discuss the state of affairs, get a calendar invite to participate.

+

You can also join Kubernauts all around the world through our + [Kubernetes Meetup Community](https://www.meetup.com/topics/kubernetes/) and the + [Kubernetes Cloud Native Meetup Community](https://www.meetup.com/Kubernetes-Cloud-Native-Online-Meetup/).

-

SIGs

+

Community Special Interest Groups (SIGs)

Have a special interest in how Kubernetes works with another technology? See our ever growing lists of SIGs, from AWS and Openstack to Big Data and Scalability, there's a place for you to contribute and instructions From d6aa14202601d807693a06b6dbb4fdd260e5291a Mon Sep 17 00:00:00 2001 From: Jared Date: Thu, 26 Jan 2017 14:48:49 -0800 Subject: [PATCH 058/113] Update index.html --- community/index.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/community/index.html b/community/index.html index dea7b0ccb1..5815fa61a9 100644 --- a/community/index.html +++ b/community/index.html @@ -18,8 +18,8 @@ cid: community get a calendar invite to participate.

You can also join Kubernauts all around the world through our - [Kubernetes Meetup Community](https://www.meetup.com/topics/kubernetes/) and the - [Kubernetes Cloud Native Meetup Community](https://www.meetup.com/Kubernetes-Cloud-Native-Online-Meetup/).

+ Kubernetes Meetup Community and the + Kubernetes Cloud Native Meetup Community.

Community Special Interest Groups (SIGs)

From 4c3e7d69514450ff30830cbbe8c8202955d17727 Mon Sep 17 00:00:00 2001 From: Jared Date: Thu, 26 Jan 2017 14:50:26 -0800 Subject: [PATCH 059/113] Update index.html --- community/index.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/community/index.html b/community/index.html index 5815fa61a9..201c70a776 100644 --- a/community/index.html +++ b/community/index.html @@ -22,7 +22,7 @@ cid: community Kubernetes Cloud Native Meetup Community.

-

Community Special Interest Groups (SIGs)

+

Special Interest Groups (SIGs)

