Merge branch 'main' into tweak-localization
This commit is contained in:
Qiming Teng
+1
-1
@@ -9,7 +9,7 @@ These are just guidelines, not rules. Use your best judgment, and feel free to p
|
||||
|
||||
### Code of Conduct
|
||||
|
||||
Kubernetes follows the [Cloud Native Computing Foundation (CNCF) Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md). By participating, you are expected to uphold this code. Please report unacceptable behavior to the
|
||||
Kubernetes follows the [Cloud Native Computing Foundation (CNCF) Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md). By participating, you are expected to uphold this code. Please report unacceptable behavior to the
|
||||
[Kubernetes Code of Conduct Committee](https://github.com/kubernetes/community/tree/master/committee-code-of-conduct) <conduct@kubernetes.io>.
|
||||
|
||||
### Documentation and Site Decisions
|
||||
|
||||
@@ -189,7 +189,7 @@ If you need help at any point when contributing, the [New Contributor Ambassador
|
||||
|
||||
## Code of conduct
|
||||
|
||||
Participation in the Kubernetes community is governed by the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).
|
||||
Participation in the Kubernetes community is governed by the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md).
|
||||
|
||||
## Thank you
|
||||
|
||||
|
||||
@@ -8,9 +8,9 @@ community_styles_migrated: true
|
||||
<div class="community-section" id="cncf-code-of-conduct-intro">
|
||||
<p>
|
||||
Kubernetes follows the
|
||||
<a href="https://github.com/cncf/foundation/blob/master/code-of-conduct.md">CNCF Code of Conduct</a>.
|
||||
<a href="https://github.com/cncf/foundation/blob/main/code-of-conduct.md">CNCF Code of Conduct</a>.
|
||||
The text of the CNCF CoC is replicated below, as of
|
||||
<a href="https://github.com/cncf/foundation/blob/214585e24aab747fb85c2ea44fbf4a2442e30de6/code-of-conduct.md">commit 214585e</a>.
|
||||
<a href="https://github.com/cncf/foundation/blob/71b12a2f8b4589788ef2d69b351a3d035c68d927/code-of-conduct.md">commit 71b12a2</a>.
|
||||
If you notice that this is out of date, please
|
||||
<a href="https://github.com/kubernetes/website/issues/new">file an issue</a>.
|
||||
</p>
|
||||
|
||||
@@ -1,45 +1,72 @@
|
||||
<!-- Do not edit this file directly. Get the latest from
|
||||
https://github.com/cncf/foundation/blob/master/code-of-conduct.md -->
|
||||
## CNCF Community Code of Conduct v1.0
|
||||
https://github.com/cncf/foundation/blob/main/code-of-conduct.md -->
|
||||
## CNCF Community Code of Conduct v1.1
|
||||
|
||||
### Contributor Code of Conduct
|
||||
|
||||
As contributors and maintainers of this project, and in the interest of fostering
|
||||
As contributors and maintainers in the CNCF community, and in the interest of fostering
|
||||
an open and welcoming community, we pledge to respect all people who contribute
|
||||
through reporting issues, posting feature requests, updating documentation,
|
||||
submitting pull requests or patches, and other activities.
|
||||
|
||||
We are committed to making participation in this project a harassment-free experience for
|
||||
everyone, regardless of level of experience, gender, gender identity and expression,
|
||||
We are committed to making participation in the CNCF community a harassment-free experience for everyone, regardless of level of experience, gender, gender identity and expression,
|
||||
sexual orientation, disability, personal appearance, body size, race, ethnicity, age,
|
||||
religion, or nationality.
|
||||
|
||||
Examples of unacceptable behavior by participants include:
|
||||
## Scope
|
||||
|
||||
* The use of sexualized language or imagery
|
||||
* Personal attacks
|
||||
* Trolling or insulting/derogatory comments
|
||||
This code of conduct applies both within project spaces and in public spaces when an individual is representing the project or its community.
|
||||
|
||||
### CNCF Events
|
||||
|
||||
CNCF events, or events run by the Linux Foundation with professional events staff, are governed by the Linux Foundation [Events Code of Conduct](https://events.linuxfoundation.org/code-of-conduct/) available on the event page. This is designed to be used in conjunction with the CNCF Code of Conduct.
|
||||
|
||||
## Our Standards
|
||||
|
||||
Examples of behavior that contributes to a positive environment include:
|
||||
|
||||
* Demonstrating empathy and kindness toward other people
|
||||
* Being respectful of differing opinions, viewpoints, and experiences
|
||||
* Giving and gracefully accepting constructive feedback
|
||||
* Accepting responsibility and apologizing to those affected by our mistakes,
|
||||
and learning from the experience
|
||||
* Focusing on what is best not just for us as individuals, but for the
|
||||
overall community
|
||||
|
||||
Examples of unacceptable behavior include:
|
||||
|
||||
* The use of sexualized language or imagery, and sexual attention or
|
||||
advances of any kind
|
||||
* Trolling, insulting or derogatory comments, and personal or political attacks
|
||||
* Public or private harassment
|
||||
* Publishing other's private information, such as physical or electronic addresses,
|
||||
without explicit permission
|
||||
* Other unethical or unprofessional conduct.
|
||||
* Publishing others' private information, such as a physical or email
|
||||
address, without their explicit permission
|
||||
* Other conduct which could reasonably be considered inappropriate in a
|
||||
professional setting
|
||||
|
||||
Project maintainers have the right and responsibility to remove, edit, or reject
|
||||
comments, commits, code, wiki edits, issues, and other contributions that are not
|
||||
aligned to this Code of Conduct. By adopting this Code of Conduct, project maintainers
|
||||
commit themselves to fairly and consistently applying these principles to every aspect
|
||||
of managing this project. Project maintainers who do not follow or enforce the Code of
|
||||
Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct.
|
||||
By adopting this Code of Conduct, project maintainers commit themselves to fairly and consistently applying these principles to every aspect
|
||||
of managing this project.
|
||||
Project maintainers who do not follow or enforce the Code of
|
||||
Conduct may be permanently removed from the project team.
|
||||
|
||||
This code of conduct applies both within project spaces and in public spaces
|
||||
when an individual is representing the project or its community.
|
||||
## Reporting
|
||||
|
||||
Instances of abusive, harassing, or otherwise unacceptable behavior in Kubernetes may be reported by contacting the [Kubernetes Code of Conduct Committee](https://git.k8s.io/community/committee-code-of-conduct) via <conduct@kubernetes.io>. For other projects, please contact a CNCF project maintainer or our mediator, Mishi Choudhary <mishi@linux.com>.
|
||||
For incidents occuring in the Kubernetes community, contact the [Kubernetes Code of Conduct Committee](https://git.k8s.io/community/committee-code-of-conduct) via <conduct@kubernetes.io>. You can expect a response within three business days.
|
||||
|
||||
For other projects, please contact the CNCF staff via <conduct@cncf.io>. You can expect a response within three business days.
|
||||
|
||||
In matters that require an outside mediator, CNCF has retained Mishi Choudhary (mishi@linux.com). Use of an outside mediator can be requested when reporting or used at CNCF staff's discretion. In general, contacting <conduct@cncf.io> directly is preferred.
|
||||
|
||||
|
||||
## Enforcement
|
||||
|
||||
The Kubernetes project's [Code of Conduct Committee](https://github.com/kubernetes/community/tree/master/committee-code-of-conduct) enforces code of conduct issues. For all other projects, the CNCF enforces code of conduct issues.
|
||||
|
||||
Both bodies try to resolve incidents without punishment, but may remove people from the project or CNCF communities at their discretion.
|
||||
|
||||
## Acknowledgements
|
||||
|
||||
This Code of Conduct is adapted from the Contributor Covenant
|
||||
(https://contributor-covenant.org), version 1.2.0, available at
|
||||
https://contributor-covenant.org/version/1/2/0/
|
||||
|
||||
### CNCF Events Code of Conduct
|
||||
|
||||
CNCF events are governed by the Linux Foundation [Code of Conduct](https://events.linuxfoundation.org/code-of-conduct/) available on the event page. This is designed to be compatible with the above policy and also includes more details on responding to incidents.
|
||||
(http://contributor-covenant.org), version 2.0 available at
|
||||
http://contributor-covenant.org/version/2/0/code_of_conduct/
|
||||
@@ -691,7 +691,6 @@ In order to use this behavior, you must enable the `JobTrackingWithFinalizers`
|
||||
[feature gate](/docs/reference/command-line-tools-reference/feature-gates/)
|
||||
on the [API server](/docs/reference/command-line-tools-reference/kube-apiserver/)
|
||||
and the [controller manager](/docs/reference/command-line-tools-reference/kube-controller-manager/).
|
||||
It is enabled by default.
|
||||
|
||||
When enabled, the control plane tracks new Jobs using the behavior described
|
||||
below. Jobs created before the feature was enabled are unaffected. As a user,
|
||||
|
||||
@@ -16,7 +16,7 @@ or API server.
|
||||
|
||||
An example is an existing application that assumes a particular well-known
|
||||
environment variable holds a unique identifier. One possibility is to wrap the
|
||||
application, but that is tedious and error prone, and it violates the goal of low
|
||||
application, but that is tedious and error-prone, and it violates the goal of low
|
||||
coupling. A better option would be to use the Pod's name as an identifier, and
|
||||
inject the Pod's name into the well-known environment variable.
|
||||
|
||||
@@ -119,8 +119,8 @@ for resources such as CPU and memory.
|
||||
If CPU and memory limits are not specified for a container, and you use the
|
||||
downward API to try to expose that information, then the
|
||||
kubelet defaults to exposing the maximum allocatable value for CPU and memory
|
||||
(based on the [node allocatable](/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable)
|
||||
calculation).
|
||||
based on the [node allocatable](/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable)
|
||||
calculation.
|
||||
|
||||
## {{% heading "whatsnext" %}}
|
||||
|
||||
|
||||
@@ -136,7 +136,7 @@ The role of co-chair is one of service: co-chairs build contributor capacity, ha
|
||||
Responsibilities include:
|
||||
|
||||
- Keep SIG Docs focused on maximizing developer happiness through excellent documentation
|
||||
- Exemplify the [community code of conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md) and hold SIG members accountable to it
|
||||
- Exemplify the [community code of conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md) and hold SIG members accountable to it
|
||||
- Learn and set best practices for the SIG by updating contribution guidelines
|
||||
- Schedule and run SIG meetings: weekly status updates, quarterly retro/planning sessions, and others as needed
|
||||
- Schedule and run doc sprints at KubeCon events and other conferences
|
||||
@@ -147,7 +147,7 @@ Responsibilities include:
|
||||
|
||||
To schedule and run effective meetings, these guidelines show what to do, how to do it, and why.
|
||||
|
||||
**Uphold the [community code of conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md)**:
|
||||
**Uphold the [community code of conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md)**:
|
||||
|
||||
- Hold respectful, inclusive discussions with respectful, inclusive language.
|
||||
|
||||
|
||||
@@ -198,7 +198,7 @@ For example, for German the strings live in `data/i18n/de/de.toml`, and
|
||||
|
||||
### Localize the community code of conduct
|
||||
|
||||
Open a PR against the [`cncf/foundation`](https://github.com/cncf/foundation/tree/master/code-of-conduct-languages)
|
||||
Open a PR against the [`cncf/foundation`](https://github.com/cncf/foundation/tree/main/code-of-conduct-languages)
|
||||
repository to add the code of conduct in your language.
|
||||
|
||||
### Setting up the OWNERS files
|
||||
|
||||
@@ -16,16 +16,17 @@ Case studies require extensive review before they're approved.
|
||||
|
||||
## The Kubernetes Blog
|
||||
|
||||
The Kubernetes blog is used by the project to communicate new features, community reports, and any news that might be relevant to the Kubernetes community.
|
||||
This includes end users and developers.
|
||||
Most of the blog's content is about things happening in the core project, but we encourage you to submit about things happening elsewhere in the ecosystem too!
|
||||
The Kubernetes blog is used by the project to communicate new features, community reports, and any
|
||||
news that might be relevant to the Kubernetes community. This includes end users and developers.
|
||||
Most of the blog's content is about things happening in the core project, but we encourage you to
|
||||
submit about things happening elsewhere in the ecosystem too!
|
||||
|
||||
Anyone can write a blog post and submit it for review.
|
||||
|
||||
### Submit a Post
|
||||
|
||||
Blog posts should not be commercial in nature and should consist of original content that applies broadly to the Kubernetes community.
|
||||
Appropriate blog content includes:
|
||||
Blog posts should not be commercial in nature and should consist of original content that applies
|
||||
broadly to the Kubernetes community. Appropriate blog content includes:
|
||||
|
||||
- New Kubernetes capabilities
|
||||
- Kubernetes projects updates
|
||||
@@ -43,75 +44,138 @@ Unsuitable content includes:
|
||||
|
||||
To submit a blog post, follow these steps:
|
||||
|
||||
1. [Sign the CLA](https://kubernetes.io/docs/contribute/start/#sign-the-cla) if you have not yet done so.
|
||||
1. Have a look at the Markdown format for existing blog posts in the [website repository](https://github.com/kubernetes/website/tree/master/content/en/blog/_posts).
|
||||
1. [Sign the CLA](https://github.com/kubernetes/community/blob/master/CLA.md)
|
||||
if you have not yet done so.
|
||||
|
||||
1. Have a look at the Markdown format for existing blog posts in the
|
||||
[website repository](https://github.com/kubernetes/website/tree/master/content/en/blog/_posts).
|
||||
|
||||
1. Write out your blog post in a text editor of your choice.
|
||||
1. On the same link from step 2, click the Create new file button. Paste your content into the editor. Name the file to match the proposed title of the blog post, but don’t put the date in the file name. The blog reviewers will work with you on the final file name and the date the blog will be published.
|
||||
|
||||
1. On the same link from step 2, click the Create new file button. Paste your content into the editor.
|
||||
Name the file to match the proposed title of the blog post, but don’t put the date in the file name.
|
||||
The blog reviewers will work with you on the final file name and the date the blog will be published.
|
||||
|
||||
1. When you save the file, GitHub will walk you through the pull request process.
|
||||
1. A blog post reviewer will review your submission and work with you on feedback and final details. When the blog post is approved, the blog will be scheduled for publication.
|
||||
|
||||
1. A blog post reviewer will review your submission and work with you on feedback and final details.
|
||||
When the blog post is approved, the blog will be scheduled for publication.
|
||||
|
||||
### Guidelines and expectations
|
||||
|
||||
- Blog posts should not be vendor pitches.
|
||||
- Articles must contain content that applies broadly to the Kubernetes community. For example, a submission should focus on upstream Kubernetes as opposed to vendor-specific configurations. Check the [Documentation style guide](/docs/contribute/style/content-guide/#what-s-allowed) for what is typically allowed on Kubernetes properties.
|
||||
- Links should primarily be to the official Kubernetes documentation. When using external references, links should be diverse - For example a submission shouldn't contain only links back to a single company's blog.
|
||||
- Sometimes this is a delicate balance. The [blog team](https://kubernetes.slack.com/messages/sig-docs-blog/) is there to give guidance on whether a post is appropriate for the Kubernetes blog, so don't hesitate to reach out.
|
||||
|
||||
- Articles must contain content that applies broadly to the Kubernetes community. For example, a
|
||||
submission should focus on upstream Kubernetes as opposed to vendor-specific configurations.
|
||||
Check the [Documentation style guide](/docs/contribute/style/content-guide/#what-s-allowed) for
|
||||
what is typically allowed on Kubernetes properties.
|
||||
- Links should primarily be to the official Kubernetes documentation. When using external
|
||||
references, links should be diverse - For example a submission shouldn't contain only links
|
||||
back to a single company's blog.
|
||||
- Sometimes this is a delicate balance. The [blog team](https://kubernetes.slack.com/messages/sig-docs-blog/)
|
||||
is there to give guidance on whether a post is appropriate for the Kubernetes blog, so don't
|
||||
hesitate to reach out.
|
||||
|
||||
- Blog posts are not published on specific dates.
|
||||
- Articles are reviewed by community volunteers. We'll try our best to accommodate specific timing, but we make no guarantees.
|
||||
- Many core parts of the Kubernetes projects submit blog posts during release windows, delaying publication times. Consider submitting during a quieter period of the release cycle.
|
||||
- If you are looking for greater coordination on post release dates, coordinating with [CNCF marketing](https://www.cncf.io/about/contact/) is a more appropriate choice than submitting a blog post.
|
||||
- Sometimes reviews can get backed up. If you feel your review isn't getting the attention it needs, you can reach out to the blog team via [this slack channel](https://kubernetes.slack.com/messages/sig-docs-blog/) to ask in real time.
|
||||
|
||||
- Articles are reviewed by community volunteers. We'll try our best to accommodate specific
|
||||
timing, but we make no guarantees.
|
||||
- Many core parts of the Kubernetes projects submit blog posts during release windows, delaying
|
||||
publication times. Consider submitting during a quieter period of the release cycle.
