Update localization guidelines (#10485)
* Update localization guidelines for language labels
Continuing work
Continuing work
Continuing work
More work in progress
Add local OWNERS folders
Add an OWNERS file to Chinese
Remove shortcode for repos
Add Japanese
Alphabetize languages, change weights accordingly
More updates
Add Korean in Korean
Add English to languageName
Feedback from gochist
Move Chinese content from cn/ to zh/
Move OWNERS from cn/ to zh/
Resolve merge conflicts by updating from master
Add files back in to prep for resolution
After rebase on upstream/master, remove files
Review and update localization guidelines
Feedback from gochist, tnir, cstoku
Add a trailing newline to content/ja/OWNERS
Add a trailing newline to content/zh/OWNERS
Drop requirement for GH repo project
Clarify language about forks/branches
Edits and typos
Remove a shortcode specific to a multi-repo language setup
Update aliases and owners
Add explicit OWNERS for content/en
Migrate content from Chinese repo, update regex in config.toml
Remove untranslated strings
Add trailing newline to content/en/OWNERS
Add trailing newlines to OWNERS files
add Jaguar project description (#10433)
* add Jaguar project description
[Jaguar](https://gitlab.com/sdnlab/jaguar) is an open source solution for Kubernetes's network based on OpenDaylight.
Jaguar provides overlay network using vxlan and Jaguar CNIPlugin provides one IP address per pod.
* Minor newline tweak
blog post for azure vmss (#10538)
Add microk8s to pick-right-solution.md (#10542)
* Add microk8s to pick-right-solution.md
Microk8s is a single-command installation of upstream Kubernetes on any Linux and should be included in the list of local-machine solutions.
* capitalized Istio
Add microk8s to foundational.md (#10543)
* Add microk8s to foundational.md
Adding microk8s as credible and stable alternative to get started with Kubernetes on a local machine. This is especially attractive for those not wanting to incur the overhead of running a VM for a local cluster.
* Update foundational.md
Thank you for your suggestions! LMK if this works now?
* Rewrote first paragraph
And included a bullet list of features of microk8s
* Copyedit
fix typo (#10545)
Fix the kubectl subcommands links. (#10550)
Signed-off-by: William Zhang <warmchang@outlook.com>
Fix command issue (#10515)
Signed-off-by: mooncake <xcoder@tenxcloud.com>
remove imported community files per issue 10184 (#10501)
networking.md: Markdown fix (#10498)
Fix front matter, federation command-line tools (#10500)
Clean up glossary entry (#10399)
update slack link (#10536)
typo in StatefulSet docs (#10558)
fix discription about horizontal pod autoscale (#10557)
Remove redundant symbols (#10556)
Fix issue #10520 (#10554)
Signed-off-by: William Zhang <warmchang@outlook.com>
Update api-concepts.md (#10534)
Revert "Fix command issue (#10515)"
This reverts commit c02a7fb9f9.
Update memory-constraint-namespace.md (#10530)
update memory request to 100MiB corresponding the yaml content
Blog: Introducing Volume Snapshot Alpha for Kubernetes (#10562)
* blog post for azure vmss
* snapshot blog post
Resolve merge conflicts in OWNERS*
Minor typo fix (#10567)
Not sure what's supposed to be here, proposing removing it.
* Feedback from gochist
Tweaks to feedback
* Feedback from ClaudiaJKang
This commit is contained in:
Zach Corleissen
committed by
k8s-ci-robot
k8s-ci-robot
parent
753f57f0e6
commit
abcee2dccd
@@ -0,0 +1,563 @@
|
||||
---
|
||||
assignees:
|
||||
- bprashanth
|
||||
- davidopp
|
||||
- derekwaynecarr
|
||||
- erictune
|
||||
- janetkuo
|
||||
- thockin
|
||||
cn-approvers:
|
||||
- linyouchong
|
||||
title: 使用准入控制插件
|
||||
---
|
||||
<!--
|
||||
---
|
||||
assignees:
|
||||
- bprashanth
|
||||
- davidopp
|
||||
- derekwaynecarr
|
||||
- erictune
|
||||
- janetkuo
|
||||
- thockin
|
||||
title: Using Admission Controllers
|
||||
---
|
||||
-->
|
||||
|
||||
* TOC
|
||||
{:toc}
|
||||
|
||||
<!--
|
||||
## What are they?
|
||||
-->
|
||||
## 什么是准入控制插件？
|
||||
|
||||
<!--
|
||||
An admission control plug-in is a piece of code that intercepts requests to the Kubernetes
|
||||
API server prior to persistence of the object, but after the request is authenticated
|
||||
and authorized. The plug-in code is in the API server process
|
||||
and must be compiled into the binary in order to be used at this time.
|
||||
-->
|
||||
一个准入控制插件是一段代码，它会在请求通过认证和授权之后、对象被持久化之前拦截到达 API server 的请求。插件代码运行在 API server 进程中，必须将其编译为二进制文件，以便在此时使用。
|
||||
|
||||
<!--
|
||||
Each admission control plug-in is run in sequence before a request is accepted into the cluster. If
|
||||
any of the plug-ins in the sequence reject the request, the entire request is rejected immediately
|
||||
and an error is returned to the end-user.
|
||||
-->
|
||||
在每个请求被集群接受之前，准入控制插件依次执行。如果插件序列中任何一个拒绝了该请求，则整个请求将立即被拒绝并且返回一个错误给终端用户。
|
||||
|
||||
<!--
|
||||
Admission control plug-ins may mutate the incoming object in some cases to apply system configured
|
||||
defaults. In addition, admission control plug-ins may mutate related resources as part of request
|
||||
processing to do things like increment quota usage.
|
||||
-->
|
||||
准入控制插件可能会在某些情况下改变传入的对象，从而应用系统配置的默认值。另外，作为请求处理的一部分，准入控制插件可能会对相关的资源进行变更，以实现类似增加配额使用量这样的功能。
|
||||
|
||||
<!--
|
||||
## Why do I need them?
|
||||
-->
|
||||
## 为什么需要准入控制插件？
|
||||
|
||||
<!--
|
||||
Many advanced features in Kubernetes require an admission control plug-in to be enabled in order
|
||||
to properly support the feature. As a result, a Kubernetes API server that is not properly
|
||||
configured with the right set of admission control plug-ins is an incomplete server and will not
|
||||
support all the features you expect.
|
||||
-->
|
||||
Kubernetes 的许多高级功能都要求启用一个准入控制插件，以便正确地支持该特性。因此，一个没有正确配置准入控制插件的 Kubernetes API server 是不完整的，它不会支持您所期望的所有特性。
|
||||
|
||||
<!--
|
||||
## How do I turn on an admission control plug-in?
|
||||
-->
|
||||
## 如何启用一个准入控制插件？
|
||||
|
||||
<!--
|
||||
The Kubernetes API server supports a flag, `admission-control` that takes a comma-delimited,
|
||||
ordered list of admission control choices to invoke prior to modifying objects in the cluster.
|
||||
-->
|
||||
Kubernetes API server 支持一个标志参数 `admission-control` ，它指定了一个用于在集群修改对象之前调用的以逗号分隔的准入控制插件顺序列表。
|
||||
|
||||
<!--
|
||||
## What does each plug-in do?
|
||||
-->
|
||||
## 每个插件的功能是什么？
|
||||
|
||||
### AlwaysAdmit
|
||||
|
||||
<!--
|
||||
Use this plugin by itself to pass-through all requests.
|
||||
-->
|
||||
使用这个插件自行通过所有的请求。
|
||||
|
||||
### AlwaysPullImages
|
||||
|
||||
<!--
|
||||
This plug-in modifies every new Pod to force the image pull policy to Always. This is useful in a
|
||||
multitenant cluster so that users can be assured that their private images can only be used by those
|
||||
who have the credentials to pull them. Without this plug-in, once an image has been pulled to a
|
||||
node, any pod from any user can use it simply by knowing the image's name (assuming the Pod is
|
||||
scheduled onto the right node), without any authorization check against the image. When this plug-in
|
||||
is enabled, images are always pulled prior to starting containers, which means valid credentials are
|
||||
required.
|
||||
-->
|
||||
这个插件修改每一个新创建的 Pod 的镜像拉取策略为 Always 。这在多租户集群中是有用的，这样用户就可以放心，他们的私有镜像只能被那些有凭证的人使用。没有这个插件，一旦镜像被拉取到节点上，任何用户的 pod 都可以通过已了解到的镜像的名称（假设 pod 被调度到正确的节点上）来使用它，而不需要对镜像进行任何授权检查。当启用这个插件时，总是在启动容器之前拉取镜像，这意味着需要有效的凭证。
|
||||
|
||||
### AlwaysDeny
|
||||
|
||||
<!--
|
||||
Rejects all requests. Used for testing.
|
||||
-->
|
||||
拒绝所有的请求。用于测试。
|
||||
|
||||
<!--
|
||||
### DenyExecOnPrivileged (deprecated)
|
||||
-->
|
||||
### DenyExecOnPrivileged （已废弃）
|
||||
|
||||
<!--
|
||||
This plug-in will intercept all requests to exec a command in a pod if that pod has a privileged container.
|
||||
-->
|
||||
如果一个 pod 拥有一个特权容器，这个插件将拦截所有在该 pod 中执行 exec 命令的请求。
|
||||
|
||||
<!--
|
||||
If your cluster supports privileged containers, and you want to restrict the ability of end-users to exec
|
||||
commands in those containers, we strongly encourage enabling this plug-in.
|
||||
-->
|
||||
如果集群支持特权容器，并且希望限制最终用户在这些容器中执行 exec 命令的能力，我们强烈建议启用这个插件。
|
||||
|
||||
<!--
|
||||
This functionality has been merged into [DenyEscalatingExec](#denyescalatingexec).
|
||||
-->
|
||||
此功能已合并到 [DenyEscalatingExec](#denyescalatingexec)。
|
||||
|
||||
### DenyEscalatingExec
|
||||
|
||||
<!--
|
||||
This plug-in will deny exec and attach commands to pods that run with escalated privileges that
|
||||
allow host access. This includes pods that run as privileged, have access to the host IPC namespace, and
|
||||
have access to the host PID namespace.
|
||||
-->
|
||||
这个插件将拒绝在拥有衍生特权而具备访问宿主机能力的 pod 中执行 exec 和 attach 命令。这包括在特权模式运行的 pod ，可以访问主机 IPC 命名空间的 pod ，和访问主机 PID 命名空间的 pod 。
|
||||
|
||||
<!--
|
||||
If your cluster supports containers that run with escalated privileges, and you want to
|
||||
restrict the ability of end-users to exec commands in those containers, we strongly encourage
|
||||
enabling this plug-in.
|
||||
-->
|
||||
如果集群支持使用以衍生特权运行的容器，并且希望限制最终用户在这些容器中执行 exec 命令的能力，我们强烈建议启用这个插件。
|
||||
|
||||
### ImagePolicyWebhook
|
||||
|
||||
<!--
|
||||
The ImagePolicyWebhook plug-in allows a backend webhook to make admission decisions. You enable this plug-in by setting the admission-control option as follows:
|
||||
-->
|
||||
ImagePolicyWebhook 插件允许使用一个后端的 webhook 做出准入决策。您可以按照如下配置 admission-control 选项来启用这个插件:
|
||||
|
||||
```shell
|
||||
--admission-control=ImagePolicyWebhook
|
||||
```
|
||||
|
||||
<!--
|
||||
#### Configuration File Format
|
||||
-->
|
||||
#### 配置文件格式
|
||||
<!--
|
||||
ImagePolicyWebhook uses the admission config file `--admission-control-config-file` to set configuration options for the behavior of the backend. This file may be json or yaml and has the following format:
|
||||
-->
|
||||
ImagePolicyWebhook 插件使用了admission config 文件 `--admission-control-config-file` 来为后端行为设置配置选项。该文件可以是 json 或 yaml ，并具有以下格式:
|
||||
|
||||
```javascript
|
||||
{
|
||||
"imagePolicy": {
|
||||
"kubeConfigFile": "path/to/kubeconfig/for/backend",
|
||||
"allowTTL": 50, // time in s to cache approval
|
||||
"denyTTL": 50, // time in s to cache denial
|
||||
"retryBackoff": 500, // time in ms to wait between retries
|
||||
"defaultAllow": true // determines behavior if the webhook backend fails
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
<!--
|
||||
The config file must reference a [kubeconfig](/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/) formatted file which sets up the connection to the backend. It is required that the backend communicate over TLS.