Have a special interest in how Kubernetes works with another technology? See our ever growing lists of SIGs, from AWS and Openstack to Big Data and Scalability, there's a place for you to contribute and instructions From ef4ff9b6fb019ff5516c26477dc87530f1716475 Mon Sep 17 00:00:00 2001 From: Andrew Chen Date: Thu, 26 Jan 2017 15:02:50 -0800 Subject: [PATCH 060/113] reimplementation of PR #2165 PR #2165 was LGTM'ed, but the CLA check failed even after contributor signed it, so I'm reimplementing those changes here. --- docs/getting-started-guides/centos/centos_manual_config.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/getting-started-guides/centos/centos_manual_config.md b/docs/getting-started-guides/centos/centos_manual_config.md index 7f8f5ea7f2..031a5bb3f5 100644 --- a/docs/getting-started-guides/centos/centos_manual_config.md +++ b/docs/getting-started-guides/centos/centos_manual_config.md @@ -122,9 +122,9 @@ KUBE_API_ARGS="" **Warning** This network must be unused in your network infrastructure! `172.30.0.0/16` is free in our network. ```shell -$ systemctl start etcd -$ etcdctl mkdir /kube-centos/network -$ etcdctl mk /kube-centos/network/config "{ \"Network\": \"172.30.0.0/16\", \"SubnetLen\": 24, \"Backend\": { \"Type\": \"vxlan\" } }" +systemctl start etcd +etcdctl mkdir /kube-centos/network +etcdctl mk /kube-centos/network/config "{ \"Network\": \"172.30.0.0/16\", \"SubnetLen\": 24, \"Backend\": { \"Type\": \"vxlan\" } }" ``` * Configure flannel to overlay Docker network in /etc/sysconfig/flanneld on the master (also in the nodes as we'll see): From dbc615e862335cbaed8a82582e755c0b28a2fb50 Mon Sep 17 00:00:00 2001 From: Andrew Chen Date: Thu, 26 Jan 2017 15:13:51 -0800 Subject: [PATCH 061/113] Reimplementing #1708 PR #1708 was Tech LGTM'ed, but the CLA needed to be re-signed (the new CLA needed to be signed), so I'm reimplementing the changes here. --- docs/getting-started-guides/kubeadm.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/getting-started-guides/kubeadm.md b/docs/getting-started-guides/kubeadm.md index 1765e0a1f4..40827c8825 100644 --- a/docs/getting-started-guides/kubeadm.md +++ b/docs/getting-started-guides/kubeadm.md @@ -113,9 +113,9 @@ To initialize the master, pick one of the machines you previously installed `kub # kubeadm init **Note:** this will autodetect the network interface to advertise the master on as the interface with the default gateway. -If you want to use a different interface, specify `--api-advertise-addresses=` argument to `kubeadm init`. +If you want to use a different interface, specify `--api-advertise-addresses ` argument to `kubeadm init`. -If you want to use [flannel](https://github.com/coreos/flannel) as the pod network, specify `--pod-network-cidr=10.244.0.0/16` if you're using the daemonset manifest below. _However, please note that this is not required for any other networks besides Flannel._ +If you want to use [flannel](https://github.com/coreos/flannel) as the pod network, specify `--pod-network-cidr 10.244.0.0/16` if you're using the daemonset manifest below. _However, please note that this is not required for any other networks besides Flannel._ Please refer to the [kubeadm reference doc](/docs/admin/kubeadm/) if you want to read more about the flags `kubeadm init` provides. From e3494fd1430f77545cf819bb457039d0173e6de2 Mon Sep 17 00:00:00 2001 From: Slava Semushin Date: Tue, 3 Jan 2017 16:36:53 +0100 Subject: [PATCH 062/113] docs/user-guide/pod-security-policy: misc improvements. - update link - improve wording - update list of volumes --- docs/user-guide/pod-security-policy/index.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/docs/user-guide/pod-security-policy/index.md b/docs/user-guide/pod-security-policy/index.md index 6a756c4766..da1c6514d6 100644 --- a/docs/user-guide/pod-security-policy/index.md +++ b/docs/user-guide/pod-security-policy/index.md @@ -8,7 +8,7 @@ Objects of type `podsecuritypolicy` govern the ability to make requests on a pod that affect the `SecurityContext` that will be applied to a pod and container. -See [PodSecurityPolicy proposal](https://github.com/kubernetes/kubernetes/blob/{{page.githubbranch}}/docs/proposals/security-context-constraints.md) for more information. +See [PodSecurityPolicy proposal](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/security-context-constraints.md) for more information. * TOC {:toc} @@ -39,7 +39,7 @@ into three categories: restrictive value. - *Controlled by an allowable set*: Fields of this type are checked against the set to ensure their value is allowed. -- *Controlled by a strategy*: Items that have a strategy to generate a value provide +- *Controlled by a strategy*: Items that have a strategy to provide a mechanism to generate the value and a mechanism to ensure that a specified value falls into the set of allowable values. @@ -102,6 +102,10 @@ to the volume sources that are defined when creating a volume: 1. downwardAPI 1. fc 1. configMap +1. vsphereVolume +1. quobyte +1. azureDisk +1. photonPersistentDisk 1. \* (allow all volumes) The recommended minimum set of allowed volumes for new PSPs are From 8229123e7b66348004c82363d88094d1613075b8 Mon Sep 17 00:00:00 2001 From: tolleiv Date: Fri, 27 Jan 2017 17:47:53 +0100 Subject: [PATCH 063/113] Add backlink to the related example --- docs/user-guide/jobs/work-queue-1/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/jobs/work-queue-1/index.md b/docs/user-guide/jobs/work-queue-1/index.md index 60703a03e3..b2b68cff23 100644 --- a/docs/user-guide/jobs/work-queue-1/index.md +++ b/docs/user-guide/jobs/work-queue-1/index.md @@ -40,7 +40,7 @@ $ kubectl create -f examples/celery-rabbitmq/rabbitmq-controller.yaml replicationController "rabbitmq-controller" created ``` -We will only use the rabbitmq part from the celery-rabbitmq example. +We will only use the rabbitmq part from the [celery-rabbitmq example](https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/celery-rabbitmq). ## Testing the message queue service From 2e60a567dd4f35c794585c5045bca09623093735 Mon Sep 17 00:00:00 2001 From: Jess Frazelle Date: Thu, 20 Oct 2016 12:27:42 -0700 Subject: [PATCH 064/113] turn on travis for preformat balance Signed-off-by: Jess Frazelle --- .travis.yml | 2 ++ docs/admin/authorization.md | 5 +++-- docs/user-guide/kubectl/kubectl_get.md | 3 ++- docs/user-guide/pods/init-container.md | 5 ++--- 4 files changed, 9 insertions(+), 6 deletions(-) diff --git a/.travis.yml b/.travis.yml index 791d289e88..e527e16dbc 100644 --- a/.travis.yml +++ b/.travis.yml @@ -16,8 +16,10 @@ install: - cp -r $GOPATH/src/k8s.io/kubernetes/vendor/* $GOPATH/src/ - rm -rf $GOPATH/src/k8s.io/kubernetes/vendor/* - cp -r $GOPATH/src/k8s.io/kubernetes/staging/src/* $GOPATH/src/ +- go get -v k8s.io/kubernetes/cmd/mungedocs script: - go test -v k8s.io/kubernetes.github.io/test - $GOPATH/bin/md-check --root-dir=$HOME/gopath/src/k8s.io/kubernetes.github.io - ./verify-docs-format.sh +- $GOPATH/bin/mungedocs --verbose --verify --upstream=origin --root-dir=$HOME/gopath/src/k8s.io/kubernetes.github.io/docs/ --repo-root=$HOME/gopath/src/k8s.io/kubernetes.github.io --skip-munges=remove-whitespace,blank-lines-surround-preformatted,header-lines,sync-examples,analytics,analytics,kubectl-dash-f,table-of-contents,md-links,kubectl-dash-f diff --git a/docs/admin/authorization.md b/docs/admin/authorization.md index 526f07a8db..45affd5d15 100644 --- a/docs/admin/authorization.md +++ b/docs/admin/authorization.md @@ -115,10 +115,10 @@ The tuple of attributes is checked for a match against every policy in the policy file. If at least one line matches the request attributes, then the request is authorized (but may fail later validation). -To permit any authenticated user to do something, write a policy with the +To permit any authenticated user to do something, write a policy with the group property set to `"system:authenticated"`. -To permit any unauthenticated user to do something, write a policy with the +To permit any unauthenticated user to do something, write a policy with the group property set to `"system:unauthenticated"`. To permit a user to do anything, write a policy with the apiGroup, namespace, @@ -465,6 +465,7 @@ subjects: name: system:authenticated - kind: Group name: system:unauthenticated +``` ## Webhook Mode diff --git a/docs/user-guide/kubectl/kubectl_get.md b/docs/user-guide/kubectl/kubectl_get.md index 7e973d7bc9..ac8817cf78 100644 --- a/docs/user-guide/kubectl/kubectl_get.md +++ b/docs/user-guide/kubectl/kubectl_get.md @@ -76,7 +76,8 @@ kubectl get [(-o|--output=)json|yaml|wide|custom-columns=...|custom-columns-file # List one or more resources by their type and names. kubectl get rc/web service/frontend pods/web-pod-13je7 -{% endraw %}``` +{% endraw %} +``` ### Options diff --git a/docs/user-guide/pods/init-container.md b/docs/user-guide/pods/init-container.md index ab743f2fd8..ce7679d40e 100644 --- a/docs/user-guide/pods/init-container.md +++ b/docs/user-guide/pods/init-container.md @@ -20,7 +20,7 @@ the next one is started. If the init container fails, Kubernetes will restart the pod until the init container succeeds. If a pod is marked as `RestartNever`, the pod will fail if the init container fails. -You specify a container as an init container by adding an annotation. +You specify a container as an init container by adding an annotation. The annotation key is `pod.beta.kubernetes.io/init-containers`. The annotation value is a JSON array of [objects of type `v1.Container` ](http://kubernetes.io/docs/api-reference/v1/definitions/#_v1_container) @@ -62,7 +62,7 @@ not able to access. Since init containers run to completion before any app containers start, and since app containers run in parallel, they provide an easier way to block or -delay the startup of application containers until some precondition is met. +delay the startup of application containers until some precondition is met. Because init containers run in sequence and there can be multiple init containers, they can be composed easily. @@ -77,7 +77,6 @@ Here are some ideas for how to use init containers: - Clone a git repository into a volume - Place values like a POD_IP into a configuration file, and run a template tool (e.g. jinja) to generate a configuration file to be consumed by the main app contianer. -``` Complete usage examples can be found in the [StatefulSets documentation](/docs/concepts/abstractions/controllers/statefulsets/) and the [Production Pods From b2b09e67bf0e76e22c804f9f662ef62a6b46bd02 Mon Sep 17 00:00:00 2001 From: blakebarnett Date: Fri, 27 Jan 2017 13:34:36 -0800 Subject: [PATCH 065/113] typo: loser -> looser --- docs/admin/authorization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/authorization.md b/docs/admin/authorization.md index 45affd5d15..d398bba2c8 100644 --- a/docs/admin/authorization.md +++ b/docs/admin/authorization.md @@ -516,7 +516,7 @@ request, and either details about the resource being accessed or requests attributes. Note that webhook API objects are subject to the same [versioning compatibility rules](/docs/api/) -as other Kubernetes API objects. Implementers should be aware of loser +as other Kubernetes API objects. Implementers should be aware of looser compatibility promises for beta objects and check the "apiVersion" field of the request to ensure correct deserialization. Additionally, the API Server must enable the `authorization.k8s.io/v1beta1` API extensions group (`--runtime-config=authorization.k8s.io/v1beta1=true`). From f81c30ee8b197cf5a7db3d26e655ac0cf7400269 Mon Sep 17 00:00:00 2001 From: "Madhusudan.C.S" Date: Wed, 25 Jan 2017 11:13:38 -0800 Subject: [PATCH 066/113] Add some clarifications to the kubefed doc. --- docs/admin/federation/kubefed.md | 30 ++++++++++++++++++++++-------- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/docs/admin/federation/kubefed.md b/docs/admin/federation/kubefed.md index 1551c74213..9685271b85 100644 --- a/docs/admin/federation/kubefed.md +++ b/docs/admin/federation/kubefed.md @@ -33,6 +33,12 @@ or later extract the binaries in the tarball to one of the directories in your `$PATH` and set the executable permission on those binaries. +Note: The URL in the curl command below downloads the binaries for +Linux amd64. If you are on a different platform, please use the URL +for the binaries appropriate for your platform. You can find the list +of available binaries on the [release page](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG.md#client-binaries-3) + + ```shell curl -O https://storage.googleapis.com/kubernetes-release/release/v1.5.0/kubernetes-client-linux-amd64.tar.gz tar -xzvf kubernetes-client-linux-amd64.tar.gz @@ -141,12 +147,13 @@ local kubeconfig. If it fails to find a matching context, it exits with an error. This might cause issues in cases where context names for each cluster -in the federation don't follow RFC 1035 label naming rules. In such -cases, you can specify a cluster name that conforms to the RFC 1035 -label naming rules and specify the cluster context using the -`--cluster-context` flag. For example, if context of the cluster your -are joining is `gondor_needs-no_king`, then you can -join the cluster by running: +in the federation don't follow +[RFC 1035](https://www.ietf.org/rfc/rfc1035.txt) label naming rules. +In such cases, you can specify a cluster name that conforms to the +[RFC 1035](https://www.ietf.org/rfc/rfc1035.txt) label naming rules +and specify the cluster context using the `--cluster-context` flag. +For example, if context of the cluster your are joining is +`gondor_needs-no_king`, then you can join the cluster by running: ```shell kubefed join gondor --host-cluster-context=rivendell --cluster-context=gondor_needs-no_king @@ -159,8 +166,9 @@ described above are stored as a secret in the host cluster. The name of the secret is also derived from the cluster name. However, the name of a secret object in Kubernetes should conform -to the subdomain name specification described in RFC 1123. If this -isn't case, you can pass the secret name to `kubefed join` using the +to the DNS subdomain name specification described in +[RFC 1123](https://tools.ietf.org/html/rfc1123). If this isn't the +case, you can pass the secret name to `kubefed join` using the `--secret-name` flag. For example, if the cluster name is `noldor` and the secret name is `11kingdom`, you can join the cluster by running: @@ -169,6 +177,12 @@ running: kubefed join noldor --host-cluster-context=rivendell --secret-name=11kingdom ``` +Note: If your cluster name does not conform to the DNS subdomain name +specification, all you need to do is supply the secret name via the +`--secret-name` flag. `kubefed join` automatically creates the secret +for you. + + ## Removing a cluster from a federation To remove a cluster from a federation, run the `kubefed unjoin` From d9f097f286d252a2ddf2b1402821da39ba624384 Mon Sep 17 00:00:00 2001 From: markturansky Date: Mon, 12 Sep 2016 12:08:06 -0400 Subject: [PATCH 067/113] added storage limit example --- _data/guides.yml | 1 + .../resourcequota/limitstorageconsumption.md | 75 +++++++++++++++++++ 2 files changed, 76 insertions(+) create mode 100644 docs/admin/resourcequota/limitstorageconsumption.md diff --git a/_data/guides.yml b/_data/guides.yml index d3f7f7f43b..38ee10b438 100644 --- a/_data/guides.yml +++ b/_data/guides.yml @@ -189,6 +189,7 @@ toc: - docs/admin/disruptions.md - docs/admin/resourcequota/index.md - docs/admin/resourcequota/walkthrough.md + - docs/admin/resourcequota/limitstorageconsumption.md - docs/admin/rescheduler.md - docs/admin/sysctls.md - docs/admin/cluster-components.md diff --git a/docs/admin/resourcequota/limitstorageconsumption.md b/docs/admin/resourcequota/limitstorageconsumption.md new file mode 100644 index 0000000000..888041f65a --- /dev/null +++ b/docs/admin/resourcequota/limitstorageconsumption.md @@ -0,0 +1,75 @@ +--- +--- + +This example demonstrates an easy way to limit the amount of storage consumed in a namespace. + +The following resources are used in the demonstration: + +* [Resource Quota](/docs/admin/resourcequota/) +* [Limit Range](/docs/admin/limitrange/) +* [Persistent Volume Claim](/docs/user-guide/persistent-volumes/) + +This example assumes you have a functional Kubernetes setup. + +## Scenario + +The cluster-admin is operating a cluster on behalf of a user population and the admin wants to control +how much storage a single namespace can consume in order to control cost. + +The admin would like to limit: + +1. The number of persistent volume claims in a namespace +2. The amount of storage each claim can request +3. The amount of cumulative storage the namespace can have + + +## LimitRange to limit requests for storage + +Adding a `LimitRange` to a namespace enforces storage request sizes to a minimum and maximum. Storage is requested +via `PersistentVolumeClaim`. The admission controller that enforces limit ranges will reject any PVC that is above or below +the values set by the admin. + +In this example, a PVC requesting 10Gi of storage would be rejected because it exceeds the 2Gi max. + +``` +apiVersion: v1 +kind: LimitRange +metadata: + name: storagelimits +spec: + limits: + - type: PersistentVolumeClaim + max: + storage: 2Gi + min: + storage: 1Gi +``` + +Minimum storage requests are used when the underlying storage provider requires certain minimums. For example, +AWS EBS volumes have a 1Gi minimum requirement. + +## StorageQuota to limit PVC count and cumulative storage capacity + +Admins can limit the number of PVCs in a namespace as well as the cumulative capacity of those PVCs. New PVCs that exceed +either maximum value will be rejected. + +In this example, a 6th PVC in the namespace would be rejected because it exceeds the maximum count of 5. Alternatively, +a 5Gi maximum quota when combined with the 2Gi max limit above, cannot have 3 PVCs where each has 2Gi. That would be 6Gi requested + for a namespace capped at 5Gi. + +``` +apiVersion: v1 +kind: ResourceQuota +metadata: + name: storagequota +spec: + hard: + persistentvolumeclaims: "5" + requests.storage: "5Gi" +``` + +## Summary + +A limit range can put a ceiling on how much storage is requested while a resource quota can effectively cap the storage +consumed by a namespace through claim counts and cumulative storage capacity. The allows a cluster-admin to plan their +cluster's storage budget without risk of any one project going over their allotment. From 981fe0ce2be6c9e81d656885023b39a843d1e583 Mon Sep 17 00:00:00 2001 From: markturansky Date: Fri, 27 Jan 2017 10:19:23 -0500 Subject: [PATCH 068/113] title change after rebase --- docs/admin/resourcequota/limitstorageconsumption.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/docs/admin/resourcequota/limitstorageconsumption.md b/docs/admin/resourcequota/limitstorageconsumption.md index 888041f65a..1c88088d8f 100644 --- a/docs/admin/resourcequota/limitstorageconsumption.md +++ b/docs/admin/resourcequota/limitstorageconsumption.md @@ -1,6 +1,9 @@ --- +assignees: +- derekwaynecarr +- janetkuo +title: Limiting Storage Consumption --- - This example demonstrates an easy way to limit the amount of storage consumed in a namespace. The following resources are used in the demonstration: @@ -11,7 +14,7 @@ The following resources are used in the demonstration: This example assumes you have a functional Kubernetes setup. -## Scenario +## Limiting Storage Consumption The cluster-admin is operating a cluster on behalf of a user population and the admin wants to control how much storage a single namespace can consume in order to control cost. From 49002b3d2ebd004d595bac8d3d76ca77d2af197b Mon Sep 17 00:00:00 2001 From: Andrew Chen Date: Fri, 27 Jan 2017 14:51:29 -0800 Subject: [PATCH 069/113] reimplement PRs to fix tech typo This is to resolve the typo referenced for PRs #2127, #2312, and #2349 --- docs/tutorials/stateless-application/hello-minikube.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/tutorials/stateless-application/hello-minikube.md b/docs/tutorials/stateless-application/hello-minikube.md index 36b92dd97a..a4d9af0e17 100644 --- a/docs/tutorials/stateless-application/hello-minikube.md +++ b/docs/tutorials/stateless-application/hello-minikube.md @@ -146,7 +146,7 @@ eval $(minikube docker-env) ``` **Note:** Later, when you no longer wish to use the Minikube host, you can undo -this change by running `eval $(minikube docker-env) -u`. +this change by running `eval $(minikube docker-env -u)`. Build your Docker image, using the Minikube Docker daemon: From b4f87d17dfecd514ba8fb99f469ad8add6d7c87f Mon Sep 17 00:00:00 2001 From: nikhiljindal Date: Wed, 21 Dec 2016 19:09:47 -0800 Subject: [PATCH 070/113] Adding more details on why is federation useful --- docs/user-guide/federation/index.md | 69 +++++++++++++++++++++++++++-- 1 file changed, 66 insertions(+), 3 deletions(-) diff --git a/docs/user-guide/federation/index.md b/docs/user-guide/federation/index.md index 719a3e8174..358e70e9fb 100644 --- a/docs/user-guide/federation/index.md +++ b/docs/user-guide/federation/index.md @@ -2,15 +2,71 @@ title: Federation User Guide --- -This guide explains how we can manage multiple Kubernetes clusters using +This guide explains why and how to manage multiple Kubernetes clusters using federation. -[Federation proposal](https://github.com/kubernetes/kubernetes/blob/{{page.githubbranch}}/docs/proposals/federation.md) -details the use cases motivating cluster federation. * TOC {:toc} + +## Why federation + +Federation makes it easy to manage multiple clusters. It does so by providing 2 +major building blocks: + + * Sync resources across clusters: Federation provides the ability to keep + resources in multiple clusters in sync. This can be used, for example, to + ensure that the same deployment exists in multiple clusters. + * Cross cluster discovery: It provides the ability to auto-configure DNS + servers and load balancers with backends from all clusters. This can be used, + for example, to ensure that a global VIP or DNS record can be used to access + backends from multiple clusters. + +Some other use cases that federation enables are: + +* High Availability: By spreading load across clusters and auto configuring DNS + servers and load balancers, federation minimises the impact of cluster + failure. +* Avoiding provider lock-in: By making it easier to migrate applications across + clusters, federation prevents cluster provider lock-in. + + +Federation is not helpful unless you have multiple clusters. Some of the reasons +why you might want multiple clusters are: + +* Low latency: Having clusters in multiple regions minimises latency by serving + users from the cluster that is closest to them. +* Fault isolation: It might be better to have multiple small clusters rather + than a single large cluster for fault isolation (for example: multiple + clusters in different availability zones of a cloud provider). + [Multi cluster guide](/docs/admin/multi-cluster) has more details on this. +* Scalability: There are scalability limits to a single kubernetes cluster (this + should not be the case for most users. For more details: + https://github.com/kubernetes/community/blob/master/sig-scalability/goals.md). +* Hybrid cloud: You can have multiple clusters on different cloud providers or + on-premises data centers. + + +### Caveats + +While there are a lot of attractive use cases for federation, there are also +some caveats. + +* Increased network bandwidth and cost: The dederation control plane watches all + clusters to ensure that the current state is as expected. This can lead to + significant network cost if the clusters are running in different regions on + a cloud provider or on different cloud providers. +* Reduced cross cluster isolation: A bug in the federation control plane can + impact all clusters. This is mitigated by keeping the logic in federation + control plane to a minimum. It mostly delegates to the control plane in + kubernetes clusters whenever it can. The design and implementation also errs + on the side of safety and avoiding multicluster outage. +* Maturity: The federation project is relatively new and is not very mature. + Not all resources are available and many are still alpha. [Issue + 38893](https://github.com/kubernetes/kubernetes/issues/38893) ennumerates + known issues with the system that the team is busy solving. + ## Setup To be able to federate multiple clusters, we first need to setup a federation @@ -70,3 +126,10 @@ The following Federated resources are affected by cascading deletion: Note: By default, deleting a resource from federation control plane does not delete the corresponding resources from underlying clusters. + + +## For more information + +* [Federation + proposal](https://github.com/kubernetes/kubernetes/blob/{{page.githubbranch}}/docs/proposals/federation.md) +* [Kubecon2016 talk on federation](https://www.youtube.com/watch?v=pq9lbkmxpS8) From 1739a02841555bced7d45dde554ae06b8a0b964a Mon Sep 17 00:00:00 2001 From: Jeff Mendoza Date: Mon, 12 Dec 2016 11:31:31 -0800 Subject: [PATCH 071/113] Connecting a Frontend to a Backend Tutorial. --- _data/tutorials.yml | 3 + .../connecting-frontend-backend.md | 187 ++++++++++++++++++ docs/tutorials/connecting-apps/frontend.yaml | 34 ++++ .../connecting-apps/frontend/Dockerfile | 4 + .../connecting-apps/frontend/frontend.conf | 11 ++ .../connecting-apps/hello-service.yaml | 12 ++ docs/tutorials/connecting-apps/hello.yaml | 19 ++ .../connecting-apps/hello/Dockerfile | 4 + docs/tutorials/connecting-apps/hello/README | 7 + docs/tutorials/connecting-apps/hello/main.go | 74 +++++++ docs/tutorials/index.md | 4 + 11 files changed, 359 insertions(+) create mode 100644 docs/tutorials/connecting-apps/connecting-frontend-backend.md create mode 100644 docs/tutorials/connecting-apps/frontend.yaml create mode 100644 docs/tutorials/connecting-apps/frontend/Dockerfile create mode 100644 docs/tutorials/connecting-apps/frontend/frontend.conf create mode 100644 docs/tutorials/connecting-apps/hello-service.yaml create mode 100644 docs/tutorials/connecting-apps/hello.yaml create mode 100644 docs/tutorials/connecting-apps/hello/Dockerfile create mode 100644 docs/tutorials/connecting-apps/hello/README create mode 100644 docs/tutorials/connecting-apps/hello/main.go diff --git a/_data/tutorials.yml b/_data/tutorials.yml index 954d0841a1..395ff9d06d 100644 --- a/_data/tutorials.yml +++ b/_data/tutorials.yml @@ -41,6 +41,9 @@ toc: - docs/tutorials/stateful-application/run-stateful-application.md - docs/tutorials/stateful-application/run-replicated-stateful-application.md - docs/tutorials/stateful-application/zookeeper.md +- title: Connecting Applications + section: + - docs/tutorials/connecting-apps/connecting-frontend-backend.md - title: Services section: - docs/tutorials/services/source-ip.md diff --git a/docs/tutorials/connecting-apps/connecting-frontend-backend.md b/docs/tutorials/connecting-apps/connecting-frontend-backend.md new file mode 100644 index 0000000000..8f7f184b98 --- /dev/null +++ b/docs/tutorials/connecting-apps/connecting-frontend-backend.md @@ -0,0 +1,187 @@ +--- +title: Connecting a Front End to a Back End Using a Service +--- + +{% capture overview %} + +This tutorial shows how to create a frontend and a backend +microservice. The backend microservice is a hello greeter. The +frontend and backend are connected using a Kubernetes Service object. + +{% endcapture %} + + +{% capture objectives %} + +* Create and run a microservice using a Deployment object. +* Route traffic to the backend using a frontend. +* Use a Service object to connect the frontend application to the + backend application. + +{% endcapture %} + + +{% capture prerequisites %} + +* {% include task-tutorial-prereqs.md %} + +* This tutorial uses + [Services with external load balancers](/docs/user-guide/load-balancer/), which + require a supported environment. If your environment does not + support this, you can use a Service of type + [NodePort](/docs/user-guide/services/#type-nodeport) instead. + +{% endcapture %} + + +{% capture lessoncontent %} + +### Creating the backend using a Deployment + +The backend is a simple hello greeter microservice. Here is the configuration +file for the backend Deployment: + +{% include code.html language="yaml" file="hello.yaml" ghlink="/docs/tutorials/connecting-apps/hello.yaml" %} + +Create the backend Deployment: + +``` +kubectl create -f http://k8s.io/docs/tutorials/connecting-apps/hello.yaml +``` + +View information about the backend Deployment: + +``` +kubectl describe deployment hello +``` + +The output is similar to this: + +``` +Name: hello +Namespace: default +CreationTimestamp: Mon, 24 Oct 2016 14:21:02 -0700 +Labels: app=hello + tier=backend + track=stable +Selector: app=hello,tier=backend,track=stable +Replicas: 7 updated | 7 total | 7 available | 0 unavailable +StrategyType: RollingUpdate +MinReadySeconds: 0 +RollingUpdateStrategy: 1 max unavailable, 1 max surge +OldReplicaSets: +NewReplicaSet: hello-3621623197 (7/7 replicas created) +Events: +... +``` + +### Creating the backend Service object + +The key to connecting a frontend to a backend is the backend +Service. A Service creates a persistent IP address and DNS name entry +so that the backend microservice can always be reached. A Service uses +selector labels to find the Pods that it routes traffic to. + +First, explore the Service configuration file: + +{% include code.html language="yaml" file="hello-service.yaml" ghlink="/docs/tutorials/connecting-apps/hello-service.yaml" %} + +In the configuration file, you can see that the Service routes traffic to Pods +that have the labels `app: hello` and `tier: backend`. + +Create the `hello` Service: + +``` +kubectl create -f http://k8s.io/docs/tutorials/connecting-apps/hello-service.yaml +``` + +At this point, you have a backend Deployment running, and you have a +Service that can route traffic to it. + +### Creating the frontend + +Now that you have your backend, you can create a frontend that connects to the backend. +The frontend connects to the backend worker Pods by using the DNS name +given to the backend Service. The DNS name is "hello", which is the value +of the `name` field in the preceding Service configuration file. + +The Pods in the frontend Deployment run an nginx image that is configured +to find the hello backend Service. Here is the nginx configuration file: + +{% include code.html file="frontend/frontend.conf" ghlink="/docs/tutorials/connecting-apps/frontend/frontend.conf" %} + +Similar to the backend, the frontend has a Deployment and a Service. The +configuration for the Service has `type: LoadBalancer`, which means that +the Service uses the default load balancer of your cloud provider. + +{% include code.html language="yaml" file="frontend.yaml" ghlink="/docs/tutorials/connecting-apps/frontend.yaml" %} + +Create the frontend Deployment and Service: + +``` +kubectl create -f http://k8s.io/docs/tutorials/connecting-apps/frontend.yaml +``` + +The output verifies that both resources were created: + +``` +deployment "frontend" created +service "frontend" created +``` + +**Note**: The nginx configuration is baked into the +[container image](/docs/tutorials/connecting-apps/frontend/Dockerfile). +A better way to do this would be to use a +[ConfigMap](/docs/user-guide/configmap/), so +that you can change the configuration more easily. + +### Interact with the frontend Service + +Once you’ve created a Service of type LoadBalancer, you can use this +command to find the external IP: + +``` +kubectl get service frontend +``` + +The external IP field may take some time to populate. If this is the +case, the external IP is listed as ``. + +``` +NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE +frontend 10.51.252.116 80/TCP 10s +``` + +Repeat the same command again until it shows an external IP address: + +``` +NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE +frontend 10.51.252.116 XXX.XXX.XXX.XXX 80/TCP 1m +``` + +### Send traffic through the frontend + +The frontend and backends are now connected. You can hit the endpoint +by using the curl command on the external IP of your frontend Service. + +``` +curl http:// +``` + +The output shows the message generated by the backend: + +``` +{"message":"Hello"} +``` + +{% endcapture %} + + +{% capture whatsnext %} + +* Learn more about [Services](/docs/user-guide/services/) +* Learn more about [ConfigMaps](/docs/user-guide/configmap/) + +{% endcapture %} + +{% include templates/tutorial.md %} diff --git a/docs/tutorials/connecting-apps/frontend.yaml