|
||||
- If you are looking for greater coordination on post release dates, coordinating with
|
||||
[CNCF marketing](https://www.cncf.io/about/contact/) is a more appropriate choice than submitting a blog post.
|
||||
- Sometimes reviews can get backed up. If you feel your review isn't getting the attention it needs,
|
||||
you can reach out to the blog team via [this slack channel](https://kubernetes.slack.com/messages/sig-docs-blog/)
|
||||
to ask in real time.
|
||||
|
||||
- Blog posts should be relevant to Kubernetes users.
|
||||
- Topics related to participation in or results of Kubernetes SIGs activities are always on topic (see the work in the [Upstream Marketing Team](https://github.com/kubernetes/community/blob/master/communication/marketing-team/blog-guidelines.md#upstream-marketing-blog-guidelines) for support on these posts).
|
||||
- The components of Kubernetes are purposely modular, so tools that use existing integration points like CNI and CSI are on topic.
|
||||
- Posts about other CNCF projects may or may not be on topic. We recommend asking the blog team before submitting a draft.
|
||||
- Many CNCF projects have their own blog. These are often a better choice for posts. There are times of major feature or milestone for a CNCF project that users would be interested in reading on the Kubernetes blog.
|
||||
- Blog posts about contributing to the Kubernetes project should be in the [Kubernetes Contributors site](https://kubernetes.dev)
|
||||
|
||||
- Topics related to participation in or results of Kubernetes SIGs activities are always on
|
||||
topic (see the work in the [Upstream Marketing Team](https://github.com/kubernetes/community/blob/master/communication/marketing-team/blog-guidelines.md#upstream-marketing-blog-guidelines)
|
||||
for support on these posts).
|
||||
- The components of Kubernetes are purposely modular, so tools that use existing integration
|
||||
points like CNI and CSI are on topic.
|
||||
- Posts about other CNCF projects may or may not be on topic. We recommend asking the blog team
|
||||
before submitting a draft.
|
||||
- Many CNCF projects have their own blog. These are often a better choice for posts. There are
|
||||
times of major feature or milestone for a CNCF project that users would be interested in
|
||||
reading on the Kubernetes blog.
|
||||
- Blog posts about contributing to the Kubernetes project should be in the
|
||||
[Kubernetes Contributors site](https://kubernetes.dev)
|
||||
|
||||
- Blog posts should be original content
|
||||
|
||||
- The official blog is not for repurposing existing content from a third party as new content.
|
||||
- The [license](https://github.com/kubernetes/website/blob/main/LICENSE) for the blog allows commercial use of the content for commercial purposes, but not the other way around.
|
||||
- The [license](https://github.com/kubernetes/website/blob/main/LICENSE) for the blog allows
|
||||
commercial use of the content for commercial purposes, but not the other way around.
|
||||
|
||||
- Blog posts should aim to be future proof
|
||||
- Given the development velocity of the project, we want evergreen content that won't require updates to stay accurate for the reader.
|
||||
- It can be a better choice to add a tutorial or update official documentation than to write a high level overview as a blog post.
|
||||
- Consider concentrating the long technical content as a call to action of the blog post, and focus on the problem space or why readers should care.
|
||||
|
||||
- Given the development velocity of the project, we want evergreen content that won't require
|
||||
updates to stay accurate for the reader.
|
||||
- It can be a better choice to add a tutorial or update official documentation than to write a
|
||||
high level overview as a blog post.
|
||||
- Consider concentrating the long technical content as a call to action of the blog post, and
|
||||
focus on the problem space or why readers should care.
|
||||
|
||||
### Technical Considerations for submitting a blog post
|
||||
|
||||
Submissions need to be in Markdown format to be used by the [Hugo](https://gohugo.io/) generator for the blog. There are [many resources available](https://gohugo.io/documentation/) on how to use this technology stack.
|
||||
Submissions need to be in Markdown format to be used by the [Hugo](https://gohugo.io/) generator
|
||||
for the blog. There are [many resources available](https://gohugo.io/documentation/) on how to use
|
||||
this technology stack.
|
||||
|
||||
We recognize that this requirement makes the process more difficult for less-familiar folks to submit, and we're constantly looking at solutions to lower this bar. If you have ideas on how to lower the barrier, please volunteer to help out.
|
||||
We recognize that this requirement makes the process more difficult for less-familiar folks to
|
||||
submit, and we're constantly looking at solutions to lower this bar. If you have ideas on how to
|
||||
lower the barrier, please volunteer to help out.
|
||||
|
||||
The SIG Docs [blog subproject](https://github.com/kubernetes/community/tree/master/sig-docs/blog-subproject) manages the review process for blog posts. For more information, see [Submit a post](https://github.com/kubernetes/community/tree/master/sig-docs/blog-subproject#submit-a-post).
|
||||
The SIG Docs [blog subproject](https://github.com/kubernetes/community/tree/master/sig-docs/blog-subproject)
|
||||
manages the review process for blog posts. For more information, see
|
||||
[Submit a post](https://github.com/kubernetes/community/tree/master/sig-docs/blog-subproject#submit-a-post).
|
||||
|
||||
To submit a blog post follow these directions:
|
||||
|
||||
- [Open a pull request](/docs/contribute/new-content/open-a-pr/#fork-the-repo) with a new blog post. New blog posts go under the [`content/en/blog/_posts`](https://github.com/kubernetes/website/tree/main/content/en/blog/_posts) directory.
|
||||
- [Open a pull request](/docs/contribute/new-content/open-a-pr/#fork-the-repo) with a new blog post.
|
||||
New blog posts go under the [`content/en/blog/_posts`](https://github.com/kubernetes/website/tree/main/content/en/blog/_posts)
|
||||
directory.
|
||||
|
||||
- Ensure that your blog post follows the correct naming conventions and the following frontmatter (metadata) information:
|
||||
- Ensure that your blog post follows the correct naming conventions and the following frontmatter
|
||||
(metadata) information:
|
||||
|
||||
- The Markdown file name must follow the format `YYYY-MM-DD-Your-Title-Here.md`. For example, `2020-02-07-Deploying-External-OpenStack-Cloud-Provider-With-Kubeadm.md`.
|
||||
- Do **not** include dots in the filename. A name like `2020-01-01-whats-new-in-1.19.md` causes failures during a build.
|
||||
- The Markdown file name must follow the format `YYYY-MM-DD-Your-Title-Here.md`. For example,
|
||||
`2020-02-07-Deploying-External-OpenStack-Cloud-Provider-With-Kubeadm.md`.
|
||||
- Do **not** include dots in the filename. A name like `2020-01-01-whats-new-in-1.19.md` causes
|
||||
failures during a build.
|
||||
- The front matter must include the following:
|
||||
|
||||
```yaml
|
||||
---
|
||||
layout: blog
|
||||
title: "Your Title Here"
|
||||
date: YYYY-MM-DD
|
||||
slug: text-for-URL-link-here-no-spaces
|
||||
---
|
||||
```
|
||||
- The first or initial commit message should be a short summary of the work being done and should stand alone as a description of the blog post. Please note that subsequent edits to your blog will be squashed into this main commit, so it should be as useful as possible.
|
||||
```yaml
|
||||
---
|
||||
layout: blog
|
||||
title: "Your Title Here"
|
||||
date: YYYY-MM-DD
|
||||
slug: text-for-URL-link-here-no-spaces
|
||||
---
|
||||
```
|
||||
|
||||
- The first or initial commit message should be a short summary of the work being done and
|
||||
should stand alone as a description of the blog post. Please note that subsequent edits to
|
||||
your blog will be squashed into this main commit, so it should be as useful as possible.
|
||||
|
||||
- Examples of a good commit message:
|
||||
- _Add blog post on the foo kubernetes feature_
|
||||
- _blog: foobar announcement_
|
||||
- _Add blog post on the foo kubernetes feature_
|
||||
- _blog: foobar announcement_
|
||||
- Examples of bad commit message:
|
||||
- _Add blog post_
|
||||
- _._
|
||||
- _initial commit_
|
||||
- _draft post_
|
||||
- The blog team will then review your PR and give you comments on things you might need to fix. After that the bot will merge your PR and your blog post will be published.
|
||||
- If the content of the blog post contains only content that is not expected to require updates to stay accurate for the reader, it can be marked as evergreen and exempted from the automatic warning about outdated content added to blog posts older than one year.
|
||||
|
||||
- The blog team will then review your PR and give you comments on things you might need to fix.
|
||||
After that the bot will merge your PR and your blog post will be published.
|
||||
|
||||
- If the content of the blog post contains only content that is not expected to require updates
|
||||
to stay accurate for the reader, it can be marked as evergreen and exempted from the automatic
|
||||
warning about outdated content added to blog posts older than one year.
|
||||
|
||||
- To mark a blog post as evergreen, add this to the front matter:
|
||||
|
||||
```yaml
|
||||
@@ -121,13 +185,15 @@ To submit a blog post follow these directions:
|
||||
- **Tutorials** that only apply to specific releases or versions and not all future versions
|
||||
- References to pre-GA APIs or features
|
||||
|
||||
|
||||
## Submit a case study
|
||||
|
||||
Case studies highlight how organizations are using Kubernetes to solve
|
||||
real-world problems. The Kubernetes marketing team and members of the {{< glossary_tooltip text="CNCF" term_id="cncf" >}} collaborate with you on all case studies.
|
||||
Case studies highlight how organizations are using Kubernetes to solve real-world problems. The
|
||||
Kubernetes marketing team and members of the {{< glossary_tooltip text="CNCF" term_id="cncf" >}}
|
||||
collaborate with you on all case studies.
|
||||
|
||||
Have a look at the source for the
|
||||
[existing case studies](https://github.com/kubernetes/website/tree/main/content/en/case-studies).
|
||||
|
||||
Refer to the [case study guidelines](https://github.com/cncf/foundation/blob/master/case-study-guidelines.md) and submit your request as outlined in the guidelines.
|
||||
Refer to the [case study guidelines](https://github.com/cncf/foundation/blob/master/case-study-guidelines.md)
|
||||
and submit your request as outlined in the guidelines.
|
||||
|
||||
|
||||
@@ -27,7 +27,7 @@ Before reviewing, it's a good idea to:
|
||||
|
||||
Before you start a review:
|
||||
|
||||
- Read the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md) and ensure that you abide by it at all times.
|
||||
- Read the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md) and ensure that you abide by it at all times.
|
||||
- Be polite, considerate, and helpful.
|
||||
- Comment on positive aspects of PRs as well as changes.
|
||||
- Be empathetic and mindful of how your review may be received.
|
||||
|
||||
@@ -1,256 +0,0 @@
|
||||
---
|
||||
reviewers:
|
||||
- jayunit100
|
||||
- jsturtevant
|
||||
- marosset
|
||||
- perithompson
|
||||
title: Adding Windows nodes
|
||||
min-kubernetes-server-version: 1.17
|
||||
content_type: tutorial
|
||||
weight: 30
|
||||
---
|
||||
|
||||
<!-- overview -->
|
||||
|
||||
{{< feature-state for_k8s_version="v1.18" state="beta" >}}
|
||||
|
||||
You can use Kubernetes to run a mixture of Linux and Windows nodes, so you can mix Pods that run on Linux on with Pods that run on Windows. This page shows how to register Windows nodes to your cluster.
|
||||
|
||||
|
||||
## {{% heading "prerequisites" %}}
|
||||
{{< version-check >}}
|
||||
|
||||
* Obtain a [Windows Server 2019 license](https://www.microsoft.com/en-us/cloud-platform/windows-server-pricing)
|
||||
(or higher) in order to configure the Windows node that hosts Windows containers.
|
||||
If you are using VXLAN/Overlay networking you must have also have [KB4489899](https://support.microsoft.com/help/4489899) installed.
|
||||
|
||||
* A Linux-based Kubernetes kubeadm cluster in which you have access to the control plane (see [Creating a single control-plane cluster with kubeadm](/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/)).
|
||||
|
||||
|
||||
|
||||
|
||||
## {{% heading "objectives" %}}
|
||||
|
||||
|
||||
* Register a Windows node to the cluster
|
||||
* Configure networking so Pods and Services on Linux and Windows can communicate with each other
|
||||
|
||||
|
||||
|
||||
|
||||
<!-- lessoncontent -->
|
||||
|
||||
## Getting Started: Adding a Windows Node to Your Cluster
|
||||
|
||||
### Networking Configuration
|
||||
|
||||
Once you have a Linux-based Kubernetes control-plane node you are ready to choose a networking solution. This guide illustrates using Flannel in VXLAN mode for simplicity.
|
||||
|
||||
#### Configuring Flannel
|
||||
|
||||
1. Prepare Kubernetes control plane for Flannel
|
||||
|
||||
Some minor preparation is recommended on the Kubernetes control plane in our cluster. It is recommended to enable bridged IPv4 traffic to iptables chains when using Flannel. The following command must be run on all Linux nodes:
|
||||
|
||||
```bash
|
||||
sudo sysctl net.bridge.bridge-nf-call-iptables=1
|
||||
```
|
||||
|
||||
1. Download & configure Flannel for Linux
|
||||
|
||||
Download the most recent Flannel manifest:
|
||||
|
||||
```bash
|
||||
wget https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
|
||||
```
|
||||
|
||||
Modify the `net-conf.json` section of the flannel manifest in order to set the VNI to 4096 and the Port to 4789. It should look as follows:
|
||||
|
||||
```json
|
||||
net-conf.json: |
|
||||
{
|
||||
"Network": "10.244.0.0/16",
|
||||
"Backend": {
|
||||
"Type": "vxlan",
|
||||
"VNI": 4096,
|
||||
"Port": 4789
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
{{< note >}}The VNI must be set to 4096 and port 4789 for Flannel on Linux to interoperate with Flannel on Windows. See the [VXLAN documentation](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan).
|
||||
for an explanation of these fields.{{< /note >}}
|
||||
|
||||
{{< note >}}To use L2Bridge/Host-gateway mode instead change the value of `Type` to `"host-gw"` and omit `VNI` and `Port`.{{< /note >}}
|
||||
|
||||
1. Apply the Flannel manifest and validate
|
||||
|
||||
Let's apply the Flannel configuration:
|
||||
|
||||
```bash
|
||||
kubectl apply -f kube-flannel.yml
|
||||
```
|
||||
|
||||
After a few minutes, you should see all the pods as running if the Flannel pod network was deployed.
|
||||
|
||||
```bash
|
||||
kubectl get pods -n kube-system
|
||||
```
|
||||
|
||||
The output should include the Linux flannel DaemonSet as running:
|
||||
|
||||
```
|
||||
NAMESPACE NAME READY STATUS RESTARTS AGE
|
||||
...
|
||||
kube-system kube-flannel-ds-54954 1/1 Running 0 1m
|
||||
```
|
||||
|
||||
1. Add Windows Flannel and kube-proxy DaemonSets
|
||||
|
||||
Now you can add Windows-compatible versions of Flannel and kube-proxy. In order
|
||||
to ensure that you get a compatible version of kube-proxy, you'll need to substitute
|
||||
the tag of the image. The following example shows usage for Kubernetes {{< param "fullversion" >}},
|
||||
but you should adjust the version for your own deployment.
|
||||
|
||||
```bash
|
||||
curl -L https://github.com/kubernetes-sigs/sig-windows-tools/releases/latest/download/kube-proxy.yml | sed 's/VERSION/{{< param "fullversion" >}}/g' | kubectl apply -f -
|
||||
kubectl apply -f https://github.com/kubernetes-sigs/sig-windows-tools/releases/latest/download/flannel-overlay.yml
|
||||
```
|
||||
{{< note >}}
|
||||
If you're using host-gateway use https://github.com/kubernetes-sigs/sig-windows-tools/releases/latest/download/flannel-host-gw.yml instead
|
||||
{{< /note >}}
|
||||
|
||||
{{< note >}}
|
||||
If you're using a different interface rather than Ethernet (i.e. "Ethernet0 2") on the Windows nodes, you have to modify the line:
|
||||
|
||||
```powershell
|
||||
wins cli process run --path /k/flannel/setup.exe --args "--mode=overlay --interface=Ethernet"
|
||||
```
|
||||
|
||||
in the `flannel-host-gw.yml` or `flannel-overlay.yml` file and specify your interface accordingly.
|
||||
|
||||
```bash
|
||||
# Example
|
||||
curl -L https://github.com/kubernetes-sigs/sig-windows-tools/releases/latest/download/flannel-overlay.yml | sed 's/Ethernet/Ethernet0 2/g' | kubectl apply -f -
|
||||
```
|
||||
{{< /note >}}
|
||||
|
||||
|
||||
|
||||
### Joining a Windows worker node
|
||||
|
||||
{{< note >}}
|
||||
All code snippets in Windows sections are to be run in a PowerShell environment
|
||||
with elevated permissions (Administrator) on the Windows worker node.