|
||||
-->
|
||||
这个配置文件必须引用一个 [kubeconfig](/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/) 格式的文件，并在其中配置指向后端的连接。且需要在 TLS 上与后端进行通信。
|
||||
|
||||
<!--
|
||||
The kubeconfig file's cluster field must point to the remote service, and the user field must contain the returned authorizer.
|
||||
-->
|
||||
kubeconfig 文件的 cluster 字段需要指向远端服务，user 字段需要包含已返回的授权者。
|
||||
|
||||
```yaml
|
||||
# clusters refers to the remote service.
|
||||
clusters:
|
||||
- name: name-of-remote-imagepolicy-service
|
||||
cluster:
|
||||
certificate-authority: /path/to/ca.pem # CA for verifying the remote service.
|
||||
server: https://images.example.com/policy # URL of remote service to query. Must use 'https'.
|
||||
|
||||
# users refers to the API server's webhook configuration.
|
||||
users:
|
||||
- name: name-of-api-server
|
||||
user:
|
||||
client-certificate: /path/to/cert.pem # cert for the webhook plugin to use
|
||||
client-key: /path/to/key.pem # key matching the cert
|
||||
```
|
||||
<!--
|
||||
For additional HTTP configuration, refer to the [kubeconfig](/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/) documentation.
|
||||
-->
|
||||
对于更多的 HTTP 配置，请参阅 [kubeconfig](/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/) 文档。
|
||||
|
||||
<!--
|
||||
#### Request Payloads
|
||||
-->
|
||||
#### 请求载荷
|
||||
|
||||
<!--
|
||||
When faced with an admission decision, the API Server POSTs a JSON serialized api.imagepolicy.v1alpha1.ImageReview object describing the action. This object contains fields describing the containers being admitted, as well as any pod annotations that match `*.image-policy.k8s.io/*`.
|
||||
-->
|
||||
当面对一个准入决策时，API server 发送一个描述操作的 JSON 序列化的 api.imagepolicy.v1alpha1.ImageReview 对象。该对象包含描述被审核容器的字段，以及所有匹配 `*.image-policy.k8s.io/*` 的 pod 注释。
|
||||
|
||||
<!--
|
||||
Note that webhook API objects are subject to the same versioning compatibility rules as other Kubernetes API objects. Implementers should be aware of looser compatibility promises for alpha objects and check the "apiVersion" field of the request to ensure correct deserialization. Additionally, the API Server must enable the imagepolicy.k8s.io/v1alpha1 API extensions group (`--runtime-config=imagepolicy.k8s.io/v1alpha1=true`).
|
||||
-->
|
||||
注意，webhook API 对象与其他 Kubernetes API 对象一样受制于相同的版本控制兼容性规则。实现者应该知道对 alpha 对象的更宽松的兼容性，并检查请求的 "apiVersion" 字段，以确保正确的反序列化。此外，API server 必须启用 imagepolicy.k8s.io/v1alpha1 API 扩展组 (`--runtime-config=imagepolicy.k8s.io/v1alpha1=true`)。
|
||||
|
||||
<!--
|
||||
An example request body:
|
||||
-->
|
||||
请求载荷例子：
|
||||
|
||||
```
|
||||
{
|
||||
"apiVersion":"imagepolicy.k8s.io/v1alpha1",
|
||||
"kind":"ImageReview",
|
||||
"spec":{
|
||||
"containers":[
|
||||
{
|
||||
"image":"myrepo/myimage:v1"
|
||||
},
|
||||
{
|
||||
"image":"myrepo/myimage@sha256:beb6bd6a68f114c1dc2ea4b28db81bdf91de202a9014972bec5e4d9171d90ed"
|
||||
}
|
||||
],
|
||||
"annotations":[
|
||||
"mycluster.image-policy.k8s.io/ticket-1234": "break-glass"
|
||||
],
|
||||
"namespace":"mynamespace"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
<!--
|
||||
The remote service is expected to fill the ImageReviewStatus field of the request and respond to either allow or disallow access. The response body's "spec" field is ignored and may be omitted. A permissive response would return:
|
||||
-->
|
||||
远程服务将填充请求的 ImageReviewStatus 字段，并返回允许或不允许访问。响应主体的 "spec" 字段会被忽略，并且可以省略。一个允许访问应答会返回：
|
||||
|
||||
```
|
||||
{
|
||||
"apiVersion": "imagepolicy.k8s.io/v1alpha1",
|
||||
"kind": "ImageReview",
|
||||
"status": {
|
||||
"allowed": true
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
<!--
|
||||
To disallow access, the service would return:
|
||||
-->
|
||||
不允许访问，服务将返回：
|
||||
|
||||
```
|
||||
{
|
||||
"apiVersion": "imagepolicy.k8s.io/v1alpha1",
|
||||
"kind": "ImageReview",
|
||||
"status": {
|
||||
"allowed": false,
|
||||
"reason": "image currently blacklisted"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
<!--
|
||||
For further documentation refer to the `imagepolicy.v1alpha1` API objects and `plugin/pkg/admission/imagepolicy/admission.go`.
|
||||
-->
|
||||
更多的文档，请参阅 `imagepolicy.v1alpha1` API 对象 和 `plugin/pkg/admission/imagepolicy/admission.go`。
|
||||
|
||||
<!--
|
||||
#### Extending with Annotations
|
||||
-->
|
||||
使用注解进行扩展
|
||||
|
||||
<!--
|
||||
All annotations on a Pod that match `*.image-policy.k8s.io/*` are sent to the webhook. Sending annotations allows users who are aware of the image policy backend to send extra information to it, and for different backends implementations to accept different information.
|
||||
-->
|
||||
一个 pod 中匹配 `*.image-policy.k8s.io/*` 的注解都会被发送给 webhook。这允许了解镜像策略后端的用户向它发送额外的信息，并为不同的后端实现接收不同的信息。
|
||||
|
||||
<!--
|
||||
Examples of information you might put here are:
|
||||
-->
|
||||
您可以在这里输入的信息有：
|
||||
|
||||
<!--
|
||||
* request to "break glass" to override a policy, in case of emergency.
|
||||
-->
|
||||
* 在紧急情况下，请求 "break glass" 覆盖一个策略。
|
||||
<!--
|
||||
* a ticket number from a ticket system that documents the break-glass request
|
||||
-->
|
||||
* 从一个记录了 break-glass 的请求的票证系统得到的一个票证编号
|
||||
<!--
|
||||
* provide a hint to the policy server as to the imageID of the image being provided, to save it a lookup
|
||||
-->
|
||||
* 向策略服务器提供一个提示，用于提供镜像的 imageID，以方便它进行查找
|
||||
|
||||
<!--
|
||||
In any case, the annotations are provided by the user and are not validated by Kubernetes in any way. In the future, if an annotation is determined to be widely useful, it may be promoted to a named field of ImageReviewSpec.
|
||||
-->
|
||||
在任何情况下，注解都是由用户提供的，并不会被 Kubernetes 以任何方式进行验证。在将来，如果一个注解确定将被广泛使用，它可能会被提升为 ImageReviewSpec 的一个命名字段。
|
||||
|
||||
### ServiceAccount
|
||||
|
||||
<!--
|
||||
This plug-in implements automation for [serviceAccounts](/docs/user-guide/service-accounts).
|
||||
We strongly recommend using this plug-in if you intend to make use of Kubernetes `ServiceAccount` objects.
|
||||
-->
|
||||
这个插件实现了 [serviceAccounts](/docs/user-guide/service-accounts) 的自动化。
|
||||
如果您打算使用 Kubernetes 的 ServiceAccount 对象，我们强烈建议您使用这个插件。
|
||||
|
||||
### SecurityContextDeny
|
||||
|
||||
<!--
|
||||
This plug-in will deny any pod that attempts to set certain escalating [SecurityContext](/docs/user-guide/security-context) fields. This should be enabled if a cluster doesn't utilize [pod security policies](/docs/user-guide/pod-security-policy) to restrict the set of values a security context can take.
|
||||
-->
|
||||
该插件将拒绝任何试图设置特定扩展 [SecurityContext](/docs/user-guide/security-context) 字段的 pod。如果集群没有使用 [ pod 安全策略](/docs/user-guide/pod-security-policy) 来限制安全上下文所能获取的值集，那么应该启用这个功能。
|
||||
|
||||
### ResourceQuota
|
||||
|
||||
<!--
|
||||
This plug-in will observe the incoming request and ensure that it does not violate any of the constraints
|
||||
enumerated in the `ResourceQuota` object in a `Namespace`. If you are using `ResourceQuota`
|
||||
objects in your Kubernetes deployment, you MUST use this plug-in to enforce quota constraints.
|
||||
-->
|
||||
此插件将观察传入的请求，并确保它不违反任何一个 `Namespace` 中的 `ResourceQuota` 对象中枚举出来的约束。如果您在 Kubernetes 部署中使用了 `ResourceQuota`
|
||||
，您必须使用这个插件来强制执行配额限制。
|
||||
|
||||
<!--
|
||||
See the [resourceQuota design doc](https://git.k8s.io/community/contributors/design-proposals/admission_control_resource_quota.md) and the [example of Resource Quota](/docs/concepts/policy/resource-quotas/) for more details.
|
||||
-->
|
||||
请查看 [resourceQuota 设计文档](https://git.k8s.io/community/contributors/design-proposals/admission_control_resource_quota.md) 和 [Resource Quota 例子](/docs/concepts/policy/resource-quotas/) 了解更多细节。
|
||||
|
||||
<!--
|
||||
It is strongly encouraged that this plug-in is configured last in the sequence of admission control plug-ins. This is
|
||||
so that quota is not prematurely incremented only for the request to be rejected later in admission control.
|
||||
-->
|
||||
强烈建议将这个插件配置在准入控制插件序列的末尾。这样配额就不会过早地增加，只会在稍后的准入控制中被拒绝。
|
||||
|
||||
### LimitRanger
|
||||
|
||||
<!--
|
||||
This plug-in will observe the incoming request and ensure that it does not violate any of the constraints
|
||||
enumerated in the `LimitRange` object in a `Namespace`. If you are using `LimitRange` objects in
|
||||
your Kubernetes deployment, you MUST use this plug-in to enforce those constraints. LimitRanger can also
|
||||
be used to apply default resource requests to Pods that don't specify any; currently, the default LimitRanger
|
||||
applies a 0.1 CPU requirement to all Pods in the `default` namespace.
|
||||
-->
|
||||
这个插件将观察传入的请求，并确保它不会违反 `Namespace` 中 `LimitRange` 对象枚举的任何约束。如果您在 Kubernetes 部署中使用了 `LimitRange` 对象，则必须使用此插件来执行这些约束。LimitRanger 插件还可以用于将默认资源请求应用到没有指定任何内容的 Pod ；当前，默认的 LimitRanger 对 `default` 命名空间中的所有 pod 应用了0.1 CPU 的需求。
|
||||
|
||||
<!--
|
||||
See the [limitRange design doc](https://git.k8s.io/community/contributors/design-proposals/admission_control_limit_range.md) and the [example of Limit Range](/docs/tasks/configure-pod-container/limit-range/) for more details.
|
||||
-->
|
||||
请查看 [limitRange 设计文档](https://git.k8s.io/community/contributors/design-proposals/admission_control_limit_range.md) 和 [Limit Range 例子](/docs/tasks/configure-pod-container/limit-range/) 了解更多细节。
|
||||
|
||||
<!--
|
||||
### InitialResources (experimental)
|
||||
-->
|
||||
### InitialResources （试验）
|
||||
|
||||
<!--
|
||||
This plug-in observes pod creation requests. If a container omits compute resource requests and limits,
|
||||
then the plug-in auto-populates a compute resource request based on historical usage of containers running the same image.