b/docs/tutorials/connecting-apps/frontend.yaml new file mode 100644 index 0000000000..a084f75582 --- /dev/null +++ b/docs/tutorials/connecting-apps/frontend.yaml @@ -0,0 +1,34 @@ +kind: Service +apiVersion: v1 +metadata: + name: frontend +spec: + selector: + app: hello + tier: frontend + ports: + - protocol: "TCP" + port: 80 + targetPort: 80 + type: LoadBalancer +--- +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: frontend +spec: + replicas: 1 + template: + metadata: + labels: + app: hello + tier: frontend + track: stable + spec: + containers: + - name: nginx + image: "gcr.io/google-samples/hello-frontend:1.0" + lifecycle: + preStop: + exec: + command: ["/usr/sbin/nginx","-s","quit"] diff --git a/docs/tutorials/connecting-apps/frontend/Dockerfile b/docs/tutorials/connecting-apps/frontend/Dockerfile new file mode 100644 index 0000000000..7de606a642 --- /dev/null +++ b/docs/tutorials/connecting-apps/frontend/Dockerfile @@ -0,0 +1,4 @@ +FROM nginx:1.9.14 + +RUN rm /etc/nginx/conf.d/default.conf +COPY frontend.conf /etc/nginx/conf.d diff --git a/docs/tutorials/connecting-apps/frontend/frontend.conf b/docs/tutorials/connecting-apps/frontend/frontend.conf new file mode 100644 index 0000000000..9a1f5a0ed6 --- /dev/null +++ b/docs/tutorials/connecting-apps/frontend/frontend.conf @@ -0,0 +1,11 @@ +upstream hello { + server hello; +} + +server { + listen 80; + + location / { + proxy_pass http://hello; + } +} diff --git a/docs/tutorials/connecting-apps/hello-service.yaml b/docs/tutorials/connecting-apps/hello-service.yaml new file mode 100644 index 0000000000..8be93e1da6 --- /dev/null +++ b/docs/tutorials/connecting-apps/hello-service.yaml @@ -0,0 +1,12 @@ +kind: Service +apiVersion: v1 +metadata: + name: hello +spec: + selector: + app: hello + tier: backend + ports: + - protocol: TCP + port: 80 + targetPort: http diff --git a/docs/tutorials/connecting-apps/hello.yaml b/docs/tutorials/connecting-apps/hello.yaml new file mode 100644 index 0000000000..97e3a79df1 --- /dev/null +++ b/docs/tutorials/connecting-apps/hello.yaml @@ -0,0 +1,19 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: hello +spec: + replicas: 7 + template: + metadata: + labels: + app: hello + tier: backend + track: stable + spec: + containers: + - name: hello + image: "gcr.io/google-samples/hello-go-gke:1.0" + ports: + - name: http + containerPort: 80 diff --git a/docs/tutorials/connecting-apps/hello/Dockerfile b/docs/tutorials/connecting-apps/hello/Dockerfile new file mode 100644 index 0000000000..405ee2a05c --- /dev/null +++ b/docs/tutorials/connecting-apps/hello/Dockerfile @@ -0,0 +1,4 @@ +FROM alpine:3.1 +MAINTAINER Carter Morgan +COPY hello /usr/bin/ +CMD ["/usr/bin/hello"] diff --git a/docs/tutorials/connecting-apps/hello/README b/docs/tutorials/connecting-apps/hello/README new file mode 100644 index 0000000000..023bd03781 --- /dev/null +++ b/docs/tutorials/connecting-apps/hello/README @@ -0,0 +1,7 @@ +Build hello go binary first + + go build -tags netgo -ldflags "-extldflags '-lm -lstdc++ -static'" . + +Then build docker image + + docker build -t hello . diff --git a/docs/tutorials/connecting-apps/hello/main.go b/docs/tutorials/connecting-apps/hello/main.go new file mode 100644 index 0000000000..cb5cf18dc6 --- /dev/null +++ b/docs/tutorials/connecting-apps/hello/main.go @@ -0,0 +1,74 @@ +package main + +import ( + "flag" + "fmt" + "log" + "net/http" + "os" + "os/signal" + "syscall" + + "github.com/braintree/manners" + "github.com/GoogleCloudPlatform/kubernetes-workshops/bundles/kubernetes-101/workshop/app/handlers" + "github.com/GoogleCloudPlatform/kubernetes-workshops/bundles/kubernetes-101/workshop/app/health" +) + +const version = "1.0.0" + +func main() { + var ( + httpAddr = flag.String("http", "0.0.0.0:80", "HTTP service address.") + healthAddr = flag.String("health", "0.0.0.0:81", "Health service address.") + ) + flag.Parse() + + log.Println("Starting server...") + log.Printf("Health service listening on %s", *healthAddr) + log.Printf("HTTP service listening on %s", *httpAddr) + + errChan := make(chan error, 10) + + hmux := http.NewServeMux() + hmux.HandleFunc("/healthz", health.HealthzHandler) + hmux.HandleFunc("/readiness", health.ReadinessHandler) + hmux.HandleFunc("/healthz/status", health.HealthzStatusHandler) + hmux.HandleFunc("/readiness/status", health.ReadinessStatusHandler) + healthServer := manners.NewServer() + healthServer.Addr = *healthAddr + healthServer.Handler = handlers.LoggingHandler(hmux) + + go func() { + errChan <- healthServer.ListenAndServe() + }() + + mux := http.NewServeMux() + mux.HandleFunc("/", handlers.HelloHandler) + mux.Handle("/secure", handlers.JWTAuthHandler(handlers.HelloHandler)) + mux.Handle("/version", handlers.VersionHandler(version)) + + httpServer := manners.NewServer() + httpServer.Addr = *httpAddr + httpServer.Handler = handlers.LoggingHandler(mux) + + go func() { + errChan <- httpServer.ListenAndServe() + }() + + signalChan := make(chan os.Signal, 1) + signal.Notify(signalChan, syscall.SIGINT, syscall.SIGTERM) + + for { + select { + case err := <-errChan: + if err != nil { + log.Fatal(err) + } + case s := <-signalChan: + log.Println(fmt.Sprintf("Captured %v. Exiting...", s)) + health.SetReadinessStatus(http.StatusServiceUnavailable) + httpServer.BlockingClose() + os.Exit(0) + } + } +} diff --git a/docs/tutorials/index.md b/docs/tutorials/index.md index 958c3aa2e9..76e42570b1 100644 --- a/docs/tutorials/index.md +++ b/docs/tutorials/index.md @@ -31,6 +31,10 @@ each of which has a sequence of steps. * [Running ZooKeeper, A CP Distributed System](/docs/tutorials/stateful-application/zookeeper/) +#### Connecting Applications + +* [Connecting a Front End to a Back End Using a Service](/docs/tutorials/connecting-apps/connecting-frontend-backend/) + #### Services * [Using SourceIP](/docs/tutorials/services/source-ip/) From b564e266b7d255f5933d98a959526e759b166080 Mon Sep 17 00:00:00 2001 From: tolleiv Date: Sat, 28 Jan 2017 16:22:39 +0100 Subject: [PATCH 072/113] Add missing environment variables --- docs/user-guide/jobs/work-queue-1/job.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/user-guide/jobs/work-queue-1/job.yaml b/docs/user-guide/jobs/work-queue-1/job.yaml index d2696ed022..4e1a61892b 100644 --- a/docs/user-guide/jobs/work-queue-1/job.yaml +++ b/docs/user-guide/jobs/work-queue-1/job.yaml @@ -12,4 +12,9 @@ spec: containers: - name: c image: gcr.io//job-wq-1 + env: + - name: BROKER_URL + value: amqp://guest:guest@rabbitmq-service:5672 + - name: QUEUE + value: job1 restartPolicy: OnFailure From 98a91d02f77bfe4d9207ef573030082210f738cd Mon Sep 17 00:00:00 2001 From: Jan Zerebecki Date: Mon, 30 Jan 2017 11:29:02 +0100 Subject: [PATCH 073/113] Correct internal link from federated to normal deployment --- docs/user-guide/federation/deployment.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/federation/deployment.md b/docs/user-guide/federation/deployment.md index a6633b356d..f146ae72f6 100644 --- a/docs/user-guide/federation/deployment.md +++ b/docs/user-guide/federation/deployment.md @@ -26,7 +26,7 @@ general and [Deployment](/docs/user-guide/deployments) in particular. Deployments in federation control plane (referred to as "Federated Deployments" in this guide) are very similar to the traditional [Kubernetes -Deployment](/docs/user-guide/deployment.md), and provide the same functionality. +Deployment](/docs/user-guide/deployments/), and provide the same functionality. Creating them in the federation control plane ensures that the desired number of replicas exist across the registered clusters. From 4eafd1e0a3a3410693d2e063798be1f246977fd7 Mon Sep 17 00:00:00 2001 From: tolleiv Date: Sat, 28 Jan 2017 17:04:07 +0100 Subject: [PATCH 074/113] Update references to the example configuration files --- docs/user-guide/jobs/work-queue-2/index.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/user-guide/jobs/work-queue-2/index.md b/docs/user-guide/jobs/work-queue-2/index.md index 621be7f795..5e2e8a03ec 100644 --- a/docs/user-guide/jobs/work-queue-2/index.md +++ b/docs/user-guide/jobs/work-queue-2/index.md @@ -37,12 +37,14 @@ of deploying Redis scalably and redundantly. Start a temporary Pod running Redis and a service so we can find it. ```shell -$ kubectl create -f examples/job/work-queue-2/redis-pod.yaml +$ kubectl create -f docs/user-guide/jobs/work-queue-2/redis-pod.yaml pod "redis-master" created -$ kubectl create -f examples/job/work-queue-2/redis-service.yaml +$ kubectl create -f docs/user-guide/jobs/work-queue-2/redis-service.yaml service "redis" created ``` +If you're not working from the source tree, you could also download [`redis-pod.yaml`](redis-pod.yaml?raw=true) and [`redis-service.yaml`](redis-service.yaml?raw=true) directly. + ## Filling the Queue with tasks Now lets fill the queue with some "tasks". In our example, our tasks are just strings to be @@ -112,7 +114,7 @@ client library to get work. Here it is: {% include code.html language="python" file="worker.py" ghlink="/docs/user-guide/jobs/work-queue-2/worker.py" %} If you are working from the source tree, -change directory to the `examples/job/work-queue-2` directory. +change directory to the `docs/user-guide/jobs/work-queue-2/` directory. Otherwise, download [`worker.py`](worker.py?raw=true), [`rediswq.py`](rediswq.py?raw=true), and [`Dockerfile`](Dockerfile?raw=true) using above links. Then build the image: From e4ea7eea309edc6a26d795dd0c4b50a20d6d6cae Mon Sep 17 00:00:00 2001 From: Richard Edwards Date: Fri, 27 Jan 2017 16:31:30 -0800 Subject: [PATCH 075/113] fix broquen link --- docs/api.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/api.md b/docs/api.md index b52e55a298..2b18343fee 100644 --- a/docs/api.md +++ b/docs/api.md @@ -12,7 +12,7 @@ Overall API conventions are described in the [API conventions doc](https://githu Remote access to the API is discussed in the [access doc](/docs/admin/accessing-the-api). -The Kubernetes API also serves as the foundation for the declarative configuration schema for the system. The [Kubectl](/docs/user-guide/kubectl/kubectl) command-line tool can be used to create, update, delete, and get API objects. +The Kubernetes API also serves as the foundation for the declarative configuration schema for the system. The [Kubectl](/docs/user-guide/kubectl) command-line tool can be used to create, update, delete, and get API objects. Kubernetes also stores its serialized state (currently in [etcd](https://coreos.com/docs/distributed-configuration/getting-started-with-etcd/)) in terms of the API resources. From 591adaffe5c84077bdea8a5671299ff76f4e40d9 Mon Sep 17 00:00:00 2001 From: steveperry-53 Date: Tue, 17 Jan 2017 12:04:57 -0800 Subject: [PATCH 076/113] Write new Task: Configuring a Pod to use a PersistentVolume. --- _data/tasks.yml | 1 + .../configure-persistent-volume-storage.md | 211 ++++++++++++++++++ .../task-pv-claim.yaml | 10 + .../configure-pod-container/task-pv-pod.yaml | 22 ++ .../task-pv-volume.yaml | 13 ++ 5 files changed, 257 insertions(+) create mode 100644 docs/tasks/configure-pod-container/configure-persistent-volume-storage.md create mode 100644 docs/tasks/configure-pod-container/task-pv-claim.yaml create mode 100644 docs/tasks/configure-pod-container/task-pv-pod.yaml create mode 100644 docs/tasks/configure-pod-container/task-pv-volume.yaml diff --git a/_data/tasks.yml b/_data/tasks.yml index 231a583524..de066c9ed2 100644 --- a/_data/tasks.yml +++ b/_data/tasks.yml @@ -9,6 +9,7 @@ toc: - docs/tasks/configure-pod-container/define-command-argument-container.md - docs/tasks/configure-pod-container/assign-cpu-ram-container.md - docs/tasks/configure-pod-container/configure-volume-storage.md + - docs/tasks/configure-pod-container/configure-persistent-volume-storage.md - docs/tasks/configure-pod-container/distribute-credentials-secure.md - docs/tasks/configure-pod-container/pull-image-private-registry.md - docs/tasks/configure-pod-container/configure-liveness-readiness-probes.md diff --git a/docs/tasks/configure-pod-container/configure-persistent-volume-storage.md b/docs/tasks/configure-pod-container/configure-persistent-volume-storage.md new file mode 100644 index 0000000000..95065e7a93 --- /dev/null +++ b/docs/tasks/configure-pod-container/configure-persistent-volume-storage.md @@ -0,0 +1,211 @@ +--- +redirect_from: +- "/docs/user-guide/persistent-volumes/walkthrough/" +- "/docs/user-guide/persistent-volumes/walkthrough.html" +title: Configuring a Pod to Use a PersistentVolume for Storage +--- + +{% capture overview %} + +This page shows how to configure a Pod to use a PersistentVolumeClaim for storage. +Here is a summary of the process: + +1. A cluster administrator creates a PersistentVolume that is backed by physical +storage. The administrator does not associate the volume with any Pod. + +1. A cluster user creates a PersistentVolumeClaim, which gets automatically +bound to a suitable PersistentVolume. + +1. The user creates a Pod that uses the PersistentVolumeClaim as storage. + +{% endcapture %} + +{% capture prerequisites %} + +* You need to have a Kubernetes cluster that has only one Node, and the kubectl +command-line tool must be configured to communicate with your cluster. If you +do not already have a single-node cluster, you can create one by using +[Minikube](/docs/getting-started-guides/minikube). + +* Familiarize yourself with the material in +[Persistent Volumes](/docs/user-guide/persistent-volumes/). + +{% endcapture %} + +{% capture steps %} + +## Creating an index.html file on your Node + +Open a shell to the Node in your cluster. How you open a shell depends on how +you set up your cluster. For example, if you are using Minikube, you can open a +shell to your Node by entering `minikube ssh`. + +In your shell, create a `/tmp/data` directory: + + mkdir /tmp/data + +In the `/tmp/data` directory, create an `index.html` file: + + echo 'Hello from Kubernetes storage' > /tmp/data/index.html + +## Creating a PersistentVolume + +In this exercise, you create a *hostPath* PersistentVolume. Kubernetes supports +hostPath for development and testing on a single-node cluster. A hostPath +PersistentVolume uses a file or directory on the Node to emulate network-attached storage. + +In a production cluster, you would not use hostPath. Instead a cluster administrator +would provision a network resource like a Google Compute Engine persistent disk, +an NFS share, or an Amazon Elastic Block Store volume. Cluster administrators can also +use [StorageClasses](/docs/resources-reference/v1.5/#storageclass-v1beta1) +to set up +[dynamic provisioning](http://blog.kubernetes.io/2016/10/dynamic-provisioning-and-storage-in-kubernetes.html). + +Here is the configuration file for the hostPath PersistentVolume: + +{% include code.html language="yaml" file="task-pv-volume.yaml" ghlink="/docs/tasks/configure-pod-container/task-pv-volume.yaml" %} + +The configuration file specifies that the volume is at `/tmp/data` on the +the cluster's Node. The configuration also specifies a size of 10 gibibytes and +an access mode of `ReadWriteOnce`, which means the volume can be mounted as +read-write by a single Node. + +Create the PersistentVolume: + + kubectl create -f http://k8s.io/docs/tasks/configure-pod-container/task-pv-volume.yaml + +View information about the PersistentVolume: + + kubectl get pv task-pv-volume + +The output shows that the PersistentVolume has a `STATUS` of `Available`. This +means it has not yet been bound to a PersistentVolumeClaim. + + NAME CAPACITY ACCESSMODES RECLAIMPOLICY STATUS CLAIM REASON AGE + task-pv-volume 10Gi RWO Retain Available 17s + + +## Creating a PersistentVolumeClaim + +The next step is to create a PersistentVolumeClaim. Pods use PersistentVolumeClaims +to request physical storage. In this exercise, you create a PersistentVolumeClaim +that requests a volume of at least three gibibytes that can provide read-write +access for at least one Node. + +Here is the configuration file for the PersistentVolumeClaim: + +{% include code.html language="yaml" file="task-pv-claim.yaml" ghlink="/docs/tasks/configure-pod-container/task-pv-claim.yaml" %} + +Create the PersistentVolumeClaim: + + kubectl create -f http://k8s.io/docs/tasks/configure-pod-container/task-pv-claim.yaml + +After you create the PersistentVolumeClaim, the Kubernetes control plane looks +for a PersistentVolume that satisfies the claim's requirements. If the control +plane finds a suitable PersistentVolume, it binds the claim to the volume. + +Look again at the PersistentVolume: + + kubectl get pv task-pv-volume + +Now the output shows a `STATUS` of `Bound`. + + kubectl get pv task-pv-volume + NAME CAPACITY ACCESSMODES RECLAIMPOLICY STATUS CLAIM REASON AGE + task-pv-volume 10Gi RWO Retain Bound default/task-pv-claim 8m + +Look at the PersistentVolumeClaim: + + kubectl get pvc task-pv-claim + +The output shows that the PersistentVolumeClaim is bound to your PersistentVolume, +`task-pv-volume`. + + NAME STATUS VOLUME CAPACITY ACCESSMODES AGE + task-pv-claim Bound task-pv-volume 10Gi RWO 5s + +## Creating a Pod + +The next step is to create a Pod that uses your PersistentVolumeClaim as a volume. + +Here is the configuration file for the Pod: + +{% include code.html language="yaml" file="task-pv-pod.yaml" ghlink="/docs/tasks/configure-pod-container/task-pv-pod.yaml" %} + +Notice that the Pod's configuration file specifies a PersistentVolumeClaim, but +it does not specify a PersistentVolume. From the Pod's point of view, the claim +is a volume. + +Create the Pod: + + kubectl create -f http://k8s.io/docs/tasks/configure-pod-container/task-pv-pod.yaml + +Verify that the Container in the Pod is running; + + kubectl get pod task-pv-pod + +Get a shell to the Container running in your Pod: + + kubectl exec -it task-pv-pod -- /bin/bash + +In your shell, verify that nginx is serving the `index.html` file from the +hostPath volume: + + root@task-pv-pod:/# apt-get update + root@task-pv-pod:/# apt-get install curl + root@task-pv-pod:/# curl localhost + +The output shows the text that you wrote to the `index.html` file on the +hostPath volume: + + Hello from Kubernetes storage + +{% endcapture %} + + +{% capture discussion %} + +## Access control + +Storage configured with a group ID (GID) allows writing only by Pods using the same +GID. Mismatched or missing GIDs cause permission denied errors. To reduce the +need for coordination with users, an administrator can annotate a PersistentVolume +with a GID. Then the GID is automatically added to any Pod that uses the +PersistentVolume. + +Use the `pv.beta.kubernetes.io/gid` annotation as follows: + + kind: PersistentVolume + apiVersion: v1 + metadata: + name: pv1 + annotations: + pv.beta.kubernetes.io/gid: "1234" + +When a Pod consumes a PersistentVolume that has a GID annotation, the annotated GID +is applied to all Containers in the Pod in the same way that GIDs specified in the +Pod’s security context are. Every GID, whether it originates from a PersistentVolume +annotation or the Pod’s specification, is applied to the first process run in +each Container. + +**Note**: When a Pod consumes a PersistentVolume, the GIDs associated with the +PersistentVolume are not present on the Pod resource itself. + +{% endcapture %} + + +{% capture whatsnext %} + +* Learn more about [PersistentVolumes](/docs/user-guide/persistent-volumes/). +* Read the [Persistent Storage design document](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/persistent-storage.md). + +### Reference + +* [PersistentVolume](/docs/resources-reference/v1.5/#persistentvolume-v1) +* [PersistentVolumeSpec](/docs/resources-reference/v1.5/#persistentvolumespec-v1) +* [PersistentVolumeClaim](/docs/resources-reference/v1.5/#persistentvolumeclaim-v1) +* [PersistentVolumeClaimSpec](/docs/resources-reference/v1.5/#persistentvolumeclaimspec-v1) + +{% endcapture %} + +{% include templates/task.md %} diff --git a/docs/tasks/configure-pod-container/task-pv-claim.yaml b/docs/tasks/configure-pod-container/task-pv-claim.yaml new file mode 100644 index 0000000000..fc82113f41 --- /dev/null +++ b/docs/tasks/configure-pod-container/task-pv-claim.yaml @@ -0,0 +1,10 @@ +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: task-pv-claim +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 3Gi diff --git a/docs/tasks/configure-pod-container/task-pv-pod.yaml b/docs/tasks/configure-pod-container/task-pv-pod.yaml new file mode 100644 index 0000000000..79d97c2f77 --- /dev/null +++ b/docs/tasks/configure-pod-container/task-pv-pod.yaml @@ -0,0 +1,22 @@ +kind: Pod +apiVersion: v1 +metadata: + name: task-pv-pod +spec: + + volumes: + - name: task-pv-storage + persistentVolumeClaim: + claimName: task-pv-claim + + containers: + - name: task-pv-container + image: nginx + ports: + - containerPort: 80 + name: "http-server" + volumeMounts: + - mountPath: "/usr/share/nginx/html" + name: task-pv-storage + + diff --git a/docs/tasks/configure-pod-container/task-pv-volume.yaml b/docs/tasks/configure-pod-container/task-pv-volume.yaml new file mode 100644 index 0000000000..bffcc7ae97 --- /dev/null +++ b/docs/tasks/configure-pod-container/task-pv-volume.yaml @@ -0,0 +1,13 @@ +kind: PersistentVolume +apiVersion: v1 +metadata: + name: task-pv-volume + labels: + type: local +spec: + capacity: + storage: 10Gi + accessModes: + - ReadWriteOnce + hostPath: + path: "/tmp/data" From 57711a0c9b008b28a01734a6e140aab5c26a83c2 Mon Sep 17 00:00:00 2001 From: Wojciech Tyczynski Date: Fri, 27 Jan 2017 15:17:07 +0100 Subject: [PATCH 077/113] Update secrets doc --- docs/user-guide/secrets/index.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/user-guide/secrets/index.md b/docs/user-guide/secrets/index.md index 7da0f446fd..8388dac53f 100644 --- a/docs/user-guide/secrets/index.md +++ b/docs/user-guide/secrets/index.md @@ -370,7 +370,10 @@ files. **Mounted Secrets are updated automatically** When a secret being already consumed in a volume is updated, projected keys are eventually updated as well. -The update time depends on the kubelet syncing period. +Kubelet is checking whether the mounted secret is fresh on every periodic sync. +However, it is using its local ttl-based cache for getting the current value of the secret. +As a result, the total delay from the moment when the secret is updated to the moment when new keys are +projected to the pod can be as long as kubelet sync period + ttl of secrets cache in kubelet. #### Optional Secrets as Files from a Pod From 3185b43411363d83692fd19d73cf48915120688d Mon Sep 17 00:00:00 2001 From: steveperry-53 Date: Mon, 30 Jan 2017 16:17:18 -0800 Subject: [PATCH 078/113] Move Commands and Capabilities out of User Guide. --- _data/concepts.yml | 12 ++ _includes/redirection-note.md | 3 + docs/concepts/configuration/commands.yaml | 12 ++ .../configuration/container-command-args.md | 84 +++++++++++++ .../concepts/policy/container-capabilities.md | 102 ++++++++++++++++ docs/user-guide/containers.md | 112 +----------------- 6 files changed, 216 insertions(+), 109 deletions(-) create mode 100644 _includes/redirection-note.md create mode 100644 docs/concepts/configuration/commands.yaml create mode 100644 docs/concepts/configuration/container-command-args.md create mode 100644 docs/concepts/policy/container-capabilities.md diff --git a/_data/concepts.yml b/_data/concepts.yml index 71c6512909..5699ef430c 100644 --- a/_data/concepts.yml +++ b/_data/concepts.yml @@ -2,16 +2,28 @@ bigheader: "Concepts" abstract: "Detailed explanations of Kubernetes system concepts and abstractions." toc: - docs/concepts/index.md + - title: Kubectl Command Line section: - docs/concepts/tools/kubectl/object-management-overview.md + - title: Kubernetes Objects section: - docs/concepts/abstractions/overview.md - docs/concepts/abstractions/pod.md + - title: Controllers section: - docs/concepts/abstractions/controllers/statefulsets.md + - title: Object Metadata section: - docs/concepts/object-metadata/annotations.md + +- title: Configuration + section: + - docs/concepts/configuration/container-command-args.md + +- title: Policies + section: + - docs/concepts/policy/container-capabilities.md diff --git a/_includes/redirection-note.md b/_includes/redirection-note.md new file mode 100644 index 0000000000..8b93e29f12 --- /dev/null +++ b/_includes/redirection-note.md @@ -0,0 +1,3 @@ +The topics in the [User Guide](/docs/user-guide/) section of the Kubernetes docs +are being moved to the [Tasks](/docs/tasks/), [Tutorials](/docs/tutorials/), and +[Concepts](/docs/concepts) sections. The content in this topic has moved to: diff --git a/docs/concepts/configuration/commands.yaml b/docs/concepts/configuration/commands.yaml new file mode 100644 index 0000000000..8d58007db4 --- /dev/null +++ b/docs/concepts/configuration/commands.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Pod +metadata: + name: command-demo + labels: + purpose: demonstrate-command +spec: + containers: + - name: command-demo-container + image: debian + command: ["printenv"] + args: ["HOSTNAME", "KUBERNETES_PORT"] diff --git a/docs/concepts/configuration/container-command-args.md b/docs/concepts/configuration/container-command-args.md new file mode 100644 index 0000000000..54fe3afcb9 --- /dev/null +++ b/docs/concepts/configuration/container-command-args.md @@ -0,0 +1,84 @@ +--- +title: Container Command and Arguments +--- + +{% capture overview %} + +In the configuration file for a Container, you can set the `command` and `args` +fields to override the default Entrypoint and Cmd of the the Container's image. + +{% endcapture %} + +{% capture body %} + +## Container entry points and arguments + +The configuration file for a Container has an `image` field that specifies the +the Docker image to be run in the Container. A Docker image has metadata that includes +a default Entrypoint and a default Cmd. + +When Kubernetes starts a Container, it runs the image's default Entrypoint and +passes the image's default Cmd as arguments. + +If you want override the image's default Entrypoint and Cmd, you can use the +`command` and `args` fields in the Container's configuration. + +* The `command` field specifies the actual command run by the Container. +* The `args` field specifies the arguments passed to the command. + +This table summarizes the field names used by Docker and Kubernetes. + +| Description | Docker field name | Kubernetes field name | +|----------------------------------------|------------------------|-----------------------| +| The command run by the container | Entrypoint | command | +| The arguments passed to the command | Cmd | args | + +Here's an example of a configuration file for a Pod that has one Container. + +{% include code.html language="yaml" file="commands.yaml" ghlink="/docs/concepts/configuration/commands.yaml" %} + +When Kubernetes starts the Container, it runs this command: + +```shell +printenv HOSTNAME KUBERNETES_PORT +``` + +When you override the default Entrypoint and Cmd, these rules apply: + +* If you do not supply `command` or `args` for a Container, the defaults defined +in the Docker image are used. + +* If you supply a `command` but no `args` for a Container, only the supplied +`command` is used. The default EntryPoint and the default Cmd defined in the Docker +image are ignored. + +* If you supply only `args` for a Container, the default Entrypoint defined in +the Docker image is run with the `args` that you supplied. + +* If you supply a `command` and `args`, the default Entrypoint and the default +Cmd defined in the Docker image are ignored. Your `command` is run with your +`args`. + +Here are some examples: + +| Image Entrypoint | Image Cmd | Container command | Container args | Command run | +|--------------------|------------------|---------------------|--------------------|------------------| +| `[/ep-1]` | `[foo bar]` | <not set> | <not set> | `[ep-1 foo bar]` | +| `[/ep-1]` | `[foo bar]` | `[/ep-2]` | <not set> | `[ep-2]` | +| `[/ep-1]` | `[foo bar]` | <not set> | `[zoo boo]` | `[ep-1 zoo boo]` | + +{% endcapture %} + +{% capture whatsnext %} + +* [Defining a Command and Arguments for a Container](/docs/tasks/configure-pod-container/define-command-argument-container/) + +* [Running Commands in a Container with kubectl exec](/docs/user-guide/getting-into-containers/) + +* [Container](/docs/api-reference/v1/definitions/#_v1_container) + +* [Docker Entrypoint field](https://docs.docker.com/engine/reference/builder/) + +{% endcapture %} + +{% include templates/concept.md %} diff --git a/docs/concepts/policy/container-capabilities.md b/docs/concepts/policy/container-capabilities.md new file mode 100644 index 0000000000..21c6b38a17 --- /dev/null +++ b/docs/concepts/policy/container-capabilities.md @@ -0,0 +1,102 @@ +--- +title: Container Capabilities +--- + +{% capture overview %} + +You can specify Container capabilities by using the `securityContext` field of a +Container's configuration. + +{% endcapture %} + +{% capture body %} + +## Capabilities + +By default, Docker containers are unprivileged. For example, in the default case, +you cannot run a Docker daemon inside a Docker container. To give you control +over a container's capabilities, Docker supports `cap-add` +and `cap-drop`. For more details, see +[Runtime privilege and Linux capabilities](https://docs.docker.com/engine/reference/run/#/runtime-privilege-and-linux-capabilities). + +This table shows the relationship between Docker capabilities and +[Linux capabilities](http://man7.org/linux/man-pages/man7/capabilities.7.html): + +| Docker's capabilities | Linux capabilities | +| ---- | ---- | +| SETPCAP | CAP_SETPCAP | +| SYS_MODULE | CAP_SYS_MODULE | +| SYS_RAWIO | CAP_SYS_RAWIO | +| SYS_PACCT | CAP_SYS_PACCT | +| SYS_ADMIN | CAP_SYS_ADMIN | +| SYS_NICE | CAP_SYS_NICE | +| SYS_RESOURCE | CAP_SYS_RESOURCE | +| SYS_TIME | CAP_SYS_TIME | +| SYS_TTY_CONFIG | CAP_SYS_TTY_CONFIG | +| MKNOD | CAP_MKNOD | +| AUDIT_WRITE | CAP_AUDIT_WRITE | +| AUDIT_CONTROL | CAP_AUDIT_CONTROL | +| MAC_OVERRIDE | CAP_MAC_OVERRIDE | +| MAC_ADMIN | CAP_MAC_ADMIN | +| NET_ADMIN | CAP_NET_ADMIN | +| SYSLOG | CAP_SYSLOG | +| CHOWN | CAP_CHOWN | +| NET_RAW | CAP_NET_RAW | +| DAC_OVERRIDE | CAP_DAC_OVERRIDE | +| FOWNER | CAP_FOWNER | +| DAC_READ_SEARCH | CAP_DAC_READ_SEARCH | +| FSETID | CAP_FSETID | +| KILL | CAP_KILL | +| SETGID | CAP_SETGID | +| SETUID | CAP_SETUID | +| LINUX_IMMUTABLE | CAP_LINUX_IMMUTABLE | +| NET_BIND_SERVICE | CAP_NET_BIND_SERVICE | +| NET_BROADCAST | CAP_NET_BROADCAST | +| IPC_LOCK | CAP_IPC_LOCK | +| IPC_OWNER | CAP_IPC_OWNER | +| SYS_CHROOT | CAP_SYS_CHROOT | +| SYS_PTRACE | CAP_SYS_PTRACE | +| SYS_BOOT | CAP_SYS_BOOT | +| LEASE | CAP_LEASE | +| SETFCAP | CAP_SETFCAP | +| WAKE_ALARM | CAP_WAKE_ALARM | +| BLOCK_SUSPEND | CAP_BLOCK_SUSPEND | + +In Kubernetes, you can add or drop capabilities in the +[`SecurityContext`](/docs/resources-reference/v1.5/#securitycontext-v1) +field of a Container: + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: hello-world +spec: + containers: + - name: friendly-container + image: "alpine:3.4" + command: ["/bin/echo", "hello", "world"] + securityContext: + capabilities: + add: + - SYS_NICE + drop: + - KILL +``` + +{% endcapture %} + +{% capture whatsnext %} + +* [Security Context](/docs/user-guide/security-context/) + +* [Pod Security Policy](/docs/user-guide/pod-security-policy/) + +* [SecurityContext](/docs/resources-reference/v1.5/#securitycontext-v1) + +* [Container](/docs/api-reference/v1/definitions/#_v1_container) + +{% endcapture %} + +{% include templates/concept.md %} + diff --git a/docs/user-guide/containers.md b/docs/user-guide/containers.md index e6c135e5ea..14d1ded7fb 100644 --- a/docs/user-guide/containers.md +++ b/docs/user-guide/containers.md @@ -4,113 +4,7 @@ assignees: title: Commands and Capabilities --- -* TOC -{:toc} +{% include redirection-note.md %} -## Containers and commands - -So far the Pods we've seen have all used the `image` field to indicate what process Kubernetes -should run in a container. In this case, Kubernetes runs the image's default command. If we want -to run a particular command or override the image's defaults, there are two additional fields that -we can use: - -1. `command`: Controls the actual command run by the image -2. `args`: Controls the arguments passed to the command - -### How docker handles command and arguments - -Docker images have metadata associated with them that is used to store information about the image. -The image author may use this to define defaults for the command and arguments to run a container -when the user does not supply values. Docker calls the fields for commands and arguments -`Entrypoint` and `Cmd` respectively. The full details for this feature are too complicated to -describe here, mostly due to the fact that the docker API allows users to specify both of these -fields as either a string array or a string and there are subtle differences in how those cases are -handled. We encourage the curious to check out Docker's documentation for this feature. - -Kubernetes allows you to override both the image's default command (docker `Entrypoint`) and args -(docker `Cmd`) with the `command` and `args` fields of `container`. The rules are: - -1. If you do not supply a `command` or `args` for a container, the defaults defined by the image - will be used. -2. If you supply a `command` but no `args` for a container, only the supplied `command` will be - used; the image's default arguments are ignored. -3. If you supply only `args`, the image's default command will be used with the arguments you - supply. -4. If you supply a `command` **and** `args`, the image's defaults will be ignored and the values - you supply will be used. - -Here are examples for these rules in table format - -| Image `Entrypoint` | Image `Cmd` | Container `command` | Container `args` | Command Run | -|--------------------|------------------|---------------------|--------------------|------------------| -| `[/ep-1]` | `[foo bar]` | <not set> | <not set> | `[ep-1 foo bar]` | -| `[/ep-1]` | `[foo bar]` | `[/ep-2]` | <not set> | `[ep-2]` | -| `[/ep-1]` | `[foo bar]` | <not set> | `[zoo boo]` | `[ep-1 zoo boo]` | -| `[/ep-1]` | `[foo bar]` | `[/ep-2]` | `[zoo boo]` | `[ep-2 zoo boo]` | - - -## Capabilities - -By default, Docker containers are "unprivileged" and cannot, for example, run a Docker daemon inside a Docker container. We can have fine grain control over the capabilities using cap-add and cap-drop. More details [here](https://docs.docker.com/engine/reference/run/#/runtime-privilege-and-linux-capabilities). - -The relationship between Docker's capabilities and [Linux capabilities](http://man7.org/linux/man-pages/man7/capabilities.7.html) - -| Docker's capabilities | Linux capabilities | -| ---- | ---- | -| SETPCAP | CAP_SETPCAP | -| SYS_MODULE | CAP_SYS_MODULE | -| SYS_RAWIO | CAP_SYS_RAWIO | -| SYS_PACCT | CAP_SYS_PACCT | -| SYS_ADMIN | CAP_SYS_ADMIN | -| SYS_NICE | CAP_SYS_NICE | -| SYS_RESOURCE | CAP_SYS_RESOURCE | -| SYS_TIME | CAP_SYS_TIME | -| SYS_TTY_CONFIG | CAP_SYS_TTY_CONFIG | -| MKNOD | CAP_MKNOD | -| AUDIT_WRITE | CAP_AUDIT_WRITE | -| AUDIT_CONTROL | CAP_AUDIT_CONTROL | -| MAC_OVERRIDE | CAP_MAC_OVERRIDE | -| MAC_ADMIN | CAP_MAC_ADMIN | -| NET_ADMIN | CAP_NET_ADMIN | -| SYSLOG | CAP_SYSLOG | -| CHOWN | CAP_CHOWN | -| NET_RAW | CAP_NET_RAW | -| DAC_OVERRIDE | CAP_DAC_OVERRIDE | -| FOWNER | CAP_FOWNER | -| DAC_READ_SEARCH | CAP_DAC_READ_SEARCH | -| FSETID | CAP_FSETID | -| KILL | CAP_KILL | -| SETGID | CAP_SETGID | -| SETUID | CAP_SETUID | -| LINUX_IMMUTABLE | CAP_LINUX_IMMUTABLE | -| NET_BIND_SERVICE | CAP_NET_BIND_SERVICE | -| NET_BROADCAST | CAP_NET_BROADCAST | -| IPC_LOCK | CAP_IPC_LOCK | -| IPC_OWNER | CAP_IPC_OWNER | -| SYS_CHROOT | CAP_SYS_CHROOT | -| SYS_PTRACE | CAP_SYS_PTRACE | -| SYS_BOOT | CAP_SYS_BOOT | -| LEASE | CAP_LEASE | -| SETFCAP | CAP_SETFCAP | -| WAKE_ALARM | CAP_WAKE_ALARM | -| BLOCK_SUSPEND | CAP_BLOCK_SUSPEND | - -You can add or drop capabilities in the [`SecurityContext`](http://kubernetes.io/docs/api-reference/v1/definitions/#_v1_securitycontext), e.g.: - -```yaml -apiVersion: v1 -kind: Pod -metadata: - name: hello-world -spec: - containers: - - name: friendly-container - image: "alpine:3.4" - command: ["/bin/echo", "hello", "world"] - securityContext: - capabilities: - add: - - SYS_NICE - drop: - - KILL -``` +* [Container Command and Arguments](/docs/concepts/configuration/container-command-args/) +* [Container Capabilities](/docs/concepts/policy/container-capabilities/) From 105bf6e1f2fb93ccf119f34b08c3122645e6a0fe Mon Sep 17 00:00:00 2001 From: Slava Semushin Date: Mon, 16 Jan 2017 17:55:46 +0100 Subject: [PATCH 079/113] docs/user-guide/secrets: fix invalid syntax of Pod.spec.containers.command. --- docs/user-guide/secrets/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/secrets/index.md b/docs/user-guide/secrets/index.md index 8388dac53f..9723e00aee 100644 --- a/docs/user-guide/secrets/index.md +++ b/docs/user-guide/secrets/index.md @@ -763,7 +763,7 @@ make that key begin with a dot. For example, when the following secret is mount { "name": "dotfile-test-container", "image": "gcr.io/google_containers/busybox", - "command": "ls -l /etc/secret-volume", + "command": [ "ls", "-l", "/etc/secret-volume" ], "volumeMounts": [ { "name": "secret-volume", From 10c6bc9e65ee371a23263b0433e9c39181075952 Mon Sep 17 00:00:00 2001 From: Alexander Date: Tue, 31 Jan 2017 17:45:03 +0000 Subject: [PATCH 080/113] Fix broken documentation link --- .../configure-pod-container/communicate-containers-same-pod.