|
||||
{{< /note >}}
|
||||
|
||||
{{< tabs name="tab-windows-kubeadm-runtime-installation" >}}
|
||||
|
||||
{{% tab name="CRI-containerD" %}}
|
||||
|
||||
#### Install containerD
|
||||
|
||||
```powershell
|
||||
curl.exe -LO https://github.com/kubernetes-sigs/sig-windows-tools/releases/latest/download/Install-Containerd.ps1
|
||||
.\Install-Containerd.ps1
|
||||
```
|
||||
|
||||
{{< note >}}
|
||||
To install a specific version of containerD specify the version with -ContainerDVersion.
|
||||
|
||||
```powershell
|
||||
# Example
|
||||
.\Install-Containerd.ps1 -ContainerDVersion 1.4.1
|
||||
```
|
||||
|
||||
If you're using a different interface rather than Ethernet (i.e. "Ethernet0 2") on the Windows nodes, specify the name with `-netAdapterName`.
|
||||
|
||||
```powershell
|
||||
# Example
|
||||
.\Install-Containerd.ps1 -netAdapterName "Ethernet0 2"
|
||||
```
|
||||
|
||||
{{< /note >}}
|
||||
|
||||
#### Install wins, kubelet, and kubeadm
|
||||
|
||||
```PowerShell
|
||||
curl.exe -LO https://raw.githubusercontent.com/kubernetes-sigs/sig-windows-tools/master/kubeadm/scripts/PrepareNode.ps1
|
||||
.\PrepareNode.ps1 -KubernetesVersion {{< param "fullversion" >}} -ContainerRuntime containerD
|
||||
```
|
||||
|
||||
Install `crictl` from the [cri-tools project](https://github.com/kubernetes-sigs/cri-tools)
|
||||
which is required so that kubeadm can talk to the CRI endpoint.
|
||||
|
||||
#### Run `kubeadm` to join the node
|
||||
|
||||
Use the command that was given to you when you ran `kubeadm init` on a control plane host.
|
||||
If you no longer have this command, or the token has expired, you can run `kubeadm token create --print-join-command`
|
||||
(on a control plane host) to generate a new token and join command.
|
||||
|
||||
{{% /tab %}}
|
||||
|
||||
{{% tab name="Docker Engine" %}}
|
||||
|
||||
#### Install Docker Engine
|
||||
|
||||
Install the `Containers` feature
|
||||
|
||||
```powershell
|
||||
Install-WindowsFeature -Name containers
|
||||
```
|
||||
|
||||
Install Docker
|
||||
Instructions to do so are available at [Install Docker Engine - Enterprise on Windows Servers](https://docs.microsoft.com/en-us/virtualization/windowscontainers/quick-start/set-up-environment?tabs=Windows-Server#install-docker).
|
||||
|
||||
[Install cri-dockerd](https://github.com/Mirantis/cri-dockerd) which is required so that the kubelet
|
||||
can communicate with Docker on a CRI compatible endpoint.
|
||||
|
||||
{{< note >}}
|
||||
Docker Engine does not implement the [CRI](/docs/concepts/architecture/cri/)
|
||||
which is a requirement for a container runtime to work with Kubernetes.
|
||||
For that reason, an additional service [cri-dockerd](https://github.com/Mirantis/cri-dockerd)
|
||||
has to be installed. cri-dockerd is a project based on the legacy built-in
|
||||
Docker Engine support that was [removed](/dockershim) from the kubelet in version 1.24.
|
||||
{{< /note >}}
|
||||
|
||||
Install `crictl` from the [cri-tools project](https://github.com/kubernetes-sigs/cri-tools)
|
||||
which is required so that kubeadm can talk to the CRI endpoint.
|
||||
|
||||
#### Install wins, kubelet, and kubeadm
|
||||
|
||||
```PowerShell
|
||||
curl.exe -LO https://raw.githubusercontent.com/kubernetes-sigs/sig-windows-tools/master/kubeadm/scripts/PrepareNode.ps1
|
||||
.\PrepareNode.ps1 -KubernetesVersion {{< param "fullversion" >}}
|
||||
```
|
||||
|
||||
#### Run `kubeadm` to join the node
|
||||
|
||||
Use the command that was given to you when you ran `kubeadm init` on a control plane host.
|
||||
If you no longer have this command, or the token has expired, you can run `kubeadm token create --print-join-command`
|
||||
(on a control plane host) to generate a new token and join command.
|
||||
|
||||
{{% /tab %}}
|
||||
|
||||
{{< /tabs >}}
|
||||
|
||||
### Verifying your installation
|
||||
|
||||
You should now be able to view the Windows node in your cluster by running:
|
||||
|
||||
```bash
|
||||
kubectl get nodes -o wide
|
||||
```
|
||||
|
||||
If your new node is in the `NotReady` state it is likely because the flannel image is still downloading.
|
||||
You can check the progress as before by checking on the flannel pods in the `kube-system` namespace:
|
||||
|
||||
```shell
|
||||
kubectl -n kube-system get pods -l app=flannel
|
||||
```
|
||||
|
||||
Once the flannel Pod is running, your node should enter the `Ready` state and then be available to handle workloads.
|
||||
|
||||
## {{% heading "whatsnext" %}}
|
||||
|
||||
- [Upgrading Windows kubeadm nodes](/docs/tasks/administer-cluster/kubeadm/upgrading-windows-nodes)
|
||||
@@ -34,7 +34,7 @@ upgrade the control plane nodes before upgrading your Windows nodes.
|
||||
|
||||
```powershell
|
||||
# replace {{< param "fullversion" >}} with your desired version
|
||||
curl.exe -Lo C:\k\kubeadm.exe https://dl.k8s.io/{{< param "fullversion" >}}/bin/windows/amd64/kubeadm.exe
|
||||
curl.exe -Lo <path-to-kubeadm.exe> https://dl.k8s.io/{{< param "fullversion" >}}/bin/windows/amd64/kubeadm.exe
|
||||
```
|
||||
|
||||
### Drain the node
|
||||
@@ -62,16 +62,28 @@ upgrade the control plane nodes before upgrading your Windows nodes.
|
||||
kubeadm upgrade node
|
||||
```
|
||||
|
||||
### Upgrade kubelet
|
||||
### Upgrade kubelet and kube-proxy
|
||||
|
||||
1. From the Windows node, upgrade and restart the kubelet:
|
||||
|
||||
```powershell
|
||||
stop-service kubelet
|
||||
curl.exe -Lo C:\k\kubelet.exe https://dl.k8s.io/{{< param "fullversion" >}}/bin/windows/amd64/kubelet.exe
|
||||
curl.exe -Lo <path-to-kubelet.exe> https://dl.k8s.io/{{< param "fullversion" >}}/bin/windows/amd64/kubelet.exe
|
||||
restart-service kubelet
|
||||
```
|
||||
|
||||
2. From the Windows node, upgrade and restart the kube-proxy.
|
||||
|
||||
```powershell
|
||||
stop-service kube-proxy
|
||||
curl.exe -Lo <path-to-kube-proxy.exe> https://dl.k8s.io/{{< param "fullversion" >}}/bin/windows/amd64/kube-proxy.exe
|
||||
restart-service kube-proxy
|
||||
```
|
||||
|
||||
{{< note >}}
|
||||
If you are running kube-proxy in a HostProcess container within a Pod, and not as a Windows Service, you can upgrade kube-proxy by applying a newer version of your kube-proxy manifests.
|
||||
{{< /note >}}
|
||||
|
||||
### Uncordon the node
|
||||
|
||||
1. From a machine with access to the Kubernetes API,
|
||||
@@ -81,14 +93,7 @@ bring the node back online by marking it schedulable:
|
||||
# replace <node-to-drain> with the name of your node
|
||||
kubectl uncordon <node-to-drain>
|
||||
```
|
||||
### Upgrade kube-proxy
|
||||
|
||||
1. From a machine with access to the Kubernetes API, run the following,
|
||||
again replacing {{< param "fullversion" >}} with your desired version:
|
||||
|
||||
```shell
|
||||
curl -L https://github.com/kubernetes-sigs/sig-windows-tools/releases/latest/download/kube-proxy.yml | sed 's/VERSION/{{< param "fullversion" >}}/g' | kubectl apply -f -
|
||||
```
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -34,7 +34,7 @@ Kubernetes cluster.
|
||||
worker1 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker1
|
||||
worker2 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker2
|
||||
```
|
||||
1. Chose one of your nodes, and add a label to it:
|
||||
1. Choose one of your nodes, and add a label to it:
|
||||
|
||||
```shell
|
||||
kubectl label nodes <your-node-name> disktype=ssd
|
||||
|
||||
@@ -14,7 +14,7 @@ weight: 30
|
||||
<!-- overview -->
|
||||
|
||||
This page shows how to run a replicated stateful application using a
|
||||
[StatefulSet](/docs/concepts/workloads/controllers/statefulset/) controller.
|
||||
{{< glossary_tooltip term_id="statefulset" >}}.
|
||||
This application is a replicated MySQL database. The example topology has a
|
||||
single primary server and multiple replicas, using asynchronous row-based
|
||||
replication.
|
||||
@@ -24,12 +24,10 @@ replication.
|
||||
on general patterns for running stateful applications in Kubernetes.
|
||||
{{< /note >}}
|
||||
|
||||
|
||||
|
||||
## {{% heading "prerequisites" %}}
|
||||
|
||||
|
||||
* {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
|
||||
* {{< include "task-tutorial-prereqs.md" >}}
|
||||
* {{< include "default-storage-class-prereqs.md" >}}
|
||||
* This tutorial assumes you are familiar with
|
||||
[PersistentVolumes](/docs/concepts/storage/persistent-volumes/)
|
||||
@@ -46,7 +44,7 @@ on general patterns for running stateful applications in Kubernetes.
|
||||
## {{% heading "objectives" %}}
|
||||
|
||||
|
||||
* Deploy a replicated MySQL topology with a StatefulSet controller.
|
||||
* Deploy a replicated MySQL topology with a StatefulSet.
|
||||
* Send MySQL client traffic.
|
||||
* Observe resistance to downtime.
|
||||
* Scale the StatefulSet up and down.
|
||||
@@ -60,7 +58,7 @@ on general patterns for running stateful applications in Kubernetes.
|
||||
The example MySQL deployment consists of a ConfigMap, two Services,
|
||||
and a StatefulSet.
|
||||
|
||||
### ConfigMap
|
||||
### Create a ConfigMap {#configmap}
|
||||
|
||||
Create the ConfigMap from the following YAML configuration file:
|
||||
|
||||
@@ -71,7 +69,7 @@ kubectl apply -f https://k8s.io/examples/application/mysql/mysql-configmap.yaml
|
||||
```
|
||||
|
||||
This ConfigMap provides `my.cnf` overrides that let you independently control
|
||||
configuration on the primary MySQL server and replicas.
|
||||
configuration on the primary MySQL server and its replicas.
|
||||
In this case, you want the primary server to be able to serve replication logs to replicas
|
||||
and you want replicas to reject any writes that don't come via replication.
|
||||
|
||||
@@ -80,7 +78,7 @@ portions to apply to different Pods.
|
||||
Each Pod decides which portion to look at as it's initializing,
|
||||
based on information provided by the StatefulSet controller.
|
||||
|
||||
### Services
|
||||
### Create Services {#services}
|
||||
|
||||
Create the Services from the following YAML configuration file:
|
||||
|
||||
@@ -90,23 +88,24 @@ Create the Services from the following YAML configuration file:
|
||||
kubectl apply -f https://k8s.io/examples/application/mysql/mysql-services.yaml
|
||||
```
|
||||
|
||||
The Headless Service provides a home for the DNS entries that the StatefulSet
|
||||
controller creates for each Pod that's part of the set.
|
||||
Because the Headless Service is named `mysql`, the Pods are accessible by
|
||||
The headless Service provides a home for the DNS entries that the StatefulSet
|
||||
{{< glossary_tooltip text="controllers" term_id="controller" >}} creates for each
|
||||
Pod that's part of the set.
|
||||
Because the headless Service is named `mysql`, the Pods are accessible by
|
||||
resolving `<pod-name>.mysql` from within any other Pod in the same Kubernetes
|
||||
cluster and namespace.
|
||||
|
||||
The Client Service, called `mysql-read`, is a normal Service with its own
|
||||
The client Service, called `mysql-read`, is a normal Service with its own
|
||||
cluster IP that distributes connections across all MySQL Pods that report
|
||||
being Ready. The set of potential endpoints includes the primary MySQL server and all
|
||||
replicas.
|
||||
|
||||
Note that only read queries can use the load-balanced Client Service.
|
||||
Note that only read queries can use the load-balanced client Service.
|
||||
Because there is only one primary MySQL server, clients should connect directly to the
|
||||
primary MySQL Pod (through its DNS entry within the Headless Service) to execute
|
||||
primary MySQL Pod (through its DNS entry within the headless Service) to execute
|
||||
writes.
|
||||
|
||||
### StatefulSet
|
||||
### Create the StatefulSet {#statefulset}
|
||||
|
||||
Finally, create the StatefulSet from the following YAML configuration file:
|
||||
|
||||
@@ -122,7 +121,7 @@ You can watch the startup progress by running:
|
||||
kubectl get pods -l app=mysql --watch
|
||||
```
|
||||
|
||||
After a while, you should see all 3 Pods become Running:
|
||||
After a while, you should see all 3 Pods become `Running`:
|
||||
|
||||
```
|
||||
NAME READY STATUS RESTARTS AGE
|
||||
@@ -132,8 +131,11 @@ mysql-2 2/2 Running 0 1m
|
||||
```
|
||||
|
||||
Press **Ctrl+C** to cancel the watch.
|
||||
|
||||
{{< note >}}
|
||||
If you don't see any progress, make sure you have a dynamic PersistentVolume
|
||||
provisioner enabled as mentioned in the [prerequisites](#before-you-begin).
|
||||
provisioner enabled, as mentioned in the [prerequisites](#before-you-begin).
|
||||
{{< /note >}}
|
||||
|
||||
This manifest uses a variety of techniques for managing stateful Pods as part of
|
||||
a StatefulSet. The next section highlights some of these techniques to explain
|
||||
@@ -155,10 +157,10 @@ properties to perform orderly startup of MySQL replication.
|
||||
### Generating configuration
|
||||
|
||||
Before starting any of the containers in the Pod spec, the Pod first runs any
|
||||
[Init Containers](/docs/concepts/workloads/pods/init-containers/)
|
||||
[init containers](/docs/concepts/workloads/pods/init-containers/)
|
||||
in the order defined.
|
||||
|
||||
The first Init Container, named `init-mysql`, generates special MySQL config
|
||||
The first init container, named `init-mysql`, generates special MySQL config
|
||||
files based on the ordinal index.
|
||||
|
||||
The script determines its own ordinal index by extracting it from the end of
|
||||
@@ -166,8 +168,7 @@ the Pod name, which is returned by the `hostname` command.
|
||||
Then it saves the ordinal (with a numeric offset to avoid reserved values)
|
||||
into a file called `server-id.cnf` in the MySQL `conf.d` directory.
|
||||
This translates the unique, stable identity provided by the StatefulSet
|
||||
controller into the domain of MySQL server IDs, which require the same
|
||||
properties.
|
||||
into the domain of MySQL server IDs, which require the same properties.
|
||||
|
||||
The script in the `init-mysql` container also applies either `primary.cnf` or
|
||||
`replica.cnf` from the ConfigMap by copying the contents into `conf.d`.
|
||||
@@ -187,7 +188,7 @@ logs might not go all the way back to the beginning of time.
|
||||
These conservative assumptions are the key to allow a running StatefulSet
|
||||
to scale up and down over time, rather than being fixed at its initial size.
|
||||
|
||||
The second Init Container, named `clone-mysql`, performs a clone operation on
|
||||
The second init container, named `clone-mysql`, performs a clone operation on
|
||||
a replica Pod the first time it starts up on an empty PersistentVolume.
|
||||
That means it copies all existing data from another running Pod,
|
||||
so its local state is consistent enough to begin replicating from the primary server.
|
||||
@@ -202,7 +203,7 @@ Ready before starting Pod `N+1`.
|
||||
|
||||
### Starting replication
|
||||
|
||||
After the Init Containers complete successfully, the regular containers run.
|
||||
After the init containers complete successfully, the regular containers run.
|
||||
The MySQL Pods consist of a `mysql` container that runs the actual `mysqld`
|
||||
server, and an `xtrabackup` container that acts as a
|
||||
[sidecar](https://kubernetes.io/blog/2015/06/the-distributed-system-toolkit-patterns).
|
||||
@@ -291,13 +292,13 @@ endpoint might be selected upon each connection attempt:
|
||||
You can press **Ctrl+C** when you want to stop the loop, but it's useful to keep
|
||||
it running in another window so you can see the effects of the following steps.
|
||||
|
||||
## Simulating Pod and Node downtime
|
||||
## Simulate Pod and Node failure {#simulate-pod-and-node-downtime}
|
||||
|
||||
To demonstrate the increased availability of reading from the pool of replicas
|
||||
instead of a single server, keep the `SELECT @@server_id` loop from above
|
||||
running while you force a Pod out of the Ready state.