|
||||
If there is not enough data to make a decision the Request is left unchanged.
|
||||
When the plug-in sets a compute resource request, it annotates the pod with information on what compute resources it auto-populated.
|
||||
-->
|
||||
此插件观察 pod 创建请求。如果容器忽略了 requests 和 limits 计算资源，那么插件就会根据运行相同镜像的容器的历史使用记录来自动填充计算资源请求。如果没有足够的数据进行决策，则请求将保持不变。当插件设置了一个计算资源请求时，它会用它自动填充的计算资源对 pod 进行注解。
|
||||
|
||||
<!--
|
||||
See the [InitialResouces proposal](https://git.k8s.io/community/contributors/design-proposals/initial-resources.md) for more details.
|
||||
-->
|
||||
请查看 [InitialResouces 建议书](https://git.k8s.io/community/contributors/design-proposals/initial-resources.md) 了解更多细节。
|
||||
|
||||
### NamespaceLifecycle
|
||||
|
||||
<!--
|
||||
This plug-in enforces that a `Namespace` that is undergoing termination cannot have new objects created in it,
|
||||
and ensures that requests in a non-existent `Namespace` are rejected.
|
||||
-->
|
||||
这个插件强制不能在一个正在被终止的 `Namespace` 中创建新对象，和确保使用不存在 `Namespace` 的请求被拒绝。
|
||||
|
||||
<!--
|
||||
A `Namespace` deletion kicks off a sequence of operations that remove all objects (pods, services, etc.) in that
|
||||
namespace. In order to enforce integrity of that process, we strongly recommend running this plug-in.
|
||||
-->
|
||||
删除 `Namespace` 触发了在该命名空间中删除所有对象（ pod 、 services 等）的一系列操作。为了确保这个过程的完整性，我们强烈建议启用这个插件。
|
||||
|
||||
### DefaultStorageClass
|
||||
|
||||
<!--
|
||||
This plug-in observes creation of `PersistentVolumeClaim` objects that do not request any specific storage class
|
||||
and automatically adds a default storage class to them.
|
||||
This way, users that do not request any special storage class do no need to care about them at all and they
|
||||
will get the default one.
|
||||
-->
|
||||
这个插件观察不指定 storage class 字段的 `PersistentVolumeClaim` 对象的创建，并自动向它们添加默认的 storage class 。这样，不指定 storage class 字段的用户根本无需关心它们，它们将得到默认的 storage class 。
|
||||
|
||||
<!--
|
||||
This plug-in does not do anything when no default storage class is configured. When more than one storage
|
||||
class is marked as default, it rejects any creation of `PersistentVolumeClaim` with an error and administrator
|
||||
must revisit `StorageClass` objects and mark only one as default.
|
||||
This plugin ignores any `PersistentVolumeClaim` updates, it acts only on creation.
|
||||
-->
|
||||
当没有配置默认 storage class 时，这个插件不会执行任何操作。当一个以上的 storage class 被标记为默认时，它拒绝 `PersistentVolumeClaim` 创建并返回一个错误，管理员必须重新检查 `StorageClass` 对象，并且只标记一个作为默认值。这个插件忽略了任何 `PersistentVolumeClaim` 更新，它只对创建起作用。
|
||||
|
||||
<!--
|
||||
See [persistent volume](/docs/user-guide/persistent-volumes) documentation about persistent volume claims and
|
||||
storage classes and how to mark a storage class as default.
|
||||
-->
|
||||
查看 [persistent volume](/docs/user-guide/persistent-volumes) 文档了解 persistent volume claims 和 storage classes 并了解如何将一个 storage classes 标志为默认。
|
||||
|
||||
### DefaultTolerationSeconds
|
||||
|
||||
<!--
|
||||
This plug-in sets the default forgiveness toleration for pods, which have no forgiveness tolerations, to tolerate
|
||||
the taints `notready:NoExecute` and `unreachable:NoExecute` for 5 minutes.
|
||||
-->
|
||||
这个插件设置了 pod 默认的宽恕容忍时间，对于那些没有设置宽恕容忍时间的 pod ，可以容忍 `notready:NoExecute` 和 `unreachable:NoExecute` 这些 taint 5分钟。
|
||||
|
||||
### PodNodeSelector
|
||||
|
||||
<!--
|
||||
This plug-in defaults and limits what node selectors may be used within a namespace by reading a namespace annotation and a global configuration.
|
||||
-->
|
||||
通过读取命名空间注释和全局配置,这个插件默认并限制了在一个命名空间中使用什么节点选择器。
|
||||
|
||||
<!--
|
||||
#### Configuration File Format
|
||||
-->
|
||||
#### 配置文件格式
|
||||
<!--
|
||||
PodNodeSelector uses the admission config file `--admission-control-config-file` to set configuration options for the behavior of the backend.
|
||||
-->
|
||||
PodNodeSelector 插件使用准入配置文件 `--admission-control-config-file` 来设置后端行为的配置选项。
|
||||
|
||||
<!--
|
||||
Note that the configuration file format will move to a versioned file in a future release.
|
||||
-->
|
||||
请注意，配置文件格式将在未来版本中移至版本化文件。
|
||||
|
||||
<!--
|
||||
This file may be json or yaml and has the following format:
|
||||
-->
|
||||
这个文件可能是 json 或 yaml ，格式如下：
|
||||
|
||||
```yaml
|
||||
podNodeSelectorPluginConfig:
|
||||
clusterDefaultNodeSelector: <node-selectors-labels>
|
||||
namespace1: <node-selectors-labels>
|
||||
namespace2: <node-selectors-labels>
|
||||
```
|
||||
|
||||
<!--
|
||||
#### Configuration Annotation Format
|
||||
-->
|
||||
#### 配置注解格式
|
||||
<!--
|
||||
PodNodeSelector uses the annotation key `scheduler.alpha.kubernetes.io/node-selector` to assign node selectors to namespaces.
|
||||
-->
|
||||
PodNodeSelector 插件使用键为 `scheduler.alpha.kubernetes.io/node-selector` 的注解将节点选择器分配给 namespace 。
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
annotations:
|
||||
scheduler.alpha.kubernetes.io/node-selector: <node-selectors-labels>
|
||||
name: namespace3
|
||||
```
|
||||
|
||||
### PodSecurityPolicy
|
||||
|
||||
<!--
|
||||
This plug-in acts on creation and modification of the pod and determines if it should be admitted
|
||||
based on the requested security context and the available Pod Security Policies.
|
||||
-->
|
||||
此插件负责在创建和修改 pod 时根据请求的安全上下文和可用的 pod 安全策略确定是否应该通过 pod。
|
||||
|
||||
<!--
|
||||
For Kubernetes < 1.6.0, the API Server must enable the extensions/v1beta1/podsecuritypolicy API
|
||||
extensions group (`--runtime-config=extensions/v1beta1/podsecuritypolicy=true`).
|
||||
-->
|
||||
对于 Kubernetes < 1.6.0 的版本，API Server 必须启用 extensions/v1beta1/podsecuritypolicy API 扩展组 (`--runtime-config=extensions/v1beta1/podsecuritypolicy=true`)。
|
||||
|
||||
<!--
|
||||
See also [Pod Security Policy documentation](/docs/concepts/policy/pod-security-policy/)
|
||||
for more information.
|
||||
-->
|
||||
查看 [Pod 安全策略文档](/docs/concepts/policy/pod-security-policy/) 了解更多细节。
|
||||
|
||||
### NodeRestriction
|
||||
|
||||
<!--
|
||||
This plug-in limits the `Node` and `Pod` objects a kubelet can modify. In order to be limited by this admission plugin,
|
||||
kubelets must use credentials in the `system:nodes` group, with a username in the form `system:node:<nodeName>`.
|
||||
Such kubelets will only be allowed to modify their own `Node` API object, and only modify `Pod` API objects that are bound to their node.
|
||||
-->
|
||||
这个插件限制了 kubelet 可以修改的 `Node` 和 `Pod` 对象。 为了受到这个入场插件的限制，kubelet 必须在 `system：nodes` 组中使用凭证，并使用 `system：node：<nodeName>` 形式的用户名。这样的 kubelet 只允许修改自己的 `Node` API 对象，只能修改绑定到节点本身的 `Pod` 对象。
|
||||
<!--
|
||||
Future versions may add additional restrictions to ensure kubelets have the minimal set of permissions required to operate correctly.
|
||||
-->
|
||||
未来的版本可能会添加额外的限制，以确保 kubelet 具有正确操作所需的最小权限集。
|
||||
|
||||
<!--
|
||||
## Is there a recommended set of plug-ins to use?
|
||||
-->
|
||||
## 是否有推荐的一组插件可供使用？
|
||||
|
||||
<!--
|
||||
Yes.
|
||||
For Kubernetes >= 1.6.0, we strongly recommend running the following set of admission control plug-ins (order matters):
|
||||
-->
|
||||
有。
|
||||
对于 Kubernetes >= 1.6.0 版本，我们强烈建议运行以下一系列准入控制插件（顺序也很重要）
|
||||
|
||||
```shell
|
||||
--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,ResourceQuota,DefaultTolerationSeconds
|
||||
```
|
||||
|
||||
<!--
|
||||
For Kubernetes >= 1.4.0, we strongly recommend running the following set of admission control plug-ins (order matters):
|
||||
-->
|
||||
对于 Kubernetes >= 1.4.0 版本，我们强烈建议运行以下一系列准入控制插件（顺序也很重要）
|
||||
|
||||
```shell
|
||||
--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota
|
||||
```
|
||||
|
||||
<!--
|
||||
For Kubernetes >= 1.2.0, we strongly recommend running the following set of admission control plug-ins (order matters):
|
||||
-->
|
||||
对于 Kubernetes >= 1.2.0 版本，我们强烈建议运行以下一系列准入控制插件（顺序也很重要）
|
||||
|
||||
```shell
|
||||
--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,ResourceQuota
|
||||
```
|
||||
|
||||
<!--
|
||||
For Kubernetes >= 1.0.0, we strongly recommend running the following set of admission control plug-ins (order matters):
|
||||
-->
|
||||
对于 Kubernetes >= 1.0.0 版本，我们强烈建议运行以下一系列准入控制插件（顺序也很重要）
|
||||
|
||||
```shell
|
||||
--admission-control=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,PersistentVolumeLabel,ResourceQuota
|
||||
```
|
||||
@@ -0,0 +1,304 @@
|
||||
---
|
||||
reviewers:
|
||||
- erictune
|
||||
- lavalamp
|
||||
- deads2k
|
||||
- liggitt
|
||||
cnapprove:
|
||||
- fatalc
|
||||
<!-- title: Authorization Overview -->
|
||||
title: 授权概述
|
||||
content_template: templates/concept
|
||||
weight: 60
|
||||
---
|
||||
|
||||
{{% capture overview %}}
|
||||
<!-- Learn more about Kubernetes authorization, including details about creating
|
||||
policies using the supported authorization modules. -->
|
||||
了解有关 Kubernetes 授权的更多信息，包括使用支持的授权模块创建策略的详细信息。
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture body %}}
|
||||
<!-- In Kubernetes, you must be authenticated (logged in) before your request can be
|
||||
authorized (granted permission to access). For information about authentication,
|
||||
see [Accessing Control Overview](/docs/reference/access-authn-authz/controlling-access/).
|
||||
|
||||
Kubernetes expects attributes that are common to REST API requests. This means
|
||||
that Kubernetes authorization works with existing organization-wide or
|
||||
cloud-provider-wide access control systems which may handle other APIs besides
|
||||
the Kubernetes API. -->
|
||||
|
||||
在Kubernetes中，您必须在授权（授予访问权限）之前进行身份验证（登录），有关身份验证的信息，
|
||||
请参阅 [访问控制概述](/docs/reference/access-authn-authz/controlling-access/).