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/tasks/configure-pod-container/communicate-containers-same-pod.md b/docs/tasks/configure-pod-container/communicate-containers-same-pod.md index 815ee8dc19..853169a676 100644 --- a/docs/tasks/configure-pod-container/communicate-containers-same-pod.md +++ b/docs/tasks/configure-pod-container/communicate-containers-same-pod.md @@ -137,7 +137,7 @@ the shared Volume is lost. [composite containers for modular architecture](http://www.slideshare.net/Docker/slideshare-burns). * See -[Configuring a Pod to Use a Volume for Storage](http://localhost:4000/docs/tasks/configure-pod-container/configure-volume-storage/). +[Configuring a Pod to Use a Volume for Storage](/docs/tasks/configure-pod-container/configure-volume-storage/). * See [Volume](/docs/api-reference/v1/definitions/#_v1_volume). From c87772cd92e6e3be95ec7ac23f79fb45e20923ba Mon Sep 17 00:00:00 2001 From: Dave Sewell Date: Tue, 31 Jan 2017 10:43:02 -0500 Subject: [PATCH 081/113] Fix typo in xhyve --- docs/tutorials/stateless-application/hello-minikube.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/tutorials/stateless-application/hello-minikube.md b/docs/tutorials/stateless-application/hello-minikube.md index a4d9af0e17..187e059b0a 100644 --- a/docs/tutorials/stateless-application/hello-minikube.md +++ b/docs/tutorials/stateless-application/hello-minikube.md @@ -88,7 +88,7 @@ If a proxy server is required, use the following method to start Minikube cluste minikube start --vm-driver=xhyve --docker-env HTTP_PROXY=http://your-http-proxy-host:your-http-proxy-port --docker-env HTTPS_PROXY=http(s)://your-https-proxy-host:your-https-proxy-port ``` -The `--vm-driver=xyhve` flag specifies that you are using Docker for Mac. The +The `--vm-driver=xhyve` flag specifies that you are using Docker for Mac. The default VM driver is VirtualBox. Now set the Minikube context. The context is what determines which cluster From 2dcac111291c03074975e430db62560d9aa5e0a3 Mon Sep 17 00:00:00 2001 From: Matt Singletary Date: Tue, 31 Jan 2017 10:32:31 -0500 Subject: [PATCH 082/113] typo fix --- docs/user-guide/persistent-volumes/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/persistent-volumes/index.md b/docs/user-guide/persistent-volumes/index.md index a1260ac22d..d6245e8198 100644 --- a/docs/user-guide/persistent-volumes/index.md +++ b/docs/user-guide/persistent-volumes/index.md @@ -543,7 +543,7 @@ and need persistent storage, we recommend that you use the following pattern: - Do include PersistentVolumeClaim objects in your bundle of config (alongside Deployments, ConfigMaps, etc). - Do not include PersistentVolume objects in the config, since the user instantiating the config may not have permission to create PersistentVolumes. -- Give the user the option of providing a storage class name when instantating the template. +- Give the user the option of providing a storage class name when instantiating the template. - If the user provides a storage class name, and the cluster is version 1.4 or newer, put that value into the `volume.beta.kubernetes.io/storage-class` annotation of the PVC. This will cause the PVC to match the right storage class if the cluster has StorageClasses enabled by the admin. - If the user does not provide a storage class name or the cluster is version 1.3, then instead put a `volume.alpha.kubernetes.io/storage-class: default` annotation on the PVC. From b3bfa8a906f0ab908b31ddbc445a0e16e9065ba4 Mon Sep 17 00:00:00 2001 From: Samuel Cozannet Date: Mon, 23 Jan 2017 17:13:13 +0100 Subject: [PATCH 083/113] adding fix for load balancer interference with helm --- .../ubuntu/troubleshooting.md | 96 +++++++++++++++++++ 1 file changed, 96 insertions(+) diff --git a/docs/getting-started-guides/ubuntu/troubleshooting.md b/docs/getting-started-guides/ubuntu/troubleshooting.md index e8c055b17a..44b3a34346 100644 --- a/docs/getting-started-guides/ubuntu/troubleshooting.md +++ b/docs/getting-started-guides/ubuntu/troubleshooting.md @@ -105,6 +105,102 @@ charm unit data, etc. Additional application-specific information may be included as well. ## Common Problems +### Load Balancer interfering with Helm + +This section assumes you have a working deployment of Kubernetes via Juju using a Load Balancer for the API, and that you are using Helm to deploy charts. + +To deploy Helm you will have run: + +``` +helm init +$HELM_HOME has been configured at /home/ubuntu/.helm +Tiller (the helm server side component) has been installed into your Kubernetes Cluster. +Happy Helming! +``` + +Then when using helm you may see one of the following errors: + +* Helm doesn't get the version from the Tiller server + +``` +helm version +Client: &version.Version{SemVer:"v2.1.3", GitCommit:"5cbc48fb305ca4bf68c26eb8d2a7eb363227e973", GitTreeState:"clean"} +Error: cannot connect to Tiller +``` + +* Helm cannot install your chart + +``` +helm install --debug +Error: forwarding ports: error upgrading connection: Upgrade request required +``` + +This is caused by the API load balancer not forwarding ports in the context of the helm client-server relationship. To deploy using helm, you will need to follow these steps: + +1. Expose the Kubernetes Master service + +``` +juju expose kubernetes-master +``` + +2. Identify the public IP address of one of your masters + +``` +juju status kubernetes-master +Model Controller Cloud/Region Version +production k8s-admin aws/us-east-1 2.0.0 + +App Version Status Scale Charm Store Rev OS Notes +flannel 0.6.1 active 1 flannel jujucharms 7 ubuntu +kubernetes-master 1.5.1 active 1 kubernetes-master jujucharms 10 ubuntu exposed + +Unit Workload Agent Machine Public address Ports Message +kubernetes-master/0* active idle 5 54.210.100.102 6443/tcp Kubernetes master running. + flannel/0 active idle 54.210.100.102 Flannel subnet 10.1.50.1/24 + +Machine State DNS Inst id Series AZ +5 started 54.210.100.102 i-002b7150639eb183b xenial us-east-1a + +Relation Provides Consumes Type +certificates easyrsa kubernetes-master regular +etcd etcd flannel regular +etcd etcd kubernetes-master regular +cni flannel kubernetes-master regular +loadbalancer kubeapi-load-balancer kubernetes-master regular +cni kubernetes-master flannel subordinate +cluster-dns kubernetes-master kubernetes-worker regular +cni kubernetes-worker flannel subordinate +``` + +In this context the public IP address is 54.210.100.102. + +If you want to access this data programmatically you can use the JSON output: + +``` +juju show-status kubernetes-master --format json | jq --raw-output '.applications."kubernetes-master".units | keys[]' +54.210.100.102 +``` + +3. Update the kubeconfig file + +Identify the kubeconfig file or section used for this cluster, and edit the server configuration. + +By default, it will look like ```https://54.213.123.123:443```. Replace it with the Kubernetes Master endpoint ```https://54.210.100.102:6443``` and save. + +Note that the default port used by CDK for the Kubernetes Master API is 6443 while the port exposed by the load balancer is 443. + +4. Start helming again! + +``` +helm install --debug +Created tunnel using local port: '36749' +SERVER: "localhost:36749" +CHART PATH: /home/ubuntu/.helm/ +NAME: +... +... + +``` ## etcd From 095b4bcf54e4c4408d61590b1b1f051130dfe797 Mon Sep 17 00:00:00 2001 From: Samuel Cozannet Date: Mon, 23 Jan 2017 17:56:00 +0100 Subject: [PATCH 084/113] adding operational hints for people running long lived clusters --- .../ubuntu/operations.md | 127 ++++++++++++++++++ 1 file changed, 127 insertions(+) create mode 100644 docs/getting-started-guides/ubuntu/operations.md diff --git a/docs/getting-started-guides/ubuntu/operations.md b/docs/getting-started-guides/ubuntu/operations.md new file mode 100644 index 0000000000..53b848978d --- /dev/null +++ b/docs/getting-started-guides/ubuntu/operations.md @@ -0,0 +1,127 @@ +--- +title: Operations +--- + +{% capture overview %} +This page gives recommendations and hints for people managing long lived CDK clusters +{% endcapture %} +{% capture prerequisites %} +This page assumes you understand the basics of Juju and Kubernetes. +{% endcapture %} + +{% capture steps %} +## Managing Juju +### Sizing your controller node + +The Juju Controller: + +* requires about 2 to 2.5GB RAM to operate. +* uses a MongoDB database as a storage backend for the configuration and state of the cluster. This database can grow significantly, and can also be the biggest consumer of CPU cycles on the instance +* aggregates and stores the log data of all services and units. Therefore, significant storage is needed for long lived models. If your intention is to keep the cluster running, make sure to provision at least 64GB for the logs. + +To bootstrap a controller with constraints run the following command: + +``` +juju bootstrap --contraints "mem=8GB cpu-cores=4 root-disk=128G" +``` + +Juju will elect the cheapest instance type matching your constraints on your target cloud. You can also use the ```instance-type``` constraint in conjunction with ```root-disk``` for strict control. For more information about the constraints available, refer to the [official documentation](https://jujucharms.com/docs/stable/reference-constraints) + +### Connecting on the Controller Node + +By default, Juju will create a pair of SSH key that it will use to automate the connection to units. They are stored on the client node in ```~/.local/share/juju/ssh/``` + +After deployment, Juju Controller is a "silent unit" that acts as a proxy between the client and the deployed applications. Nevertheless it can be useful to SSH into it. To do so run the following command from your client node: + +``` +ssh -i ./.local/share/juju/ssh/juju_id_rsa ubuntu@ +``` + +where ```public-ip-of-juju-controller``` can be found in ```~/.local/share/juju/controllers.yaml``` in the ```api-endpoints``` section. + +### Restricting log verbosity + +Log verbosity in Juju is set at the model level. You can adjust it at any time: + +``` +juju add-model cdk-development --config logging-config='=DEBUG;unit=DEBUG' +``` + +and later + +``` +juju config-model cdk-production --config logging-config='=ERROR;unit=ERROR' +``` + +In addition, the jujud daemon is started in debug mode by default on all controllers. To remove that behavior edit ```/var/lib/juju/init/jujud-machine-0/exec-start.sh``` on the controller node and comment the ```--debug``` section. + +It will then look like: + +``` +#!/usr/bin/env bash + +# Set up logging. +touch '/var/log/juju/machine-0.log' +chown syslog:syslog '/var/log/juju/machine-0.log' +chmod 0600 '/var/log/juju/machine-0.log' +exec >> '/var/log/juju/machine-0.log' +exec 2>&1 + +# Run the script. +'/var/lib/juju/tools/machine-0/jujud' machine --data-dir '/var/lib/juju' --machine-id 0 # --debug +``` + +Then restart the service with: + +``` +sudo systemctl restart jujud-machine-0.service +``` + +See the [official documentation](https://jujucharms.com/docs/stable/models-config) for more information about logging and other model settings in Juju. + + +## Managing your Kubernetes cluster +### Running privileged containers + +By default CDK does not support running privileged containers. If you need them, you have to edit ```/etc/default/kube-apiserver``` on the master nodes, and ```/etc/default/kubelet``` on your worker nodes. + +On Kubernetes Core or on small deployment, run the following commands from the Juju client: + +#### Manually + +1. Update the Master + +``` +juju ssh kubernetes-master/0 "sudo sed -i 's/KUBE_API_ARGS=\"/KUBE_API_ARGS=\"--allow-privileged\ /' /etc/default/kube-apiserver && sudo systemctl restart kube-apiserver.service" +``` + +2. Update the Worker(s) + +``` +juju ssh kubernetes-worker/0 "sudo sed -i 's/KUBELET_ARGS=\"/KUBELET_ARGS=\"--allow-privileged\ /' /etc/default/kubelet && sudo systemctl restart kubelet.service" +``` + +#### Programmatically + +If the deployment is larger the following commands will run on all units successively: + +1. Update all Masters + +``` +juju show-status kubernetes-master --format json | \ + jq --raw-output '.applications."kubernetes-master".units | keys[]' | \ + xargs -I UNIT juju ssh UNIT "sudo sed -i 's/KUBE_API_ARGS=\"/KUBE_API_ARGS=\"--allow-privileged\ /' /etc/default/kube-apiserver && sudo systemctl restart kube-apiserver.service" +``` + +2. Update all workers + +``` +juju show-status kubernetes-worker --format json | \ + jq --raw-output '.applications."kubernetes-worker".units | keys[]' | \ + xargs -I UNIT juju ssh UNIT "sudo sed -i 's/KUBELET_ARGS=\"/KUBELET_ARGS=\"--allow-privileged\ /' /etc/default/kubelet && sudo systemctl restart kubelet.service" +``` + + +{% endcapture %} + +{% include templates/task.md %} \ No newline at end of file From e28cec48e900b96cc4dcee25176c9f23cbe9df7e Mon Sep 17 00:00:00 2001 From: Samuel Cozannet Date: Mon, 23 Jan 2017 18:10:09 +0100 Subject: [PATCH 085/113] dummy commit to register new email --- docs/getting-started-guides/ubuntu/operations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started-guides/ubuntu/operations.md b/docs/getting-started-guides/ubuntu/operations.md index 53b848978d..b2b3a5a688 100644 --- a/docs/getting-started-guides/ubuntu/operations.md +++ b/docs/getting-started-guides/ubuntu/operations.md @@ -120,7 +120,7 @@ juju show-status kubernetes-worker --format json | \ jq --raw-output '.applications."kubernetes-worker".units | keys[]' | \ xargs -I UNIT juju ssh UNIT "sudo sed -i 's/KUBELET_ARGS=\"/KUBELET_ARGS=\"--allow-privileged\ /' /etc/default/kubelet && sudo systemctl restart kubelet.service" ``` - + {% endcapture %} From 6f1c745bb6b828d628a4774ef53d9b40b2c149e1 Mon Sep 17 00:00:00 2001 From: Samuel Cozannet Date: Mon, 23 Jan 2017 18:12:53 +0100 Subject: [PATCH 086/113] dummy commit to register new email --- docs/getting-started-guides/ubuntu/operations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started-guides/ubuntu/operations.md b/docs/getting-started-guides/ubuntu/operations.md index b2b3a5a688..53b848978d 100644 --- a/docs/getting-started-guides/ubuntu/operations.md +++ b/docs/getting-started-guides/ubuntu/operations.md @@ -120,7 +120,7 @@ juju show-status kubernetes-worker --format json | \ jq --raw-output '.applications."kubernetes-worker".units | keys[]' | \ xargs -I UNIT juju ssh UNIT "sudo sed -i 's/KUBELET_ARGS=\"/KUBELET_ARGS=\"--allow-privileged\ /' /etc/default/kubelet && sudo systemctl restart kubelet.service" ``` - + {% endcapture %} From 147bb4cf0279e0c959fbc3570c202795b231adfc Mon Sep 17 00:00:00 2001 From: Samuel Cozannet Date: Tue, 24 Jan 2017 10:28:24 +0100 Subject: [PATCH 087/113] modified: docs/getting-started-guides/ubuntu/index.md * adding Operational Considerations section modified: docs/getting-started-guides/ubuntu/logging.md * Moving logging section from operational-considerations.md to logging.md renamed: docs/getting-started-guides/ubuntu/operations.md -> docs/getting-started-guides/ubuntu/operational-considerations.md * mapping to the proposed name * ditched CDK naming in favor of k8s or cluster * add whitelines for titles --- docs/getting-started-guides/ubuntu/index.md | 1 + docs/getting-started-guides/ubuntu/logging.md | 40 ++++++++++++++ ...tions.md => operational-considerations.md} | 52 +++---------------- 3 files changed, 49 insertions(+), 44 deletions(-) rename docs/getting-started-guides/ubuntu/{operations.md => operational-considerations.md} (70%) diff --git a/docs/getting-started-guides/ubuntu/index.md b/docs/getting-started-guides/ubuntu/index.md index 5e706f0add..d54b94a88c 100644 --- a/docs/getting-started-guides/ubuntu/index.md +++ b/docs/getting-started-guides/ubuntu/index.md @@ -43,6 +43,7 @@ These are more in-depth guides for users choosing to run Kubernetes in productio - [Storage](/docs/getting-started-guides/ubuntu/storage) - [Troubleshooting](/docs/getting-started-guides/ubuntu/troubleshooting) - [Decommissioning](/docs/getting-started-guides/ubuntu/decommissioning) + - [Operational Considerations](/docs/getting-started-guides/ubuntu/operational-considerations) - [Glossary](/docs/getting-started-guides/ubuntu/glossary) ## Developer Guides diff --git a/docs/getting-started-guides/ubuntu/logging.md b/docs/getting-started-guides/ubuntu/logging.md index b7ae3c9a10..ae7237a0a7 100644 --- a/docs/getting-started-guides/ubuntu/logging.md +++ b/docs/getting-started-guides/ubuntu/logging.md @@ -18,3 +18,43 @@ The `juju debug-log` will show all of the consolidated logs of all the Juju agen See the [Juju documentation](https://jujucharms.com/docs/stable/troubleshooting-logs) for more information. +## Managing log verbosity + +Log verbosity in Juju is set at the model level. You can adjust it at any time: + +``` +juju add-model k8s-development --config logging-config='=DEBUG;unit=DEBUG' +``` + +and later + +``` +juju config-model k8s-production --config logging-config='=ERROR;unit=ERROR' +``` + +In addition, the jujud daemon is started in debug mode by default on all controllers. To remove that behavior edit ```/var/lib/juju/init/jujud-machine-0/exec-start.sh``` on the controller node and comment the ```--debug``` section. + +It then contains: + +``` +#!/usr/bin/env bash + +# Set up logging. +touch '/var/log/juju/machine-0.log' +chown syslog:syslog '/var/log/juju/machine-0.log' +chmod 0600 '/var/log/juju/machine-0.log' +exec >> '/var/log/juju/machine-0.log' +exec 2>&1 + +# Run the script. +'/var/lib/juju/tools/machine-0/jujud' machine --data-dir '/var/lib/juju' --machine-id 0 # --debug +``` + +Then restart the service with: + +``` +sudo systemctl restart jujud-machine-0.service +``` + +See the [official documentation](https://jujucharms.com/docs/stable/models-config) for more information about logging and other model settings in Juju. + diff --git a/docs/getting-started-guides/ubuntu/operations.md b/docs/getting-started-guides/ubuntu/operational-considerations.md similarity index 70% rename from docs/getting-started-guides/ubuntu/operations.md rename to docs/getting-started-guides/ubuntu/operational-considerations.md index 53b848978d..25b910073c 100644 --- a/docs/getting-started-guides/ubuntu/operations.md +++ b/docs/getting-started-guides/ubuntu/operational-considerations.md @@ -1,16 +1,18 @@ --- -title: Operations +title: Operational Considerations --- {% capture overview %} -This page gives recommendations and hints for people managing long lived CDK clusters +This page gives recommendations and hints for people managing long lived clusters {% endcapture %} {% capture prerequisites %} This page assumes you understand the basics of Juju and Kubernetes. {% endcapture %} {% capture steps %} + ## Managing Juju + ### Sizing your controller node The Juju Controller: @@ -27,6 +29,8 @@ juju bootstrap --contraints "mem=8GB cpu-cores=4 root-disk=128G" Juju will elect the cheapest instance type matching your constraints on your target cloud. You can also use the ```instance-type``` constraint in conjunction with ```root-disk``` for strict control. For more information about the constraints available, refer to the [official documentation](https://jujucharms.com/docs/stable/reference-constraints) +Additional information about logging can be found in the [logging section](/docs/getting-started-guides/ubuntu/logging) + ### Connecting on the Controller Node By default, Juju will create a pair of SSH key that it will use to automate the connection to units. They are stored on the client node in ```~/.local/share/juju/ssh/``` @@ -39,51 +43,11 @@ ssh -i ./.local/share/juju/ssh/juju_id_rsa ubuntu@ where ```public-ip-of-juju-controller``` can be found in ```~/.local/share/juju/controllers.yaml``` in the ```api-endpoints``` section. -### Restricting log verbosity - -Log verbosity in Juju is set at the model level. You can adjust it at any time: - -``` -juju add-model cdk-development --config logging-config='=DEBUG;unit=DEBUG' -``` - -and later - -``` -juju config-model cdk-production --config logging-config='=ERROR;unit=ERROR' -``` - -In addition, the jujud daemon is started in debug mode by default on all controllers. To remove that behavior edit ```/var/lib/juju/init/jujud-machine-0/exec-start.sh``` on the controller node and comment the ```--debug``` section. - -It will then look like: - -``` -#!/usr/bin/env bash - -# Set up logging. -touch '/var/log/juju/machine-0.log' -chown syslog:syslog '/var/log/juju/machine-0.log' -chmod 0600 '/var/log/juju/machine-0.log' -exec >> '/var/log/juju/machine-0.log' -exec 2>&1 - -# Run the script. -'/var/lib/juju/tools/machine-0/jujud' machine --data-dir '/var/lib/juju' --machine-id 0 # --debug -``` - -Then restart the service with: - -``` -sudo systemctl restart jujud-machine-0.service -``` - -See the [official documentation](https://jujucharms.com/docs/stable/models-config) for more information about logging and other model settings in Juju. - - ## Managing your Kubernetes cluster + ### Running privileged containers -By default CDK does not support running privileged containers. If you need them, you have to edit ```/etc/default/kube-apiserver``` on the master nodes, and ```/etc/default/kubelet``` on your worker nodes. +By default juju-deployed clusters do not support running privileged containers. If you need them, you have to edit ```/etc/default/kube-apiserver``` on the master nodes, and ```/etc/default/kubelet``` on your worker nodes. On Kubernetes Core or on small deployment, run the following commands from the Juju client: From d6ee95c6a19d01211bf37431d535022ff0989baf Mon Sep 17 00:00:00 2001 From: Samuel Cozannet Date: Tue, 24 Jan 2017 16:48:56 +0100 Subject: [PATCH 088/113] adding link into _data/guides.yml --- _data/guides.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/_data/guides.yml b/_data/guides.yml index 38ee10b438..2d79fb00dd 100644 --- a/_data/guides.yml +++ b/_data/guides.yml @@ -164,6 +164,7 @@ toc: - docs/getting-started-guides/ubuntu/troubleshooting.md - docs/getting-started-guides/ubuntu/decommissioning.md - docs/getting-started-guides/ubuntu/calico.md + - docs/getting-started-guides/ubuntu/operational-considerations.md - docs/getting-started-guides/ubuntu/glossary.md - docs/getting-started-guides/ubuntu/local.md - docs/getting-started-guides/ubuntu/logging.md From c317ac00d8aad64dc877c2d64ea93d1e4b0f64f5 Mon Sep 17 00:00:00 2001 From: Samuel Cozannet Date: Tue, 24 Jan 2017 18:17:33 +0100 Subject: [PATCH 089/113] modified: docs/getting-started-guides/ubuntu/operational-considerations.md * Rewording the access section for the controller to make it more user friendly * fix typos --- .../ubuntu/operational-considerations.md | 81 +++++++++++++++++-- 1 file changed, 75 insertions(+), 6 deletions(-) diff --git a/docs/getting-started-guides/ubuntu/operational-considerations.md b/docs/getting-started-guides/ubuntu/operational-considerations.md index 25b910073c..e6c6a02097 100644 --- a/docs/getting-started-guides/ubuntu/operational-considerations.md +++ b/docs/getting-started-guides/ubuntu/operational-considerations.md @@ -27,21 +27,90 @@ To bootstrap a controller with constraints run the following command: juju bootstrap --contraints "mem=8GB cpu-cores=4 root-disk=128G" ``` -Juju will elect the cheapest instance type matching your constraints on your target cloud. You can also use the ```instance-type``` constraint in conjunction with ```root-disk``` for strict control. For more information about the constraints available, refer to the [official documentation](https://jujucharms.com/docs/stable/reference-constraints) +Juju will select the cheapest instance type matching your constraints on your target cloud. You can also use the ```instance-type``` constraint in conjunction with ```root-disk``` for strict control. For more information about the constraints available, refer to the [official documentation](https://jujucharms.com/docs/stable/reference-constraints) Additional information about logging can be found in the [logging section](/docs/getting-started-guides/ubuntu/logging) -### Connecting on the Controller Node +### SSHing into the Controller Node -By default, Juju will create a pair of SSH key that it will use to automate the connection to units. They are stored on the client node in ```~/.local/share/juju/ssh/``` +By default, Juju will create a pair of SSH keys that it will use to automate the connection to units. They are stored on the client node in ```~/.local/share/juju/ssh/``` -After deployment, Juju Controller is a "silent unit" that acts as a proxy between the client and the deployed applications. Nevertheless it can be useful to SSH into it. To do so run the following command from your client node: +After deployment, Juju Controller is a "silent unit" that acts as a proxy between the client and the deployed applications. Nevertheless it can be useful to SSH into it. + +First you need to understand your environment, especially if you run several Juju models and controllers. Run ``` -ssh -i ./.local/share/juju/ssh/juju_id_rsa ubuntu@ +juju list-models --all +$ juju models --all +Controller: k8s + +Model Cloud/Region Status Machines Cores Access Last connection +admin/controller lxd/localhost available 1 - admin just now +admin/default lxd/localhost available 0 - admin 2017-01-23 +admin/whale* lxd/localhost available 6 - admin 3 minutes ago + ``` -where ```public-ip-of-juju-controller``` can be found in ```~/.local/share/juju/controllers.yaml``` in the ```api-endpoints``` section. +The first line ```Controller: k8s``` refers to how you bootstrapped. + +Then you will see 2, 3 or more models listed below. + +* admin/controller is the default model that hosts all controller units of juju +* admin/default is created by default as the primary model to host the user application, such as the Kubernetes cluster +* admin/whale is an additional model created if you use conjure-up as an overlay on top of Juju. + +Now to ssh into a controller node, you first ask Juju to switch context, then ssh as you would with a normal unit: + +``` +juju switch controller +``` + +At this stage, you can query the controller model as well: + +``` +juju status +Model Controller Cloud/Region Version +controller k8s lxd/localhost 2.0.2 + +App Version Status Scale Charm Store Rev OS Notes + +Unit Workload Agent Machine Public address Ports Message + +Machine State DNS Inst id Series AZ +0 started 10.191.22.15 juju-2a5ed8-0 xenial +``` + +Note that if you had bootstrapped in HA mode, you would see several machines listed. + +Now ssh-ing into the controller follows the same semantic as classic Juju commands: + +``` +$ juju ssh 0 +Welcome to Ubuntu 16.04.1 LTS (GNU/Linux 4.8.0-34-generic x86_64) + + * Documentation: https://help.ubuntu.com + * Management: https://landscape.canonical.com + * Support: https://ubuntu.com/advantage + + Get cloud support with Ubuntu Advantage Cloud Guest: + http://www.ubuntu.com/business/services/cloud + +0 packages can be updated. +0 updates are security updates. + + +Last login: Tue Jan 24 16:38:13 2017 from 10.191.22.1 +ubuntu@juju-2a5ed8-0:~$ +``` + +When you are done and want to come back to your initial model, exit the controller and + + +Then if you need to switch back to your cluster and ssh into the units, run + +``` +juju switch default +``` ## Managing your Kubernetes cluster From a631ff3cc94fb3d9802f396485f8b9ef043dd31e Mon Sep 17 00:00:00 2001 From: Albert Vaca Date: Wed, 1 Feb 2017 12:14:21 +0100 Subject: [PATCH 090/113] Fixed link --- docs/api-reference/v1/definitions.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/api-reference/v1/definitions.html b/docs/api-reference/v1/definitions.html index e207f68c0a..fe869dc84f 100755 --- a/docs/api-reference/v1/definitions.html +++ b/docs/api-reference/v1/definitions.html @@ -4176,7 +4176,7 @@ The resulting set of endpoints can be viewed as:

nodeSelector

-

NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node’s labels for the pod to be scheduled on that node. More info: http://kubernetes.io/docs/user-guide/node-selection/README

+

NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node’s labels for the pod to be scheduled on that node. More info: http://kubernetes.io/docs/user-guide/node-selection

false

object

@@ -8267,4 +8267,4 @@ Last updated 2016-11-17 06:26:10 UTC
- \ No newline at end of file + From 2027ed39bbb4318d650e015b3a1b245e71cd3637 Mon Sep 17 00:00:00 2001 From: Eugene Chow Date: Wed, 1 Feb 2017 16:12:52 +0800 Subject: [PATCH 091/113] Changed "haripin-veth" to "hairpin-veth" --- docs/user-guide/debugging-services.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/user-guide/debugging-services.md b/docs/user-guide/debugging-services.md index a99c60e53a..de9cec5c3f 100644 --- a/docs/user-guide/debugging-services.md +++ b/docs/user-guide/debugging-services.md @@ -566,11 +566,11 @@ This mostly happens when `kube-proxy` is running in `iptables` mode and Pods are connected with bridge network. The `Kubelet` exposes a `hairpin-mode` [flag](http://kubernetes.io/docs/admin/kubelet/) that allows endpoints of a Service to loadbalance back to themselves if they try to access their own Service VIP. The `hairpin-mode` flag must either be -set to `haripin-veth` or `promiscuous-bridge`. +set to `hairpin-veth` or `promiscuous-bridge`. The common steps to trouble shoot this are as follows: -* Confirm `hairpin-mode` is set to `haripin-veth` or `promiscuous-bridge`. +* Confirm `hairpin-mode` is set to `hairpin-veth` or `promiscuous-bridge`. You should see something like the below. `hairpin-mode` is set to `promiscuous-bridge` in the following example. From a32a2a59c299a7efc769df3c28e01c57e7d42640 Mon Sep 17 00:00:00 2001 From: Jeff Mendoza Date: Wed, 21 Dec 2016 09:39:45 -0800 Subject: [PATCH 092/113] Getting started guides overhaul. --- _data/guides.yml | 16 +- _data/tutorials.yml | 4 +- docs/getting-started-guides/kubectl.md | 111 ----- docs/hellonode.md | 433 ------------------ .../stateless-application/hello-minikube.md | 3 + docs/user-guide/prereqs.md | 85 +++- 6 files changed, 95 insertions(+), 557 deletions(-) delete mode 100644 docs/getting-started-guides/kubectl.md delete mode 100755 docs/hellonode.md diff --git a/_data/guides.yml b/_data/guides.yml index 2d79fb00dd..3c7064014e 100644 --- a/_data/guides.yml +++ b/_data/guides.yml @@ -3,17 +3,7 @@ abstract: "How to get started, and accomplish tasks, using Kubernetes." toc: - docs/user-guide/index.md -- title: Getting Started - section: - - docs/whatisk8s.md - - docs/getting-started-guides/kubeadm.md - - docs/getting-started-guides/kops.md - - docs/getting-started-guides/kargo.md - - docs/hellonode.md - - docs/getting-started-guides/kubectl.md - - docs/getting-started-guides/binary_release.md - - title: Online Training Course - path: https://www.udacity.com/course/scalable-microservices-with-kubernetes--ud615 +- docs/whatisk8s.md - title: Accessing the Cluster section: @@ -119,11 +109,14 @@ toc: - title: Running Kubernetes on Custom Solutions section: - docs/getting-started-guides/scratch.md + - docs/getting-started-guides/kubeadm.md - title: Custom Cloud Solutions section: - docs/getting-started-guides/coreos/index.md - docs/getting-started-guides/ubuntu/index.md - docs/getting-started-guides/rackspace.md + - docs/getting-started-guides/kops.md + - docs/getting-started-guides/kargo.md - title: On-Premise VMs section: - docs/getting-started-guides/coreos/index.md @@ -175,6 +168,7 @@ toc: - docs/admin/cluster-large.md - docs/admin/multiple-zones.md - docs/admin/high-availability/index.md + - docs/getting-started-guides/binary_release.md - title: Administering Clusters section: diff --git a/_data/tutorials.yml b/_data/tutorials.yml index 395ff9d06d..695d2b8805 100644 --- a/_data/tutorials.yml +++ b/_data/tutorials.yml @@ -29,9 +29,11 @@ toc: section: - docs/tutorials/kubernetes-basics/update-intro.html - docs/tutorials/kubernetes-basics/update-interactive.html +- title: Online Training Course + path: https://www.udacity.com/course/scalable-microservices-with-kubernetes--ud615 +- docs/tutorials/stateless-application/hello-minikube.md - title: Stateless Applications section: - - docs/tutorials/stateless-application/hello-minikube.md - docs/tutorials/stateless-application/run-stateless-application-deployment.md - docs/tutorials/stateless-application/expose-external-ip-address-service.md - docs/tutorials/stateless-application/expose-external-ip-address.md diff --git a/docs/getting-started-guides/kubectl.md b/docs/getting-started-guides/kubectl.md deleted file mode 100644 index 508e1516da..0000000000 --- a/docs/getting-started-guides/kubectl.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Installing kubectl ---- - - - -## Overview - -kubectl is the command line tool you use to interact with Kubernetes clusters. - -You should use a version of kubectl that is at least as new as your server. -`kubectl version` will print the server and client versions. Using the same version of kubectl -as your server naturally works; using a newer kubectl than your server also works; but if you use -an older kubectl with a newer server you may see odd validation errors . - -## Download a release - -Download kubectl from the [official Kubernetes releases](https://console.cloud.google.com/storage/browser/kubernetes-release/release/): - -On MacOS: - -```shell -wget https://storage.googleapis.com/kubernetes-release/release/v1.4.4/bin/darwin/amd64/kubectl -chmod +x kubectl -mv kubectl /usr/local/bin/kubectl -``` - -On Linux: - -```shell -wget https://storage.googleapis.com/kubernetes-release/release/v1.4.4/bin/linux/amd64/kubectl -chmod +x kubectl -mv kubectl /usr/local/bin/kubectl -``` - - -You may need to `sudo` the `mv`; you can put it anywhere in your `PATH` - some people prefer to install to `~/bin`. - - -## Alternatives - -### Download as part of the Google Cloud SDK - -kubectl can be installed as part of the Google Cloud SDK: - -First install the [Google Cloud SDK](https://cloud.google.com/sdk/). - -After Google Cloud SDK installs, run the following command to install `kubectl`: - -```shell -gcloud components install kubectl -``` - -Do check that the version is sufficiently up-to-date using `kubectl version`. - -### Install with brew - -If you are on MacOS and using brew, you can install with: - -```shell -brew install kubectl -``` - -The homebrew project is independent from Kubernetes, so do check that the version is -sufficiently up-to-date using `kubectl version`. - - -# Enabling shell autocompletion - -kubectl includes autocompletion support, which can save a lot of typing! - -The completion script itself is generated by kubectl, so you typically just need to invoke it from your profile. - -Common examples are provided here, but for more details please consult `kubectl completion -h` - -## On Linux, using bash - -To add it to your current shell: `source <(kubectl completion bash)` - -To add kubectl autocompletion to your profile (so it is automatically loaded in future shells): - -```shell -echo "source <(kubectl completion bash)" >> ~/.bashrc -``` - -## On MacOS, using bash - -On MacOS, you will need to install the bash-completion support first: - -```shell -brew install bash-completion -``` - -To add it to your current shell: - -```shell -source $(brew --prefix)/etc/bash_completion -source <(kubectl completion bash) -``` - -To add kubectl autocompletion to your profile (so it is automatically loaded in future shells): - -```shell -echo "source $(brew --prefix)/etc/bash_completion" >> ~/.bash_profile -echo "source <(kubectl completion bash)" >> ~/.bash_profile -``` - -Please note that this only appears to work currently if you install using `brew install kubectl`, -and not if you downloaded kubectl directly. \ No newline at end of file diff --git a/docs/hellonode.md b/docs/hellonode.md deleted file mode 100755 index fcb8eec480..0000000000 --- a/docs/hellonode.md +++ /dev/null @@ -1,433 +0,0 @@ ---- -assignees: -- dchen1107 -- pwittrock -title: Hello World on Google Container Engine ---- - -* TOC -{:toc} - -## Introduction - -The goal of this codelab is for you to turn a simple Hello World node.js app into a replicated application running on Kubernetes. We will show you how to take code that you have developed on your machine, turn it into a Docker container image, and then run that image on [Google Container Engine](https://cloud.google.com/container-engine/). - -Here's a diagram of the various parts in play in this codelab to help you understand how pieces fit with one another. Use this as a reference as we progress through the codelab; it should all make sense by the time we get to the end. - -![image](/images/hellonode/image_1.png) - -Kubernetes is an open source project which can run on many different environments, from laptops to high-availability multi-node clusters, from public clouds to on-premise deployments, from virtual machines to bare metal. Using a managed environment such as Google Container Engine (a Google-hosted version of Kubernetes) will allow you to focus more on experiencing Kubernetes rather than setting up the underlying infrastructure. - -## Setup and Requirements - -If you don't already have a Google Account (Gmail or Google Apps), you must [create one](https://accounts.google.com/SignUp). Then, sign-in to Google Cloud Platform console ([console.cloud.google.com](http://console.cloud.google.com)) and create a new project: - -![image](/images/hellonode/image_2.png) - -![image](/images/hellonode/image_3.png) - -Remember the project ID; it will be referred to later in this codelab as `$PROJECT_ID`. - -Make sure you have a Linux terminal available, you will use it to control your cluster via command line. You can use [Google Cloud Shell](https://console.cloud.google.com?cloudshell=true), it has the software this codelab uses pre-installed so that you can skip most of the environment configuration steps below. - -It may be helpful to store your project ID into a variable as many commands below use it: - -```shell -export PROJECT_ID="your-project-id" -``` - -Next, [enable billing](https://console.cloud.google.com/billing) in the Cloud Console in order to use Google Cloud resources and [enable the Container Engine API](https://console.cloud.google.com/project/_/kubernetes/list). - -New users of Google Cloud Platform receive a [$300 free trial](https://console.cloud.google.com/billing/freetrial?hl=en). Running through this codelab shouldn't cost you more than a few dollars of that trial. Google Container Engine pricing is documented [here](https://cloud.google.com/container-engine/pricing). - -Next, make sure you [download Node.js](https://nodejs.org/en/download/). You can skip this and the steps for installing Docker and Cloud SDK if you're using Cloud Shell. - -Then install [Docker](https://docs.docker.com/engine/installation/), and [Google Cloud SDK](https://cloud.google.com/sdk/). - -Finally, after Google Cloud SDK installs, run the following command to install [`kubectl`](http://kubernetes.io/docs/user-guide/kubectl-overview/): - -```shell -gcloud components install kubectl -``` - -You're all set up with an environment that can build container images, run Node apps, run Kubernetes clusters locally, and deploy Kubernetes clusters to Google Container Engine. Let's begin! - -## Create your Node.js application - -The first step is to write the application. Save this code in a folder called "`hellonode/`" with the filename `server.js`: - -#### server.js - -```javascript -const http = require('http'); -const handleRequest = (request, response) => { - console.log('Received request for URL: ' + request.url); - response.writeHead(200); - response.end('Hello World!'); -}; -const www = http.createServer(handleRequest); -www.listen(8080); -``` - -Now run this simple command: - -```shell -node server.js -``` - -You should be able to see your "Hello World!" message at http://localhost:8080/. If using Cloud Shell, use [Web Preview](https://cloud.google.com/shell/docs/using-web-preview) to view the URL. - -Stop the running node server by pressing Ctrl-C. - -Now let's package this application in a Docker container. - -## Create a Docker container image - -Next, create a file, also within `hellonode/` named `Dockerfile`. A Dockerfile describes the image that you want to build. Docker container images can extend from other existing images so for this image, we'll extend from an existing Node image. - -#### Dockerfile - -```conf -FROM node:4.5 -EXPOSE 8080 -COPY server.js . -CMD node server.js -``` - -This "recipe" for the Docker image will start from the official Node.js LTS image found on the Docker registry, expose port 8080, copy our `server.js` file to the image and start the Node server. - -Now build an image of your container by running `docker build`, tagging the image with the Google Container Registry repo for your `$PROJECT_ID`: - -```shell -docker build -t gcr.io/$PROJECT_ID/hello-node:v1 . -``` -Now there is a trusted source for getting an image of your containerized app. - -Let's try your image out with Docker: - -```shell -docker run -d -p 8080:8080 --name hello_tutorial gcr.io/$PROJECT_ID/hello-node:v1 -``` - -Visit your app in the browser, or use `curl` or `wget` if you'd like : - -```shell -curl http://localhost:8080 -``` - -You should see `Hello World!` - -**Note:** *If you receive a `Connection refused` message from Docker for Mac, ensure you are using the latest version of Docker (1.12 or later). Alternatively, if you are using Docker Toolbox on OSX, make sure you are using the VM's IP and not localhost:* - -```shell -curl "http://$(docker-machine ip YOUR-VM-MACHINE-NAME):8080" -``` - -Let's now stop the container. You can list the docker containers with: - -```shell -docker ps -``` - -You should see something like this: - -```shell -CONTAINER ID IMAGE COMMAND NAMES -c5b6d4b9f36d gcr.io/$PROJECT_ID/hello-node:v1 "/bin/sh -c 'node ser" hello_tutorial -``` - -Now stop the running container with - -``` -docker stop hello_tutorial -``` - -Now that the image works as intended and is all tagged with your `$PROJECT_ID`, we can push it to the [Google Container Registry](https://cloud.google.com/tools/container-registry/), a private repository for your Docker images accessible from every Google Cloud project (but also from outside Google Cloud Platform) : - -```shell -gcloud docker -- push gcr.io/$PROJECT_ID/hello-node:v1 -``` - -If all goes well, you should be able to see the container image listed in the console: *Compute > Container Engine > Container Registry*. We now have a project-wide Docker image available which Kubernetes can access and orchestrate. - -If you see an error message like the following: __denied: Unable to create the repository, please check that you have access to do so.__ ensure that you are pushing the image to Container Registry with the correct user credentials, use `gcloud auth list` and then `gcloud config set account example@gmail.com`. - -![image](/images/hellonode/image_10.png) - -**Note:** *Docker for Windows, Version 1.12 or 1.12.1, does not yet support this procedure. Instead, it replies with the message 'denied: Unable to access the repository; please check that you have permission to access it'. A bugfix is available at http://stackoverflow.com/questions/39277986/unable-to-push-to-google-container-registry-unable-to-access-the-repository?answertab=votes#tab-top.* - -## Create your Kubernetes Cluster - -A cluster consists of a Master API server and a set of worker VMs called Nodes. - -First, choose a [Google Cloud Project zone](https://cloud.google.com/compute/docs/regions-zones/regions-zones) to run -your service. For this tutorial, we will be using **us-central1-a**. This is -configured on the command line via: - -``` -gcloud config set compute/zone us-central1-a -``` - -Now, create a cluster via the `gcloud` command line tool: - -```shell -gcloud container clusters create hello-world -``` - -Alternatively, you can create a cluster via the [Google Cloud Console](https://console.cloud.google.com): *Compute > Container Engine > Container Clusters > New container cluster*. Set the name to **hello-world**, leaving all other options default. - -You should get a Kubernetes cluster with three nodes, ready to receive your container image! (this may take a couple of minutes) - -![image](/images/hellonode/image_11.png) - -It's now time to deploy your own containerized application to the Kubernetes cluster! - -```shell -gcloud container clusters get-credentials hello-world -``` - -**The rest of this document requires both the Kubernetes client and server version to be 1.3. Run `kubectl version` to see your current versions.** For 1.2 see [this document](https://github.com/kubernetes/kubernetes.github.io/blob/release-1.2/docs/hellonode.md). - -## Create your pod - -A Kubernetes **[pod](/docs/user-guide/pods/)** is a group of containers, tied together for the purposes of administration and networking. It can contain a single container or multiple. - -Create a Pod with the `kubectl run` command: - -```shell -kubectl run hello-node --image=gcr.io/$PROJECT_ID/hello-node:v1 --port=8080 -``` - -As shown in the output, the `kubectl run` created a **[Deployment](/docs/user-guide/deployments/)** object. Deployments are the recommended way for managing creation and scaling of pods. In this example, a new deployment manages a single pod replica running the *hello-node:v1* image. - -To view the Deployment we just created run: - -```shell -kubectl get deployments - -NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE -hello-node 1 1 1 1 3m -``` - -To view the Pod created by the deployment run: - -```shell -kubectl get pods - -NAME READY STATUS RESTARTS AGE -hello-node-714049816-ztzrb 1/1 Running 0 6m -``` - -To view the stdout / stderr from a Pod run (probably empty currently): - -```shell -kubectl logs -``` - -To view metadata about the cluster run: - -```shell -kubectl cluster-info -``` - -To view cluster events run: - -```shell -kubectl get events -``` - -To view the kubectl configuration run: - -```shell -kubectl config view -``` - -Full documentation for kubectl commands is available **[here](/docs/user-guide/kubectl-overview/)**: - -At this point you should have our container running under the control of Kubernetes but we still have to make it accessible to the outside world. - -## Allow external traffic - -By default, the pod is only accessible by its internal IP within the Kubernetes cluster. In order to make the `hello-node` container accessible from outside the Kubernetes virtual network, you have to expose the Pod as a Kubernetes **[Service](/docs/user-guide/services/)**. - -From our Development machine we can expose the pod to the public internet using the `kubectl expose` command combined with the `--type="LoadBalancer"` flag. The flag is needed for the creation of an externally accessible ip: - -```shell -kubectl expose deployment hello-node --type="LoadBalancer" -``` - -**If this fails, make sure your client and server are both version 1.3. See the [Create your cluster](#create-your-cluster) section for details.** - -The flag used in this command specifies that we'll be using the load-balancer provided by the underlying infrastructure (in this case the [Compute Engine load balancer](https://cloud.google.com/compute/docs/load-balancing/)). Note that we expose the deployment, and not the pod directly. This will cause the resulting service to load balance traffic across all pods managed by the deployment (in this case only 1 pod, but we will add more replicas later). - -The Kubernetes master creates the load balancer and related Compute Engine forwarding rules, target pools, and firewall rules to make the service fully accessible from outside of Google Cloud Platform. - -To find the ip addresses associated with the service run: - -```shell -kubectl get services hello-node - -NAME CLUSTER_IP EXTERNAL_IP PORT(S) AGE -hello-node 10.3.246.12 8080/TCP 23s -``` - -The `EXTERNAL_IP` may take several minutes to become available and visible. If the `EXTERNAL_IP` is missing, wait a few minutes and try again. - -```shell -kubectl get services hello-node - -NAME CLUSTER_IP EXTERNAL_IP PORT(S) AGE -hello-node 10.3.246.12 23.251.159.72 8080/TCP 2m -``` - -Note there are 2 IP addresses listed, both serving port 8080. `CLUSTER_IP` is only visible inside your cloud virtual network. `EXTERNAL_IP` is externally accessible. In this example, the external IP address is 23.251.159.72. - -You should now be able to reach the service by pointing your browser to this address: http://EXTERNAL_IP**:8080** or running `curl http://EXTERNAL_IP:8080`. - -![image](/images/hellonode/image_12.png) - -Assuming you've sent requests to your new webservice via the browser or curl, -you should now be able to see some logs by running: - -```shell -kubectl logs -``` - -## Scale up your website - -One of the powerful features offered by Kubernetes is how easy it is to scale your application. Suppose you suddenly need more capacity for your application; you can simply tell the deployment to manage a new number of replicas for your pod: - -```shell -kubectl scale deployment hello-node --replicas=4 -``` - -You now have four replicas of your application, each running independently on the cluster with the load balancer you created earlier and serving traffic to all of them. - -```shell -kubectl get deployment - -NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE -hello-node 4 4 4 3 40m -``` - -```shell -kubectl get pods - -NAME READY STATUS RESTARTS AGE -hello-node-714049816-g4azy 1/1 Running 0 1m -hello-node-714049816-rk0u6 1/1 Running 0 1m -hello-node-714049816-sh812 1/1 Running 0 1m -hello-node-714049816-ztzrb 1/1 Running 0 41m -``` - -Note the **declarative approach** here - rather than starting or stopping new instances you declare how many instances you want to be running. Kubernetes reconciliation loops simply make sure the reality matches what you requested and take action if needed. - -Here's a diagram summarizing the state of our Kubernetes cluster: - -![image](/images/hellonode/image_13.png) - -## Roll out an upgrade to your website - -As always, the application you deployed to production requires bug fixes or additional features. Kubernetes is here to help you deploy a new version to production without impacting your users. - -First, let's modify the application. On the development machine, edit server.js and update the response message: - -```javascript - response.end('Hello Kubernetes World!'); -``` - -We can now build and publish a new container image to the registry with an incremented tag: - -```shell -docker build -t gcr.io/$PROJECT_ID/hello-node:v2 . -gcloud docker -- push gcr.io/$PROJECT_ID/hello-node:v2 -``` - -Building and pushing this updated image should be much quicker as we take full advantage of the Docker cache. - -We're now ready for Kubernetes to smoothly update our deployment to the new version of the application. In order to change -the image label for our running container, we will need to edit the existing *hello-node deployment* and change the image from -`gcr.io/$PROJECT_ID/hello-node:v1` to `gcr.io/$PROJECT_ID/hello-node:v2`. To do this, we will use the `kubectl set image` command. - -```shell -kubectl set image deployment/hello-node hello-node=gcr.io/$PROJECT_ID/hello-node:v2 -``` - -This updates the deployment with the new image, causing new pods to be created with the new image and old pods to be deleted. - -``` -kubectl get deployments - -NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE -hello-node 4 5 4 3 1h -``` - -While this is happening, the users of the services should not see any interruption. After a little while they will start accessing the new version of your application. You can find more details in the [deployment documentation](/docs/user-guide/deployments/). - -Hopefully with these deployment, scaling and update features you'll agree that once you've setup your environment (your GKE/Kubernetes cluster here), Kubernetes is here to help you focus on the application rather than the infrastructure. - -## Observe the Kubernetes Web UI (optional) - -Kubernetes comes with a graphical web user interface that is enabled by default with your clusters. - -This user interface allows you to get started quickly and enables some of the functionality found in the CLI as a more approachable and discoverable way of interacting with the system. - -Enjoy the Kubernetes graphical dashboard and use it for deploying containerized applications, as well as for monitoring and managing your clusters! - -![image](/images/docs/ui-dashboard-workloadview.png) - -Learn more about the web interface by taking the [Dashboard tour](/docs/user-guide/ui/). - -## Cleaning it Up - -That's it for the demo! So you don't leave this all running and incur charges, let's learn how to tear things down. - -Delete the Deployment (which also deletes the running pods) and Service (which also deletes your external load balancer): - -```shell -kubectl delete service,deployment hello-node -``` - -Delete your cluster: - -```shell -gcloud container clusters delete hello-world -``` - -You should see: - -``` -The following clusters will be deleted. - - [hello-world] in [us-central1-a] - -Do you want to continue (Y/n)? - -Deleting cluster hello-world...done. -Deleted [https://container.googleapis.com/v1/projects/<$PROJECT_ID>/zones/us-central1-a/clusters/hello-world]. -``` - -This deletes the Google Compute Engine instances that are running the cluster. - -Finally delete the Docker registry storage bucket hosting your image(s) by using -`gsutil`, which should have been installed during the gcloud installation -process. For more information on gsutil, see [the gsutil documentation](https://cloud.google.com/storage/docs/gsutil) - -To list the images we created earlier in the tutorial: - -```shell -gsutil ls -``` - -You should see: - -```shell -gs://artifacts.<$PROJECT_ID>.appspot.com/ -``` - -And then to remove the all the images under this path, run: - -```shell -gsutil rm -r gs://artifacts.$PROJECT_ID.appspot.com/ -``` - -You can also delete the entire Google Cloud project but note that you must first disable billing on the project. Additionally, deleting a project will only happen after the current billing cycle ends. diff --git a/docs/tutorials/stateless-application/hello-minikube.md b/docs/tutorials/stateless-application/hello-minikube.md index 187e059b0a..6f2a47b897 100644 --- a/docs/tutorials/stateless-application/hello-minikube.md +++ b/docs/tutorials/stateless-application/hello-minikube.md @@ -1,6 +1,9 @@ --- title: Hello Minikube +redirect_from: +- "/docs/hellonode/" +- "/docs/hellonode.html" --- {% capture overview %} diff --git a/docs/user-guide/prereqs.md b/docs/user-guide/prereqs.md index 6e630ec0ea..de3cd3264f 100644 --- a/docs/user-guide/prereqs.md +++ b/docs/user-guide/prereqs.md @@ -3,9 +3,24 @@ assignees: - bgrant0607 - mikedanese title: Installing and Setting up kubectl +redirect_from: +- "/docs/getting-started-guides/kubectl/" +- "/docs/getting-started-guides/kubectl.html" --- -To deploy and manage applications on Kubernetes, you'll use the Kubernetes command-line tool, [kubectl](/docs/user-guide/kubectl/). It lets you inspect your cluster resources, create, delete, and update components, and much more. You will use it to look at your new cluster and bring up example apps. +To deploy and manage applications on Kubernetes, you'll use the +Kubernetes command-line tool, [kubectl](/docs/user-guide/kubectl/). It +lets you inspect your cluster resources, create, delete, and update +components, and much more. You will use it to look at your new cluster +and bring up example apps. + +You should use a version of kubectl that is at least as new as your +server. `kubectl version` will print the server and client versions. +Using the same version of kubectl as your server naturally works; +using a newer kubectl than your server also works; but if you use an +older kubectl with a newer server you may see odd validation errors. + +Here are a few methods to install kubectl. ## Install kubectl Binary Via curl @@ -65,6 +80,31 @@ export PATH=/platforms/darwin/amd64:$PATH export PATH=/platforms/linux/amd64:$PATH ``` +## Download as part of the Google Cloud SDK + +kubectl can be installed as part of the Google Cloud SDK: + +First install the [Google Cloud SDK](https://cloud.google.com/sdk/). + +After Google Cloud SDK installs, run the following command to install `kubectl`: + +```shell +gcloud components install kubectl +``` + +Do check that the version is sufficiently up-to-date using `kubectl version`. + +## Install with brew + +If you are on MacOS and using brew, you can install with: + +```shell +brew install kubectl +``` + +The homebrew project is independent from kubernetes, so do check that the version is +sufficiently up-to-date using `kubectl version`. + ## Configuring kubectl In order for kubectl to find and access the Kubernetes cluster, it needs a [kubeconfig file](/docs/user-guide/kubeconfig-file), which is created automatically when creating a cluster using kube-up.sh (see the [getting started guides](/docs/getting-started-guides/) for more about creating clusters). If you need access to a cluster you didn't create, see the [Sharing Cluster Access document](/docs/user-guide/sharing-clusters). @@ -80,6 +120,49 @@ $ kubectl cluster-info If you see a url response, you are ready to go. +## Enabling shell autocompletion + +kubectl includes autocompletion support, which can save a lot of typing! + +The completion script itself is generated by kubectl, so you typically just need to invoke it from your profile. + +Common examples are provided here, but for more details please consult `kubectl completion -h` + +### On Linux, using bash + +To add it to your current shell: `source <(kubectl completion bash)` + +To add kubectl autocompletion to your profile (so it is automatically loaded in future shells): + +```shell +echo "source <(kubectl completion bash)" >> ~/.bashrc +``` + +### On MacOS, using bash + +On MacOS, you will need to install the bash-completion support first: + +```shell +brew install bash-completion +``` + +To add it to your current shell: + +```shell +source $(brew --prefix)/etc/bash_completion +source <(kubectl completion bash) +``` + +To add kubectl autocompletion to your profile (so it is automatically loaded in future shells): + +```shell +echo "source $(brew --prefix)/etc/bash_completion" >> ~/.bash_profile +echo "source <(kubectl completion bash)" >> ~/.bash_profile +``` + +Please note that this only appears to work currently if you install using `brew install kubectl`, +and not if you downloaded kubectl directly. + ## What's next? [Learn how to launch and expose your application.](/docs/user-guide/quick-start) From fa9cb16339273a7964869885140dea77d9a12871 Mon Sep 17 00:00:00 2001 From: Jared Date: Wed, 1 Feb 2017 11:11:48 -0800 Subject: [PATCH 093/113] Fixed broken link to build directory https://github.com/kubernetes/kubernetes.github.io/issues/2384 --- docs/getting-started-guides/binary_release.