|
||||
|
||||
### Break the Readiness Probe
|
||||
### Break the Readiness probe
|
||||
|
||||
The [readiness probe](/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes)
|
||||
for the `mysql` container runs the command `mysql -h 127.0.0.1 -e 'SELECT 1'`
|
||||
@@ -371,14 +372,18 @@ NAME READY STATUS RESTARTS AGE IP NODE
|
||||
mysql-2 2/2 Running 0 15m 10.244.5.27 kubernetes-node-9l2t
|
||||
```
|
||||
|
||||
Then drain the Node by running the following command, which cordons it so
|
||||
Then, drain the Node by running the following command, which cordons it so
|
||||
no new Pods may schedule there, and then evicts any existing Pods.
|
||||
Replace `<node-name>` with the name of the Node you found in the last step.
|
||||
|
||||
This might impact other applications on the Node, so it's best to
|
||||
**only do this in a test cluster**.
|
||||
{{< caution >}}
|
||||
Draining a Node can impact other workloads and applications
|
||||
running on the same node. Only perform the following step in a test
|
||||
cluster.
|
||||
{{< /caution >}}
|
||||
|
||||
```shell
|
||||
# See above advice about impact on other workloads
|
||||
kubectl drain <node-name> --force --delete-emptydir-data --ignore-daemonsets
|
||||
```
|
||||
|
||||
@@ -413,8 +418,9 @@ kubectl uncordon <node-name>
|
||||
|
||||
## Scaling the number of replicas
|
||||
|
||||
With MySQL replication, you can scale your read query capacity by adding replicas.
|
||||
With StatefulSet, you can do this with a single command:
|
||||
When you use MySQL replication, you can scale your read query capacity by
|
||||
adding replicas.
|
||||
For a StatefulSet, you can achieve this with a single command:
|
||||
|
||||
```shell
|
||||
kubectl scale statefulset mysql --replicas=5
|
||||
@@ -453,10 +459,13 @@ Scaling back down is also seamless:
|
||||
kubectl scale statefulset mysql --replicas=3
|
||||
```
|
||||
|
||||
Note, however, that while scaling up creates new PersistentVolumeClaims
|
||||
{{< note >}}
|
||||
Although scaling up creates new PersistentVolumeClaims
|
||||
automatically, scaling down does not automatically delete these PVCs.
|
||||
|
||||
This gives you the choice to keep those initialized PVCs around to make
|
||||
scaling back up quicker, or to extract data before deleting them.
|
||||
{{< /note >}}
|
||||
|
||||
You can see this by running:
|
||||
|
||||
|
||||
@@ -4,6 +4,7 @@ metadata:
|
||||
name: mysql
|
||||
labels:
|
||||
app: mysql
|
||||
app.kubernetes.io/name: mysql
|
||||
data:
|
||||
primary.cnf: |
|
||||
# Apply this config only on the primary.
|
||||
|
||||
@@ -5,6 +5,7 @@ metadata:
|
||||
name: mysql
|
||||
labels:
|
||||
app: mysql
|
||||
app.kubernetes.io/name: mysql
|
||||
spec:
|
||||
ports:
|
||||
- name: mysql
|
||||
@@ -21,6 +22,8 @@ metadata:
|
||||
name: mysql-read
|
||||
labels:
|
||||
app: mysql
|
||||
app.kubernetes.io/name: mysql
|
||||
readonly: "true"
|
||||
spec:
|
||||
ports:
|
||||
- name: mysql
|
||||
|
||||
@@ -5,13 +5,15 @@ metadata:
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: mysql
|
||||
app: mysql-server
|
||||
app.kubernetes.io/name: mysql
|
||||
serviceName: mysql
|
||||
replicas: 3
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mysql
|
||||
app.kubernetes.io/name: mysql
|
||||
spec:
|
||||
initContainers:
|
||||
- name: init-mysql
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
---
|
||||
title: I componenti di Kubernetes
|
||||
description: >
|
||||
Un cluster di Kubernetes è costituito da un insieme di componenti che sono, come minimo, un Control Plane e uno o più sistemi di elaborazione, detti nodi.
|
||||
content_type: concept
|
||||
weight: 20
|
||||
card:
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
---
|
||||
title: Le API di Kubernetes
|
||||
title: Le API di Kubernetes
|
||||
description: >
|
||||
Le API di Kubernetes ti permettono di interrogare e manipolare lo stato degli oggetti in Kubernetes. Il cuore del Control Plane di Kubernetes è l'API server e le API HTTP che esso espone. Ogni entità o componente che si interfaccia con il cluster (gli utenti, le singole parti del tuo cluster, i componenti esterni), comunica attraverso l'API server.
|
||||
content_type: concept
|
||||
weight: 30
|
||||
card:
|
||||
|
||||
@@ -72,8 +72,7 @@ Kubernetes1.8のように、ユーザーは`.spec.template`のラベルにマッ
|
||||
|
||||
### 選択したNode上でPodを稼働させる
|
||||
|
||||
もしユーザーが`.spec.template.spec.nodeSelector`を指定したとき、DaemonSetコントローラーは、その[node
|
||||
selector](/ja/docs/concepts/scheduling-eviction/assign-pod-node/)にマッチするPodをNode上に作成します。同様に、もし`.spec.template.spec.affinity`を指定したとき、DaemonSetコントローラーは[node affinity](/ja/docs/concepts/scheduling-eviction/assign-pod-node/)マッチするPodをNode上に作成します。
|
||||
もしユーザーが`.spec.template.spec.nodeSelector`を指定したとき、DaemonSetコントローラーは、その[node selector](/ja/docs/concepts/scheduling-eviction/assign-pod-node/)にマッチするNode上にPodを作成します。同様に、もし`.spec.template.spec.affinity`を指定したとき、DaemonSetコントローラーは[node affinity](/ja/docs/concepts/scheduling-eviction/assign-pod-node/)にマッチするNode上にPodを作成します。
|
||||
もしユーザーがどちらも指定しないとき、DaemonSetコントローラーは全てのNode上にPodを作成します。
|
||||
|
||||
## Daemon Podがどのようにスケジューリングされるか
|
||||
|
||||
@@ -85,6 +85,6 @@ PR 랭글러는 일주일 간 매일 다음의 일을 해야 한다.
|
||||
|
||||
{{< note >}}
|
||||
|
||||
[`fejta-bot`](https://github.com/fejta-bot)이라는 봇은 90일 동안 활동이 없으면 이슈를 오래된 것(stale)으로 표시한다. 30일이 더 지나면 rotten으로 표시하고 종료한다. PR 랭글러는 14-30일 동안 활동이 없으면 이슈를 닫아야 한다.
|
||||
[`k8s-triage-robot`](https://github.com/k8s-triage-robot)이라는 봇은 90일 동안 활동이 없으면 이슈를 오래된 것(stale)으로 표시한다. 30일이 더 지나면 rotten으로 표시하고 종료한다. PR 랭글러는 14-30일 동안 활동이 없으면 이슈를 닫아야 한다.
|
||||
|
||||
{{< /note >}}
|
||||
|
||||
@@ -56,8 +56,8 @@ object. In most cases, Kubernetes manages owner references automatically.
|
||||
|
||||
Kubernetes 中很多对象通过[*属主引用*](/zh/docs/concepts/overview/working-with-objects/owners-dependents/)
|
||||
链接到彼此。属主引用（Owner Reference）可以告诉控制面哪些对象依赖于其他对象。
|
||||
Kubernetes 使用属主引用来为控制面以及其他 API 客户端在删除某对象时提供一个
|
||||
清理关联资源的机会。在大多数场合，Kubernetes 都是自动管理属主引用的。
|
||||
Kubernetes 使用属主引用来为控制面以及其他 API 客户端在删除某对象时提供一个清理关联资源的机会。
|
||||
在大多数场合，Kubernetes 都是自动管理属主引用的。
|
||||
|
||||
<!--
|
||||
Ownership is different from the [labels and selectors](/docs/concepts/overview/working-with-objects/labels/)
|
||||
@@ -69,8 +69,8 @@ to the labels, each `EndpointSlice` that is managed on behalf of a Service has
|
||||
an owner reference. Owner references help different parts of Kubernetes avoid
|
||||
interfering with objects they don’t control.
|
||||
-->
|
||||
属主关系与某些资源所使用的的[标签和选择算符](/zh/docs/concepts/overview/working-with-objects/labels/)
|
||||
不同。例如，考虑一个创建 `EndpointSlice` 对象的 {{<glossary_tooltip text="Service" term_id="service">}}
|
||||
属主关系与某些资源所使用的[标签和选择算符](/zh/docs/concepts/overview/working-with-objects/labels/)不同。
|
||||
例如，考虑一个创建 `EndpointSlice` 对象的 {{<glossary_tooltip text="Service" term_id="service">}}
|
||||
对象。Service 对象使用*标签*来允许控制面确定哪些 `EndpointSlice` 对象被该
|
||||
Service 使用。除了标签，每个被 Service 托管的 `EndpointSlice` 对象还有一个属主引用属性。
|
||||
属主引用可以帮助 Kubernetes 中的不同组件避免干预并非由它们控制的对象。
|
||||
@@ -85,8 +85,7 @@ is subject to deletion once all owners are verified absent.
|
||||
-->
|
||||
根据设计，系统不允许出现跨名字空间的属主引用。名字空间作用域的依赖对象可以指定集群作用域或者名字空间作用域的属主。
|
||||
名字空间作用域的属主**必须**存在于依赖对象所在的同一名字空间。
|
||||
如果属主位于不同名字空间，则属主引用被视为不存在，而当检查发现所有属主都已不存在时，
|
||||
依赖对象会被删除。
|
||||
如果属主位于不同名字空间，则属主引用被视为不存在，而当检查发现所有属主都已不存在时，依赖对象会被删除。
|
||||
|
||||
<!--
|
||||
Cluster-scoped dependents can only specify cluster-scoped owners.
|
||||
@@ -127,8 +126,8 @@ two types of cascading deletion, as follows:
|
||||
## 级联删除 {#cascading-deletion}
|
||||
|
||||
Kubernetes 会检查并删除那些不再拥有属主引用的对象，例如在你删除了 ReplicaSet
|
||||
之后留下来的 Pod。当你删除某个对象时，你可以控制 Kubernetes 是否要通过一个称作
|
||||
级联删除（Cascading Deletion）的过程自动删除该对象的依赖对象。
|
||||
之后留下来的 Pod。当你删除某个对象时，你可以控制 Kubernetes 是否去自动删除该对象的依赖对象，
|
||||
这个过程称为 **级联删除（Cascading Deletion）**。
|
||||
级联删除有两种类型，分别如下：
|
||||
|
||||
* 前台级联删除
|
||||
@@ -150,7 +149,7 @@ owner object:
|
||||
-->
|
||||
### 前台级联删除 {#foreground-deletion}
|
||||
|
||||
在前台级联删除中，正在被你删除的对象首先进入 *deletion in progress* 状态。
|
||||
在前台级联删除中，正在被你删除的属主对象首先进入 *deletion in progress* 状态。
|
||||
在这种状态下，针对属主对象会发生以下事情：
|
||||
|
||||
<!--
|
||||
@@ -180,8 +179,8 @@ to learn more.
|
||||
当属主对象进入删除过程中状态后，控制器删除其依赖对象。控制器在删除完所有依赖对象之后，
|
||||
删除属主对象。这时，通过 Kubernetes API 就无法再看到该对象。
|
||||
|
||||
在前台级联删除过程中，唯一的可能阻止属主对象被删除的依赖对象是那些带有
|
||||
`ownerReference.blockOwnerDeletion=true` 字段的对象。
|
||||
在前台级联删除过程中，唯一可能阻止属主对象被删除的是那些带有
|
||||
`ownerReference.blockOwnerDeletion=true` 字段的依赖对象。
|
||||
参阅[使用前台级联删除](/zh/docs/tasks/administer-cluster/use-cascading-deletion/#use-foreground-cascading-deletion)
|
||||
以了解进一步的细节。
|
||||
|
||||
|
||||
@@ -157,7 +157,7 @@ Within Kubernetes RBAC there are a number of privileges which, if granted, can a
|
||||
to escalate their privileges in the cluster or affect systems outside the cluster.
|
||||
|
||||
This section is intended to provide visibility of the areas where cluster operators
|
||||
should take care, to ensure that they do not inadvertantly allow for more access to clusters than intended.
|
||||
should take care, to ensure that they do not inadvertently allow for more access to clusters than intended.
|
||||
-->
|
||||
## Kubernetes RBAC - 权限提权的风险 {#privilege-escalation-risks}
|
||||
|
||||
|
||||
@@ -1230,7 +1230,7 @@ apply multiple fixes in between pausing and resuming without triggering unnecess
|
||||
|
||||
在你更新一个 Deployment 的时候，或者计划更新它的时候，
|
||||
你可以在触发一个或多个更新之前暂停 Deployment 的上线过程。
|
||||
当你准备行应用这些变更时，你可以重新恢复 Deployment 上线过程。
|
||||
当你准备应用这些变更时，你可以重新恢复 Deployment 上线过程。
|
||||
这样做使得你能够在暂停和恢复执行之间应用多个修补程序，而不会触发不必要的上线操作。
|
||||
|
||||
<!--
|
||||
|
||||
+1600
File diff suppressed because it is too large
Load Diff
+566
@@ -0,0 +1,566 @@
|
||||
---
|
||||
api_metadata:
|
||||
apiVersion: "storage.k8s.io/v1"
|
||||
import: "k8s.io/api/storage/v1"
|
||||
kind: "CSINode"
|
||||
content_type: "api_reference"
|
||||
description: "CSINode 包含节点上安装的所有 CSI 驱动有关的信息。"
|
||||
title: "CSINode"
|
||||
weight: 9
|
||||
---
|
||||
<!--
|
||||
api_metadata:
|
||||
apiVersion: "storage.k8s.io/v1"
|
||||
import: "k8s.io/api/storage/v1"
|
||||
kind: "CSINode"
|
||||
content_type: "api_reference"
|
||||
description: "CSINode holds information about all CSI drivers installed on a node."
|
||||
title: "CSINode"
|
||||
weight: 9
|
||||
-->
|
||||
|
||||
`apiVersion: storage.k8s.io/v1`
|
||||
|
||||
`import "k8s.io/api/storage/v1"`
|
||||
|
||||
## CSINode {#CSINode}
|
||||
<!--
|
||||
CSINode holds information about all CSI drivers installed on a node. CSI drivers do not need to create the CSINode object directly. As long as they use the node-driver-registrar sidecar container, the kubelet will automatically populate the CSINode object for the CSI driver as part of kubelet plugin registration. CSINode has the same name as a node. If the object is missing, it means either there are no CSI Drivers available on the node, or the Kubelet version is low enough that it doesn't create this object. CSINode has an OwnerReference that points to the corresponding node object.
|
||||
-->
|
||||
CSINode 包含节点上安装的所有 CSI 驱动有关的信息。CSI 驱动不需要直接创建 CSINode 对象。
|
||||
只要这些驱动使用 node-driver-registrar 边车容器，kubelet 就会自动为 CSI 驱动填充 CSINode 对象，
|
||||
作为 kubelet 插件注册操作的一部分。CSINode 的名称与节点名称相同。
|
||||
如果不存在此对象，则说明该节点上没有可用的 CSI 驱动或 Kubelet 版本太低无法创建该对象。
|
||||
CSINode 包含指向相应节点对象的 OwnerReference。
|
||||
|
||||
<hr>
|
||||
|
||||
- **apiVersion**: storage.k8s.io/v1
|
||||
|
||||
- **kind**: CSINode
|
||||
|
||||
<!--
|
||||
- **metadata** (<a href="{{< ref "../common-definitions/object-meta#ObjectMeta" >}}">ObjectMeta</a>)
|
||||
metadata.name must be the Kubernetes node name.
|
||||
|
||||
- **spec** (<a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINodeSpec" >}}">CSINodeSpec</a>), required
|
||||
spec is the specification of CSINode
|
||||
-->
|
||||
- **metadata** (<a href="{{< ref "../common-definitions/object-meta#ObjectMeta" >}}">ObjectMeta</a>)
|
||||
|
||||
metadata.name 必须是 Kubernetes 节点的名称。
|
||||
|
||||
- **spec** (<a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINodeSpec" >}}">CSINodeSpec</a>)，必需
|
||||
|
||||
spec 是 CSINode 的规约。
|
||||
|
||||
## CSINodeSpec {#CSINodeSpec}
|
||||
<!--
|
||||
CSINodeSpec holds information about the specification of all CSI drivers installed on a node
|
||||
-->
|
||||
CSINodeSpec 包含一个节点上安装的所有 CSI 驱动规约有关的信息。
|
||||
|
||||
<hr>
|
||||
|
||||
<!--
|
||||
- **drivers** ([]CSINodeDriver), required
|
||||
|
||||
*Patch strategy: merge on key `name`*
|
||||
|
||||
drivers is a list of information of all CSI Drivers existing on a node. If all drivers in the list are uninstalled, this can become empty.