|
||||
|
||||
Kubernetes期望REST API请求中常见的属性。
|
||||
这意味着Kubernetes授权适用于现有的组织范围或云提供商范围的访问控制系统，
|
||||
除了Kubernetes API之外，它还可以处理其他API。
|
||||
|
||||
<!-- ## Determine Whether a Request is Allowed or Denied
|
||||
Kubernetes authorizes API requests using the API server. It evaluates all of the
|
||||
request attributes against all policies and allows or denies the request. All
|
||||
parts of an API request must be allowed by some policy in order to proceed. This
|
||||
means that permissions are denied by default.
|
||||
|
||||
(Although Kubernetes uses the API server, access controls and policies that
|
||||
depend on specific fields of specific kinds of objects are handled by Admission
|
||||
Controllers.)
|
||||
|
||||
When multiple authorization modules are configured, each is checked in sequence.
|
||||
If any authorizer approves or denies a request, that decision is immediately
|
||||
returned and no other authorizer is consulted. If all modules have no opinion on
|
||||
the request, then the request is denied. A deny returns an HTTP status code 403. -->
|
||||
|
||||
## 确定是允许还是拒绝请求
|
||||
Kubernetes 使用 API 服务器授权 API 请求。它根据所有策略评估所有请求属性来决定允许或拒绝请求。
|
||||
一个API请求的所有部分必须被某些策略允许才能继续。这意味着默认情况下拒绝权限。
|
||||
|
||||
（尽管 Kubernetes 使用 API 服务器，但是依赖于特定种类对象的特定字段的访问控制和策略由准入控制器处理。）
|
||||
|
||||
配置多个授权模块时，将按顺序检查每个模块。
|
||||
如果任何授权模块批准或拒绝请求，则立即返回该决定，并且不会与其他授权模块协商。
|
||||
如果所有模块对请求没有意见，则拒绝该请求。一个拒绝响应返回 HTTP 状态代码 403 。
|
||||
|
||||
<!--
|
||||
## Review Your Request Attributes
|
||||
Kubernetes reviews only the following API request attributes:
|
||||
|
||||
* **user** - The `user` string provided during authentication.
|
||||
* **group** - The list of group names to which the authenticated user belongs.
|
||||
* **extra** - A map of arbitrary string keys to string values, provided by the authentication layer.
|
||||
* **API** - Indicates whether the request is for an API resource.
|
||||
* **Request path** - Path to miscellaneous non-resource endpoints like `/api` or `/healthz`.
|
||||
* **API request verb** - API verbs `get`, `list`, `create`, `update`, `patch`, `watch`, `proxy`, `redirect`, `delete`, and `deletecollection` are used for resource requests. To determine the request verb for a resource API endpoint, see [Determine the request verb](/docs/reference/access-authn-authz/authorization/#determine-whether-a-request-is-allowed-or-denied) below.
|
||||
* **HTTP request verb** - HTTP verbs `get`, `post`, `put`, and `delete` are used for non-resource requests.
|
||||
* **Resource** - The ID or name of the resource that is being accessed (for resource requests only) -- For resource requests using `get`, `update`, `patch`, and `delete` verbs, you must provide the resource name.
|
||||
* **Subresource** - The subresource that is being accessed (for resource requests only).
|
||||
* **Namespace** - The namespace of the object that is being accessed (for namespaced resource requests only).
|
||||
* **API group** - The API group being accessed (for resource requests only). An empty string designates the [core API group](/docs/concepts/overview/kubernetes-api/).
|
||||
-->
|
||||
|
||||
## 审查您的请求属性
|
||||
Kubernetes仅审查以下API请求属性：
|
||||
|
||||
* **user** - 身份验证期间提供的`user`字符串。
|
||||
* **group** - 经过身份验证的用户所属的组名列表。
|
||||
* **extra** - 由身份验证层提供的任意字符串键到字符串值的映射。
|
||||
* **API** - 指示请求是否针对 API 资源。
|
||||
* **Request path** - 各种非资源端点的路径，如`/api`或`/healthz`。
|
||||
* **API request verb** - API 动词`get`，`list`，`create`，`update`，`patch`，`watch`，`proxy`，`redirect`，`delete`和`deletecollection`用于资源请求。要确定资源API端点的请求动词，请参阅[确定请求动词](/docs/reference/access-authn-authz/authorization/#determine-whether-a-request-is-allowed-or-denied)。
|
||||
* **HTTP request verb** - HTTP 动词`get`，`post`，`put`和`delete`用于非资源请求。
|
||||
* **Resource** - 正在访问的资源的 ID 或名称（仅限资源请求） - 对于使用`get`，`update`，`patch`和`delete`动词的资源请求，您必须提供资源名称。
|
||||
* **Subresource** - 正在访问的子资源（仅限资源请求）。
|
||||
* **Namespace** - 正在访问的对象的名称空间（仅适用于命名空间资源请求）。
|
||||
* **API group** - 正在访问的 API 组（仅限资源请求）。空字符串表示[核心API组](/docs/concepts/overview/kubernetes-api/)。
|
||||
|
||||
<!--
|
||||
## Determine the Request Verb
|
||||
To determine the request verb for a resource API endpoint, review the HTTP verb
|
||||
used and whether or not the request acts on an individual resource or a
|
||||
collection of resources:
|
||||
|
||||
HTTP verb | request verb
|
||||
----------|---------------
|
||||
POST | create
|
||||
GET, HEAD | get (for individual resources), list (for collections)
|
||||
PUT | update
|
||||
PATCH | patch
|
||||
DELETE | delete (for individual resources), deletecollection (for collections)
|
||||
|
||||
Kubernetes sometimes checks authorization for additional permissions using specialized verbs. For example:
|
||||
|
||||
* [PodSecurityPolicy](/docs/concepts/policy/pod-security-policy/) checks for authorization of the `use` verb on `podsecuritypolicies` resources in the `policy` API group.
|
||||
* [RBAC](/docs/reference/access-authn-authz/rbac/#privilege-escalation-prevention-and-bootstrapping) checks for authorization
|
||||
of the `bind` verb on `roles` and `clusterroles` resources in the `rbac.authorization.k8s.io` API group.
|
||||
* [Authentication](/docs/reference/access-authn-authz/authentication/) layer checks for authorization of the `impersonate` verb on `users`, `groups`, and `serviceaccounts` in the core API group, and the `userextras` in the `authentication.k8s.io` API group.
|
||||
-->
|
||||
|
||||
## 确定请求动词
|
||||
|
||||
要确定资源API端点的请求谓词，请检查所使用的 HTTP 动词以及请求是否对单个资源或资源集合起作用：
|
||||
|
||||
HTTP 动词 | request 动词
|
||||
----------|---------------
|
||||
POST | create
|
||||
GET, HEAD | get (单个资源), list (资源集合)
|
||||
PUT | update
|
||||
PATCH | patch
|
||||
DELETE | delete (单个资源), deletecollection (资源集合)
|
||||
|
||||
Kubernetes有时使用专门的动词检查授权以获得额外的权限。例如：
|
||||
|
||||
* [Pod安全策略](/docs/concepts/policy/pod-security-policy/) 检查`policy` API组中`podsecuritypolicies`资源的`use`动词的授权。
|
||||
* [RBAC](/docs/reference/access-authn-authz/rbac/#privilege-escalation-prevention-and-bootstrapping) 检查`rbac.authorization.k8s.io` API 组中`roles`和`clusterroles`资源的`bind`动词的授权。
|
||||
* [认证](/docs/reference/access-authn-authz/authentication/) layer检查核心API组中`users`，`groups`和`serviceaccounts`的`impersonate`动词的授权，以及`authentication.k8s.io` API组中的`userextras`。
|
||||
|
||||
<!--
|
||||
## Authorization Modules
|
||||
* **Node** - A special-purpose authorizer that grants permissions to kubelets based on the pods they are scheduled to run. To learn more about using the Node authorization mode, see [Node Authorization](/docs/reference/access-authn-authz/node/).
|
||||
* **ABAC** - Attribute-based access control (ABAC) defines an access control paradigm whereby access rights are granted to users through the use of policies which combine attributes together. The policies can use any type of attributes (user attributes, resource attributes, object, environment attributes, etc). To learn more about using the ABAC mode, see [ABAC Mode](/docs/reference/access-authn-authz/abac/).
|
||||
* **RBAC** - Role-based access control (RBAC) is a method of regulating access to computer or network resources based on the roles of individual users within an enterprise. In this context, access is the ability of an individual user to perform a specific task, such as view, create, or modify a file. To learn more about using the RBAC mode, see [RBAC Mode](/docs/reference/access-authn-authz/rbac/)
|
||||
* When specified RBAC (Role-Based Access Control) uses the `rbac.authorization.k8s.io` API group to drive authorization decisions, allowing admins to dynamically configure permission policies through the Kubernetes API.
|
||||
* To enable RBAC, start the apiserver with `--authorization-mode=RBAC`.
|
||||
* **Webhook** - A WebHook is an HTTP callback: an HTTP POST that occurs when something happens; a simple event-notification via HTTP POST. A web application implementing WebHooks will POST a message to a URL when certain things happen. To learn more about using the Webhook mode, see [Webhook Mode](/docs/reference/access-authn-authz/webhook/).
|
||||
-->
|
||||
|
||||
## 授权模块
|
||||
* **Node** - 一个专用授权程序，根据计划运行的 pod 为 kubelet 授予权限。了解有关使用节点授权模式的更多信息，请参阅[节点授权](/docs/reference/access-authn-authz/node/).
|
||||
* **ABAC** - 基于属性的访问控制（ABAC) 定义了一种访问控制范例，通过使用将属性组合在一起的策略，将访问权限授予用户。策略可以使用任何类型的属性（用户属性，资源属性，对象，环境属性等）。要了解有关使用 ABAC 模式的更多信息，请参阅[ABAC 模式](/docs/reference/access-authn-authz/abac/)。
|
||||
* **RBAC** - 基于角色的访问控制（RBAC）是一种基于企业内个人用户的角色来管理对计算机或网络资源的访问的方法。在此上下文中，权限是单个用户执行特定任务的能力，例如查看，创建或修改文件。要了解有关使用 RBAC 模式的更多信息，请参阅[RBAC 模式](/docs/reference/access-authn-authz/rbac/)。
|
||||
* 当指定的RBAC（基于角色的访问控制）使用`rbac.authorization.k8s.io` API 组来驱动授权决策时，允许管理员通过 Kubernetes API 动态配置权限策略。
|
||||
* 要启用RBAC，请使用`--authorization-mode = RBAC`启动 apiserver 。
|
||||
* **Webhook** - WebHook 是一个 HTTP 回调: 发生某些事情时调用的 HTTP POST;通过 HTTP POST 进行简单的事件通知。实现 WebHooks 的 Web 应用程序会在发生某些事情时将消息发布到URL。要了解有关使用 Webhook 模式的更多信息，请参阅[Webhook 模式](/docs/reference/access-authn-authz/webhook/)。
|
||||
|
||||
<!--
|
||||
#### Checking API Access
|
||||
|
||||
`kubectl` provides the `auth can-i` subcommand for quickly querying the API authorization layer.
|
||||
The command uses the `SelfSubjectAccessReview` API to determine if the current user can perform
|
||||
a given action, and works regardless of the authorization mode used.
|
||||
-->
|
||||
|
||||
#### 检查API访问
|
||||
|
||||
`kubectl`提供`auth can-i`子命令，用于快速查询 API 授权层。
|
||||
该命令使用`SelfSubjectAccessReview` API来确定当前用户是否可以执行给定操作，并且无论使用何种授权模式都可以工作。
|
||||
|
||||
```bash
|
||||
$ kubectl auth can-i create deployments --namespace dev
|
||||
yes
|
||||
$ kubectl auth can-i create deployments --namespace prod
|
||||
no
|
||||
```
|
||||
<!--
|
||||
Administrators can combine this with [user impersonation](/docs/reference/access-authn-authz/authentication/#user-impersonation)
|
||||
to determine what action other users can perform.