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started-guides/binary_release.md b/docs/getting-started-guides/binary_release.md index 6b12c75e1d..aaf8d1eb6b 100644 --- a/docs/getting-started-guides/binary_release.md +++ b/docs/getting-started-guides/binary_release.md @@ -33,7 +33,7 @@ cd kubernetes make release ``` -For more details on the release process see the [`build-tools/`](http://releases.k8s.io/{{page.githubbranch}}/build-tools/) directory +For more details on the release process see the [`build`](http://releases.k8s.io/{{page.githubbranch}}/build/) directory ### Download Kubernetes and automatically set up a default cluster From bd9b561ad1cc416e2440921bde2e73817260c29c Mon Sep 17 00:00:00 2001 From: Phillip Wittrock Date: Sun, 22 Jan 2017 11:48:07 -0800 Subject: [PATCH 094/113] Concept docs for kubectl configuration management methods. --- _data/concepts.yml | 3 + .../kubectl/object-management-overview.md | 21 +- ...ect-management-using-declarative-config.md | 958 ++++++++++++++++++ ...ct-management-using-imperative-commands.md | 159 +++ ...ject-management-using-imperative-config.md | 129 +++ .../tools/kubectl/simple_deployment.yaml | 16 + .../tools/kubectl/update_deployment.yaml | 15 + 7 files changed, 1283 insertions(+), 18 deletions(-) create mode 100644 docs/concepts/tools/kubectl/object-management-using-declarative-config.md create mode 100644 docs/concepts/tools/kubectl/object-management-using-imperative-commands.md create mode 100644 docs/concepts/tools/kubectl/object-management-using-imperative-config.md create mode 100644 docs/concepts/tools/kubectl/simple_deployment.yaml create mode 100644 docs/concepts/tools/kubectl/update_deployment.yaml diff --git a/_data/concepts.yml b/_data/concepts.yml index 71c6512909..7c0d0082a7 100644 --- a/_data/concepts.yml +++ b/_data/concepts.yml @@ -5,6 +5,9 @@ toc: - title: Kubectl Command Line section: - docs/concepts/tools/kubectl/object-management-overview.md + - docs/concepts/tools/kubectl/object-management-using-imperative-commands.md + - docs/concepts/tools/kubectl/object-management-using-imperative-config.md + - docs/concepts/tools/kubectl/object-management-using-declarative-config.md - title: Kubernetes Objects section: - docs/concepts/abstractions/overview.md diff --git a/docs/concepts/tools/kubectl/object-management-overview.md b/docs/concepts/tools/kubectl/object-management-overview.md index 0969086ff9..2604a50468 100644 --- a/docs/concepts/tools/kubectl/object-management-overview.md +++ b/docs/concepts/tools/kubectl/object-management-overview.md @@ -59,12 +59,6 @@ Disadvantages compared to object configuration: - Commands do not provide a source of records except for what is live. - Commands do not provide a template for creating new objects. -{% comment %} -If we use Markdown comments instead of HTML comments, they won't appear in the built HTML files. -For a tutorial on how to use Imperative Commands for app management, see: -[App Management Using Comands](/docs/tutorials/kubectl/app-management-using-commands/) -{% endcomment %} - ## Imperative object configuration When using imperative object configuration, a user operates on object @@ -124,11 +118,6 @@ Disadvantages compared to declarative object configuration: - Imperative object configuration works best on files, not directories. - Updates to live objects must be reflected in configuration files, or they will be lost during the next replacement. -{% comment %} -For a tutorial on how to use Yaml Config for app management, see: -[App Management Yaml Config](/docs/tutorials/kubectl/app-management-using-yaml-config/) -{% endcomment %} - ## Declarative object configuration When using declarative object configuration, a user operates on object @@ -170,20 +159,16 @@ Disadvantages compared to imperative object configuration: - Declarative object configuration is harder to debug and understand results when they are unexpected. - Partial updates using diffs create complex merge and patch operations. -{% comment %} -For a tutorial on how to use Yaml Config with multiple writers, see: -[App Management Yaml Config](/docs/tutorials/kubectl/app-management-using-yaml-config-multiple-writers/) -{% endcomment %} - {% endcapture %} {% capture whatsnext %} +- [Managing Kubernetes Objects Using Imperative Commands](/docs/concepts/tools/kubectl/object-management-using-imperative-commands/) +- [Managing Kubernetes Objects Using Object Configuration (Imperative)](/docs/concepts/tools/kubectl/object-management-using-imperative-config/) +- [Managing Kubernetes Objects Using Object Configuration (Declarative)](/docs/concepts/tools/kubectl/object-management-using-declarative-config/) - [Kubectl Command Reference](/docs/user-guide/kubectl/v1.5/) - [Kubernetes Object Schema Reference](/docs/resources-reference/v1.5/) {% comment %} -- [App Management Using Yaml Config](/docs/tutorials/kubectl/declarative-app-management-using-yaml-config/) -- [App Management Using Yaml Config With Multiple Writers](/docs/tutorials/kubectl/declarative-app-management-using-yaml-config-multiple-writers/) {% endcomment %} {% endcapture %} diff --git a/docs/concepts/tools/kubectl/object-management-using-declarative-config.md b/docs/concepts/tools/kubectl/object-management-using-declarative-config.md new file mode 100644 index 0000000000..ce90126be8 --- /dev/null +++ b/docs/concepts/tools/kubectl/object-management-using-declarative-config.md @@ -0,0 +1,958 @@ +--- +title: Declarative Management of Kubernetes Objects Using Configuration Files +--- + +{% capture overview %} +Kubernetes objects can be created, updated, and deleted by storing multiple +object configuration files in a directory and using `kubectl apply` to +recursively create and update those objects as needed. This method +retains writes made to live objects without merging the changes +back into the object configuration files. +{% endcapture %} + +{% capture body %} + +## Trade-offs + +The `kubectl` tool supports three kinds of object management: + +* Imperative commands +* Imperative object configuration +* Declarative object configuration + +See [Kubernetes Object Management](/docs/concepts/tools/kubectl/object-management-overview/) +for a discussion of the advantages and disadvantage of each kind of object management. + +## Before you begin + +Declarative object configuration requires a firm understanding of +the Kubernetes object definitions and configuration. Read and complete +the following documents if you have not already: + +- [Managing Kubernetes Objects Using Imperative Commands](/docs/concepts/tools/kubectl/object-management-using-imperative-commands/) +- [Imperative Management of Kubernetes Objects Using Configuration Files](/docs/concepts/tools/kubectl/object-management-using-imperative-config/) + +Following are definitions for terms used in this document: + +- *object configuration file / configuration file*: A file that defines the + configuration for a Kubernetes object. This topic shows how to pass configuration + files to `kubectl apply`. Configuration files are typically stored in source control, such as Git. +- *live object configuration / live configuration*: The live configuration + values of an object, as observed by the Kubernetes cluster. These are kept in the Kubernetes + cluster storage, typically etcd. +- *declarative configuration writer / declarative writer*: A person or software component + that makes updates to a live object. The live writers refered to in this topic make changes + to object configuration files and run `kubectl apply` to write the changes. + +## How to create objects + +Use `kubectl apply` to create all objects, except those that already exist, +defined by configuration files in a specified directory: + +```shell +kubectl apply -f / +``` + +This sets the `kubectl.kubernetes.io/last-applied-configuration: '{...}'` +annotation on each object. The annotation contains the contents of the object +configuration file that was used to create the object. + +**Note**: Add the `-R` flag to recursively process directories. + +Here's an example of an object configuration file: + +{% include code.html language="yaml" file="simple_deployment.yaml" ghlink="/docs/concepts/tools/simple_deployment.yaml" %} + +Create the object using `kubectl apply`: + +```shell +kubectl apply -f http://k8s.io/docs/concepts/tools/kubectl/simple_deployment.yaml +``` + +Print the live configuration using `kubectl get`: + +```shell +kubectl get -f http://k8s.io/docs/concepts/tools/kubectl/simple_deployment.yaml -o yaml +``` + +The output shows that the `kubectl.kubernetes.io/last-applied-configuration` annotation +was written to the live configuration, and it matches the configuration file: + +```shell +kind: Deployment +metadata: + annotations: + # ... + # This is the json representation of simple_deployment.yaml + # It was written by kubectl apply when the object was created + kubectl.kubernetes.io/last-applied-configuration: | + {"apiVersion":"extensions/v1beta1","kind":"Deployment", + "metadata":{"annotations":{},"name":"nginx-deployment","namespace":"default"}, + "spec":{"minReadySeconds":5,"template":{"metadata":{"labels":{"app":"nginx"}}, + "spec":{"containers":[{"image":"nginx:1.7.9","name":"nginx", + "ports":[{"containerPort":80}]}]}}}} + # ... +spec: + # ... + minReadySeconds: 5 + template: + metadata: + # ... + labels: + app: nginx + spec: + containers: + - image: nginx:1.7.9 + # ... + name: nginx + ports: + - containerPort: 80 + # ... + # ... + # ... + # ... +``` + +## How to update objects + +You can also use `kubectl apply` to update all objects defined in a directory, even +if those objects already exist. This approach accomplishes the following: + +1. Sets fields that appear in the configuration file in the live configuration. +2. Clears fields removed from the configuration file in the live configuration. + +```shell +kubectl apply -f / +``` + +**Note**: Add the `-R` flag to recursively process directories. + +Here's an example configuration file: + +{% include code.html language="yaml" file="simple_deployment.yaml" ghlink="/docs/concepts/tools/simple_deployment.yaml" %} + +Create the object using `kubectl apply`: + +```shell +kubectl apply -f http://k8s.io/docs/concepts/tools/kubectl/simple_deployment.yaml +``` + +**Note:** For purposes of illustration, the preceding command refers to a single +configuration file instead of a directory. + +Print the live configuration using `kubectl get`: + +```shell +kubectl get -f http://k8s.io/docs/concepts/tools/kubectl/simple_deployment.yaml -o yaml +``` + +The output shows that the `kubectl.kubernetes.io/last-applied-configuration` annotation +was written to the live configuration, and it matches the configuration file: + +```shell +kind: Deployment +metadata: + annotations: + # ... + # This is the json representation of simple_deployment.yaml + # It was written by kubectl apply when the object was created + kubectl.kubernetes.io/last-applied-configuration: | + {"apiVersion":"extensions/v1beta1","kind":"Deployment", + "metadata":{"annotations":{},"name":"nginx-deployment","namespace":"default"}, + "spec":{"minReadySeconds":5,"template":{"metadata":{"labels":{"app":"nginx"}}, + "spec":{"containers":[{"image":"nginx:1.7.9","name":"nginx", + "ports":[{"containerPort":80}]}]}}}} + # ... +spec: + # ... + minReadySeconds: 5 + template: + metadata: + # ... + labels: + app: nginx + spec: + containers: + - image: nginx:1.7.9 + # ... + name: nginx + ports: + - containerPort: 80 + # ... + # ... + # ... + # ... +``` + +Directly update the `replicas` field in the live configuration by using `kubectl scale`. +This does not use `kubectl apply`: + +```shell +kubectl scale deployment/nginx-deployment --replicas 2 +``` + +Print the live configuration using `kubectl get`: + +```shell +kubectl get -f http://k8s.io/docs/concepts/tools/kubectl/simple_deployment.yaml -o yaml +``` + +The output shows that the `replicas` field has been set to 2, and the `last-applied-configuration` +annotation does not contain a `replicas` field: + +``` +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + annotations: + # ... + # note that the annotation does not contain replicas + # because it was not updated through apply + kubectl.kubernetes.io/last-applied-configuration: | + {"apiVersion":"extensions/v1beta1","kind":"Deployment", + "metadata":{"annotations":{},"name":"nginx-deployment","namespace":"default"}, + "spec":{"minReadySeconds":5,"template":{"metadata":{"labels":{"app":"nginx"}}, + "spec":{"containers":[{"image":"nginx:1.7.9","name":"nginx", + "ports":[{"containerPort":80}]}]}}}} + # ... +spec: + replicas: 2 # written by scale + # ... + minReadySeconds: 5 + template: + metadata: + # ... + labels: + app: nginx + spec: + containers: + - image: nginx:1.7.9 + # ... + name: nginx + ports: + - containerPort: 80 + # ... +``` + +Update the `simple_deployment.yaml` configuration file to change the image from +`nginx:1.7.9` to `nginx:1.11.9`, and delete the `minReadySeconds` field: + +{% include code.html language="yaml" file="update_deployment.yaml" ghlink="/docs/concepts/tools/update_deployment.yaml" %} + +Apply the changes made to the configuration file: + +```shell +kubectl apply -f http://k8s.io/docs/concepts/tools/kubectl/updated_deployment.yaml +``` + +Print the live configuration using `kubectl get`: + +``` +kubectl get -f http://k8s.io/docs/concepts/tools/kubectl/simple_deployment.yaml -o yaml +``` + +The output shows the following changes to the live configuration: + +- The `replicas` field retains the value of 2 set by `kubectl scale`. + This is possible because it is omitted from the configuration file. +- The `image` field has been updated to `nginx:1.11.9` from `nginx:1.7.9`. +- The `last-applied-configuration` annotation has been updated with the new image. +- The `minReadySeconds` field has been cleared. +- The `last-applied-configuration` annotation no longer contains the `minReadySeconds` field. + +```shell +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + annotations: + # ... + # The annotation contains the updated image to nginx 1.11.9, + # but does not contain the updated replicas to 2 + kubectl.kubernetes.io/last-applied-configuration: | + {"apiVersion":"extensions/v1beta1","kind":"Deployment", + "metadata":{"annotations":{},"name":"nginx-deployment","namespace":"default"}, + "spec":{"template":{"metadata":{"labels":{"app":"nginx"}}, + "spec":{"containers":[{"image":"nginx:1.11.9","name":"nginx", + "ports":[{"containerPort":80}]}]}}}} + # ... +spec: + replicas: 2 # Set by `kubectl scale`. Ignored by `kubectl apply`. + # minReadySeconds cleared by `kubectl apply` + # ... + template: + metadata: + # ... + labels: + app: nginx + spec: + containers: + - image: nginx:1.11.9 # Set by `kubectl apply` + # ... + name: nginx + ports: + - containerPort: 80 + # ... + # ... + # ... + # ... +``` + +**Warning**: Mixing `kubectl apply` with the imperative object configuration commands +`create` and `replace` is not supported. This is because `create` +and `replace` do not retain the `kubectl.kubernetes.io/last-applied-configuration` +that `kubectl apply` uses to compute updates. + +**Warning**: As of Kubernetes 1.5, the `kubectl edit` command is +incompatible with `kubectl apply`, and the two should not be +used together. + +## How to delete objects + +There are two approaches to delete objects managed by `kubectl apply`. + +### Recommended: `delete -f ` + +Manually deleting objects using the imperative command is the recommended +approach, as it is more explicit about what is being deleted, and less likely +to result in the user deleting something unintentionally: + +```shell +delete -f +``` + +### Alternative: `kubectl apply -f --prune -l your=label` + +Only use this if you know what you are doing. + +**Warning:** `kubectl apply --prune` is in alpha, and backwards incompatible +changes might be introduced in subsequent releases. + +**Warning**: You must be careful when using this command, so that you +do not delete objects unintentionally. + +As an alternative to `kubectl delete`, you can use `kubectl apply` to identify objects to be deleted after their +configuration files have been removed from the directory. Apply with `--prune` +queries the API server for all objects matching a set of labels, and attempts +to match the returned live object configurations against the object +configuration files. If an object matches the query, and it does not have a +configuration file in the directory, and it does not have a `last-applied-configuration` annotation, +it is deleted. + +{% comment %} +TODO(pwittrock): We need to change the behavior to prevent the user from running apply on subdirectories unintentionally. +{% endcomment %} + +```shell +kubectl apply -f --prune -l +``` + +**Important:** Apply with prune should only be run against the root directory +containing the object configuration files. Running against sub-directories +can cause objects to be unintentionally deleted if they are returned +by the label selector query specified with `-l ` and +do not appear in the subdirectory. + +## How to view an object + +You can use `kubectl get` with `-o yaml` to view the configuration of a live object: + +```shell +kubectl get -f -o yaml +``` + +## How apply calculates differences and merges changes + +**Definition:** A *patch* is an update operation that is scoped to specific +fields of an object instead of the entire object. +This enables updating only a specific set of fields on an object without +reading the object first. + +When `kubectl apply` updates the live configuration for an object, +it does so by sending a patch request to the API server. The +patch defines updates scoped to specific fields of the live object +configuration. The `kubectl apply` command calculates this patch request +using the configuration file, the live configuration, and the +`last-applied-configuration` annotation stored in the live configuration. + +### Merge patch calculation + +The `kubectl apply` command writes the contents of the configuration file to the +`kubectl.kubernetes.io/last-applied-configuration` annotation. This +is used to identify fields that have been removed from the configuration +file and need to be cleared from the live configuration. Here are the steps used +to caluculate which fields should be deleted or set: + +1. Calculate the fields to delete. Thes are the fields present in `last-applied-configuration` and missing from the configuration file. +2. Calculate the fields to add or set. These are the fields present in the configuration file whose values don't match the live configuration. + +Here's an example. Suppose this is the configuration file for a Deployment object: + +{% include code.html language="yaml" file="update_deployment.yaml" ghlink="/docs/concepts/tools/update_deployment.yaml" %} + +Also, suppose this is the live configuration for the same Deployment object: + +```shell +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + annotations: + # ... + # note that the annotation does not contain replicas + # because it was not updated through apply + kubectl.kubernetes.io/last-applied-configuration: | + {"apiVersion":"extensions/v1beta1","kind":"Deployment", + "metadata":{"annotations":{},"name":"nginx-deployment","namespace":"default"}, + "spec":{"minReadySeconds":5,"template":{"metadata":{"labels":{"app":"nginx"}}, + "spec":{"containers":[{"image":"nginx:1.7.9","name":"nginx", + "ports":[{"containerPort":80}]}]}}}} + # ... +spec: + replicas: 2 # written by scale + # ... + minReadySeconds: 5 + template: + metadata: + # ... + labels: + app: nginx + spec: + containers: + - image: nginx:1.7.9 + # ... + name: nginx + ports: + - containerPort: 80 + # ... +``` + +Here are the merge calculations that would be performed by `kubectl apply`: + +1. Calculate the fields to delete by reading values from + `last-applied-configuration` and comparing them to values in the + configuration file. In this example, `minReadySeconds` appears in the + `last-applied-configuration` annotation, but does not appear in the configuration file. + **Action:** Clear `minReadySeconds` from the live configuration. +2. Calculate the fields to set by reading values from the configuration + file and comparing them to values in the live configuration. In this example, + the value of `image` in the configuration file does not match + the value in the live configuration. **Action:** Set the value of `image` in the live configuration. +3. Set the `last-applied-configuration` annotation to match the value + of the configuration file. +4. Merge the results from 1, 2, 3 into a single patch request to the API server. + +Here is the live configuration that is the result of the merge: + +```shell +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + annotations: + # ... + # The annotation contains the updated image to nginx 1.11.9, + # but does not contain the updated replicas to 2 + kubectl.kubernetes.io/last-applied-configuration: | + {"apiVersion":"extensions/v1beta1","kind":"Deployment", + "metadata":{"annotations":{},"name":"nginx-deployment","namespace":"default"}, + "spec":{"template":{"metadata":{"labels":{"app":"nginx"}}, + "spec":{"containers":[{"image":"nginx:1.11.9","name":"nginx", + "ports":[{"containerPort":80}]}]}}}} + # ... +spec: + replicas: 2 # Set by `kubectl scale`. Ignored by `kubectl apply`. + # minReadySeconds cleared by `kubectl apply` + # ... + template: + metadata: + # ... + labels: + app: nginx + spec: + containers: + - image: nginx:1.11.9 # Set by `kubectl apply` + # ... + name: nginx + ports: + - containerPort: 80 + # ... + # ... + # ... + # ... +``` + +{% comment %} +TODO(1.6): For 1.6, add the following bullet point to 1. + +- clear fields explicitly set to null in the local object configuration file regardless of whether they appear in the last-applied-configuration +{% endcomment %} + +### How different types of fields are merged + +How a particular field in a configuration file is merged with +with the live configuration depends on the +type of the field. There are several types of fields: + +- *primitive*: A field of type string, integer, or boolean. + For example, `image` and `replicas` are primitive fields. **Action:** Replace. + +- *map*, also called *object*: A field of type map or a complex type that contains subfields. For example `labels` + and `annotations` are maps; `spec` and `metadata` are complex types. **Action:** Merge elements or subfields. + +- *list*: A field containing a list of items that can be either primitive types, maps, or complex types. + For example, `containers`, `ports`, and `args` are lists. **Action:** Varies. + +When `kubectl apply` updates a map or list field, it typically does +not replace the entire field, but instead updates the individual subelements. +For instance, when merging the `spec` on a Deployment, the entire `spec` is +not replaced. Instead the subfields of `spec`, such as `replicas`, are compared +and merged. + +### Merging changes to primitive fields + +Primative fieldss are replaced or cleared. + +**Note:** '-' is used for "not applicable" because the value is not used. + +| Field in object configuration file | Field in live object configuration | Field in last-applied-configuration | Action | +|-------------------------------------|------------------------------------|-------------------------------------|-------------------------------------------| +| Yes | Yes | - | Set live to configuration file value. | +| Yes | No | - | Set live to local configuration. | +| No | - | Yes | Clear from live configuration. | +| No | - | No | Do nothing. Keep live value. | + +### Merging changes to map or complex fields + +Fields that represent maps or complex-types are merged by comparing each of the sub fields or elements of of the map / complex-type: + +**Note:** '-' is used for "not applicable" because the value is not used. + +| Key in object configuration file | Key in live object configuration | Field in last-applied-configuration | Action | +|-------------------------------------|------------------------------------|-------------------------------------|----------------------------------| +| Yes | Yes | - | Compare sub fields values. | +| Yes | No | - | Set live to local configuration. | +| No | - | Yes | Delete from live configuration. | +| No | - | No | Do nothing. Keep live value. | + +### Merging changes for fields of type list + +Merging changes to a list uses one of three strategies: + +* Replace the list. +* Merge individual elements in a list of complex elements. +* Merge a list of primitive elements. + +The choice of strategy is made on a per-field basis. + +#### Replace the list + +Treat the list the same as a primitive field. Replace or delete the +entire list. This preserves ordering. + +**Example:** Use `kubectl apply` to update the `args` field of a Container in a Pod. This sets +the value of `args` in the live configuration to the value in the configuration file. +Any `args` elements that had previously been added to the live configuration are lost. +The order of the `args` elements defined in the configuration file is +retained in the live configuration. + +```yaml +# last-applied-configuration value + args: ["a, b"] + +# configuration file value + args: ["a", "c"] + +# live configuration + args: ["a", "b", "d"] + +# result after merge + args: ["a", "c"] +``` + +**Explanation:** The merge used the configuration file value as the new list value. + +#### Merge individual elements of a list of complex elements: + +Treat the list as a map, and treat a specific field of each element as a key. +Add, delete, or update individual elements. This does not preserve ordering. + +This merge strategy uses a special tag on each field called a `mergeKey`. The +`mergeKey` is defined for each field in the Kubernetes source code: +[types.go](https://github.com/kubernetes/kubernetes/blob/master/pkg/api/v1/types.go#L2119) +When merging a list of complex elements, the field specified as the `mergeKey` for a given element +is used like a map key for that element. + +**Example:** Use `kubectl apply` to update the `containers` field of a PodSpec. +This merges the list as though `containers` was a map where each element is keyed +by `name`. + +```yaml +# last-applied-configuration value + containers: + - name: nginx + image: nginx:1.10 + - name: nginx-helper-a # key: nginx-helper-a; will be deleted in result + image: helper:1.3 + - name: nginx-helper-b # key: nginx-helper-b; will be retained + image: helper:1.3 + +# configuration file value + containers: + - name: nginx + image: nginx:1.11 + - name: nginx-helper-b + image: helper:1.3 + - name: nginx-helper-c # key: nginx-helper-c; will be added in result + image: helper:1.3 + +# live configuration + containers: + - name: nginx + image: nginx:1.10 + - name: nginx-helper-a + image: helper:1.3 + - name: nginx-helper-b + image: helper:1.3 + args: ["run"] # Field will be retained + - name: nginx-helper-d # key: nginx-helper-d; will be retained + image: helper:1.3 + +# result after merge + containers: + - name: nginx + image: nginx:1.10 + # Element nginx-helper-a was deleted + - name: nginx-helper-b + image: helper:1.3 + args: ["run"] # Field was retained + - name: nginx-helper-c # Element was added + image: helper:1.3 + - name: nginx-helper-d # Element was ignored + image: helper:1.3 +``` + +**Explanation:** + +- The container named "nginx-helper-a" was deleted because no container + named "nginx-helper-a" appeared in the configuration file. +- The container named "nginx-helper-b" retained the changes to `args` + in the live configuration. `kubectl apply` was able to identify + that "nginx-helper-b" in the live configuration was the same + "nginx-helper-b" as in the configuration file, even though their fields + had different values (no `args` in the configuration file). This is + because the `mergeKey` field value (name) was identical in both. +- The container named "nginx-helper-c" was added because no container + with that name appeared in the live configuration, but one with + that name appeared in the configuration file. +- The container named "nginx-helper-d" was retained because + no element with that name appeared in the last-applied-configuration. + +#### Merge a list of primitive elements + +As of Kubernetes 1.5, merging lists of primitive elements is not supported. + +**Note:** Which of the above strategies is chosen for a given field is controlled by +the `patchStrategy` tag in [types.go](https://github.com/kubernetes/kubernetes/blob/master/pkg/api/v1/types.go#L2119) +If no `patchStrategy` is specified for a field of type list, then +the list is replaced. + +{% comment %} +TODO(pwittrock): Uncomment this for 1.6 + +- Treat the list as a set of primitives. Replace or delete individual + elements. Does not preserve ordering. Does not preserve duplicates. + +**Example:** Using apply to update the `finalizers` field of ObjectMeta +keeps elements added to the live configuration. Ordering of finalizers +is lost. +{% endcomment %} + +## Default field values + +The API server sets certain fields to default values in the live configuration if they are +not specified when the object is created. + +Here's a configuration file for a Deployment. The file does not specify `strategy` or `selector`: + +{% include code.html language="yaml" file="simple_deployment.yaml" ghlink="/docs/concepts/tools/simple_deployment.yaml" %} + +Create the object using `kubectl apply`: + +```shell +kubectl apply -f http://k8s.io/docs/concepts/tools/kubectl/simple_deployment.yaml +``` + +Print the live configuration using `kubectl get`: + +```shell +kubectl get -f http://k8s.io/docs/concepts/tools/kubectl/simple_deployment.yaml -o yaml +``` + +The output shows that the API server set several fields to default values in the live +configuration. These fields were not specified in the configuration file. + +```shell +apiVersion: extensions/v1beta1 +kind: Deployment +# ... +spec: + minReadySeconds: 5 + replicas: 1 # defaulted by apiserver + selector: + matchLabels: # defaulted by apiserver - derived from template.metadata.labels + app: nginx + strategy: + rollingUpdate: # defaulted by apiserver - derived from strategy.type + maxSurge: 1 + maxUnavailable: 1 + type: RollingUpdate # defaulted apiserver + template: + metadata: + creationTimestamp: null + labels: + app: nginx + spec: + containers: + - image: nginx:1.7.9 + imagePullPolicy: IfNotPresent # defaulted by apiserver + name: nginx + ports: + - containerPort: 80 + protocol: TCP # defaulted by apiserver + resources: {} # defaulted by apiserver + terminationMessagePath: /dev/termination-log # defaulted by apiserver + dnsPolicy: ClusterFirst # defaulted by apiserver + restartPolicy: Always # defaulted by apiserver + securityContext: {} # defaulted by apiserver + terminationGracePeriodSeconds: 30 # defaulted by apiserver +# ... +``` + +**Note:** Some of the fields' default values have been derived from +the values of other fields that were specified in the configuration file, +such as the `selector` field. + +In a patch request, defaulted fields are not re-defaulted unless they are explicitly cleared +as part of a patch request. This can cause unexpected behavior for +fields that are defaulted based +on the values of other fields. When the other fields are later changed, +the values defaulted from them will not be updated unless they are +explicitly cleared. + +For this reason, it is recommended that certain fields defaulted +by the server are explicitly defined in the configuration file, even +if the desired values match the server defaults. This makes it +easier to recognize conflicting values that will not be re-defaulted +by the server. + +**Example:** + +```yaml +# last-applied-configuration +spec: + template: + metadata: + labels: + app: nginx + spec: + containers: + - name: nginx + image: nginx:1.7.9 + ports: + - containerPort: 80 + +# configuration file +spec: + strategy: + type: Recreate # updated value + template: + metadata: + labels: + app: nginx + spec: + containers: + - name: nginx + image: nginx:1.7.9 + ports: + - containerPort: 80 + +# live configuration +spec: + strategy: + type: RollingUpdate # defaulted value + rollingUpdate: # defaulted value derived from type + maxSurge : 1 + maxUnavailable: 1 + template: + metadata: + labels: + app: nginx + spec: + containers: + - name: nginx + image: nginx:1.7.9 + ports: + - containerPort: 80 + +# result after merge - ERROR! +spec: + strategy: + type: Recreate # updated value: incompatible with rollingUpdate + rollingUpdate: # defaulted value: incompatible with "type: Recreate" + maxSurge : 1 + maxUnavailable: 1 + template: + metadata: + labels: + app: nginx + spec: + containers: + - name: nginx + image: nginx:1.7.9 + ports: + - containerPort: 80 +``` + +**Explanation:** + +1. The user creates a Deployment without defining `strategy.type`. +2. The server defaults `strategy.type` to `RollingUpdate` and defaults the + `strategy.rollingUpdate` values. +3. The user changes `strategy.type` to `Recreate`. The `strategy.rollingUpdate` + values remain at their defaulted values, though the server expects them to be cleared. + If the `strategy.rollingUpdate` values had been defined initially in the configuration file, + it would have been more clear that they needed to be deleted. +4. Apply fails because `strategy.rollingUpdate` is not cleared. The `strategy.rollingupdate` + field cannot be defined with a `strategy.type` of `Recreate`. + +Recommendation: These fields should be explicitly defined in the object configuration file: + +- Selectors and PodTemplate labels on workloads, such as Deployment, StatefulSet, Job, DaemonSet, + ReplicaSet, and ReplicationController +- Deployment rollout strategy + +### How to clear server-defaulted fields or fields set by other writers + +As of Kubernetes 1.5, fields that do not appear in the configuration file cannot be +cleared by a merge operation. Here are some workarounds: + +Option 1: Remove the field by directly modifying the live object. + +**Note:** As of Kubernetes 1.5, `kubectl edit` does not work with `kubectl apply`. +Using these together will cause unexpected behavior. + +Option 2: Remove the field through the configuration file. + +1. Add the field to the configuration file to match the live object. +1. Apply the configuration file; this updates the annotation to include the field. +1. Delete the field from the configuration file. +1. Apply the configuration file; this deletes the field from the live object and annotation. + +{% comment %} +TODO(1.6): Update this with the following for 1.6 + +Fields that do not appear in the configuration file can be cleared by +setting their values to `null` and then applying the configuration file. +For fields defaulted by the server, this triggers re-defaulting +the values. +{% endcomment %} + +## How to change ownership of a field between the configuration file and direct imperative writers + +These are the only methods you should use to change an individual object field: + +- Use `kubectl apply`. +- Write directly to the live configuration without modifying the configuration file: +for example, use `kubectl scale`. + +### Changing the owner from a direct imperative writer to a configuration file + +Add the field to the configuration file. For the field, discontinue direct updates to +the live configuration that do not go through `kubectl apply`. + +### Changing the owner from a configuration file to a direct imperative writer + +As of Kubernetes 1.5, changing ownership of a field from a configuration file to +an imperative writer requires manual steps: + +- Remove the field from the configuration file. +- Remove the field from the `kubectl.kubernetes.io/last-applied-configuration` annotation on the live object. + +## Changing management methods + +Kubernetes objects should be managed using only one method at a time. +Switching from one method to another is possible, but is a manual process. + +**Exception:** It is OK to use imperative deletion with declarative management. + +{% comment %} +TODO(pwittrock): We need to make using imperative commands with +declarative object configuration work so that it doesn't write the +fields to the annotation, and instead. Then add this bullet point. + +- using imperative commands with declarative configuration to manage where each manages different fields. +{% endcomment %} + +### Migrating from imperative command management to declarative object configuration + +Migrating from imperative command management to declarative object +configuration involves several manual steps: + +1. Export the live object to a local configuration file: + + kubectl get / -o yaml --export > _.yaml + +1. Manually remove the `status` field from the configuration file. + + **Note:** This step is optional, as `kubectl apply` does not update the status field + even if it is present in the configuration file. + +1. Set the `kubectl.kubernetes.io/last-applied-configuration` annotation on the object: + + kubectl replace --save-config -f _.yaml + +1. Change processes to use `kubectl apply` for managing the object exclusively. + +{% comment %} +TODO(pwittrock): Why doesn't export remove the status field? Seems like it should. +{% endcomment %} + +### Migrating from imperative object configuration to declarative object configuration + +1. Set the `kubectl.kubernetes.io/last-applied-configuration` annotation on the object: + + kubectl replace --save-config -f _.yaml + +1. Change processes to use `kubectl apply` for managing the object exclusively. + +## Defining controller selectors and PodTemplate labels + +**Warning**: Updating selectors on controllers is strongly discouraged. + +The recommended approach is to define a single, immutable PodTemplate label +used only by the controller selector with no other semantic meaning. + +**Example:** + +```yaml +selector: + matchLabels: + controller-selector: "v1beta1/deployment/nginx" +template: + metadata: + labels: + controller-selector: "v1beta1/deployment/nginx" +``` + +## Support for ThirdPartyResources + +As of Kubernetes 1.5, ThirdPartyResources are not supported by `kubectl apply`. +The recommended approach for ThirdPartyResources is to use [imperative object configuration](/docs/concepts/tools/kubectl/object-management-using-imperative-config/). +{% endcapture %} + +{% capture whatsnext %} +- [Managing Kubernetes Objects Using Imperative Commands](/docs/concepts/tools/kubectl/object-management-using-imperative-commands/) +- [Imperative Management of Kubernetes Objects Using Configuration Files](/docs/concepts/tools/kubectl/object-management-using-imperative-config/) +- [Kubectl Command Reference](/docs/user-guide/kubectl/v1.5/) +- [Kubernetes Object Schema Reference](/docs/resources-reference/v1.5/) +{% endcapture %} + +{% include templates/concept.md %} diff --git a/docs/concepts/tools/kubectl/object-management-using-imperative-commands.md b/docs/concepts/tools/kubectl/object-management-using-imperative-commands.md new file mode 100644 index 0000000000..b49114f04a --- /dev/null +++ b/docs/concepts/tools/kubectl/object-management-using-imperative-commands.md @@ -0,0 +1,159 @@ +--- +title: Managing Kubernetes Objects Using Imperative Commands +--- + +{% capture overview %} +Kubernetes objects can quickly be created, updated, and deleted directly using +imperative commands built into the `kubectl` command-line tool. This document +explains how those commands are organized and how to use them to manage live objects. +{% endcapture %} + +{% capture body %} + +## Trade-offs + +The `kubectl` tool supports three kinds of object management: + +* Imperative commands +* Imperative object configuration +* Declarative object configuration + +See [Kubernetes Object Management](/docs/concepts/tools/kubectl/object-management-overview/) +for a discussion of the advantages and disadvantage of each kind of object management. + +## How to create objects + +The `kubectl` tool supports verb-driven commands for creating some of the most common +object types. The commands are named to be recognizable to users unfamiliar with +the Kubernetes object types. + +- `run`: Create a new Deployment object to run Containers in one or more Pods. +- `expose`: Create a new Service object to load balance traffic across Pods. +- `autoscale`: Create a new Autoscaler object to automatically horizontally scale a controller, such as a Deployment. + +The `kubectl` tool also supports creation commands driven by object type. +These commands support more object types and are more explicit about +their intent, but require users to know the type of objects they intend +to create. + +- `create [] ` + +Some objects types have subtypes that you can specify in the `create` command. +For example, the Service object has several subtypes including ClusterIP, +LoadBalancer, and NodePort. Here's an example that creates a Service with +subtype NodePort: + +```shell +kubectl create service nodeport +``` + +In the preceding example, the `create service nodeport` command is called +a subcommand of the `create service` command. + +You can use the `-h` flag to find the arguments and flags supported by +a subcommand: + +```shell +kubectl create service nodeport -h +``` + +## How to update objects + +The `kubectl` command supports verb-driven commands for some common update operations. +These commands are named to enable users unfamiliar with Kubernetes +objects to perform updates without knowing the specific fields +that must be set: + +- `scale`: Horizontally scale a controller to add or remove Pods by updating the replica count of the controller. +- `annotate`: Add or remove an annotation from an object. +- `label`: Add or remove a label from an object. + +The `kubectl` command also supports update commands driven by an aspect of the object. +Setting this aspect may set different fields for different object types: + +- `set` : Set an aspect of an object. + +**Note**: In Kubernetes version 1.5, not every verb-driven command has an +associated field-driven command. + +The `kubectl` tool supports these additional ways to update a live object directly, +however they require a better understanding of the Kubernetes object schema. + +- `edit`: Directly edit the raw configuration of a live object by opening its configuration in an editor. +- `patch`: Directly modify specific fields of a live object by using a patch string. +For more details on patch strings, see the patch section in +[API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/api-conventions.md#patch-operations). + +## How to delete objects + +You can use the `delete` command to delete an object from a cluster: + +- `delete /` + +**Note**: You can use `kubectl delete` for both imperative commands and imperative object +configuration. The difference is in the arguments passed to the command. To use +`kubectl delete` as an imperative command, pass the object to be deleted as +an argument. Here's an example that passes a Deployment object named nginx: + +```shell +kubectl delete deployment/nginx +``` + +## How to view an object + +{% comment %} +TODO(pwittrock): Uncomment this when implemented. + +You can use `kubectl view` to print specific fields of an object. + +- `view`: Prints the value of a specific field of an object. + +{% endcomment %} + + + +There are several commands for printing information about an object: + +- `get`: Prints basic information about matching objects. Use `get -h` to see a list of options. +- `describe`: Prints aggregated detailed information about matching objects. +- `logs`: Prints the stdout and stderr for a container running in a Pod. + +## Using `set` commands to modify objects before creation + +There are some object fields that don't have a flag you can use +in a `create` command. In some of those cases, you can use a combination of +`set` and `create` to specify a value for the field before object +creation. This is done by piping the output of the `create` command to the +`set` command, and then back to the `create` command. Here's an example: + +```sh +kubectl create service clusterip -o yaml --dry-run | kubectl set selector --local -f - 'environment=qa' -o yaml | kubectl create -f - +``` + +1. The `create service -o yaml --dry-run` command creates the configuration for the Service, but prints it to stdout as YAML instead of sending it to the Kubernetes API server. +1. The `set --local -f - -o yaml` command reads the configuration from stdin, and writes the updated configuration to stdout as YAML. +1. The `kubectl create -f -` command creates the object using the configuration provided via stdin. + +## Using `--edit` to modify objects before creation + +You can use `kubectl create --edit` to make arbitrary changes to an object +before it is created. Here's an example: + +```sh +kubectl create service clusterip my-svc -o yaml --dry-run > /tmp/srv.yaml +kubectl create --edit -f /tmp/srv.yaml +``` + +1. The `create service` command creates the configuration for the Service and saves it to `/tmp/srv.yaml`. +1. The `create --edit` command opens the configuration file for editing before it creates the object. + +{% endcapture %} + +{% capture whatsnext %} +- [Managing Kubernetes Objects Using Object Configuration (Imperative)](/docs/concepts/tools/kubectl/object-management-using-imperative-config/) +- [Managing Kubernetes Objects Using Object Configuration (Declarative)](/docs/concepts/tools/kubectl/object-management-using-declarative-config/) +- [Kubectl Command Reference](/docs/user-guide/kubectl/v1.5/) +- [Kubernetes Object Schema Reference](/docs/resources-reference/v1.5/) +{% endcapture %} + +{% include templates/concept.md %} diff --git a/docs/concepts/tools/kubectl/object-management-using-imperative-config.md b/docs/concepts/tools/kubectl/object-management-using-imperative-config.md new file mode 100644 index 0000000000..2ce6319749 --- /dev/null +++ b/docs/concepts/tools/kubectl/object-management-using-imperative-config.md @@ -0,0 +1,129 @@ +--- +title: Imperative Management of Kubernetes Objects Using Configuration Files +--- + +{% capture overview %} +Kubernetes objects can be created, updated, and deleted by using the `kubectl` +command-line tool along with an object configuration file written in YAML or JSON. +This document explains how to define and manage objects using configuration files. +{% endcapture %} + +{% capture body %} + +## Trade-offs + +The `kubectl` tool supports three kinds of object management: + +* Imperative commands +* Imperative object configuration +* Declarative object configuration + +See [Kubernetes Object Management](/docs/concepts/tools/kubectl/object-management-overview/) +for a discussion of the advantages and disadvantage of each kind of object management. + +## How to create objects + +You can use `kubectl create -f` to create an object from a configuration file. +Refer to the [kubernetes object schema reference](/docs/resources-reference/v1.5/) +for details. + +- `create -f ` + +## How to update objects + +You can use `kubectl replace -f` to update a live object according to a +configuration file. + +- `replace -f ` + +## How to delete objects + +You can use `kubectl delete -f` to delete an object that is described in a +configuration file. + +- `delete -f ` + +## How to view an object + +You can use `kubectl get -f` to view information about an object that is +described in a configuration file. + +- `get -f -o yaml` + +The `-o yaml` flag specifies that the full object configuration is printed. +Use `get -h` to see a list of options. + +## Limitations + +The `create`, `replace`, and `delete` commands work well when each object's +configuration is fully defined and recorded in its configuration +file. However when a live object is updated, and the updates are not merged +into its configuration file, the updates will be lost the next time a `replace` +is executed. This is can happen if a controller, such as +a HorizontalPodAutoscaler, makes updates directly to a live object. Here's +an example: + +1. You create an object from a configuration file. +1. Another source updates the object by changing some field. +1. You replace the object from the configuration file. Changes made by +the other source in step 2 are lost. + +If you need to support multiple writers to the same object, you can use +`kubectl apply` to manage the object. + +## Creating and editing an object from a URL without saving the configuration + +Suppose you have the URL of an object configuration file. You can use +`kubectl create --edit` to make changes to the configuration before the +object is created. This is particularly useful for tutorials and tasks +that point to a configuration file that could be modified by the reader. + +```sh +kubectl create -f --edit +``` + +## Migrating from imperative commands to imperative object configuration + +Migrating from imperative commands to imperative object configuration involves +several manual steps. + +1. Export the live object to a local object configuration file: + + kubectl get / -o yaml --export > _.yaml + +1. Manually remove the status field from the object configuration file. + +1. For subsequent object management, use `replace` exclusively. + + kubectl replace -f _.yaml + + +## Defining controller selectors and PodTemplate labels + +**Warning**: Updating selectors on controllers is strongly discouraged. + +The recommended approach is to define a single, immutable PodTemplate label +used only by the controller selector with no other semantic meaning. + +Example label: + +```yaml +selector: + matchLabels: + controller-selector: "v1beta1/deployment/nginx" +template: + metadata: + labels: + controller-selector: "v1beta1/deployment/nginx" +``` + +{% endcapture %} + +{% capture whatsnext %} +- [Managing Kubernetes Objects Using Imperative Commands](/docs/concepts/tools/kubectl/object-management-using-imperative-commands/) +- [Managing Kubernetes Objects Using Object Configuration (Declarative)](/docs/concepts/tools/kubectl/object-management-using-declarative-config/) +- [Kubectl Command Reference](/docs/user-guide/kubectl/v1.5/) +- [Kubernetes Object Schema Reference](/docs/resources-reference/v1.5/) +{% endcapture %} + +{% include templates/concept.md %} diff --git a/docs/concepts/tools/kubectl/simple_deployment.yaml b/docs/concepts/tools/kubectl/simple_deployment.yaml new file mode 100644 index 0000000000..0348883c24 --- /dev/null +++ b/docs/concepts/tools/kubectl/simple_deployment.yaml @@ -0,0 +1,16 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: nginx-deployment +spec: + minReadySeconds: 5 + template: + metadata: + labels: + app: nginx + spec: + containers: + - name: nginx + image: nginx:1.7.9 + ports: + - containerPort: 80 diff --git a/docs/concepts/tools/kubectl/update_deployment.yaml b/docs/concepts/tools/kubectl/update_deployment.yaml new file mode 100644 index 0000000000..d2c2d82010 --- /dev/null +++ b/docs/concepts/tools/kubectl/update_deployment.yaml @@ -0,0 +1,15 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + name: nginx-deployment +spec: + template: + metadata: + labels: + app: nginx + spec: + containers: + - name: nginx + image: nginx:1.11.9 # update the image + ports: + - containerPort: 80 From db6506f640b8a0c68596fcacc0f7452b4db58b04 Mon Sep 17 00:00:00 2001 From: Phillip Wittrock Date: Wed, 1 Feb 2017 12:23:23 -0800 Subject: [PATCH 095/113] fix missnamed field in declarative docs --- .../kubectl/object-management-using-declarative-config.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/concepts/tools/kubectl/object-management-using-declarative-config.md b/docs/concepts/tools/kubectl/object-management-using-declarative-config.md index ce90126be8..593e6ffe58 100644 --- a/docs/concepts/tools/kubectl/object-management-using-declarative-config.md +++ b/docs/concepts/tools/kubectl/object-management-using-declarative-config.md @@ -574,10 +574,10 @@ retained in the live configuration. Treat the list as a map, and treat a specific field of each element as a key. Add, delete, or update individual elements. This does not preserve ordering. -This merge strategy uses a special tag on each field called a `mergeKey`. The -`mergeKey` is defined for each field in the Kubernetes source code: +This merge strategy uses a special tag on each field called a `patchMergeKey`. The +`patchMergeKey` is defined for each field in the Kubernetes source code: [types.go](https://github.com/kubernetes/kubernetes/blob/master/pkg/api/v1/types.go#L2119) -When merging a list of complex elements, the field specified as the `mergeKey` for a given element +When merging a list of complex elements, the field specified as the `patchMergeKey` for a given element is used like a map key for that element. **Example:** Use `kubectl apply` to update the `containers` field of a PodSpec. @@ -638,7 +638,7 @@ by `name`. that "nginx-helper-b" in the live configuration was the same "nginx-helper-b" as in the configuration file, even though their fields had different values (no `args` in the configuration file). This is - because the `mergeKey` field value (name) was identical in both. + because the `patchMergeKey` field value (name) was identical in both. - The container named "nginx-helper-c" was added because no container with that name appeared in the live configuration, but one with that name appeared in the configuration file. From 9891d65d3e27511e9e4ed2ff5c75b481ee8c4a57 Mon Sep 17 00:00:00 2001 From: steveperry-53 Date: Wed, 1 Feb 2017 15:05:34 -0800 Subject: [PATCH 096/113] Change name of include file for moved content. --- _includes/{redirection-note.md => user-guide-content-moved.md} | 0 docs/user-guide/containers.md | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename _includes/{redirection-note.md => user-guide-content-moved.md} (100%) diff --git a/_includes/redirection-note.md b/_includes/user-guide-content-moved.md similarity index 100% rename from _includes/redirection-note.md rename to _includes/user-guide-content-moved.md diff --git a/docs/user-guide/containers.md b/docs/user-guide/containers.md index 14d1ded7fb..dfe48ade49 100644 --- a/docs/user-guide/containers.md +++ b/docs/user-guide/containers.md @@ -4,7 +4,7 @@ assignees: title: Commands and Capabilities --- -{% include redirection-note.md %} +{% include user-guide-content-moved.md %} * [Container Command and Arguments](/docs/concepts/configuration/container-command-args/) * [Container Capabilities](/docs/concepts/policy/container-capabilities/) From 6cb33d02c4886f72960c48362e8a0302264138cc Mon Sep 17 00:00:00 2001 From: steveperry-53 Date: Wed, 1 Feb 2017 16:30:34 -0800 Subject: [PATCH 097/113] Put moved notice on User Guide pages. --- _data/guides.yml | 4 ++++ docs/tasks/index.md | 9 --------- docs/user-guide/configuring-containers.md | 7 +++++++ docs/user-guide/pods/single-container.md | 7 +++++++ docs/user-guide/production-pods.md | 23 +++++++++++++++++++++++ docs/user-guide/simple-nginx.md | 7 +++++++ 6 files changed, 48 insertions(+), 9 deletions(-) create mode 100644 docs/user-guide/configuring-containers.md create mode 100644 docs/user-guide/pods/single-container.md create mode 100644 docs/user-guide/production-pods.md create mode 100644 docs/user-guide/simple-nginx.md diff --git a/_data/guides.yml b/_data/guides.yml index 3c7064014e..511ece0885 100644 --- a/_data/guides.yml +++ b/_data/guides.yml @@ -56,9 +56,13 @@ toc: - title: Containers and Pods section: + - docs/user-guide/simple-nginx.md + - docs/user-guide/pods/single-container.md - docs/user-guide/pods/multi-container.md - docs/user-guide/pods/init-container.md + - docs/user-guide/configuring-containers.md - docs/user-guide/pod-templates.md + - docs/user-guide/production-pods.md - docs/user-guide/containers.md - docs/user-guide/environment-guide/index.md - docs/user-guide/compute-resources.md diff --git a/docs/tasks/index.md b/docs/tasks/index.md index 242c1dca75..39f81c6751 100644 --- a/docs/tasks/index.md +++ b/docs/tasks/index.md @@ -1,14 +1,5 @@ --- title: Tasks -redirect_from: -- "/docs/user-guide/production-pods/" -- "/docs/user-guide/production-pods.html" -- "/docs/user-guide/simple-nginx/" -- "/docs/user-guide/simple-nginx.html" -- "/docs/user-guide/pods/single-container/" -- "/docs/user-guide/pods/single-container.html" -- "/docs/user-guide/configuring-containers/" -- "/docs/user-guide/configuring-containers.html" --- This section of the Kubernetes documentation contains pages that diff --git a/docs/user-guide/configuring-containers.md b/docs/user-guide/configuring-containers.md new file mode 100644 index 0000000000..8e09d7aaa4 --- /dev/null +++ b/docs/user-guide/configuring-containers.md @@ -0,0 +1,7 @@ +--- +title: Configuring Containers +--- + +{% include user-guide-content-moved.md %} + +[Tasks](/docs/tasks/) diff --git a/docs/user-guide/pods/single-container.md b/docs/user-guide/pods/single-container.md new file mode 100644 index 0000000000..fd7a44ba66 --- /dev/null +++ b/docs/user-guide/pods/single-container.md @@ -0,0 +1,7 @@ +--- +title: Creating Single-Container Pods +--- + +{% include user-guide-content-moved.md %} + +[Running a Stateless Application Using a Deployment](/docs/tutorials/stateless-application/run-stateless-application-deployment/) diff --git a/docs/user-guide/production-pods.md b/docs/user-guide/production-pods.md new file mode 100644 index 0000000000..5ea3a0edd5 --- /dev/null +++ b/docs/user-guide/production-pods.md @@ -0,0 +1,23 @@ +--- +title: Working with Containers in Production +--- + +{% include user-guide-content-moved.md %} + +* [Configuring a Pod to Use a Volume for Storage](/docs/tasks/configure-pod-container/configure-volume-storage/) + +* [Distributing Credentials Securely](/docs/tasks/configure-pod-container/distribute-credentials-secure/) + +* [Pulling an Image from a Private Registry](/docs/tasks/configure-pod-container/pull-image-private-registry/) + +* [Communicating Between Containers Running in the Same Pod](/docs/tasks/configure-pod-container/communicate-containers-same-pod/) + +* [Assigning CPU and RAM Resources to a Container](/docs/tasks/configure-pod-container/assign-cpu-ram-container/) + +* [Configuring Liveness and Readiness Probes](/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/) + +* [Configuring Pod Initialization](/docs/tasks/configure-pod-container/configure-pod-initialization/) + +* [Attaching Handlers to Container Lifecycle Events](/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/) + +* [Determining the Reason for Pod Failure](/docs/tasks/debug-application-cluster/determine-reason-pod-failure/) diff --git a/docs/user-guide/simple-nginx.md b/docs/user-guide/simple-nginx.md new file mode 100644 index 0000000000..2a6b11133f --- /dev/null +++ b/docs/user-guide/simple-nginx.md @@ -0,0 +1,7 @@ +--- +title: Running Your First Containers +--- + +{% include user-guide-content-moved.md %} + +[Running a Stateless Application Using a Deployment](/docs/tutorials/stateless-application/run-stateless-application-deployment/) From 087ba3c9615e1750133d94702aa0362305946153 Mon Sep 17 00:00:00 2001 From: Vic Iglesias Date: Wed, 1 Feb 2017 12:02:51 -0800 Subject: [PATCH 098/113] Point to correct annotation in federated deployment --- docs/user-guide/federation/deployment.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/federation/deployment.md b/docs/user-guide/federation/deployment.md index f146ae72f6..51b092971d 100644 --- a/docs/user-guide/federation/deployment.md +++ b/docs/user-guide/federation/deployment.md @@ -75,7 +75,7 @@ if you have 3 registered clusters and you create a Federated Deployment with `spec.replicas=3`. To modify the number of replicas in each cluster, you can specify [FederatedReplicaSetPreference](https://github.com/kubernetes/kubernetes/blob/{{page.githubbranch}}/federation/apis/federation/types.go) -as an annotation with key `federation.kubernetes.io/replica-set-preferences` +as an annotation with key `federation.kubernetes.io/deployment-preferences` on Federated Deployment. From 6e42b5f6ceecb2b479f929735e730aef1a75c7a6 Mon Sep 17 00:00:00 2001 From: Phillip Wittrock Date: Wed, 1 Feb 2017 16:54:12 -0800 Subject: [PATCH 099/113] Fix url in declarative kubectl --- .../tools/kubectl/object-management-using-declarative-config.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/concepts/tools/kubectl/object-management-using-declarative-config.md b/docs/concepts/tools/kubectl/object-management-using-declarative-config.md index 593e6ffe58..4c960e567b 100644 --- a/docs/concepts/tools/kubectl/object-management-using-declarative-config.md +++ b/docs/concepts/tools/kubectl/object-management-using-declarative-config.md @@ -242,7 +242,7 @@ Update the `simple_deployment.yaml` configuration file to change the image from Apply the changes made to the configuration file: ```shell -kubectl apply -f http://k8s.io/docs/concepts/tools/kubectl/updated_deployment.yaml +kubectl apply -f http://k8s.io/docs/concepts/tools/kubectl/update_deployment.yaml ``` Print the live configuration using `kubectl get`: From 17db79a87550b3bdb066ef48907703e5c6149e73 Mon Sep 17 00:00:00 2001 From: Phillip Wittrock Date: Wed, 1 Feb 2017 16:57:58 -0800 Subject: [PATCH 100/113] Change label selector tag to use full gvkn instead of vkn --- .../kubectl/object-management-using-declarative-config.md | 4 ++-- .../kubectl/object-management-using-imperative-config.