|
||||
|
||||
<a name="CSINodeDriver"></a>
|
||||
*CSINodeDriver holds information about the specification of one CSI driver installed on a node*
|
||||
|
||||
- **drivers.name** (string), required
|
||||
|
||||
This is the name of the CSI driver that this object refers to. This MUST be the same name returned by the CSI GetPluginName() call for that driver.
|
||||
-->
|
||||
- **drivers** ([]CSINodeDriver)，必需
|
||||
|
||||
**补丁策略：按照键 `name` 合并**
|
||||
|
||||
drivers 是节点上存在的所有 CSI 驱动的信息列表。如果列表中的所有驱动均被卸载，则此字段可以为空。
|
||||
|
||||
<a name="CSINodeDriver"></a>
|
||||
**CSINodeDriver 包含一个节点上安装的一个 CSI 驱动规约有关的信息。**
|
||||
|
||||
- **drivers.name** (string)，必需
|
||||
|
||||
这是该对象引用的 CSI 驱动的名称。此字段值必须是针对该驱动由 CSI GetPluginName() 调用返回的相同名称。
|
||||
|
||||
<!--
|
||||
- **drivers.nodeID** (string), required
|
||||
nodeID of the node from the driver point of view. This field enables Kubernetes to communicate with storage systems that do not share the same nomenclature for nodes. For example, Kubernetes may refer to a given node as "node1", but the storage system may refer to the same node as "nodeA". When Kubernetes issues a command to the storage system to attach a volume to a specific node, it can use this field to refer to the node name using the ID that the storage system will understand, e.g. "nodeA" instead of "node1". This field is required.
|
||||
-->
|
||||
- **drivers.nodeID** (string)，必需
|
||||
|
||||
从驱动角度来看，这是节点的 nodeID。
|
||||
对于未与节点共享相同命名法的存储系统，此字段使得 Kubernetes 能够与之进行通信。
|
||||
例如，Kubernetes 可能将给定节点视为 "node1"，但存储系统可以将同一节点视为 "nodeA"。
|
||||
当 Kubernetes 向存储系统发出一条命令将一个卷挂接到特定的节点时，
|
||||
它可以藉此字段使用存储系统所理解的 ID 引用节点名称，例如使用 “nodeA” 而不是 “node1”。
|
||||
此字段是必需的。
|
||||
|
||||
<!--
|
||||
- **drivers.allocatable** (VolumeNodeResources)
|
||||
allocatable represents the volume resources of a node that are available for scheduling. This field is beta.
|
||||
|
||||
<a name="VolumeNodeResources"></a>
|
||||
*VolumeNodeResources is a set of resource limits for scheduling of volumes.*
|
||||
|
||||
- **drivers.allocatable.count** (int32)
|
||||
Maximum number of unique volumes managed by the CSI driver that can be used on a node. A volume that is both attached and mounted on a node is considered to be used once, not twice. The same rule applies for a unique volume that is shared among multiple pods on the same node. If this field is not specified, then the supported number of volumes on this node is unbounded.
|
||||
-->
|
||||
- **drivers.allocatable** (VolumeNodeResources)
|
||||
|
||||
allocatable 表示一个节点上可供调度的卷资源。此字段处于 beta 阶段。
|
||||
|
||||
<a name="VolumeNodeResources"></a>
|
||||
**VolumeNodeResources 是调度卷时所用的一组资源限制。**
|
||||
|
||||
- **drivers.allocatable.count** (int32)
|
||||
|
||||
这是一个节点上可使用的、由 CSI 驱动管理的独立卷个数的上限。
|
||||
挂接并挂载到一个节点上的卷被视为被使用一次，不是两次。
|
||||
相同的规则适用于同一个节点上多个 Pod 之间共享的同一个卷。
|
||||
如果未指定此字段，则该节点上支持的卷数量是无限的。
|
||||
|
||||
<!--
|
||||
- **drivers.topologyKeys** ([]string)
|
||||
|
||||
topologyKeys is the list of keys supported by the driver. When a driver is initialized on a cluster, it provides a set of topology keys that it understands (e.g. "company.com/zone", "company.com/region"). When a driver is initialized on a node, it provides the same topology keys along with values. Kubelet will expose these topology keys as labels on its own node object. When Kubernetes does topology aware provisioning, it can use this list to determine which labels it should retrieve from the node object and pass back to the driver. It is possible for different nodes to use different topology keys. This can be empty if driver does not support topology.
|
||||
-->
|
||||
- **drivers.topologyKeys** ([]string)
|
||||
|
||||
topologyKeys 是驱动支持的键的列表。
|
||||
在集群上初始化一个驱动时，该驱动将提供一组自己理解的拓扑键
|
||||
（例如 “company.com/zone”、“company.com/region”）。
|
||||
在一个节点上初始化一个驱动时，该驱动将提供相同的拓扑键和值。
|
||||
Kubelet 将在其自己的节点对象上将这些拓扑键暴露为标签。
|
||||
当 Kubernetes 进行拓扑感知的制备时，可以使用此列表决定应从节点对象中检索哪些标签并传回驱动。
|
||||
不同的节点可以使用不同的拓扑键。
|
||||
如果驱动不支持拓扑，则此字段可以为空。
|
||||
|
||||
## CSINodeList {#CSINodeList}
|
||||
<!--
|
||||
CSINodeList is a collection of CSINode objects.
|
||||
-->
|
||||
CSINodeList 是 CSINode 对象的集合。
|
||||
|
||||
<hr>
|
||||
|
||||
- **apiVersion**: storage.k8s.io/v1
|
||||
|
||||
- **kind**: CSINodeList
|
||||
|
||||
<!--
|
||||
- **metadata** (<a href="{{< ref "../common-definitions/list-meta#ListMeta" >}}">ListMeta</a>)
|
||||
Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
|
||||
- **items** ([]<a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINode" >}}">CSINode</a>), required
|
||||
items is the list of CSINode
|
||||
-->
|
||||
- **metadata** (<a href="{{< ref "../common-definitions/list-meta#ListMeta" >}}">ListMeta</a>)
|
||||
|
||||
标准的列表元数据。更多信息：
|
||||
https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
|
||||
- **items** ([]<a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINode" >}}">CSINode</a>)，必需
|
||||
|
||||
items 是 CSINode 的列表。
|
||||
|
||||
<!--
|
||||
## Operations {#Operations}
|
||||
<hr>
|
||||
### `get` read the specified CSINode
|
||||
#### HTTP Request
|
||||
-->
|
||||
## 操作 {#Operations}
|
||||
|
||||
<hr>
|
||||
|
||||
### `get` 读取指定的 CSINode
|
||||
#### HTTP 请求
|
||||
|
||||
GET /apis/storage.k8s.io/v1/csinodes/{name}
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **name** (*in path*): string, required
|
||||
name of the CSINode
|
||||
- **pretty** (*in query*): string
|
||||
-->
|
||||
#### 参数
|
||||
- **name** (**路径参数**): string，必需
|
||||
|
||||
CSINode 的名称
|
||||
|
||||
- **pretty** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
200 (<a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINode" >}}">CSINode</a>): OK
|
||||
|
||||
401: Unauthorized
|
||||
|
||||
<!--
|
||||
### `list` list or watch objects of kind CSINode
|
||||
#### HTTP Request
|
||||
-->
|
||||
### `list` 列出或观测类别为 CSINode 的对象
|
||||
#### HTTP 请求
|
||||
|
||||
GET /apis/storage.k8s.io/v1/csinodes
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **allowWatchBookmarks** (*in query*): boolean
|
||||
- **continue** (*in query*): string
|
||||
- **fieldSelector** (*in query*): string
|
||||
- **labelSelector** (*in query*): string
|
||||
- **limit** (*in query*): integer
|
||||
- **pretty** (*in query*): string
|
||||
- **resourceVersion** (*in query*): string
|
||||
- **resourceVersionMatch** (*in query*): string
|
||||
- **timeoutSeconds** (*in query*): integer
|
||||
- **watch** (*in query*): boolean
|
||||
-->
|
||||
#### 参数
|
||||
- **allowWatchBookmarks** (**查询参数**): boolean
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#allowWatchBookmarks" >}}">allowWatchBookmarks</a>
|
||||
|
||||
- **continue** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#continue" >}}">continue</a>
|
||||
|
||||
- **fieldSelector** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldSelector" >}}">fieldSelector</a>
|
||||
|
||||
- **labelSelector** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#labelSelector" >}}">labelSelector</a>
|
||||
|
||||
- **limit** (**查询参数**): integer
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#limit" >}}">limit</a>
|
||||
|
||||
- **pretty** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
- **resourceVersion** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#resourceVersion" >}}">resourceVersion</a>
|
||||
|
||||
- **resourceVersionMatch** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#resourceVersionMatch" >}}">resourceVersionMatch</a>
|
||||
|
||||
- **timeoutSeconds** (**查询参数**): integer
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#timeoutSeconds" >}}">timeoutSeconds</a>
|
||||
|
||||
- **watch** (**查询参数**): boolean
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#watch" >}}">watch</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
200 (<a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINodeList" >}}">CSINodeList</a>): OK
|
||||
|
||||
401: Unauthorized
|
||||
|
||||
<!--
|
||||
### `create` create a CSINode
|
||||
#### HTTP Request
|
||||
-->
|
||||
### `create` 创建 CSINode
|
||||
#### HTTP 请求
|
||||
|
||||
POST /apis/storage.k8s.io/v1/csinodes
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **body**: <a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINode" >}}">CSINode</a>, required
|
||||
- **dryRun** (*in query*): string
|
||||
- **fieldManager** (*in query*): string
|
||||
- **fieldValidation** (*in query*): string
|
||||
- **pretty** (*in query*): string
|
||||
-->
|
||||
#### 参数
|
||||
- **body**: <a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINode" >}}">CSINode</a>，必需
|
||||
|
||||
- **dryRun** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#dryRun" >}}">dryRun</a>
|
||||
|
||||
- **fieldManager** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldManager" >}}">fieldManager</a>
|
||||
|
||||
- **fieldValidation** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldValidation" >}}">fieldValidation</a>
|
||||
|
||||
- **pretty** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
200 (<a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINode" >}}">CSINode</a>): OK
|
||||
|
||||
201 (<a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINode" >}}">CSINode</a>): Created
|
||||
|
||||
202 (<a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINode" >}}">CSINode</a>): Accepted
|
||||
|
||||
401: Unauthorized
|
||||
|
||||
<!--
|
||||
### `update` replace the specified CSINode
|
||||
#### HTTP Request
|
||||
-->
|
||||
### `update` 替换指定的 CSINode
|
||||
#### HTTP 请求
|
||||
|
||||
PUT /apis/storage.k8s.io/v1/csinodes/{name}
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **name** (*in path*): string, required
|
||||
name of the CSINode
|
||||
- **body**: <a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINode" >}}">CSINode</a>, required
|
||||
- **dryRun** (*in query*): string
|
||||
- **fieldManager** (*in query*): string
|
||||
- **fieldValidation** (*in query*): string
|
||||
- **pretty** (*in query*): string
|
||||
-->
|
||||
#### 参数
|
||||
- **name** (**路径参数**): string，必需
|
||||
|
||||
CSINode 的名称
|
||||
|
||||
- **body**: <a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINode" >}}">CSINode</a>，必需
|
||||
|
||||
- **dryRun** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#dryRun" >}}">dryRun</a>
|
||||
|
||||
- **fieldManager** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldManager" >}}">fieldManager</a>
|
||||
|
||||
- **fieldValidation** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldValidation" >}}">fieldValidation</a>
|
||||
|
||||
- **pretty** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
200 (<a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINode" >}}">CSINode</a>): OK
|
||||
|
||||
201 (<a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINode" >}}">CSINode</a>): Created
|
||||
|
||||
401: Unauthorized
|
||||
|
||||
<!--
|
||||
### `patch` partially update the specified CSINode
|
||||
#### HTTP Request
|
||||
-->
|
||||
### `patch` 部分更新指定的 CSINode
|
||||
#### HTTP 请求
|
||||
|
||||
PATCH /apis/storage.k8s.io/v1/csinodes/{name}
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **name** (*in path*): string, required
|
||||
name of the CSINode
|
||||
- **body**: <a href="{{< ref "../common-definitions/patch#Patch" >}}">Patch</a>, required
|
||||
- **dryRun** (*in query*): string
|
||||
- **fieldManager** (*in query*): string
|
||||
- **fieldValidation** (*in query*): string
|
||||
- **force** (*in query*): boolean
|
||||
- **pretty** (*in query*): string
|
||||
-->
|
||||
#### 参数
|
||||
- **name** (**路径参数**): string，必需
|
||||
|
||||
CSINode 的名称
|
||||
|
||||
- **body**: <a href="{{< ref "../common-definitions/patch#Patch" >}}">Patch</a>，必需
|
||||
|
||||
- **dryRun** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#dryRun" >}}">dryRun</a>
|
||||
|
||||
- **fieldManager** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldManager" >}}">fieldManager</a>
|
||||
|
||||
- **fieldValidation** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldValidation" >}}">fieldValidation</a>
|
||||
|
||||
- **force** (**查询参数**): boolean
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#force" >}}">force</a>
|
||||
|
||||
- **pretty** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
200 (<a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINode" >}}">CSINode</a>): OK
|
||||
|
||||
201 (<a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINode" >}}">CSINode</a>): Created
|
||||
|
||||
401: Unauthorized
|
||||
|
||||
<!--
|
||||
### `delete` delete a CSINode
|
||||
#### HTTP Request
|
||||
-->
|
||||
### `delete` 删除 CSINode
|
||||
#### HTTP 请求
|
||||
DELETE /apis/storage.k8s.io/v1/csinodes/{name}
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **name** (*in path*): string, required
|
||||
name of the CSINode
|
||||
- **body**: <a href="{{< ref "../common-definitions/delete-options#DeleteOptions" >}}">DeleteOptions</a>
|
||||
- **dryRun** (*in query*): string
|
||||
- **gracePeriodSeconds** (*in query*): integer
|
||||
- **pretty** (*in query*): string
|
||||
- **propagationPolicy** (*in query*): string
|
||||
-->
|
||||
#### 参数
|
||||
- **name** (**路径参数**): string，必需
|
||||
|
||||
CSINode 的名称
|
||||
|
||||
- **body**: <a href="{{< ref "../common-definitions/delete-options#DeleteOptions" >}}">DeleteOptions</a>
|
||||
|
||||
- **dryRun** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#dryRun" >}}">dryRun</a>
|
||||
|
||||
- **gracePeriodSeconds** (**查询参数**): integer
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#gracePeriodSeconds" >}}">gracePeriodSeconds</a>
|
||||
|
||||
- **pretty** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
- **propagationPolicy** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#propagationPolicy" >}}">propagationPolicy</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
200 (<a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINode" >}}">CSINode</a>): OK
|
||||
|
||||
202 (<a href="{{< ref "../config-and-storage-resources/csi-node-v1#CSINode" >}}">CSINode</a>): Accepted
|
||||
|
||||
401: Unauthorized
|
||||
|
||||
<!--
|
||||
### `deletecollection` delete collection of CSINode
|
||||
#### HTTP Request
|
||||
-->
|
||||
### `deletecollection` 删除 CSINode 的集合
|
||||
#### HTTP 请求
|
||||
DELETE /apis/storage.k8s.io/v1/csinodes
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **body**: <a href="{{< ref "../common-definitions/delete-options#DeleteOptions" >}}">DeleteOptions</a>
|
||||
- **continue** (*in query*): string
|
||||
- **dryRun** (*in query*): string
|
||||
- **fieldSelector** (*in query*): string
|
||||
- **gracePeriodSeconds** (*in query*): integer
|
||||
- **labelSelector** (*in query*): string
|
||||
- **limit** (*in query*): integer
|
||||
- **pretty** (*in query*): string
|
||||
- **propagationPolicy** (*in query*): string
|
||||
- **resourceVersion** (*in query*): string
|
||||
- **resourceVersionMatch** (*in query*): string
|
||||
- **timeoutSeconds** (*in query*): integer
|
||||
-->
|
||||
#### 参数
|
||||
- **body**: <a href="{{< ref "../common-definitions/delete-options#DeleteOptions" >}}">DeleteOptions</a>
|
||||
|
||||
- **continue** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#continue" >}}">continue</a>
|
||||
|
||||
- **dryRun** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#dryRun" >}}">dryRun</a>
|
||||
|
||||
- **fieldSelector** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldSelector" >}}">fieldSelector</a>
|
||||
|
||||
- **gracePeriodSeconds** (**查询参数**): integer
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#gracePeriodSeconds" >}}">gracePeriodSeconds</a>
|
||||
|
||||
- **labelSelector** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#labelSelector" >}}">labelSelector</a>
|
||||
|
||||
- **limit** (**查询参数**): integer
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#limit" >}}">limit</a>
|
||||
|
||||
- **pretty** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
- **propagationPolicy** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#propagationPolicy" >}}">propagationPolicy</a>
|
||||
|
||||
- **resourceVersion** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#resourceVersion" >}}">resourceVersion</a>
|
||||
|
||||
- **resourceVersionMatch** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#resourceVersionMatch" >}}">resourceVersionMatch</a>
|
||||
|
||||
- **timeoutSeconds** (**查询参数**): integer
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#timeoutSeconds" >}}">timeoutSeconds</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
200 (<a href="{{< ref "../common-definitions/status#Status" >}}">Status</a>): OK
|
||||
|
||||
401: Unauthorized
|
||||
+993
@@ -0,0 +1,993 @@
|
||||
---
|
||||
api_metadata:
|
||||
apiVersion: "v1"
|
||||
import: "k8s.io/api/core/v1"
|
||||
kind: "PersistentVolumeClaim"
|
||||
content_type: "api_reference"
|
||||
description: "PersistentVolumeClaim 是用户针对一个持久卷的请求和申领。"
|
||||
title: "PersistentVolumeClaim"
|
||||
weight: 4
|
||||
---
|
||||
<!--
|
||||
api_metadata:
|
||||
apiVersion: "v1"
|
||||
import: "k8s.io/api/core/v1"
|
||||
kind: "PersistentVolumeClaim"
|
||||
content_type: "api_reference"
|
||||
description: "PersistentVolumeClaim is a user's request for and claim to a persistent volume."