|
||||
-->
|
||||
管理员可以将此与[用户模拟](/docs/reference/access-authn-authz/authentication/#user-impersonation)结合使用，以确定其他用户可以执行的操作。
|
||||
|
||||
```bash
|
||||
$ kubectl auth can-i list secrets --namespace dev --as dave
|
||||
no
|
||||
```
|
||||
<!--
|
||||
`SelfSubjectAccessReview` is part of the `authorization.k8s.io` API group, which
|
||||
exposes the API server authorization to external services. Other resources in
|
||||
this group include:
|
||||
|
||||
* `SubjectAccessReview` - Access review for any user, not just the current one. Useful for delegating authorization decisions to the API server. For example, the kubelet and extension API servers use this to determine user access to their own APIs.
|
||||
* `LocalSubjectAccessReview` - Like `SubjectAccessReview` but restricted to a specific namespace.
|
||||
* `SelfSubjectRulesReview` - A review which returns the set of actions a user can perform within a namespace. Useful for users to quickly summarize their own access, or for UIs to hide/show actions.
|
||||
|
||||
These APIs can be queried by creating normal Kubernetes resources, where the response "status"
|
||||
field of the returned object is the result of the query.
|
||||
-->
|
||||
|
||||
`SelfSubjectAccessReview`是`authorization.k8s.io` API组的一部分，它将 API 服务器授权公开给外部服务。
|
||||
该组中的其他资源包括：
|
||||
|
||||
* `SubjectAccessReview` - 访问任何用户的 Review ，而不仅仅是当前用户。用于将授权决策委派给API服务器。例如，kubelet 和扩展 API 服务器使用它来确定用户对自己的API的访问权限。
|
||||
* `LocalSubjectAccessReview` - 与`SubjectAccessReview`类似，但仅限于特定的命名空间。
|
||||
* `SelfSubjectRulesReview` - 返回用户可在命名空间内执行的操作集的审阅。用户可以快速汇总自己的访问权限，或者用于隐藏/显示操作的UI。
|
||||
|
||||
可以通过创建普通 Kubernetes 资源来查询这些 API ，其中返回对象的响应“status”字段是查询的结果。
|
||||
|
||||
```bash
|
||||
$ kubectl create -f - -o yaml << EOF
|
||||
apiVersion: authorization.k8s.io/v1
|
||||
kind: SelfSubjectAccessReview
|
||||
spec:
|
||||
resourceAttributes:
|
||||
group: apps
|
||||
name: deployments
|
||||
verb: create
|
||||
namespace: dev
|
||||
EOF
|
||||
|
||||
apiVersion: authorization.k8s.io/v1
|
||||
kind: SelfSubjectAccessReview
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
spec:
|
||||
resourceAttributes:
|
||||
group: apps
|
||||
name: deployments
|
||||
namespace: dev
|
||||
verb: create
|
||||
status:
|
||||
allowed: true
|
||||
denied: false
|
||||
```
|
||||
|
||||
<!--
|
||||
## Using Flags for Your Authorization Module
|
||||
|
||||
You must include a flag in your policy to indicate which authorization module
|
||||
your policies include:
|
||||
|
||||
The following flags can be used:
|
||||
|
||||
* `--authorization-mode=ABAC` Attribute-Based Access Control (ABAC) mode allows you to configure policies using local files.
|
||||
* `--authorization-mode=RBAC` Role-based access control (RBAC) mode allows you to create and store policies using the Kubernetes API.
|
||||
* `--authorization-mode=Webhook` WebHook is an HTTP callback mode that allows you to manage authorization using a remote REST endpoint.
|
||||
* `--authorization-mode=Node` Node authorization is a special-purpose authorization mode that specifically authorizes API requests made by kubelets.
|
||||
* `--authorization-mode=AlwaysDeny` This flag blocks all requests. Use this flag only for testing.
|
||||
* `--authorization-mode=AlwaysAllow` This flag allows all requests. Use this flag only if you do not require authorization for your API requests.
|
||||
|
||||
You can choose more than one authorization module. Modules are checked in order
|
||||
so an earlier module has higher priority to allow or deny a request.
|
||||
-->
|
||||
|
||||
## 为您的授权模块使用标志
|
||||
|
||||
您必须在策略中包含一个标志，以指明您的策略包含哪个授权模块：
|
||||
|
||||
可以使用以下标志：
|
||||
|
||||
* `--authorization-mode=ABAC` 基于属性的访问控制（ABAC）模式允许您使用本地文件配置策略。
|
||||
* `--authorization-mode=RBAC` 基于角色的访问控制（RBAC）模式允许您使用 Kubernetes API 创建和存储策略。
|
||||
* `--authorization-mode=Webhook` WebHook 是一种 HTTP 回调模式，允许您使用远程REST端点管理授权。
|
||||
* `--authorization-mode=Node` 节点授权是一种特殊用途的授权模式，专门授权由 kubelet 发出的API请求。
|
||||
* `--authorization-mode=AlwaysDeny` 该标志阻止所有请求。仅将此标志用于测试。
|
||||
* `--authorization-mode=AlwaysAllow` 此标志允许所有请求。仅在您不需要 API 请求的授权时才使用此标志。
|
||||
|
||||
您可以选择多个授权模块。按顺序检查模块，以便较早的模块具有更高的优先级来允许或拒绝请求。
|
||||
|
||||
<!--
|
||||
## Privilege escalation via pod creation
|
||||
|
||||
Users who have the ability to create pods in a namespace can potentially
|
||||
escalate their privileges within that namespace. They can create pods that
|
||||
access their privileges within that namespace. They can create pods that access
|
||||
secrets the user cannot themselves read, or that run under a service account
|
||||
with different/greater permissions.
|
||||
-->
|
||||
## 通过pod创建权限升级
|
||||
|
||||
能够在命名空间中创建 pod 的用户可能会升级其在该命名空间内的权限。
|
||||
他们可以创建在该命名空间内访问其权限的 pod 。
|
||||
他们可以创建用户无法自己读取 secret 的 pod ，或者在具有不同/更高权限的服务帐户下运行的 pod 。
|
||||
|
||||
{{< caution >}}
|
||||
<!--
|
||||
**Caution:** System administrators, use care when granting access to pod
|
||||
creation. A user granted permission to create pods (or controllers that create
|
||||
pods) in the namespace can: read all secrets in the namespace; read all config
|
||||
maps in the namespace; and impersonate any service account in the namespace and
|
||||
take any action the account could take. This applies regardless of authorization
|
||||
mode.
|
||||
-->
|
||||
**注意：** 系统管理员在授予对 pod 创建的访问权限时要小心。
|
||||
授予在命名空间中创建 pod（或创建pod的控制器）的权限的用户可以：
|
||||
读取命名空间中的所有秘密;读取命名空间中的所有配置映射;
|
||||
并模拟命名空间中的任何服务帐户并执行帐户可以执行的任何操作。
|
||||
无论采用何种授权方式，这都适用。
|
||||
{{< /caution >}}
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture whatsnext %}}
|
||||
<!--
|
||||
* To learn more about Authentication, see **Authentication** in [Controlling Access to the Kubernetes API](/docs/reference/access-authn-authz/controlling-access/).
|
||||
* To learn more about Admission Control, see [Using Admission Controllers](/docs/reference/access-authn-authz/admission-controllers/).
|
||||
-->
|
||||
* 要了解有关身份验证的更多信息，请参阅 **身份验证** [控制对Kubernetes API的访问](/docs/reference/access-authn-authz/controlling-access/).
|
||||
* 要了解有关准入控制的更多信息，请参阅 [使用准入控制器](/docs/reference/access-authn-authz/admission-controllers/).
|
||||
{{% /capture %}}
|
||||
@@ -0,0 +1,491 @@
|
||||
---
|
||||
title: kube-proxy
|
||||
notitle: true
|
||||
---
|
||||
## kube-proxy
|
||||
|
||||
|
||||
<!--
|
||||
### Synopsis
|
||||
|
||||
|
||||
The Kubernetes network proxy runs on each node. This
|
||||
reflects services as defined in the Kubernetes API on each node and can do simple
|
||||
TCP and UDP stream forwarding or round robin TCP and UDP forwarding across a set of backends.
|
||||
Service cluster IPs and ports are currently found through Docker-links-compatible
|
||||
environment variables specifying ports opened by the service proxy. There is an optional
|
||||
addon that provides cluster DNS for these cluster IPs. The user must create a service
|
||||
with the apiserver API to configure the proxy.