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/concepts/tools/kubectl/object-management-using-declarative-config.md b/docs/concepts/tools/kubectl/object-management-using-declarative-config.md index 4c960e567b..264a803b76 100644 --- a/docs/concepts/tools/kubectl/object-management-using-declarative-config.md +++ b/docs/concepts/tools/kubectl/object-management-using-declarative-config.md @@ -935,11 +935,11 @@ used only by the controller selector with no other semantic meaning. ```yaml selector: matchLabels: - controller-selector: "v1beta1/deployment/nginx" + controller-selector: "extensions/v1beta1/deployment/nginx" template: metadata: labels: - controller-selector: "v1beta1/deployment/nginx" + controller-selector: "extensions/v1beta1/deployment/nginx" ``` ## Support for ThirdPartyResources diff --git a/docs/concepts/tools/kubectl/object-management-using-imperative-config.md b/docs/concepts/tools/kubectl/object-management-using-imperative-config.md index 2ce6319749..065e27c6dd 100644 --- a/docs/concepts/tools/kubectl/object-management-using-imperative-config.md +++ b/docs/concepts/tools/kubectl/object-management-using-imperative-config.md @@ -110,11 +110,11 @@ Example label: ```yaml selector: matchLabels: - controller-selector: "v1beta1/deployment/nginx" + controller-selector: "extensions/v1beta1/deployment/nginx" template: metadata: labels: - controller-selector: "v1beta1/deployment/nginx" + controller-selector: "extensions/v1beta1/deployment/nginx" ``` {% endcapture %} From cef56d1d951cb48da94022a120d3286c6f9adc31 Mon Sep 17 00:00:00 2001 From: Phillip Wittrock Date: Wed, 1 Feb 2017 18:09:08 -0800 Subject: [PATCH 101/113] Minor wording updates --- ...object-management-using-declarative-config.md | 16 ++++++++-------- ...bject-management-using-imperative-commands.md | 2 +- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/concepts/tools/kubectl/object-management-using-declarative-config.md b/docs/concepts/tools/kubectl/object-management-using-declarative-config.md index 264a803b76..5033bbac8c 100644 --- a/docs/concepts/tools/kubectl/object-management-using-declarative-config.md +++ b/docs/concepts/tools/kubectl/object-management-using-declarative-config.md @@ -494,10 +494,10 @@ type of the field. There are several types of fields: - *primitive*: A field of type string, integer, or boolean. For example, `image` and `replicas` are primitive fields. **Action:** Replace. -- *map*, also called *object*: A field of type map or a complex type that contains subfields. For example `labels` - and `annotations` are maps; `spec` and `metadata` are complex types. **Action:** Merge elements or subfields. +- *map*, also called *object*: A field of type map or a complex type that contains subfields. For example, `labels`, + `annotations`,`spec` and `metadata` are all maps. **Action:** Merge elements or subfields. -- *list*: A field containing a list of items that can be either primitive types, maps, or complex types. +- *list*: A field containing a list of items that can be either primitive types or maps. For example, `containers`, `ports`, and `args` are lists. **Action:** Varies. When `kubectl apply` updates a map or list field, it typically does @@ -508,7 +508,7 @@ and merged. ### Merging changes to primitive fields -Primative fieldss are replaced or cleared. +Primitive fields are replaced or cleared. **Note:** '-' is used for "not applicable" because the value is not used. @@ -519,9 +519,9 @@ Primative fieldss are replaced or cleared. | No | - | Yes | Clear from live configuration. | | No | - | No | Do nothing. Keep live value. | -### Merging changes to map or complex fields +### Merging changes to map fields -Fields that represent maps or complex-types are merged by comparing each of the sub fields or elements of of the map / complex-type: +Fields that represent maps are merged by comparing each of the subfields or elements of of the map: **Note:** '-' is used for "not applicable" because the value is not used. @@ -577,11 +577,11 @@ Add, delete, or update individual elements. This does not preserve ordering. This merge strategy uses a special tag on each field called a `patchMergeKey`. The `patchMergeKey` is defined for each field in the Kubernetes source code: [types.go](https://github.com/kubernetes/kubernetes/blob/master/pkg/api/v1/types.go#L2119) -When merging a list of complex elements, the field specified as the `patchMergeKey` for a given element +When merging a list of maps, the field specified as the `patchMergeKey` for a given element is used like a map key for that element. **Example:** Use `kubectl apply` to update the `containers` field of a PodSpec. -This merges the list as though `containers` was a map where each element is keyed +This merges the list as though it was a map where each element is keyed by `name`. ```yaml diff --git a/docs/concepts/tools/kubectl/object-management-using-imperative-commands.md b/docs/concepts/tools/kubectl/object-management-using-imperative-commands.md index b49114f04a..372e5c0584 100644 --- a/docs/concepts/tools/kubectl/object-management-using-imperative-commands.md +++ b/docs/concepts/tools/kubectl/object-management-using-imperative-commands.md @@ -74,7 +74,7 @@ Setting this aspect may set different fields for different object types: - `set` : Set an aspect of an object. **Note**: In Kubernetes version 1.5, not every verb-driven command has an -associated field-driven command. +associated aspect-driven command. The `kubectl` tool supports these additional ways to update a live object directly, however they require a better understanding of the Kubernetes object schema. From 0ac53c2f979394e98645ef0742ac90ffbe742501 Mon Sep 17 00:00:00 2001 From: steveperry-53 Date: Wed, 1 Feb 2017 17:13:21 -0800 Subject: [PATCH 102/113] Put moved notice in persistent volume topic. --- .../configure-persistent-volume-storage.md | 3 - .../persistent-volumes/walkthrough.md | 122 +----------------- 2 files changed, 2 insertions(+), 123 deletions(-) diff --git a/docs/tasks/configure-pod-container/configure-persistent-volume-storage.md b/docs/tasks/configure-pod-container/configure-persistent-volume-storage.md index 95065e7a93..27b5249138 100644 --- a/docs/tasks/configure-pod-container/configure-persistent-volume-storage.md +++ b/docs/tasks/configure-pod-container/configure-persistent-volume-storage.md @@ -1,7 +1,4 @@ --- -redirect_from: -- "/docs/user-guide/persistent-volumes/walkthrough/" -- "/docs/user-guide/persistent-volumes/walkthrough.html" title: Configuring a Pod to Use a PersistentVolume for Storage --- diff --git a/docs/user-guide/persistent-volumes/walkthrough.md b/docs/user-guide/persistent-volumes/walkthrough.md index d1cd6a5812..2feee3f7d9 100644 --- a/docs/user-guide/persistent-volumes/walkthrough.md +++ b/docs/user-guide/persistent-volumes/walkthrough.md @@ -5,124 +5,6 @@ assignees: title: Persistent Volumes Walkthrough --- -The purpose of this guide is to help you become familiar with [Kubernetes Persistent Volumes](/docs/user-guide/persistent-volumes/). By the end of the guide, we'll have -nginx serving content from your persistent volume. +{% include user-guide-content-moved.md %} -You can view all the files for this example in [the docs repo -here](https://github.com/kubernetes/kubernetes.github.io/tree/{{page.docsbranch}}/docs/user-guide/persistent-volumes). - -This guide assumes knowledge of Kubernetes fundamentals and that you have a cluster up and running. - -See [Persistent Storage design document](https://github.com/kubernetes/kubernetes/blob/{{page.githubbranch}}/docs/design/persistent-storage.md) for more information. - -## Provisioning - -A Persistent Volume (PV) in Kubernetes represents a real piece of underlying storage capacity in the infrastructure. Cluster administrators -must first create storage (create their Google Compute Engine (GCE) disks, export their NFS shares, etc.) in order for Kubernetes to mount it. - -PVs are intended for "network volumes" like GCE Persistent Disks, NFS shares, and AWS ElasticBlockStore volumes. `HostPath` was included -for ease of development and testing. You'll create a local `HostPath` for this example. - -> IMPORTANT! For `HostPath` to work, you will need to run a single node cluster. Kubernetes does not -support local storage on the host at this time. There is no guarantee your pod ends up on the correct node where the `HostPath` resides. - -```shell -# This will be nginx's webroot; execute this on the node where your pod will run. -$ mkdir /tmp/data01 -$ echo 'I love Kubernetes storage!' > /tmp/data01/index.html -``` - -PVs are created by posting them to the API server. - -```shell -$ kubectl create -f docs/user-guide/persistent-volumes/volumes/local-01.yaml -NAME LABELS CAPACITY ACCESSMODES STATUS CLAIM REASON -pv0001 type=local 10737418240 RWO Available -``` - -### Access Control -Storage configured with GID will only allow writing by pods using the same GID. -Mismatched or missing GIDs will cause `permission denied` errors. Annotating a -`PersistentVolume` with a GID allows `Kubelet` to automatically add the GID to -the pod that requires it. No coordination between an admin and end user is -required. - -To annotate the volume's with a GID you use the `pv.beta.kubernetes.io/gid` -annotation as follows: - -```yaml -kind: PersistentVolume -apiVersion: v1 -metadata: - name: pv1 - annotations: - pv.beta.kubernetes.io/gid: "1234" -#... -``` - -When a pod consumes a PV with a GID annotation, the annotated GID is applied to -all containers in the pod in the same way GIDs specified in the pod's -[security context](/docs/user-guide/security-context/) are. Every GID, whether -it originates from a PV annotation or the pod's specification, is applied to -the first process run in each container, in addition to the container's primary -GID. Currently, the GIDs associated with PVs a pod consumes will not be present -on the pod resource itself, unlike GIDs specified in a pod's security context. - -## Requesting storage - -Users of Kubernetes request persistent storage for their pods. They don't know how the underlying cluster is provisioned. -They just know they can rely on their claim to storage and can manage its lifecycle independently from the many pods that may use it. - -Claims must be created in the same namespace as the pods that use them. - -```shell -$ kubectl create -f docs/user-guide/persistent-volumes/claims/claim-01.yaml - -$ kubectl get pvc -NAME LABELS STATUS VOLUME -myclaim-1 map[] - - -# A background process will attempt to match this claim to a volume. -# The eventual state of your claim will look something like this: - -$ kubectl get pvc -NAME LABELS STATUS VOLUME -myclaim-1 map[] Bound pv0001 - -$ kubectl get pv -NAME LABELS CAPACITY ACCESSMODES STATUS CLAIM REASON -pv0001 type=local 10737418240 RWO Bound default/myclaim-1 -``` - -## Using your claim as a volume - -Claims are used as volumes in pods. Kubernetes uses the claim to look up its bound PV. The PV is then exposed to the pod. - -```shell -$ kubectl create -f docs/user-guide/persistent-volumes/simpletest/pod.yaml - -$ kubectl get pods -NAME READY STATUS RESTARTS AGE -mypod 1/1 Running 0 1h - -$ kubectl create -f docs/user-guide/persistent-volumes/simpletest/service.json -$ kubectl get services -NAME CLUSTER_IP EXTERNAL_IP PORT(S) SELECTOR AGE -frontendservice 10.0.0.241 3000/TCP name=frontendhttp 1d -kubernetes 10.0.0.2 443/TCP 2d -``` - -## Next steps - -You should be able to query your service endpoint and see what content nginx is serving. A "forbidden" error might mean you -need to disable SELinux (setenforce 0). - -```shell -$ curl 10.0.0.241:3000 -I love Kubernetes storage! -``` - -Hopefully this simple guide is enough to get you started with PersistentVolumes. If you have any questions, join the team on [Slack](/docs/troubleshooting/#slack) and ask! - -Enjoy! +[Configuring a Pod to Use a Persistent Volume for Storage](/docs/tasks/configure-pod-container/configure-persistent-volume-storage/) From 96fb6e24151c14c7caeca5e515cfd45fbd2d3bb3 Mon Sep 17 00:00:00 2001 From: Marc Boorshtein Date: Thu, 2 Feb 2017 09:07:57 -0500 Subject: [PATCH 103/113] added code ticks on the oidc api parameters --- docs/admin/authentication.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/admin/authentication.md b/docs/admin/authentication.md index a7cca01126..7c59c955ac 100644 --- a/docs/admin/authentication.md +++ b/docs/admin/authentication.md @@ -250,11 +250,11 @@ To enable the plugin, configure the following flags on the API server: | Parameter | Description | Example | Required | | --------- | ----------- | ------- | ------- | -| --oidc-issuer-url | URL of the provider which allows the API server to discover public signing keys. Only URLs which use the `https://` scheme are accepted. This is typically the provider's discovery URL without a path, for example "https://accounts.google.com" or "https://login.salesforce.com". This URL should point to the level below .well-known/openid-configuration | If the discovery URL is https://accounts.google.com/.well-known/openid-configuration the value should be https://accounts.google.com | Yes | -| --oidc-client-id | A client id that all tokens must be issued for. | kubernetes | Yes | -| --oidc-username-claim | JWT claim to use as the user name. By default `sub`, which is expected to be a unique identifier of the end user. Admins can choose other claims, such as `email`, depending on their provider. | sub | No | -| --oidc-groups-claim | JWT claim to use as the user's group. If the claim is present it must be an array of strings. | groups | No | -| --oidc-ca-file | The path to the certificate for the CA that signed your identity provider's web certificate. Defaults to the host's root CAs. | `/etc/kubernetes/ssl/kc-ca.pem` | No | +| `--oidc-issuer-url` | URL of the provider which allows the API server to discover public signing keys. Only URLs which use the `https://` scheme are accepted. This is typically the provider's discovery URL without a path, for example "https://accounts.google.com" or "https://login.salesforce.com". This URL should point to the level below .well-known/openid-configuration | If the discovery URL is https://accounts.google.com/.well-known/openid-configuration the value should be https://accounts.google.com | Yes | +| `--oidc-client-id` | A client id that all tokens must be issued for. | kubernetes | Yes | +| `--oidc-username-claim` | JWT claim to use as the user name. By default `sub`, which is expected to be a unique identifier of the end user. Admins can choose other claims, such as `email`, depending on their provider. | sub | No | +| `--oidc-groups-claim` | JWT claim to use as the user's group. If the claim is present it must be an array of strings. | groups | No | +| `--oidc-ca-file` | The path to the certificate for the CA that signed your identity provider's web certificate. Defaults to the host's root CAs. | `/etc/kubernetes/ssl/kc-ca.pem` | No | Importantly, the API server is not an OAuth2 client, rather it can only be configured to trust a single issuer. This allows the use of public providers, From 011178a5da8363bb03d5bc53eb04e29a87d5c6d0 Mon Sep 17 00:00:00 2001 From: "Sean M. Collins" Date: Wed, 18 Jan 2017 16:40:57 -0500 Subject: [PATCH 104/113] [OpenStack-Heat] Use openstackclient to list the Heat stack python-openstackclient is a more modern tool --- docs/getting-started-guides/openstack-heat.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started-guides/openstack-heat.md b/docs/getting-started-guides/openstack-heat.md index ef41fc847f..e4fb7c277d 100644 --- a/docs/getting-started-guides/openstack-heat.md +++ b/docs/getting-started-guides/openstack-heat.md @@ -183,7 +183,7 @@ First, set your environment variables: To get all information about your cluster, use heat: ```sh -heat stack-show $STACK_NAME +openstack stack show $STACK_NAME ``` To see a list of nodes, use nova: From a92dced98306093c3a520cac075bfe8b60285e04 Mon Sep 17 00:00:00 2001 From: Henry Nash Date: Thu, 2 Feb 2017 10:28:52 -0800 Subject: [PATCH 105/113] Update api.md Minor typo correction --- docs/api.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/api.md b/docs/api.md index 2b18343fee..5f04cf0ccc 100644 --- a/docs/api.md +++ b/docs/api.md @@ -30,7 +30,7 @@ Complete API details are documented using [Swagger v1.2](http://swagger.io/) and We also host a version of the [latest v1.2 API documentation UI](http://kubernetes.io/kubernetes/third_party/swagger-ui/). This is updated with the latest release, so if you are using a different version of Kubernetes you will want to use the spec from your apiserver. -Staring kubernetes 1.4, OpenAPI spec is also available at `/swagger.json`. While we are transitioning from Swagger v1.2 to OpenAPI (aka Swagger v2.0), some of the tools such as kubectl and swagger-ui are still using v1.2 spec. OpenAPI spec is in Beta as of Kubernetes 1.5. +Staring with kubernetes 1.4, OpenAPI spec is also available at `/swagger.json`. While we are transitioning from Swagger v1.2 to OpenAPI (aka Swagger v2.0), some of the tools such as kubectl and swagger-ui are still using v1.2 spec. OpenAPI spec is in Beta as of Kubernetes 1.5. Kubernetes implements an alternative Protobuf based serialization format for the API that is primarily intended for intra-cluster communication, documented in the [design proposal](https://github.com/kubernetes/kubernetes/blob/{{ page.githubbranch }}/docs/proposals/protobuf.md) and the IDL files for each schema are located in the Go packages that define the API objects. From 1b4557f0d3cbe6fcd59f5e612e91ff217cb6068f Mon Sep 17 00:00:00 2001 From: Henry Nash Date: Thu, 2 Feb 2017 10:38:52 -0800 Subject: [PATCH 106/113] Update api.md Minor typo. --- docs/api.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/api.md b/docs/api.md index 5f04cf0ccc..1c85283028 100644 --- a/docs/api.md +++ b/docs/api.md @@ -30,7 +30,7 @@ Complete API details are documented using [Swagger v1.2](http://swagger.io/) and We also host a version of the [latest v1.2 API documentation UI](http://kubernetes.io/kubernetes/third_party/swagger-ui/). This is updated with the latest release, so if you are using a different version of Kubernetes you will want to use the spec from your apiserver. -Staring with kubernetes 1.4, OpenAPI spec is also available at `/swagger.json`. While we are transitioning from Swagger v1.2 to OpenAPI (aka Swagger v2.0), some of the tools such as kubectl and swagger-ui are still using v1.2 spec. OpenAPI spec is in Beta as of Kubernetes 1.5. +Starting with kubernetes 1.4, OpenAPI spec is also available at `/swagger.json`. While we are transitioning from Swagger v1.2 to OpenAPI (aka Swagger v2.0), some of the tools such as kubectl and swagger-ui are still using v1.2 spec. OpenAPI spec is in Beta as of Kubernetes 1.5. Kubernetes implements an alternative Protobuf based serialization format for the API that is primarily intended for intra-cluster communication, documented in the [design proposal](https://github.com/kubernetes/kubernetes/blob/{{ page.githubbranch }}/docs/proposals/protobuf.md) and the IDL files for each schema are located in the Go packages that define the API objects. From bf0e238e2b5f1da64c63fe125ece2b536f258ff5 Mon Sep 17 00:00:00 2001 From: hekra01 Date: Thu, 2 Feb 2017 13:33:04 -0800 Subject: [PATCH 107/113] Update docker-cli-to-kubectl.md typo in deployment name --- docs/user-guide/docker-cli-to-kubectl.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/docker-cli-to-kubectl.md b/docs/user-guide/docker-cli-to-kubectl.md index 8b92682874..e288d237ef 100644 --- a/docs/user-guide/docker-cli-to-kubectl.md +++ b/docs/user-guide/docker-cli-to-kubectl.md @@ -33,7 +33,7 @@ $ kubectl run --image=nginx nginx-app --port=80 --env="DOMAIN=cluster" deployment "nginx-app" created ``` -`kubectl run` creates a Deployment named "nginx" on Kubernetes cluster >= v1.2. If you are running older versions, it creates replication controllers instead. +`kubectl run` creates a Deployment named "nginx-app" on Kubernetes cluster >= v1.2. If you are running older versions, it creates replication controllers instead. If you want to obtain the old behavior, use `--generator=run/v1` to create replication controllers. See [`kubectl run`](/docs/user-guide/kubectl/kubectl_run/) for more details. Note that `kubectl` commands will print the type and name of the resource created or mutated, which can then be used in subsequent commands. Now, we can expose a new Service with the deployment created above: From e3368b9733f0513241dd21d63c2aa4a6afa91114 Mon Sep 17 00:00:00 2001 From: Shawn McCarthy Date: Wed, 1 Feb 2017 14:28:47 -0700 Subject: [PATCH 108/113] Use base64 -D instead of -d --- docs/getting-started-guides/kubeadm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started-guides/kubeadm.md b/docs/getting-started-guides/kubeadm.md index 40827c8825..a005ed0c56 100644 --- a/docs/getting-started-guides/kubeadm.md +++ b/docs/getting-started-guides/kubeadm.md @@ -352,7 +352,7 @@ Please note: `kubeadm` is a work in progress and these limitations will be addre 1. There is no built-in way of fetching the token easily once the cluster is up and running, but here is a `kubectl` command you can copy and paste that will print out the token for you: ```console - # kubectl -n kube-system get secret clusterinfo -o yaml | grep token-map | awk '{print $2}' | base64 -d | sed "s|{||g;s|}||g;s|:|.|g;s/\"//g;" | xargs echo + # kubectl -n kube-system get secret clusterinfo -o yaml | grep token-map | awk '{print $2}' | base64 -D | sed "s|{||g;s|}||g;s|:|.|g;s/\"//g;" | xargs echo ``` 1. If you are using VirtualBox (directly or via Vagrant), you will need to ensure that `hostname -i` returns a routable IP address (i.e. one on the second network interface, not the first one). From 592d61c55ca2a27b534e0accc96746f27eb0b54e Mon Sep 17 00:00:00 2001 From: Eric Chiang Date: Thu, 2 Feb 2017 13:46:28 -0800 Subject: [PATCH 109/113] docs/admin/authorization: discourage the use rbac-super-user flag Even though this flag works in 1.5, its use should be discouraged. It will be removed in 1.6. --- docs/admin/authorization.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/admin/authorization.md b/docs/admin/authorization.md index d398bba2c8..ce75c189f0 100644 --- a/docs/admin/authorization.md +++ b/docs/admin/authorization.md @@ -221,20 +221,20 @@ don't already have even when the RBAC authorizer it disabled__. If "user-1" does not have the ability to read secrets in "namespace-a", they cannot create a binding that would grant that permission to themselves or any other user. -For bootstrapping the first roles, it becomes necessary for someone to get -around these limitations. For the alpha release of RBAC, an API Server flag was -added to allow one user to step around all RBAC authorization and privilege -escalation checks. NOTE: _This is subject to change with future releases._ +When bootstrapping, superuser credentials should include the `system:masters` +group, for example by creating a client cert with `/O=system:masters`. This +gives those credentials full access to the API and allows an admin to then set +up bindings for other users. + +In Kubernetes versions 1.4 and 1.5, there was a similar flag that gave a user +full access: ``` --authorization-rbac-super-user=admin ``` -Once set the specified super user, in this case "admin", can be used to create -the roles and role bindings to initialize the system. - -This flag is optional and once the initial bootstrapping is performed can be -unset. +__This flag will be removed in 1.6__. Admins should prefer the `system:masters` +group when setting up clusters. ### Roles, RolesBindings, ClusterRoles, and ClusterRoleBindings From d268a3eaf4e82d61b94ae7d19271d26905b6da42 Mon Sep 17 00:00:00 2001 From: Aneesh Kumar Date: Thu, 2 Feb 2017 01:05:15 +0530 Subject: [PATCH 110/113] Fix for redundant footer section in home page. This commit removes redundant footer section in the Home page. --- index.html | 1 - 1 file changed, 1 deletion(-) diff --git a/index.html b/index.html index 5e860832d7..30cb9264b5 100644 --- a/index.html +++ b/index.html @@ -172,7 +172,6 @@ cid: home
-{% include footer.html %}
From e64c482469c7d28bfa94c4b2d5540959956a7eac Mon Sep 17 00:00:00 2001 From: David Calavera Date: Tue, 17 Jan 2017 08:41:49 -0800 Subject: [PATCH 111/113] Add redirect generator to make Netlify's CDN redirect to the right places. Netlify will redirect with a 301 status to the right places without the need of a custom javascript file. The current redirects.js is not removed so production can keep working as it is for now. Signed-off-by: David Calavera --- .gitignore | 1 + Makefile | 5 ++++- netlify.toml | 4 ++-- redirects.rb | 22 ++++++++++++++++++++++ 4 files changed, 29 insertions(+), 3 deletions(-) create mode 100644 redirects.rb diff --git a/.gitignore b/.gitignore index 460a88c521..efdcc2a53e 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,4 @@ Session.vim tags kubernetes.github.io.iml +_redirects diff --git a/Makefile b/Makefile index 3657cb577a..36a4842840 100644 --- a/Makefile +++ b/Makefile @@ -1,4 +1,4 @@ -.PHONY: all build build-preview help serve +.PHONY: all build build-preview generate-redirects help serve help: ## Show this help. @awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {sub("\\\\n",sprintf("\n%22c"," "), $$2);printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST) @@ -11,5 +11,8 @@ build: ## Build site with production settings and put deliverables in _site. build-preview: ## Build site with drafts and future posts enabled. jekyll build --drafts --future +generate-redirects: ## Generate a redirects file and copy it into the _site directory. + mkdir -p _site && REDIRECTS_PATH=_site/_redirects ruby redirects.rb + serve: ## Boot the development server. jekyll serve diff --git a/netlify.toml b/netlify.toml index bac7e0b5ab..37e285cb2d 100644 --- a/netlify.toml +++ b/netlify.toml @@ -1,6 +1,6 @@ [build] - command = "make build" + command = "make build generate-redirects" publish = "_site" [context.deploy-preview] - command = "make build-preview" + command = "make build-preview generate-redirects" diff --git a/redirects.rb b/redirects.rb new file mode 100644 index 0000000000..3aeabbd326 --- /dev/null +++ b/redirects.rb @@ -0,0 +1,22 @@ +REPO_TMPL = "https://github.com/kubernetes/kubernetes/tree/%s/%s/:splat" + +fixed_redirects = """# 301 redirects (301 is the default status when no other one is provided for each line) +/third_party/swagger-ui /kubernetes/third_party/swagger-ui/ +/resource-quota /docs/admin/resourcequota/ +/horizontal-pod-autoscaler /docs/user-guide/horizontal-pod-autoscaling/ +/docs/user-guide/overview /docs/whatisk8s/ +/docs/roadmap https://github.com/kubernetes/kubernetes/milestones/ +/api-ref https://github.com/kubernetes/kubernetes/milestones/ +""" + +branch_redirects = ["examples" , "cluster", "docs/devel", "docs/design"] + +branch_redirects.each do |name| + dest = REPO_TMPL % [ENV.fetch("HEAD", "master"), name] + rule = "\n/#{name}/* #{dest}" + + fixed_redirects << rule +end + +output = ENV["DEBUG"] ? STDOUT : File.open(ENV.fetch("REDIRECTS_PATH", "_redirects"), "w+") +output.puts fixed_redirects From 631d1d1135b8f505b6decabd8b5c684a505c49a0 Mon Sep 17 00:00:00 2001 From: Andrew Chen Date: Fri, 3 Feb 2017 10:30:33 -0800 Subject: [PATCH 112/113] Change healthz port Reimplemented changes for PR #1826 and Issue #10003 --- docs/admin/kubelet.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/admin/kubelet.md b/docs/admin/kubelet.md index 258db1e3aa..4a57e00d60 100644 --- a/docs/admin/kubelet.md +++ b/docs/admin/kubelet.md @@ -96,7 +96,7 @@ StreamingProxyRedirects=true|false (ALPHA - default=false) --google-json-key string The Google Cloud Platform Service Account JSON Key to use for authentication. --hairpin-mode string How should the kubelet setup hairpin NAT. This allows endpoints of a Service to loadbalance back to themselves if they should try to access their own Service. Valid values are "promiscuous-bridge", "hairpin-veth" and "none". (default "promiscuous-bridge") --healthz-bind-address ip The IP address for the healthz server to serve on, defaulting to 127.0.0.1 (set to 0.0.0.0 for all interfaces) (default 127.0.0.1) - --healthz-port int32 The port of the localhost healthz endpoint (default 10248) + --healthz-port int32 (Deprecated) The port of the localhost healthz endpoint (default 10248) --host-ipc-sources stringSlice Comma-separated list of sources from which the Kubelet allows pods to use the host ipc namespace. [default="*"] (default [*]) --host-network-sources stringSlice Comma-separated list of sources from which the Kubelet allows pods to use of host network. [default="*"] (default [*]) --host-pid-sources stringSlice Comma-separated list of sources from which the Kubelet allows pods to use the host pid namespace. [default="*"] (default [*]) @@ -137,7 +137,7 @@ StreamingProxyRedirects=true|false (ALPHA - default=false) --pods-per-core int32 Number of Pods per core that can run on this Kubelet. The total number of Pods on this Kubelet cannot exceed max-pods, so max-pods will be used if this calculation results in a larger number of Pods allowed on the Kubelet. A value of 0 disables this limit. --port int32 The port for the Kubelet to serve on. (default 10250) --protect-kernel-defaults Default kubelet behaviour for kernel tuning. If set, kubelet errors if any of kernel tunables is different than kubelet defaults. - --read-only-port int32 The read-only port for the Kubelet to serve on with no authentication/authorization (set to 0 to disable) (default 10255) + --read-only-port int32 The read-only port for the Kubelet to serve on with no authentication/authorization, and for localhost healthz endpoint (set to 0 to disable) (default 10255) --really-crash-for-testing If true, when panics occur crash. Intended for testing. --register-node Register the node with the apiserver (defaults to true if --api-servers is set) (default true) --register-schedulable Register the node as schedulable. Won't have any effect if register-node is false. [default=true] (default true) From 70a2934d02d79a8ad03c270ed58438d4267ec624 Mon Sep 17 00:00:00 2001 From: Cole Mickens Date: Fri, 3 Feb 2017 13:16:20 -0800 Subject: [PATCH 113/113] userguide: PV docs clarify Azure storage account restriction --- docs/user-guide/persistent-volumes/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/persistent-volumes/index.md b/docs/user-guide/persistent-volumes/index.md index d6245e8198..ae34668c9e 100644 --- a/docs/user-guide/persistent-volumes/index.md +++ b/docs/user-guide/persistent-volumes/index.md @@ -532,7 +532,7 @@ parameters: * `skuName`: Azure storage account Sku tier. Default is empty. * `location`: Azure storage account location. Default is empty. -* `storageAccount`: Azure storage account name. If storage account is not provided, all storage accounts associated with the resource group are searched to find one that matches `skuName` and `location`. If storage account is provided, `skuName` and `location` are ignored. +* `storageAccount`: Azure storage account name. If storage account is not provided, all storage accounts associated with the resource group are searched to find one that matches `skuName` and `location`. If storage account is provided, it must reside in the same resource group as the cluster, and `skuName` and `location` are ignored. ## Writing Portable Configuration