|
||||
title: "PersistentVolumeClaim"
|
||||
weight: 4
|
||||
-->
|
||||
|
||||
`apiVersion: v1`
|
||||
|
||||
`import "k8s.io/api/core/v1"`
|
||||
|
||||
## PersistentVolumeClaim {#PersistentVolumeClaim}
|
||||
<!--
|
||||
PersistentVolumeClaim is a user's request for and claim to a persistent volume
|
||||
-->
|
||||
PersistentVolumeClaim 是用户针对一个持久卷的请求和申领。
|
||||
|
||||
<hr>
|
||||
|
||||
- **apiVersion**: v1
|
||||
|
||||
- **kind**: PersistentVolumeClaim
|
||||
|
||||
<!--
|
||||
- **metadata** (<a href="{{< ref "../common-definitions/object-meta#ObjectMeta" >}}">ObjectMeta</a>)
|
||||
Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
|
||||
- **spec** (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaimSpec" >}}">PersistentVolumeClaimSpec</a>)
|
||||
spec defines the desired characteristics of a volume requested by a pod author. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
|
||||
-->
|
||||
- **metadata** (<a href="{{< ref "../common-definitions/object-meta#ObjectMeta" >}}">ObjectMeta</a>)
|
||||
|
||||
标准的对象元数据。更多信息：
|
||||
https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
|
||||
|
||||
- **spec** (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaimSpec" >}}">PersistentVolumeClaimSpec</a>)
|
||||
|
||||
spec 定义 Pod 作者所请求的卷的预期特征。更多信息：
|
||||
https://kubernetes.io/zh-cn/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
|
||||
|
||||
<!--
|
||||
- **status** (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaimStatus" >}}">PersistentVolumeClaimStatus</a>)
|
||||
status represents the current information/status of a persistent volume claim. Read-only. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
|
||||
-->
|
||||
- **status** (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaimStatus" >}}">PersistentVolumeClaimStatus</a>)
|
||||
|
||||
status 表示一个持久卷申领的当前信息/状态。只读。更多信息：
|
||||
https://kubernetes.io/zh-cn/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
|
||||
|
||||
## PersistentVolumeClaimSpec {#PersistentVolumeClaimSpec}
|
||||
<!--
|
||||
PersistentVolumeClaimSpec describes the common attributes of storage devices and allows a Source for provider-specific attributes
|
||||
<hr>
|
||||
- **accessModes** ([]string)
|
||||
accessModes contains the desired access modes the volume should have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
|
||||
|
||||
- **selector** (<a href="{{< ref "../common-definitions/label-selector#LabelSelector" >}}">LabelSelector</a>)
|
||||
selector is a label query over volumes to consider for binding.
|
||||
-->
|
||||
PersistentVolumeClaimSpec 描述存储设备的常用参数，并支持通过 source 来设置特定于提供商的属性。
|
||||
|
||||
<hr>
|
||||
|
||||
- **accessModes** ([]string)
|
||||
|
||||
accessModes 包含卷应具备的预期访问模式。更多信息：
|
||||
https://kubernetes.io/zh-cn/docs/concepts/storage/persistent-volumes#access-modes-1
|
||||
|
||||
- **selector** (<a href="{{< ref "../common-definitions/label-selector#LabelSelector" >}}">LabelSelector</a>)
|
||||
|
||||
selector 是在绑定时对卷进行选择所执行的标签查询。
|
||||
|
||||
<!--
|
||||
- **resources** (ResourceRequirements)
|
||||
resources represents the minimum resources the volume should have. If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements that are lower than previous value but must still be higher than capacity recorded in the status field of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
|
||||
|
||||
<a name="ResourceRequirements"></a>
|
||||
*ResourceRequirements describes the compute resource requirements.*
|
||||
|
||||
- **resources.limits** (map[string]<a href="{{< ref "../common-definitions/quantity#Quantity" >}}">Quantity</a>)
|
||||
Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
|
||||
- **resources.requests** (map[string]<a href="{{< ref "../common-definitions/quantity#Quantity" >}}">Quantity</a>)
|
||||
Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
-->
|
||||
- **resources** (ResourceRequirements)
|
||||
|
||||
resources 表示卷应拥有的最小资源。
|
||||
如果启用了 RecoverVolumeExpansionFailure 功能特性，则允许用户指定这些资源要求，
|
||||
此值必须低于之前的值，但必须高于申领的状态字段中记录的容量。更多信息：
|
||||
https://kubernetes.io/zh-cn/docs/concepts/storage/persistent-volumes#resources
|
||||
|
||||
<a name="ResourceRequirements"></a>
|
||||
**ResourceRequirements 描述计算资源要求。**
|
||||
|
||||
- **resources.limits** (map[string]<a href="{{< ref "../common-definitions/quantity#Quantity" >}}">Quantity</a>)
|
||||
|
||||
limits 描述允许的最大计算资源量。更多信息：
|
||||
https://kubernetes.io/zh-cn/docs/concepts/configuration/manage-resources-containers/
|
||||
|
||||
- **resources.requests** (map[string]<a href="{{< ref "../common-definitions/quantity#Quantity" >}}">Quantity</a>)
|
||||
|
||||
requests 描述所需的最小计算资源量。
|
||||
如果针对容器省略 requests，则在显式指定的情况下默认为 limits，否则为具体实现所定义的值。更多信息：
|
||||
https://kubernetes.io/zh-cn/docs/concepts/configuration/manage-resources-containers/
|
||||
|
||||
<!--
|
||||
- **volumeName** (string)
|
||||
volumeName is the binding reference to the PersistentVolume backing this claim.
|
||||
|
||||
- **storageClassName** (string)
|
||||
storageClassName is the name of the StorageClass required by the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
|
||||
|
||||
- **volumeMode** (string)
|
||||
volumeMode defines what type of volume is required by the claim. Value of Filesystem is implied when not included in claim spec.
|
||||
-->
|
||||
- **volumeName** (string)
|
||||
|
||||
volumeName 是对此申领所对应的 PersistentVolume 的绑定引用。
|
||||
|
||||
- **storageClassName** (string)
|
||||
|
||||
storageClassName 是此申领所要求的 StorageClass 名称。更多信息：
|
||||
https://kubernetes.io/zh-cn/docs/concepts/storage/persistent-volumes#class-1
|
||||
|
||||
- **volumeMode** (string)
|
||||
|
||||
volumeMode 定义申领需要哪种类别的卷。当申领规约中未包含此字段时，意味着取值为 Filesystem。
|
||||
|
||||
<!--
|
||||
### Alpha level
|
||||
|
||||
- **dataSource** (<a href="{{< ref "../common-definitions/typed-local-object-reference#TypedLocalObjectReference" >}}">TypedLocalObjectReference</a>)
|
||||
|
||||
dataSource field can be used to specify either: * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. If the AnyVolumeDataSource feature gate is enabled, this field will always have the same contents as the DataSourceRef field.
|
||||
-->
|
||||
### Alpha 级别
|
||||
- **dataSource** (<a href="{{< ref "../common-definitions/typed-local-object-reference#TypedLocalObjectReference" >}}">TypedLocalObjectReference</a>)
|
||||
|
||||
dataSource 字段可用于二选一：
|
||||
|
||||
* 现有的 VolumeSnapshot 对象（snapshot.storage.k8s.io/VolumeSnapshot）
|
||||
|
||||
* 现有的 PVC (PersistentVolumeClaim)
|
||||
|
||||
如果制备器或外部控制器可以支持指定的数据源，则它将根据指定数据源的内容创建新的卷。
|
||||
如果 AnyVolumeDataSource 特性门控被启用，此字段的内容将始终与 dataSourceRef 字段内容相同。
|
||||
|
||||
<!--
|
||||
- **dataSourceRef** (<a href="{{< ref "../common-definitions/typed-local-object-reference#TypedLocalObjectReference" >}}">TypedLocalObjectReference</a>)
|
||||
|
||||
dataSourceRef specifies the object from which to populate the volume with data, if a non-empty volume is desired. This may be any local object from a non-empty API group (non core object) or a PersistentVolumeClaim object. When this field is specified, volume binding will only succeed if the type of the specified object matches some installed volume populator or dynamic provisioner. This field will replace the functionality of the DataSource field and as such if both fields are non-empty, they must have the same value. For backwards compatibility, both fields (DataSource and DataSourceRef) will be set to the same value automatically if one of them is empty and the other is non-empty. There are two important differences between DataSource and DataSourceRef: * While DataSource only allows two specific types of objects, DataSourceRef
|
||||
allows any non-core object, as well as PersistentVolumeClaim objects.
|
||||
* While DataSource ignores disallowed values (dropping them), DataSourceRef
|
||||
preserves all values, and generates an error if a disallowed value is
|
||||
specified.
|
||||
(Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
|
||||
-->
|
||||
- **dataSourceRef** (<a href="{{< ref "../common-definitions/typed-local-object-reference#TypedLocalObjectReference" >}}">TypedLocalObjectReference</a>)
|
||||
|
||||
dataSourceRef 指定一个对象，当需要非空卷时，可以使用它来为卷填充数据。
|
||||
此字段值可以是来自非空 API 组（非核心对象）的一个本地对象，或一个 PersistentVolumeClaim 对象。
|
||||
如果设置了此字段，则仅当所指定对象的类型与所安装的某些卷填充器或动态制备器匹配时，卷绑定才会成功。
|
||||
此字段将替换 dataSource 字段的功能，因此如果两个字段非空，其取值必须相同。
|
||||
为了向后兼容，如果其中一个字段为空且另一个字段非空，
|
||||
则两个字段（dataSource 和 dataSourceRef）将被自动设为相同的值。
|
||||
dataSource 和 dataSourceRef 之间有两个重要的区别：
|
||||
|
||||
* dataSource 仅允许两个特定类型的对象，而 dataSourceRef 允许设置任何非核心对象以及 PersistentVolumeClaim 对象。
|
||||
|
||||
* dataSource 忽略不允许的值（这类值会被丢弃），dataSourceRef 保留所有值并在指定不允许的值时产生错误。
|
||||
|
||||
（Beta）使用此字段需要启用 AnyVolumeDataSource 特性门控。
|
||||
|
||||
## PersistentVolumeClaimStatus {#PersistentVolumeClaimStatus}
|
||||
<!--
|
||||
PersistentVolumeClaimStatus is the current status of a persistent volume claim.
|
||||
|
||||
<hr>
|
||||
|
||||
- **accessModes** ([]string)
|
||||
accessModes contains the actual access modes the volume backing the PVC has. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
|
||||
-->
|
||||
PersistentVolumeClaimStatus 是持久卷申领的当前状态。
|
||||
|
||||
<hr>
|
||||
|
||||
- **accessModes** ([]string)
|
||||
|
||||
accessModes 包含支持 PVC 的卷所具有的实际访问模式。更多信息：
|
||||
https://kubernetes.io/zh-cn/docs/concepts/storage/persistent-volumes#access-modes-1
|
||||
|
||||
<!--
|
||||
- **allocatedResources** (map[string]<a href="{{< ref "../common-definitions/quantity#Quantity" >}}">Quantity</a>)
|
||||
|
||||
allocatedResources is the storage resource within AllocatedResources tracks the capacity allocated to a PVC. It may be larger than the actual capacity when a volume expansion operation is requested. For storage quota, the larger value from allocatedResources and PVC.spec.resources is used. If allocatedResources is not set, PVC.spec.resources alone is used for quota calculation. If a volume expansion capacity request is lowered, allocatedResources is only lowered if there are no expansion operations in progress and if the actual volume capacity is equal or lower than the requested capacity. This is an alpha field and requires enabling RecoverVolumeExpansionFailure feature.
|
||||
-->
|
||||
- **allocatedResources** (map[string]<a href="{{< ref "../common-definitions/quantity#Quantity" >}}">Quantity</a>)
|
||||
|
||||
allocatedResources 跟踪分配给 PVC 的容量。
|
||||
当出现卷扩充操作请求时，此字段可能大于实际的容量。
|
||||
就存储配额而言，将使用 allocatedResources 和 PVC.spec.resources 二者中的更大值。
|
||||
如果未设置 allocatedResources，则 PVC.spec.resources 单独用于配额计算。
|
||||
如果减小一个卷扩充容量请求，则仅当没有正在进行的扩充操作且实际卷容量等于或小于请求的容量时，
|
||||
才会减小 allocatedResources。
|
||||
这是一个 Alpha 字段，需要启用 RecoverVolumeExpansionFailure 功能特性。
|
||||
|
||||
<!--
|
||||
- **capacity** (map[string]<a href="{{< ref "../common-definitions/quantity#Quantity" >}}">Quantity</a>)
|
||||
|
||||
capacity represents the actual resources of the underlying volume.
|
||||
-->
|
||||
- **capacity** (map[string]<a href="{{< ref "../common-definitions/quantity#Quantity" >}}">Quantity</a>)
|
||||
|
||||
capacity 表示底层卷的实际资源。
|
||||
|
||||
<!--
|
||||
- **conditions** ([]PersistentVolumeClaimCondition)
|
||||
*Patch strategy: merge on key `type`*
|
||||
|
||||
conditions is the current Condition of persistent volume claim. If underlying persistent volume is being resized then the Condition will be set to 'ResizeStarted'.
|
||||
|
||||
<a name="PersistentVolumeClaimCondition"></a>
|
||||
*PersistentVolumeClaimCondition contails details about state of pvc*
|
||||
-->
|
||||
- **conditions** ([]PersistentVolumeClaimCondition)
|
||||
|
||||
**补丁策略：按照键 `type` 合并**
|
||||
|
||||
conditions 是持久卷声明的当前的状况。
|
||||
如果正在调整底层持久卷的大小，则状况将被设为 “ResizeStarted”。
|
||||
|
||||
<a name="PersistentVolumeClaimCondition"></a>
|
||||
**PersistentVolumeClaimCondition 包含有关 PVC 状态的详细信息。**
|
||||
|
||||
<!--
|
||||
- **conditions.status** (string), required
|
||||
- **conditions.type** (string), required
|
||||
- **conditions.lastProbeTime** (Time)
|
||||
lastProbeTime is the time we probed the condition.
|
||||
|
||||
<a name="Time"></a>
|
||||
*Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.*
|
||||
-->
|
||||
- **conditions.status** (string)，必需
|
||||
|
||||
- **conditions.type** (string)，必需
|
||||
|
||||
- **conditions.lastProbeTime** (Time)
|
||||
|
||||
lastProbeTime 是我们探测 PVC 状况的时间。
|
||||
|
||||
<a name="Time"></a>
|
||||
**Time 是 time.Time 的包装类，支持正确地序列化为 YAML 和 JSON。
|
||||
为 time 包提供的许多工厂方法提供了包装类。**
|
||||
|
||||
<!--
|
||||
- **conditions.lastTransitionTime** (Time)
|
||||
lastTransitionTime is the time the condition transitioned from one status to another.
|
||||
|
||||
<a name="Time"></a>
|
||||
*Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.*
|
||||
|
||||
- **conditions.message** (string)
|
||||
message is the human-readable message indicating details about last transition.
|
||||
|
||||
- **conditions.reason** (string)
|
||||
reason is a unique, this should be a short, machine understandable string that gives the reason for condition's last transition. If it reports "ResizeStarted" that means the underlying persistent volume is being resized.