|
||||
-->
|
||||
### 概要
|
||||
|
||||
Kubernetes 在每个节点上运行网络代理。这反映每个节点上 Kubernetes API 中定义的服务，并且可以做简单的
|
||||
TCP 和 UDP 流转发或在一组后端中轮询，进行 TCP 和 UDP 转发。目前服务集群 IP 和端口通过由服务代理打开的端口
|
||||
的 Docker-links-compatible 环境变量找到。有一个可选的为这些集群 IP 提供集群 DNS 的插件。用户必须
|
||||
通过 apiserver API 创建服务去配置代理。
|
||||
|
||||
```
|
||||
kube-proxy [flags]
|
||||
```
|
||||
|
||||
<!--
|
||||
### Options
|
||||
-->
|
||||
### 选项
|
||||
|
||||
<table style="width: 100%; table-layout: fixed;">
|
||||
<colgroup>
|
||||
<col span="1" style="width: 10px;" />
|
||||
<col span="1" />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--azure-container-registry-config string</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Path to the file containing Azure container registry configuration information.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">包含 Azure 容器仓库配置信息的文件的路径。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--bind-address 0.0.0.0 Default: 0.0.0.0</td>
|
||||
-->
|
||||
<td colspan="2">--bind-address 0.0.0.0 默认: 0.0.0.0</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The IP address for the proxy server to serve on (set to 0.0.0.0 for all IPv4 interfaces and `::` for all IPv6 interfaces)</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">要服务的代理服务器的 IP 地址（对于所有 IPv4 接口设置为 0.0.0.0，对于所有 IPv6 接口设置为 ::）</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--cleanup</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">If true cleanup iptables and ipvs rules and exit.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">如果为 true，清理 iptables 和 ipvs 规则并退出。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--cleanup-ipvs Default: true</td>
|
||||
-->
|
||||
<td colspan="2">--cleanup-ipvs 默认: true</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">If true make kube-proxy cleanup ipvs rules before running. Default is true</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">如果为 true，则使 kube-proxy 在运行之前清理 ipvs 规则。 默认为 true</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--cluster-cidr string</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The CIDR range of pods in the cluster. When configured, traffic sent to a Service cluster IP from outside this range will be masqueraded and traffic sent from pods to an external LoadBalancer IP will be directed to the respective cluster IP instead</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">集群中的 CIDR 范围。 配置后，从该范围之外发送到服务集群 IP 的流量将被伪装，从 pod 发送到外部 LoadBalancer IP 的流量将被定向到相应的集群 IP</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--config string</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The path to the configuration file.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">配置文件的路径。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--config-sync-period duration Default: 15m0s</td>
|
||||
-->
|
||||
<td colspan="2">--config-sync-period duration 默认: 15m0s</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">How often configuration from the apiserver is refreshed. Must be greater than 0.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">来自 apiserver 的配置的刷新频率。必须大于 0。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--conntrack-max-per-core int32 Default: 32768</td>
|
||||
-->
|
||||
<td colspan="2">--conntrack-max-per-core int32 默认: 32768</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Maximum number of NAT connections to track per CPU core (0 to leave the limit as-is and ignore conntrack-min).</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">每个 CPU 核跟踪的最大 NAT 连接数（0 表示保留原样限制并忽略 conntrack-min）。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--conntrack-min int32 Default: 131072</td>
|
||||
-->
|
||||
<td colspan="2">--conntrack-min int32 默认: 131072</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Minimum number of conntrack entries to allocate, regardless of conntrack-max-per-core (set conntrack-max-per-core=0 to leave the limit as-is).</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">要分配的最小 conntrack 条目数，不管 conntrack-max-per-core（设置 conntrack-max-per-core = 0 保留原样限制）。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--conntrack-tcp-timeout-close-wait duration Default: 1h0m0s</td>
|
||||
-->
|
||||
<td colspan="2">--conntrack-tcp-timeout-close-wait duration 默认: 1h0m0s</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">NAT timeout for TCP connections in the CLOSE_WAIT state</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">处于 CLOSE_WAIT 状态的 TCP 连接的 NAT 超时</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--conntrack-tcp-timeout-established duration Default: 24h0m0s</td>
|
||||
-->
|
||||
<td colspan="2">--conntrack-tcp-timeout-established duration 默认: 24h0m0s</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Idle timeout for established TCP connections (0 to leave as-is)</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">已建立的 TCP 连接的空闲超时（0 保持原样）</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--feature-gates mapStringBool</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:<br/>APIListChunking=true|false (BETA - default=true)<br/>APIResponseCompression=true|false (ALPHA - default=false)<br/>AdvancedAuditing=true|false (BETA - default=true)<br/>AllAlpha=true|false (ALPHA - default=false)<br/>AppArmor=true|false (BETA - default=true)<br/>AttachVolumeLimit=true|false (ALPHA - default=false)<br/>BalanceAttachedNodeVolumes=true|false (ALPHA - default=false)<br/>BlockVolume=true|false (ALPHA - default=false)<br/>CPUManager=true|false (BETA - default=true)<br/>CRIContainerLogRotation=true|false (BETA - default=true)<br/>CSIBlockVolume=true|false (ALPHA - default=false)<br/>CSIPersistentVolume=true|false (BETA - default=true)<br/>CustomPodDNS=true|false (BETA - default=true)<br/>CustomResourceSubresources=true|false (BETA - default=true)<br/>CustomResourceValidation=true|false (BETA - default=true)<br/>DebugContainers=true|false (ALPHA - default=false)<br/>DevicePlugins=true|false (BETA - default=true)<br/>DynamicKubeletConfig=true|false (BETA - default=true)<br/>DynamicProvisioningScheduling=true|false (ALPHA - default=false)<br/>EnableEquivalenceClassCache=true|false (ALPHA - default=false)<br/>ExpandInUsePersistentVolumes=true|false (ALPHA - default=false)<br/>ExpandPersistentVolumes=true|false (BETA - default=true)<br/>ExperimentalCriticalPodAnnotation=true|false (ALPHA - default=false)<br/>ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)<br/>GCERegionalPersistentDisk=true|false (BETA - default=true)<br/>HugePages=true|false (BETA - default=true)<br/>HyperVContainer=true|false (ALPHA - default=false)<br/>Initializers=true|false (ALPHA - default=false)<br/>KubeletPluginsWatcher=true|false (ALPHA - default=false)<br/>LocalStorageCapacityIsolation=true|false (BETA - default=true)<br/>MountContainers=true|false (ALPHA - default=false)<br/>MountPropagation=true|false (BETA - default=true)<br/>PersistentLocalVolumes=true|false (BETA - default=true)<br/>PodPriority=true|false (BETA - default=true)<br/>PodReadinessGates=true|false (BETA - default=false)<br/>PodShareProcessNamespace=true|false (ALPHA - default=false)<br/>QOSReserved=true|false (ALPHA - default=false)<br/>ReadOnlyAPIDataVolumes=true|false (DEPRECATED - default=true)<br/>ResourceLimitsPriorityFunction=true|false (ALPHA - default=false)<br/>ResourceQuotaScopeSelectors=true|false (ALPHA - default=false)<br/>RotateKubeletClientCertificate=true|false (BETA - default=true)<br/>RotateKubeletServerCertificate=true|false (ALPHA - default=false)<br/>RunAsGroup=true|false (ALPHA - default=false)<br/>ScheduleDaemonSetPods=true|false (ALPHA - default=false)<br/>ServiceNodeExclusion=true|false (ALPHA - default=false)<br/>ServiceProxyAllowExternalIPs=true|false (DEPRECATED - default=false)<br/>StorageObjectInUseProtection=true|false (default=true)<br/>StreamingProxyRedirects=true|false (BETA - default=true)<br/>SupportIPVSProxyMode=true|false (default=true)<br/>SupportPodPidsLimit=true|false (ALPHA - default=false)<br/>Sysctls=true|false (BETA - default=true)<br/>TaintBasedEvictions=true|false (ALPHA - default=false)<br/>TaintNodesByCondition=true|false (ALPHA - default=false)<br/>TokenRequest=true|false (ALPHA - default=false)<br/>TokenRequestProjection=true|false (ALPHA - default=false)<br/>VolumeScheduling=true|false (BETA - default=true)<br/>VolumeSubpath=true|false (default=true)<br/>VolumeSubpathEnvExpansion=true|false (ALPHA - default=false)</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">一组 key=value 对，用于描述 alpha/experimental 特征的特征门。选项包括：<br/>APIListChunking=true|false (BETA - 默认=true)<br/>APIResponseCompression=true|false (ALPHA - 默认=false)<br/>AdvancedAuditing=true|false (BETA - 默认=true)<br/>AllAlpha=true|false (ALPHA - 默认=false)<br/>AppArmor=true|false (BETA - 默认=true)<br/>AttachVolumeLimit=true|false (ALPHA - 默认=false)<br/>BalanceAttachedNodeVolumes=true|false (ALPHA - 默认=false)<br/>BlockVolume=true|false (ALPHA - 默认=false)<br/>CPUManager=true|false (BETA - 默认=true)<br/>CRIContainerLogRotation=true|false (BETA - 默认=true)<br/>CSIBlockVolume=true|false (ALPHA - 默认=false)<br/>CSIPersistentVolume=true|false (BETA - 默认=true)<br/>CustomPodDNS=true|false (BETA - 默认=true)<br/>CustomResourceSubresources=true|false (BETA - 默认=true)<br/>CustomResourceValidation=true|false (BETA - 默认=true)<br/>DebugContainers=true|false (ALPHA - 默认=false)<br/>DevicePlugins=true|false (BETA - 默认=true)<br/>DynamicKubeletConfig=true|false (BETA - 默认=true)<br/>DynamicProvisioningScheduling=true|false (ALPHA - 默认=false)<br/>EnableEquivalenceClassCache=true|false (ALPHA - 默认=false)<br/>ExpandInUsePersistentVolumes=true|false (ALPHA - 默认=false)<br/>ExpandPersistentVolumes=true|false (BETA - 默认=true)<br/>ExperimentalCriticalPodAnnotation=true|false (ALPHA - 默认=false)<br/>ExperimentalHostUserNamespaceDefaulting=true|false (BETA - 默认=false)<br/>GCERegionalPersistentDisk=true|false (BETA - 默认=true)<br/>HugePages=true|false (BETA - 默认=true)<br/>HyperVContainer=true|false (ALPHA - 默认=false)<br/>Initializers=true|false (ALPHA - 默认=false)<br/>KubeletPluginsWatcher=true|false (ALPHA - 默认=false)<br/>LocalStorageCapacityIsolation=true|false (BETA - default=true)<br/>MountContainers=true|false (ALPHA - 默认=false)<br/>MountPropagation=true|false (BETA - 默认=true)<br/>PersistentLocalVolumes=true|false (BETA - 默认=true)<br/>PodPriority=true|false (BETA - 默认=true)<br/>PodReadinessGates=true|false (BETA - 默认=false)<br/>PodShareProcessNamespace=true|false (ALPHA - 默认=false)<br/>QOSReserved=true|false (ALPHA - 默认=false)<br/>ReadOnlyAPIDataVolumes=true|false (弃用 - 默认=true)<br/>ResourceLimitsPriorityFunction=true|false (ALPHA - 默认=false)<br/>ResourceQuotaScopeSelectors=true|false (ALPHA - 默认=false)<br/>RotateKubeletClientCertificate=true|false (BETA - 默认=true)<br/>RotateKubeletServerCertificate=true|false (ALPHA - 默认=false)<br/>RunAsGroup=true|false (ALPHA - 默认=false)<br/>ScheduleDaemonSetPods=true|false (ALPHA - 默认=false)<br/>ServiceNodeExclusion=true|false (ALPHA - 默认=false)<br/>ServiceProxyAllowExternalIPs=true|false (弃用 - 默认=false)<br/>StorageObjectInUseProtection=true|false (default=true)<br/>StreamingProxyRedirects=true|false (BETA - 默认=true)<br/>SupportIPVSProxyMode=true|false (默认=true)<br/>SupportPodPidsLimit=true|false (ALPHA - 默认=false)<br/>Sysctls=true|false (BETA - 默认=true)<br/>TaintBasedEvictions=true|false (ALPHA - 默认=false)<br/>TaintNodesByCondition=true|false (ALPHA - 默认=false)<br/>TokenRequest=true|false (ALPHA - 默认=false)<br/>TokenRequestProjection=true|false (ALPHA - 默认=false)<br/>VolumeScheduling=true|false (BETA - 默认=true)<br/>VolumeSubpath=true|false (默认=true)<br/>VolumeSubpathEnvExpansion=true|false (ALPHA - 默认=false)</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--healthz-bind-address 0.0.0.0 Default: 0.0.0.0:10256</td>
|
||||
-->
|
||||
<td colspan="2">--healthz-bind-address 0.0.0.0 默认: 0.0.0.0:10256</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The IP address and port for the health check server to serve on (set to 0.0.0.0 for all IPv4 interfaces and `::` for all IPv6 interfaces)</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">服务健康检查的 IP 地址和端口（对于所有 IPv4 接口设置为 0.0.0.0，对于所有 IPv6 接口设置为 ::）</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--healthz-port int32 Default: 10256</td>
|
||||
-->
|
||||
<td colspan="2">--healthz-port int32 默认: 10256</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The port to bind the health check server. Use 0 to disable.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">绑定健康检查服务的端口。使用 0 禁用。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">-h, --help</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">help for kube-proxy</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">kube-proxy 帮助信息</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--hostname-override string</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">If non-empty, will use this string as identification instead of the actual hostname.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">如果非空，将使用此字符串作为标识而不是实际的主机名。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--iptables-masquerade-bit int32 Default: 14</td>
|
||||
-->
|
||||
<td colspan="2">--iptables-masquerade-bit int32 默认: 14</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">If using the pure iptables proxy, the bit of the fwmark space to mark packets requiring SNAT with. Must be within the range [0, 31].</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">如果使用纯 iptables 代理，则 fwmark 空间的位用于标记需要 SNAT 的数据包。 必须在 [0,31] 范围内。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--iptables-min-sync-period duration</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The minimum interval of how often the iptables rules can be refreshed as endpoints and services change (e.g. '5s', '1m', '2h22m').</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">当端点和服务发生变化时，iptables 规则的刷新的最小间隔（例如 '5s'，'1m'，'2h22m'）。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--iptables-sync-period duration Default: 30s</td>