|
||||
-->
|
||||
- **conditions.lastTransitionTime** (Time)
|
||||
|
||||
lastTransitionTime 是状况从一个状态转换为另一个状态的时间。
|
||||
|
||||
<a name="Time"></a>
|
||||
**Time 是 time.Time 的包装类，支持正确地序列化为 YAML 和 JSON。
|
||||
为 time 包提供的许多工厂方法提供了包装类。**
|
||||
|
||||
- **conditions.message** (string)
|
||||
|
||||
message 是人类可读的消息，指示有关上一次转换的详细信息。
|
||||
|
||||
- **conditions.reason** (string)
|
||||
|
||||
reason 是唯一的，它应该是一个机器可理解的简短字符串，指明上次状况转换的原因。
|
||||
如果它报告 “ResizeStarted”，则意味着正在调整底层持久卷的大小。
|
||||
|
||||
<!--
|
||||
- **phase** (string)
|
||||
phase represents the current phase of PersistentVolumeClaim.
|
||||
|
||||
- **resizeStatus** (string)
|
||||
resizeStatus stores status of resize operation. ResizeStatus is not set by default but when expansion is complete resizeStatus is set to empty string by resize controller or kubelet. This is an alpha field and requires enabling RecoverVolumeExpansionFailure feature.
|
||||
-->
|
||||
- **phase** (string)
|
||||
|
||||
phase 表示 PersistentVolumeClaim 的当前阶段。
|
||||
|
||||
- **resizeStatus** (string)
|
||||
|
||||
resizeStatus 存储大小调整操作的状态。默认不设置 resizeStatus，但在扩充完成时，
|
||||
resizeStatus 将由大小调整控制器或 kubelet 设为空。
|
||||
这是一个 Alpha 字段，需要启用 RecoverVolumeExpansionFailure 功能特性。
|
||||
|
||||
## PersistentVolumeClaimList {#PersistentVolumeClaimList}
|
||||
<!--
|
||||
PersistentVolumeClaimList is a list of PersistentVolumeClaim items.
|
||||
-->
|
||||
PersistentVolumeClaimList 是 PersistentVolumeClaim 各项的列表。
|
||||
|
||||
<hr>
|
||||
|
||||
- **apiVersion**: v1
|
||||
|
||||
- **kind**: PersistentVolumeClaimList
|
||||
|
||||
<!--
|
||||
- **metadata** (<a href="{{< ref "../common-definitions/list-meta#ListMeta" >}}">ListMeta</a>)
|
||||
Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
|
||||
- **items** ([]<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>), required
|
||||
items is a list of persistent volume claims. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
|
||||
-->
|
||||
- **metadata** (<a href="{{< ref "../common-definitions/list-meta#ListMeta" >}}">ListMeta</a>)
|
||||
|
||||
标准的列表元数据。更多信息：
|
||||
https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
|
||||
- **items** ([]<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>)，必需
|
||||
|
||||
items 是持久卷申领的列表。更多信息：
|
||||
https://kubernetes.io/zh-cn/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
|
||||
|
||||
<!--
|
||||
## Operations {#Operations}
|
||||
<hr>
|
||||
### `get` read the specified PersistentVolumeClaim
|
||||
#### HTTP Request
|
||||
-->
|
||||
## 操作 {#Operations}
|
||||
<hr>
|
||||
|
||||
### `get` 读取指定的 PersistentVolumeClaim
|
||||
#### HTTP 请求
|
||||
GET /api/v1/namespaces/{namespace}/persistentvolumeclaims/{name}
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **name** (*in path*): string, required
|
||||
name of the PersistentVolumeClaim
|
||||
- **namespace** (*in path*): string, required
|
||||
- **pretty** (*in query*): string
|
||||
-->
|
||||
#### 参数
|
||||
- **name** (**路径参数**): string，必需
|
||||
|
||||
PersistentVolumeClaim 的名称
|
||||
|
||||
- **namespace** (**路径参数**): string，必需
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#namespace" >}}">namespace</a>
|
||||
|
||||
- **pretty** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
200 (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>): OK
|
||||
|
||||
401: Unauthorized
|
||||
|
||||
<!--
|
||||
### `get` read status of the specified PersistentVolumeClaim
|
||||
#### HTTP Request
|
||||
-->
|
||||
### `get` 读取指定的 PersistentVolumeClaim 的状态
|
||||
#### HTTP 请求
|
||||
|
||||
GET /api/v1/namespaces/{namespace}/persistentvolumeclaims/{name}/status
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **name** (*in path*): string, required
|
||||
name of the PersistentVolumeClaim
|
||||
- **namespace** (*in path*): string, required
|
||||
- **pretty** (*in query*): string
|
||||
-->
|
||||
#### 参数
|
||||
- **name** (**路径参数**): string，必需
|
||||
|
||||
PersistentVolumeClaim 的名称
|
||||
|
||||
- **namespace** (**路径参数**): string，必需
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#namespace" >}}">namespace</a>
|
||||
|
||||
- **pretty** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
200 (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>): OK
|
||||
|
||||
401: Unauthorized
|
||||
|
||||
<!--
|
||||
### `list` list or watch objects of kind PersistentVolumeClaim
|
||||
#### HTTP Request
|
||||
-->
|
||||
### `list` 列出或观测类别为 PersistentVolumeClaim 的对象
|
||||
#### HTTP 请求
|
||||
GET /api/v1/namespaces/{namespace}/persistentvolumeclaims
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **namespace** (*in path*): string, required
|
||||
- **allowWatchBookmarks** (*in query*): boolean
|
||||
- **continue** (*in query*): string
|
||||
- **fieldSelector** (*in query*): string
|
||||
- **labelSelector** (*in query*): string
|
||||
- **limit** (*in query*): integer
|
||||
- **pretty** (*in query*): string
|
||||
- **resourceVersion** (*in query*): string
|
||||
- **resourceVersionMatch** (*in query*): string
|
||||
- **timeoutSeconds** (*in query*): integer
|
||||
- **watch** (*in query*): boolean
|
||||
-->
|
||||
#### 参数
|
||||
- **namespace** (**路径参数**): string，必需
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#namespace" >}}">namespace</a>
|
||||
|
||||
- **allowWatchBookmarks** (**查询参数**): boolean
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#allowWatchBookmarks" >}}">allowWatchBookmarks</a>
|
||||
|
||||
- **continue** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#continue" >}}">continue</a>
|
||||
|
||||
- **fieldSelector** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldSelector" >}}">fieldSelector</a>
|
||||
|
||||
- **labelSelector** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#labelSelector" >}}">labelSelector</a>
|
||||
|
||||
- **limit** (**查询参数**): integer
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#limit" >}}">limit</a>
|
||||
|
||||
- **pretty** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
- **resourceVersion** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#resourceVersion" >}}">resourceVersion</a>
|
||||
|
||||
- **resourceVersionMatch** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#resourceVersionMatch" >}}">resourceVersionMatch</a>
|
||||
|
||||
- **timeoutSeconds** (**查询参数**): integer
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#timeoutSeconds" >}}">timeoutSeconds</a>
|
||||
|
||||
- **watch** (**查询参数**): boolean
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#watch" >}}">watch</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
200 (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaimList" >}}">PersistentVolumeClaimList</a>): OK
|
||||
|
||||
401: Unauthorized
|
||||
|
||||
<!--
|
||||
### `list` list or watch objects of kind PersistentVolumeClaim
|
||||
#### HTTP Request
|
||||
-->
|
||||
### `list` 列出或观测类别为 PersistentVolumeClaim 的对象
|
||||
#### HTTP 请求
|
||||
GET /api/v1/persistentvolumeclaims
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **allowWatchBookmarks** (*in query*): boolean
|
||||
- **continue** (*in query*): string
|
||||
- **fieldSelector** (*in query*): string
|
||||
- **labelSelector** (*in query*): string
|
||||
- **limit** (*in query*): integer
|
||||
- **pretty** (*in query*): string
|
||||
- **resourceVersion** (*in query*): string
|
||||
- **resourceVersionMatch** (*in query*): string
|
||||
- **timeoutSeconds** (*in query*): integer
|
||||
- **watch** (*in query*): boolean
|
||||
-->
|
||||
#### 参数
|
||||
- **allowWatchBookmarks** (**查询参数**): boolean
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#allowWatchBookmarks" >}}">allowWatchBookmarks</a>
|
||||
|
||||
- **continue** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#continue" >}}">continue</a>
|
||||
|
||||
- **fieldSelector** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldSelector" >}}">fieldSelector</a>
|
||||
|
||||
- **labelSelector** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#labelSelector" >}}">labelSelector</a>
|
||||
|
||||
- **limit** (**查询参数**): integer
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#limit" >}}">limit</a>
|
||||
|
||||
- **pretty** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
- **resourceVersion** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#resourceVersion" >}}">resourceVersion</a>
|
||||
|
||||
- **resourceVersionMatch** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#resourceVersionMatch" >}}">resourceVersionMatch</a>
|
||||
|
||||
- **timeoutSeconds** (**查询参数**): integer
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#timeoutSeconds" >}}">timeoutSeconds</a>
|
||||
|
||||
- **watch** (**查询参数**): boolean
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#watch" >}}">watch</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
200 (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaimList" >}}">PersistentVolumeClaimList</a>): OK
|
||||
|
||||
401: Unauthorized
|
||||
|
||||
<!--
|
||||
### `create` create a PersistentVolumeClaim
|
||||
#### HTTP Request
|
||||
-->
|
||||
### `create` 创建 PersistentVolumeClaim
|
||||
#### HTTP 请求
|
||||
POST /api/v1/namespaces/{namespace}/persistentvolumeclaims
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **namespace** (*in path*): string, required
|
||||
- **body**: <a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>, required
|
||||
- **dryRun** (*in query*): string
|
||||
- **fieldManager** (*in query*): string
|
||||
- **fieldValidation** (*in query*): string
|
||||
- **pretty** (*in query*): string
|
||||
-->
|
||||
#### 参数
|
||||
- **namespace** (**路径参数**): string，必需
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#namespace" >}}">namespace</a>
|
||||
|
||||
- **body**: <a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>，必需
|
||||
|
||||
- **dryRun** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#dryRun" >}}">dryRun</a>
|
||||
|
||||
- **fieldManager** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldManager" >}}">fieldManager</a>
|
||||
|
||||
- **fieldValidation** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldValidation" >}}">fieldValidation</a>
|
||||
|
||||
- **pretty** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
200 (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>): OK
|
||||
|
||||
201 (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>): Created
|
||||
|
||||
202 (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>): Accepted
|
||||
|
||||
401: Unauthorized
|
||||
|
||||
<!--
|
||||
### `update` replace the specified PersistentVolumeClaim
|
||||
#### HTTP Request
|
||||
-->
|
||||
### `update` 替换指定的 PersistentVolumeClaim
|
||||
#### HTTP 请求
|
||||
PUT /api/v1/namespaces/{namespace}/persistentvolumeclaims/{name}
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **name** (*in path*): string, required
|
||||
name of the PersistentVolumeClaim
|
||||
- **namespace** (*in path*): string, required
|
||||
- **body**: <a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>, required
|
||||
- **dryRun** (*in query*): string
|
||||
- **fieldManager** (*in query*): string
|
||||
- **fieldValidation** (*in query*): string
|
||||
- **pretty** (*in query*): string
|
||||
-->
|
||||
#### 参数
|
||||
- **name** (**路径参数**): string，必需
|
||||
|
||||
PersistentVolumeClaim 的名称
|
||||
|
||||
- **namespace** (**路径参数**): string，必需
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#namespace" >}}">namespace</a>
|
||||
|
||||
- **body**: <a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>，必需
|
||||
|
||||
- **dryRun** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#dryRun" >}}">dryRun</a>
|
||||
|
||||
- **fieldManager** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldManager" >}}">fieldManager</a>
|
||||
|
||||
- **fieldValidation** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldValidation" >}}">fieldValidation</a>
|
||||
|
||||
- **pretty** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
200 (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>): OK
|
||||
|
||||
201 (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>): Created
|
||||
|
||||
401: Unauthorized
|
||||
|
||||
<!--
|
||||
### `update` replace status of the specified PersistentVolumeClaim
|
||||
#### HTTP Request
|
||||
-->
|
||||
### `update` 替换指定的 PersistentVolumeClaim 的状态
|
||||
#### HTTP 请求
|
||||
PUT /api/v1/namespaces/{namespace}/persistentvolumeclaims/{name}/status
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **name** (*in path*): string, required
|
||||
name of the PersistentVolumeClaim
|
||||
- **namespace** (*in path*): string, required
|
||||
- **body**: <a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>, required
|
||||
- **dryRun** (*in query*): string
|
||||
- **fieldManager** (*in query*): string
|
||||
- **fieldValidation** (*in query*): string
|
||||
- **pretty** (*in query*): string
|
||||
-->
|
||||
#### 参数
|
||||
- **name** (**路径参数**): string，必需
|
||||
|
||||
PersistentVolumeClaim 的名称
|
||||
|
||||
- **namespace** (**路径参数**): string，必需
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#namespace" >}}">namespace</a>
|
||||
|
||||
- **body**: <a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>，必需
|
||||
|
||||
- **dryRun** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#dryRun" >}}">dryRun</a>
|
||||
|
||||
- **fieldManager** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldManager" >}}">fieldManager</a>
|
||||
|
||||
- **fieldValidation** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldValidation" >}}">fieldValidation</a>
|
||||
|
||||
- **pretty** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
200 (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>): OK
|
||||
|
||||
201 (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>): Created
|
||||
|
||||
401: Unauthorized
|
||||
|
||||
<!--
|
||||
### `patch` partially update the specified PersistentVolumeClaim
|
||||
#### HTTP Request
|
||||
-->
|
||||
### `patch` 部分更新指定的 PersistentVolumeClaim
|
||||
#### HTTP 请求
|
||||
PATCH /api/v1/namespaces/{namespace}/persistentvolumeclaims/{name}
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **name** (*in path*): string, required
|
||||
name of the PersistentVolumeClaim
|
||||
- **namespace** (*in path*): string, required
|
||||
- **body**: <a href="{{< ref "../common-definitions/patch#Patch" >}}">Patch</a>, required
|
||||
- **dryRun** (*in query*): string
|
||||
- **fieldManager** (*in query*): string
|
||||
- **fieldValidation** (*in query*): string
|
||||
- **force** (*in query*): boolean
|
||||
- **pretty** (*in query*): string
|
||||
-->
|
||||
#### 参数
|
||||
- **name** (**路径参数**): string，必需
|
||||
|
||||
PersistentVolumeClaim 的名称
|
||||
|
||||
- **namespace** (**路径参数**): string，必需
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#namespace" >}}">namespace</a>
|
||||
|
||||
- **body**: <a href="{{< ref "../common-definitions/patch#Patch" >}}">Patch</a>，必需
|
||||
|
||||
- **dryRun** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#dryRun" >}}">dryRun</a>
|
||||
|
||||
- **fieldManager** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldManager" >}}">fieldManager</a>
|
||||
|
||||
- **fieldValidation** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldValidation" >}}">fieldValidation</a>
|
||||
|
||||
- **force** (**查询参数**): boolean
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#force" >}}">force</a>
|
||||
|
||||
- **pretty** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
200 (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>): OK
|
||||
|
||||
201 (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>): Created
|
||||
|
||||
401: Unauthorized
|
||||
|
||||
<!--
|
||||
### `patch` partially update status of the specified PersistentVolumeClaim
|
||||
#### HTTP Request
|
||||
-->
|
||||
### `patch` 部分更新指定的 PersistentVolumeClaim 的状态
|
||||
#### HTTP 请求
|
||||
PATCH /api/v1/namespaces/{namespace}/persistentvolumeclaims/{name}/status
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **name** (*in path*): string, required
|
||||
name of the PersistentVolumeClaim
|
||||
- **namespace** (*in path*): string, required
|
||||
- **body**: <a href="{{< ref "../common-definitions/patch#Patch" >}}">Patch</a>, required
|
||||
- **dryRun** (*in query*): string
|
||||
- **fieldManager** (*in query*): string
|
||||
- **fieldValidation** (*in query*): string
|
||||
- **force** (*in query*): boolean
|
||||
- **pretty** (*in query*): string
|
||||
-->
|
||||
#### 参数
|
||||
- **name** (**路径参数**): string，必需
|
||||
|
||||
PersistentVolumeClaim 的名称
|
||||
|
||||
- **namespace** (**路径参数**): string，必需
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#namespace" >}}">namespace</a>
|
||||
|
||||
- **body**: <a href="{{< ref "../common-definitions/patch#Patch" >}}">Patch</a>，必需
|
||||
|
||||
- **dryRun** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#dryRun" >}}">dryRun</a>
|
||||
|
||||
- **fieldManager** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldManager" >}}">fieldManager</a>
|
||||
|
||||
- **fieldValidation** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldValidation" >}}">fieldValidation</a>
|
||||
|
||||
- **force** (**查询参数**): boolean
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#force" >}}">force</a>
|
||||
|
||||
- **pretty** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
200 (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>): OK
|
||||
|
||||
201 (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>): Created
|
||||
|
||||
401: Unauthorized
|
||||
|
||||
<!--
|
||||
### `delete` delete a PersistentVolumeClaim
|
||||
#### HTTP Request
|
||||
-->
|
||||
### `delete` 删除 PersistentVolumeClaim
|
||||
#### HTTP 请求
|
||||
DELETE /api/v1/namespaces/{namespace}/persistentvolumeclaims/{name}
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **name** (*in path*): string, required
|
||||
name of the PersistentVolumeClaim
|
||||
- **namespace** (*in path*): string, required
|
||||
- **body**: <a href="{{< ref "../common-definitions/delete-options#DeleteOptions" >}}">DeleteOptions</a>
|
||||
- **dryRun** (*in query*): string
|
||||
- **gracePeriodSeconds** (*in query*): integer
|
||||
- **pretty** (*in query*): string
|
||||
- **propagationPolicy** (*in query*): string
|
||||
-->
|
||||
#### 参数
|
||||
- **name** (**路径参数**): string，必需
|
||||
|
||||
PersistentVolumeClaim 的名称
|
||||
|
||||
- **namespace** (**路径参数**): string，必需
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#namespace" >}}">namespace</a>
|
||||
|
||||
- **body**: <a href="{{< ref "../common-definitions/delete-options#DeleteOptions" >}}">DeleteOptions</a>
|
||||
|
||||
- **dryRun** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#dryRun" >}}">dryRun</a>
|
||||
|
||||
- **gracePeriodSeconds** (**查询参数**): integer
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#gracePeriodSeconds" >}}">gracePeriodSeconds</a>
|
||||
|
||||
- **pretty** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
- **propagationPolicy** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#propagationPolicy" >}}">propagationPolicy</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
200 (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>): OK
|
||||
|
||||
202 (<a href="{{< ref "../config-and-storage-resources/persistent-volume-claim-v1#PersistentVolumeClaim" >}}">PersistentVolumeClaim</a>): Accepted
|
||||
|
||||
401: Unauthorized
|
||||
|
||||
<!--
|
||||
### `deletecollection` delete collection of PersistentVolumeClaim
|
||||
#### HTTP Request
|
||||
-->
|
||||
### `deletecollection` 删除 PersistentVolumeClaim 的集合
|
||||
#### HTTP 请求
|
||||
DELETE /api/v1/namespaces/{namespace}/persistentvolumeclaims
|
||||
|
||||
<!--
|
||||
#### Parameters
|
||||
- **namespace** (*in path*): string, required
|
||||
- **body**: <a href="{{< ref "../common-definitions/delete-options#DeleteOptions" >}}">DeleteOptions</a>
|
||||
- **continue** (*in query*): string
|
||||
- **dryRun** (*in query*): string
|
||||
- **fieldSelector** (*in query*): string
|
||||
- **gracePeriodSeconds** (*in query*): integer
|
||||
- **labelSelector** (*in query*): string
|
||||
- **limit** (*in query*): integer
|
||||
- **pretty** (*in query*): string
|
||||
- **propagationPolicy** (*in query*): string
|
||||
- **resourceVersion** (*in query*): string
|
||||
- **resourceVersionMatch** (*in query*): string
|
||||
- **timeoutSeconds** (*in query*): integer
|
||||
-->
|
||||
#### 参数
|
||||
- **namespace** (**路径参数**): string，必需
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#namespace" >}}">namespace</a>
|
||||
|
||||
- **body**: <a href="{{< ref "../common-definitions/delete-options#DeleteOptions" >}}">DeleteOptions</a>
|
||||
|
||||
- **continue** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#continue" >}}">continue</a>
|
||||
|
||||
- **dryRun** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#dryRun" >}}">dryRun</a>
|
||||
|
||||
- **fieldSelector** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#fieldSelector" >}}">fieldSelector</a>
|
||||
|
||||
- **gracePeriodSeconds** (**查询参数**): integer
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#gracePeriodSeconds" >}}">gracePeriodSeconds</a>
|
||||
|
||||
- **labelSelector** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#labelSelector" >}}">labelSelector</a>
|
||||
|
||||
- **limit** (**查询参数**): integer
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#limit" >}}">limit</a>
|
||||
|
||||
- **pretty** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>
|
||||
|
||||
- **propagationPolicy** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#propagationPolicy" >}}">propagationPolicy</a>
|
||||
|
||||
- **resourceVersion** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#resourceVersion" >}}">resourceVersion</a>
|
||||
|
||||
- **resourceVersionMatch** (**查询参数**): string
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#resourceVersionMatch" >}}">resourceVersionMatch</a>
|
||||
|
||||
- **timeoutSeconds** (**查询参数**): integer
|
||||
|
||||
<a href="{{< ref "../common-parameters/common-parameters#timeoutSeconds" >}}">timeoutSeconds</a>
|
||||
|
||||
<!--
|
||||
#### Response
|
||||
-->
|
||||
#### 响应
|
||||
200 (<a href="{{< ref "../common-definitions/status#Status" >}}">Status</a>): OK
|
||||
|
||||
401: Unauthorized
|
||||
@@ -0,0 +1,120 @@
|
||||
---
|
||||
title: 验证已签名容器镜像
|
||||
content_type: task
|
||||
min-kubernetes-server-version: v1.24
|
||||
---
|
||||
<!--
|
||||
title: Verify Signed Container Images
|
||||
content_type: task
|
||||
min-kubernetes-server-version: v1.24
|
||||
-->
|
||||
|
||||
<!-- overview -->
|
||||
|
||||
{{< feature-state state="alpha" for_k8s_version="v1.24" >}}
|
||||
|
||||
## {{% heading "prerequisites" %}}
|
||||
|
||||
<!--
|
||||
These instructions are for Kubernetes {{< skew currentVersion >}}. If you want
|
||||
to check the integrity of components for a different version of Kubernetes,
|
||||
check the documentation for that Kubernetes release.
|
||||
|
||||
You will need to have the following tools installed:
|
||||
|
||||
- `cosign` ([install guide](https://docs.sigstore.dev/cosign/installation/))
|
||||
- `curl` (often provided by your operating system)
|
||||
-->
|
||||
这些说明适用于 Kubernetes {{< skew currentVersion >}}。如果你想要检查其他版本的 Kubernetes 组件的完整性，
|
||||
请查看对应 Kubernetes 版本的文档。
|
||||
|
||||
你需要安装以下工具:
|
||||
|
||||
- `cosign` ([安装指南](https://docs.sigstore.dev/cosign/installation/))
|
||||
- `curl` (通常由你的操作系统提供)
|
||||
|
||||
<!--
|
||||
## Verifying image signatures
|
||||
|
||||
For a complete list of images that are signed please refer
|
||||
to [Releases](/releases/download/).
|
||||
|
||||
Let's pick one image from this list and verify its signature using
|
||||
the `cosign verify` command:
|
||||
-->
|
||||
## 验证镜像签名 {#verifying-image-signatures}
|
||||
|
||||
完整的镜像签名列表请参见[发行版本](/releases/download/)。
|
||||
|
||||
我们从这个列表中选择一个镜像，并使用 `cosign verify` 命令来验证它的签名：
|
||||
|
||||
```shell
|
||||
COSIGN_EXPERIMENTAL=1 cosign verify k8s.gcr.io/kube-apiserver-amd64:v1.24.0
|
||||
```
|
||||
|
||||
{{< note >}}
|
||||
<!--
|
||||
`COSIGN_EXPERIMENTAL=1` is used to allow verification of images signed
|
||||
in `KEYLESS` mode. To learn more about keyless signing, please refer to
|
||||
[Keyless Signatures](https://github.com/sigstore/cosign/blob/main/KEYLESS.md#keyless-signatures)
|
||||
-->
|
||||
`COSIGN_EXPERIMENTAL=1` 用于对以 `KEYLESS` 模式签名的镜像进行验证。想要进一步了解 `KEYLESS`，请参考
|
||||
[Keyless Signatures](https://github.com/sigstore/cosign/blob/main/KEYLESS.md#keyless-signatures)。
|
||||
{{< /note >}}
|
||||
|
||||
<!--
|
||||
### Verifying images for all control plane components
|
||||
|
||||
To verify all signed control plane images, please run this command:
|
||||
-->
|
||||
### 验证所有控制平面组件镜像 {#verifying-images-for-all-control-plane-components}
|
||||
|
||||
验证所有已签名的控制平面组件镜像，请运行以下命令：
|
||||
|
||||
```shell
|
||||
curl -Ls https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/latest.txt)/release | grep 'PackageName: k8s.gcr.io/' | awk '{print $2}' > images.txt
|
||||
input=images.txt
|
||||
while IFS= read -r image
|
||||
do
|
||||
COSIGN_EXPERIMENTAL=1 cosign verify "$image"
|
||||
done < "$input"
|
||||
```
|
||||
|
||||
<!--
|
||||
Once you have verified an image, specify that image by its digest in your Pod
|
||||
manifests as per this
|
||||
example: `registry-url/image-name@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2`.
|
||||
|
||||
For more information, please refer
|
||||
to [Image Pull Policy](/docs/concepts/containers/images/#image-pull-policy)
|
||||
section.
|
||||
-->
|
||||
当你完成某个镜像的验证时，可以在你的 Pod 清单通过摘要值来指定该镜像，例如：
|
||||
`registry-url/image-name@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2`。
|
||||
|
||||
要了解更多信息，请参考[镜像拉取策略](/zh-cn/docs/concepts/containers/images/#image-pull-policy)章节。
|
||||
|
||||
<!--
|
||||
## Verifying Image Signatures with Admission Controller
|
||||
|
||||
For non-control plane images (
|
||||
e.g. [conformance image](https://github.com/kubernetes/kubernetes/blob/master/test/conformance/image/README.md))
|
||||
, signatures can also be verified at deploy time using
|
||||
[cosigned](https://docs.sigstore.dev/cosign/kubernetes/#cosigned-admission-controller)
|
||||
admission controller. To get started with `cosigned` here are a few helpful
|
||||
resources:
|
||||
|
||||
* [Installation](https://github.com/sigstore/helm-charts/tree/main/charts/cosigned)
|
||||
* [Configuration Options](https://github.com/sigstore/cosign/tree/main/config)
|
||||
-->
|
||||
## 使用准入控制器验证镜像签名 {#verifying-image-signatures-with-admission-controller}
|
||||
|
||||
有一些非控制平面镜像
|
||||
（例如 [conformance 镜像](https://github.com/kubernetes/kubernetes/blob/master/test/conformance/image/README.md)），
|
||||
也可以在部署时使用
|
||||
[cosigned](https://docs.sigstore.dev/cosign/kubernetes/#cosigned-admission-controller)
|
||||
控制器验证其签名。如要使用 `cosigned`，下面是一些有帮助的资源：
|
||||
|
||||
* [安装](https://github.com/sigstore/helm-charts/tree/main/charts/cosigned)
|
||||
* [配置选项](https://github.com/sigstore/cosign/tree/main/config)
|
||||
|
||||
+2
-2
@@ -56,7 +56,7 @@ plugins:
|
||||
#
|
||||
# version 标签必须是如下取值之一：
|
||||
# - "latest" (默认)
|
||||
# - 诸如 "v{{< skew latestVersion >}}" 这类版本号
|
||||
# - 诸如 "v{{< skew currentVersion>}}" 这类版本号
|
||||
defaults:
|
||||
enforce: "privileged"
|
||||
enforce-version: "latest"
|
||||
@@ -99,7 +99,7 @@ plugins:
|
||||
#
|
||||
# version 标签必须是如下取值之一：
|
||||
# - "latest" (默认)
|
||||
# - 诸如 "v{{< skew latestVersion >}}" 这类版本号
|
||||
# - 诸如 "v{{< skew currentVersion>}}" 这类版本号
|
||||
defaults:
|
||||
enforce: "privileged"
|
||||
enforce-version: "latest"
|
||||
|
||||
@@ -782,10 +782,10 @@ kubectl delete pod security-context-demo-4
|
||||
* [PodSecurityContext](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritycontext-v1-core) API 定义
|
||||
* [SecurityContext](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#securitycontext-v1-core) API 定义
|
||||
* [使用最新的安全性增强来调优 Docker（英文）](https://github.com/containerd/containerd/blob/main/docs/cri/config.md)
|
||||
* [安全上下文的设计文档（英文）](https://git.k8s.io/community/contributors/design-proposals/auth/security_context.md)
|
||||
* [属主管理的设计文档（英文）](https://git.k8s.io/community/contributors/design-proposals/storage/volume-ownership-management.md)
|
||||
* [安全上下文的设计文档（英文）](https://github.com/kubernetes/design-proposals-archive/blob/main/auth/security_context.md)
|
||||
* [属主管理的设计文档（英文）](https://github.com/kubernetes/design-proposals-archive/blob/main/storage/volume-ownership-management.md)
|
||||
* [Pod 安全策略](/zh/docs/concepts/security/pod-security-policy/)
|
||||
* [AllowPrivilegeEscalation 的设计文档（英文）](https://git.k8s.io/community/contributors/design-proposals/auth/no-new-privs.md)
|
||||
* [AllowPrivilegeEscalation 的设计文档（英文）](https://github.com/kubernetes/design-proposals-archive/blob/main/auth/no-new-privs.md)
|
||||
* 关于在 Linux 系统中的安全机制的更多信息，可参阅
|
||||
[Linux 内核安全性能力概述](https://www.linux.com/learn/overview-linux-kernel-security-features)。
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -13,9 +13,9 @@ type: docs
|
||||
<!-- overview -->
|
||||
|
||||
<!--
|
||||
The Kubernetes project maintains release branches for the most recent three minor releases ({{< skew latestVersion >}}, {{< skew prevMinorVersion >}}, {{< skew oldestMinorVersion >}}). Kubernetes 1.19 and newer receive [approximately 1 year of patch support](/releases/patch-releases/#support-period). Kubernetes 1.18 and older received approximately 9 months of patch support.
|
||||
The Kubernetes project maintains release branches for the most recent three minor releases ({{< skew currentVersion >}}, {{< skew currentVersionAddMinor -1 >}}, {{< skew currentVersionAddMinor -2 >}}). Kubernetes 1.19 and newer receive [approximately 1 year of patch support](/releases/patch-releases/#support-period). Kubernetes 1.18 and older received approximately 9 months of patch support.
|
||||
-->
|
||||
Kubernetes 项目维护最近三个次要版本（{{< skew latestVersion >}}、{{< skew prevMinorVersion >}}、{{< skew oldMinorVersion >}}）的发布分支。
|
||||
Kubernetes 项目维护最近三个次要版本（{{< skew currentVersion >}}、{{< skew currentVersionAddMinor -1 >}}、{{< skew currentVersionAddMinor -2 >}}）的发布分支。
|
||||
Kubernetes 1.19 和更新版本获得[大约 1 年的补丁支持](/zh/releases/patch-releases/#support-period)。
|
||||
Kubernetes 1.18 及更早版本获得了大约 9 个月的补丁支持周期。
|
||||
|
||||
@@ -41,9 +41,9 @@ Kubernetes 版本表示为 **x.y.z**，
|
||||
## 未来的发行版本
|
||||
|
||||
<!--
|
||||
Check out the [schedule](https://github.com/kubernetes/sig-release/tree/master/releases/release-{{< skew nextMinorVersion >}}) for the upcoming **{{< skew nextMinorVersion >}}** Kubernetes release!
|
||||
Check out the [schedule](https://github.com/kubernetes/sig-release/tree/master/releases/release-{{< skew currentVersionAddMinor 1 >}}) for the upcoming **{{< skew currentVersionAddMinor 1 >}}** Kubernetes release!
|
||||
-->
|
||||
查看[时间表](https://github.com/kubernetes/sig-release/tree/master/releases/release-{{< skew nextMinorVersion >}})，
|
||||
查看[时间表](https://github.com/kubernetes/sig-release/tree/master/releases/release-{{< skew currentVersionAddMinor 1 >}})，
|
||||
Kubernetes **{{< skew nextMinorVersion >}}** 版本即将发行！
|
||||
|
||||
<!-- ## Helpful Resources -->
|
||||
|
||||
@@ -566,6 +566,7 @@
|
||||
/docs/setup/windows/user-guide-windows-nodes/ /docs/tasks/administer-cluster/kubeadm/adding-windows-nodes/ 301
|
||||
/docs/setup/production-environment/windows/user-guide-windows-containers/ /docs/concepts/windows/user-guide/ 301
|
||||
/docs/setup/production-environment/windows/user-guide-windows-nodes/ /docs/tasks/administer-cluster/kubeadm/adding-windows-nodes/ 301
|
||||
/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes/ /docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/ 301
|
||||
/docs/setup/windows/user-guide-windows-containers/ /docs/setup/production-environment/windows/user-guide-windows-containers/ 301
|
||||
/docs/setup/production-environment/windows/intro-windows-in-kubernetes/ /docs/concepts/windows/intro/ 301
|
||||
/docs/setup/production-environment/windows/ /docs/concepts/windows/ 301
|
||||
|
||||
Reference in New Issue
Block a user