|
||||
-->
|
||||
<td colspan="2">--iptables-sync-period duration 默认: 30s</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The maximum interval of how often iptables rules are refreshed (e.g. '5s', '1m', '2h22m'). Must be greater than 0.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">iptables 规则刷新的最大时间间隔（例如 '5s'，'1m'，'2h22m'）。必须大于 0。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--ipvs-exclude-cidrs stringSlice</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">A comma-separated list of CIDR's which the ipvs proxier should not touch when cleaning up IPVS rules.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">以逗号分隔的 CIDR 列表，在清理 IPVS 规则时，不应该触及 ipvs proxier。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--ipvs-min-sync-period duration</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The minimum interval of how often the ipvs rules can be refreshed as endpoints and services change (e.g. '5s', '1m', '2h22m').</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">当端点和服务发生变化时，ipvs 规则的刷新的最小间隔（例如 '5s'，'1m'，'2h22m'）。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--ipvs-scheduler string</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The ipvs scheduler type when proxy mode is ipvs</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">代理模式为 ipvs 时的 ipvs 调度器类型</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--ipvs-sync-period duration Default: 30s</td>
|
||||
-->
|
||||
<td colspan="2">--ipvs-sync-period duration 默认: 30s</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The maximum interval of how often ipvs rules are refreshed (e.g. '5s', '1m', '2h22m'). Must be greater than 0.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">ipvs 规则刷新的最大时间间隔（例如 '5s'，'1m'，'2h22m'）。必须大于 0。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--kube-api-burst int32 Default: 10</td>
|
||||
-->
|
||||
<td colspan="2">--kube-api-burst int32 默认: 10</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Burst to use while talking with kubernetes apiserver</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">每秒与 kubernetes apiserver 交互的数量</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--kube-api-content-type string Default: "application/vnd.kubernetes.protobuf"</td>
|
||||
-->
|
||||
<td colspan="2">--kube-api-content-type string 默认: "application/vnd.kubernetes.protobuf"</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Content type of requests sent to apiserver.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">发送到 apiserver 的请求的内容类型。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--kube-api-qps float32 Default: 5</td>
|
||||
-->
|
||||
<td colspan="2">--kube-api-qps float32 默认: 5</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">QPS to use while talking with kubernetes apiserver</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">与 kubernetes apiserver 交互时使用的 QPS</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--kubeconfig string</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Path to kubeconfig file with authorization information (the master location is set by the master flag).</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">包含授权信息的 kubeconfig 文件的路径（master 位置由 master 标志设置）。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--log-flush-frequency duration Default: 5s</td>
|
||||
-->
|
||||
<td colspan="2">--log-flush-frequency duration 默认: 5s</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Maximum number of seconds between log flushes</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">日志刷新最大间隔</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--masquerade-all</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">If using the pure iptables proxy, SNAT all traffic sent via Service cluster IPs (this not commonly needed)</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">如果使用纯 iptables 代理，SNAT 所有通过服务句群 IP 发送的流量（这通常不需要）</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--master string</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The address of the Kubernetes API server (overrides any value in kubeconfig)</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Kubernetes API 服务器的地址（覆盖 kubeconfig 中的任何值）</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--metrics-bind-address 0.0.0.0 Default: 127.0.0.1:10249</td>
|
||||
-->
|
||||
<td colspan="2">--metrics-bind-address 0.0.0.0 默认: 127.0.0.1:10249</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The IP address and port for the metrics server to serve on (set to 0.0.0.0 for all IPv4 interfaces and `::` for all IPv6 interfaces)</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">要服务的度量服务器的 IP 地址和端口（对于所有 IPv4 接口设置为 0.0.0.0，对于所有 IPv6 接口设置为 ::）</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--nodeport-addresses stringSlice</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">A string slice of values which specify the addresses to use for NodePorts. Values may be valid IP blocks (e.g. 1.2.3.0/24, 1.2.3.4/32). The default empty string slice ([]) means to use all local addresses.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">一个字符串值，指定用于 NodePorts 的地址。 值可以是有效的 IP 块（例如 1.2.3.0/24, 1.2.3.4/32）。 默认的空字符串切片（[]）表示使用所有本地地址。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--oom-score-adj int32 Default: -999</td>
|
||||
-->
|
||||
<td colspan="2">--oom-score-adj int32 默认: -999</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The oom-score-adj value for kube-proxy process. Values must be within the range [-1000, 1000]</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">kube-proxy 进程的 oom-score-adj 值。 值必须在 [-1000,1000] 范围内</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--profiling</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">If true enables profiling via web interface on /debug/pprof handler.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">如果为 true，则通过 Web 接口 /debug/pprof 启用性能分析。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--proxy-mode ProxyMode</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Which proxy mode to use: 'userspace' (older) or 'iptables' (faster) or 'ipvs' (experimental). If blank, use the best-available proxy (currently iptables). If the iptables proxy is selected, regardless of how, but the system's kernel or iptables versions are insufficient, this always falls back to the userspace proxy.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">使用哪种代理模式：'userspace'（较旧）或 'iptables'（较快）或 'ipvs'（实验）。 如果为空，使用最佳可用代理（当前为 iptables）。 如果选择了 iptables 代理，无论如何，但系统的内核或 iptables 版本不足，这总是会回退到用户空间代理。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--proxy-port-range port-range</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Range of host ports (beginPort-endPort, single port or beginPort+offset, inclusive) that may be consumed in order to proxy service traffic. If (unspecified, 0, or 0-0) then ports will be randomly chosen.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">主机端口的范围（beginPort-endPort，单端口或 beginPort + offset，包括），可以被代理服务流量消耗。 如果（未指定，0 或 0-0）则随机选择端口。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--udp-timeout duration Default: 250ms</td>
|
||||
-->
|
||||
<td colspan="2">--udp-timeout duration 默认: 250ms</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">How long an idle UDP connection will be kept open (e.g. '250ms', '2s'). Must be greater than 0. Only applicable for proxy-mode=userspace</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">空闲 UDP 连接将保持打开的时长（例如 '250ms'，'2s'）。 必须大于 0。仅适用于 proxy-mode=userspace</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--version version[=true]</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Print version information and quit</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">打印版本信息并退出</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--write-config-to string</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">If set, write the default configuration values to this file and exit.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">如果设置，将配置值写入此文件并退出。</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
@@ -0,0 +1,380 @@
|
||||
---
|
||||
title: kube-scheduler
|
||||
notitle: true
|
||||
---
|
||||
## kube-scheduler
|
||||
|
||||
|
||||
|
||||
<!--
|
||||
### Synopsis
|
||||
|
||||
|
||||
The Kubernetes scheduler is a policy-rich, topology-aware,
|
||||
workload-specific function that significantly impacts availability, performance,
|
||||
and capacity. The scheduler needs to take into account individual and collective
|
||||
resource requirements, quality of service requirements, hardware/software/policy
|
||||
constraints, affinity and anti-affinity specifications, data locality, inter-workload
|
||||
interference, deadlines, and so on. Workload-specific requirements will be exposed
|
||||
through the API as necessary.
|
||||
-->
|
||||
### 概要
|
||||
|
||||
|
||||
Kubernetes 调度器是一个策略丰富、拓扑感知、工作负载特定的功能，显著影响可用性、性能和容量。调度器需要考虑个人和集体
|
||||
的资源要求、服务质量要求、硬件/软件/政策约束、亲和力和反亲和力规范、数据局部性、负载间干扰、完成期限等。
|
||||
工作负载特定的要求必要时将通过 API 暴露。
|
||||
|
||||
```
|
||||
kube-scheduler [flags]
|
||||
```
|
||||
|
||||
<!--
|
||||
### Options
|
||||
-->
|
||||
### 选项
|
||||
|
||||
<table style="width: 100%; table-layout: fixed;">
|
||||
<colgroup>
|
||||
<col span="1" style="width: 10px;" />
|
||||
<col span="1" />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--address string Default: "0.0.0.0"</td>
|
||||
-->
|
||||
<td colspan="2">--address string 默认: "0.0.0.0"</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">DEPRECATED: the IP address on which to listen for the --port port (set to 0.0.0.0 for all IPv4 interfaces and :: for all IPv6 interfaces). See --bind-address instead.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">弃用: 要监听 --port 端口的 IP 地址（对于所有 IPv4 接口设置为 0.0.0.0，对于所有 IPv6 接口设置为 ::）。 请参阅 --bind-address。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--algorithm-provider string</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">DEPRECATED: the scheduling algorithm provider to use, one of: ClusterAutoscalerProvider | DefaultProvider</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">弃用: 要使用的调度算法，可选值：ClusterAutoscalerProvider |DefaultProvider</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--azure-container-registry-config string</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Path to the file containing Azure container registry configuration information.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">包含 Azure 容器仓库配置信息的文件的路径。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--config string</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The path to the configuration file. Flags override values in this file.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">配置文件的路径。标志会覆盖此文件中的值。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--contention-profiling</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">DEPRECATED: enable lock contention profiling, if profiling is enabled</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">弃用: 如果启用了性能分析，则启用锁竞争分析</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--feature-gates mapStringBool</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:<br/>APIListChunking=true|false (BETA - default=true)<br/>APIResponseCompression=true|false (ALPHA - default=false)<br/>AdvancedAuditing=true|false (BETA - default=true)<br/>AllAlpha=true|false (ALPHA - default=false)<br/>AppArmor=true|false (BETA - default=true)<br/>AttachVolumeLimit=true|false (ALPHA - default=false)<br/>BalanceAttachedNodeVolumes=true|false (ALPHA - default=false)<br/>BlockVolume=true|false (ALPHA - default=false)<br/>CPUManager=true|false (BETA - default=true)<br/>CRIContainerLogRotation=true|false (BETA - default=true)<br/>CSIBlockVolume=true|false (ALPHA - default=false)<br/>CSIPersistentVolume=true|false (BETA - default=true)<br/>CustomPodDNS=true|false (BETA - default=true)<br/>CustomResourceSubresources=true|false (BETA - default=true)<br/>CustomResourceValidation=true|false (BETA - default=true)<br/>DebugContainers=true|false (ALPHA - default=false)<br/>DevicePlugins=true|false (BETA - default=true)<br/>DynamicKubeletConfig=true|false (BETA - default=true)<br/>DynamicProvisioningScheduling=true|false (ALPHA - default=false)<br/>EnableEquivalenceClassCache=true|false (ALPHA - default=false)<br/>ExpandInUsePersistentVolumes=true|false (ALPHA - default=false)<br/>ExpandPersistentVolumes=true|false (BETA - default=true)<br/>ExperimentalCriticalPodAnnotation=true|false (ALPHA - default=false)<br/>ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)<br/>GCERegionalPersistentDisk=true|false (BETA - default=true)<br/>HugePages=true|false (BETA - default=true)<br/>HyperVContainer=true|false (ALPHA - default=false)<br/>Initializers=true|false (ALPHA - default=false)<br/>KubeletPluginsWatcher=true|false (ALPHA - default=false)<br/>LocalStorageCapacityIsolation=true|false (BETA - default=true)<br/>MountContainers=true|false (ALPHA - default=false)<br/>MountPropagation=true|false (BETA - default=true)<br/>PersistentLocalVolumes=true|false (BETA - default=true)<br/>PodPriority=true|false (BETA - default=true)<br/>PodReadinessGates=true|false (BETA - default=false)<br/>PodShareProcessNamespace=true|false (ALPHA - default=false)<br/>QOSReserved=true|false (ALPHA - default=false)<br/>ReadOnlyAPIDataVolumes=true|false (DEPRECATED - default=true)<br/>ResourceLimitsPriorityFunction=true|false (ALPHA - default=false)<br/>ResourceQuotaScopeSelectors=true|false (ALPHA - default=false)<br/>RotateKubeletClientCertificate=true|false (BETA - default=true)<br/>RotateKubeletServerCertificate=true|false (ALPHA - default=false)<br/>RunAsGroup=true|false (ALPHA - default=false)<br/>ScheduleDaemonSetPods=true|false (ALPHA - default=false)<br/>ServiceNodeExclusion=true|false (ALPHA - default=false)<br/>ServiceProxyAllowExternalIPs=true|false (DEPRECATED - default=false)<br/>StorageObjectInUseProtection=true|false (default=true)<br/>StreamingProxyRedirects=true|false (BETA - default=true)<br/>SupportIPVSProxyMode=true|false (default=true)<br/>SupportPodPidsLimit=true|false (ALPHA - default=false)<br/>Sysctls=true|false (BETA - default=true)<br/>TaintBasedEvictions=true|false (ALPHA - default=false)<br/>TaintNodesByCondition=true|false (ALPHA - default=false)<br/>TokenRequest=true|false (ALPHA - default=false)<br/>TokenRequestProjection=true|false (ALPHA - default=false)<br/>VolumeScheduling=true|false (BETA - default=true)<br/>VolumeSubpath=true|false (default=true)<br/>VolumeSubpathEnvExpansion=true|false (ALPHA - default=false)</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">一组 key=value 对，用于描述 alpha/experimental 特征的特征门。选项包括：<br/>APIListChunking=true|false (BETA - 默认=true)<br/>APIResponseCompression=true|false (ALPHA - 默认=false)<br/>AdvancedAuditing=true|false (BETA - 默认=true)<br/>AllAlpha=true|false (ALPHA - 默认=false)<br/>AppArmor=true|false (BETA - 默认=true)<br/>AttachVolumeLimit=true|false (ALPHA - 默认=false)<br/>BalanceAttachedNodeVolumes=true|false (ALPHA - 默认=false)<br/>BlockVolume=true|false (ALPHA - 默认=false)<br/>CPUManager=true|false (BETA - 默认=true)<br/>CRIContainerLogRotation=true|false (BETA - 默认=true)<br/>CSIBlockVolume=true|false (ALPHA - 默认=false)<br/>CSIPersistentVolume=true|false (BETA - 默认=true)<br/>CustomPodDNS=true|false (BETA - 默认=true)<br/>CustomResourceSubresources=true|false (BETA - 默认=true)<br/>CustomResourceValidation=true|false (BETA - 默认=true)<br/>DebugContainers=true|false (ALPHA - 默认=false)<br/>DevicePlugins=true|false (BETA - 默认=true)<br/>DynamicKubeletConfig=true|false (BETA - 默认=true)<br/>DynamicProvisioningScheduling=true|false (ALPHA - 默认=false)<br/>EnableEquivalenceClassCache=true|false (ALPHA - 默认=false)<br/>ExpandInUsePersistentVolumes=true|false (ALPHA - 默认=false)<br/>ExpandPersistentVolumes=true|false (BETA - 默认=true)<br/>ExperimentalCriticalPodAnnotation=true|false (ALPHA - 默认=false)<br/>ExperimentalHostUserNamespaceDefaulting=true|false (BETA - 默认=false)<br/>GCERegionalPersistentDisk=true|false (BETA - 默认=true)<br/>HugePages=true|false (BETA - 默认=true)<br/>HyperVContainer=true|false (ALPHA - 默认=false)<br/>Initializers=true|false (ALPHA - 默认=false)<br/>KubeletPluginsWatcher=true|false (ALPHA - 默认=false)<br/>LocalStorageCapacityIsolation=true|false (BETA - 默认=true)<br/>MountContainers=true|false (ALPHA - 默认=false)<br/>MountPropagation=true|false (BETA - 默认=true)<br/>PersistentLocalVolumes=true|false (BETA - 默认=true)<br/>PodPriority=true|false (BETA - 默认=true)<br/>PodReadinessGates=true|false (BETA - 默认=false)<br/>PodShareProcessNamespace=true|false (ALPHA - 默认=false)<br/>QOSReserved=true|false (ALPHA - 默认=false)<br/>ReadOnlyAPIDataVolumes=true|false (弃用 - 默认=true)<br/>ResourceLimitsPriorityFunction=true|false (ALPHA - 默认=false)<br/>ResourceQuotaScopeSelectors=true|false (ALPHA - 默认=false)<br/>RotateKubeletClientCertificate=true|false (BETA - 默认=true)<br/>RotateKubeletServerCertificate=true|false (ALPHA - 默认=false)<br/>RunAsGroup=true|false (ALPHA - 默认=false)<br/>ScheduleDaemonSetPods=true|false (ALPHA - 默认=false)<br/>ServiceNodeExclusion=true|false (ALPHA - 默认=false)<br/>ServiceProxyAllowExternalIPs=true|false (弃用 - 默认=false)<br/>StorageObjectInUseProtection=true|false (默认=true)<br/>StreamingProxyRedirects=true|false (BETA - 默认=true)<br/>SupportIPVSProxyMode=true|false (默认=true)<br/>SupportPodPidsLimit=true|false (ALPHA - 默认=false)<br/>Sysctls=true|false (BETA - 默认=true)<br/>TaintBasedEvictions=true|false (ALPHA - 默认=false)<br/>TaintNodesByCondition=true|false (ALPHA - 默认=false)<br/>TokenRequest=true|false (ALPHA - 默认=false)<br/>TokenRequestProjection=true|false (ALPHA - 默认=false)<br/>VolumeScheduling=true|false (BETA - 默认=true)<br/>VolumeSubpath=true|false (默认=true)<br/>VolumeSubpathEnvExpansion=true|false (ALPHA - 默认=false)</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">-h, --help</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">help for kube-scheduler</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">kube-scheduler 帮助信息</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--kube-api-burst int32 Default: 100</td>
|
||||
-->
|
||||
<td colspan="2">--kube-api-burst int32 默认: 100</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">DEPRECATED: burst to use while talking with kubernetes apiserver</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">弃用: 每秒与 kubernetes apiserver 交互的数量</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--kube-api-content-type string Default: "application/vnd.kubernetes.protobuf"</td>
|
||||
-->
|
||||
<td colspan="2">--kube-api-content-type string 默认: "application/vnd.kubernetes.protobuf"</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">DEPRECATED: content type of requests sent to apiserver.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">弃用: 发送到 apiserver 的请求的内容类型</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--kube-api-qps float32 Default: 50</td>
|
||||
-->
|
||||
<td colspan="2">--kube-api-qps float32 默认: 50</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">DEPRECATED: QPS to use while talking with kubernetes apiserver</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">弃用: 与 kubernetes apiserver 交互时使用的 QPS</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--kubeconfig string</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">DEPRECATED: path to kubeconfig file with authorization and master location information.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">弃用: 包含授权和 master 位置信息的 kubeconfig 文件的路径。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--leader-elect Default: true</td>
|
||||
-->
|
||||
<td colspan="2">--leader-elect 默认: true</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Start a leader election client and gain leadership before executing the main loop. Enable this when running replicated components for high availability.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">在执行主循环之前，启动 leader 选举客户端并获得领导能力。在运行复制组件以实现高可用性时启用此选项。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--leader-elect-lease-duration duration Default: 15s</td>
|
||||
-->
|
||||
<td colspan="2">--leader-elect-lease-duration duration 默认: 15s</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate. This is only applicable if leader election is enabled.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">非 leader 候选人在观察领导层续约之后将等待的时间，直到试图获得领导但尚未更新的 leader 位置。这实际上是 leader 在被另一个候选人替换之前可以停止的最长持续时间。这仅适用于启用 leader 选举的情况。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--leader-elect-renew-deadline duration Default: 10s</td>
|
||||
-->
|
||||
<td colspan="2">--leader-elect-renew-deadline duration 默认: 10s</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The interval between attempts by the acting master to renew a leadership slot before it stops leading. This must be less than or equal to the lease duration. This is only applicable if leader election is enabled.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">代理 master 在停止领导之前更新领导位置的时间间隔。这必须小于或等于租约期限。这仅适用于启用 leader 选举的情况</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--leader-elect-resource-lock endpoints Default: "endpoints"</td>
|
||||
-->
|
||||
<td colspan="2">--leader-elect-resource-lock endpoints 默认: "endpoints"</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The type of resource object that is used for locking during leader election. Supported options are endpoints (default) and `configmaps`.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">在 leader 选举期间用于锁定的资源对象的类型。支持的选项是 endpoints (默认) 和 `configmaps`。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--leader-elect-retry-period duration Default: 2s</td>
|
||||
-->
|
||||
<td colspan="2">--leader-elect-retry-period duration 默认: 2s</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The duration the clients should wait between attempting acquisition and renewal of a leadership. This is only applicable if leader election is enabled.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">客户端在尝试获取和更新领导之间应该等待的持续时间。这仅适用于启用leader选举的情况。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--lock-object-name string Default: "kube-scheduler"</td>
|
||||
-->
|
||||
<td colspan="2">--lock-object-name string 默认: "kube-scheduler"</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">DEPRECATED: define the name of the lock object.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">弃用: 定义锁对象的名称。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--lock-object-namespace string Default: "kube-system"</td>
|
||||
-->
|
||||
<td colspan="2">--lock-object-namespace string 默认: "kube-system"</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">DEPRECATED: define the namespace of the lock object.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">弃用: 定义锁对象的命名空间。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--log-flush-frequency duration Default: 5s</td>
|
||||
-->
|
||||
<td colspan="2">--log-flush-frequency duration 默认: 5s</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Maximum number of seconds between log flushes</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">日志刷新最大间隔</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--master string</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">The address of the Kubernetes API server (overrides any value in kubeconfig)</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Kubernetes API 服务器的地址（覆盖 kubeconfig 中的任何值）</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--policy-config-file string</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">DEPRECATED: file with scheduler policy configuration. This file is used if policy ConfigMap is not provided or --use-legacy-policy-config=true</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">弃用: 包含调度器策略配置的文件。如果未提供策略 ConfigMap 或 --use-legacy-policy-config==true，则使用此文件</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--policy-configmap string</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">DEPRECATED: name of the ConfigMap object that contains scheduler's policy configuration. It must exist in the system namespace before scheduler initialization if --use-legacy-policy-config=false. The config must be provided as the value of an element in 'Data' map with the key='policy.cfg'</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">弃用: 包含调度器策略配置的 ConfigMap 对象的名称。如果 --use-legacy-policy-config==false，它必须在调度器初始化之前存在于系统命名空间中。配置必须作为 'Data' 映射中元素的值提供，其中 key='policy.cfg'</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--policy-configmap-namespace string Default: "kube-system"</td>
|
||||
-->
|
||||
<td colspan="2">--policy-configmap-namespace string 默认: "kube-system"</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">DEPRECATED: the namespace where policy ConfigMap is located. The kube-system namespace will be used if this is not provided or is empty.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">弃用: 策略 ConfigMap 所在的命名空间。 如果未提供此命名空间或为空，则将使用系统命名空间。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--port int Default: 10251</td>
|
||||
-->
|
||||
<td colspan="2">--port int 默认: 10251</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">DEPRECATED: the port on which to serve HTTP insecurely without authentication and authorization. If 0, don't serve HTTPS at all. See --secure-port instead.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">弃用: 不安全地提供没有身份验证和授权的 HTTP 端口。 如果为0，则根本不提供 HTTPS。 请参阅 --secure-port。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--profiling</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">DEPRECATED: enable profiling via web interface host:port/debug/pprof/</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">弃用: 通过 web 接口 host:port/debug/pprof/ 启动性能分析</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--scheduler-name string Default: "default-scheduler"</td>
|
||||
-->
|
||||
<td colspan="2">--scheduler-name string 默认: "default-scheduler"</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">DEPRECATED: name of the scheduler, used to select which pods will be processed by this scheduler, based on pod's "spec.schedulerName".</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">弃用: 调度器名称，用于根据 pod 的 "spec.SchedulerName" 选择哪些 pod 将被此调度器处理。</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--use-legacy-policy-config</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">DEPRECATED: when set to true, scheduler will ignore policy ConfigMap and uses policy config file</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">弃用: 当设置为 true 时，调度器将忽略策略 ConfigMap 并使用策略配置文件</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--version version[=true]</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Print version information and quit</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">打印版本信息并退出</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--write-config-to string</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">If set, write the configuration values to this file and exit.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">如果设置，将配置值写入此文件并退出。</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
@@ -0,0 +1,112 @@
|
||||
---
|
||||
title: kubelet
|
||||
notitle: true
|
||||
---
|
||||
## kubelet
|
||||
|
||||
|
||||
|
||||
<!--
|
||||
### Synopsis
|
||||
-->
|
||||
### 概要
|
||||
|
||||
|
||||
<!--
|
||||
The kubelet is the primary "node agent" that runs on each
|
||||
node. The kubelet works in terms of a PodSpec. A PodSpec is a YAML or JSON object
|
||||
that describes a pod. The kubelet takes a set of PodSpecs that are provided through
|
||||
various mechanisms (primarily through the apiserver) and ensures that the containers
|
||||
described in those PodSpecs are running and healthy. The kubelet doesn't manage
|
||||
containers which were not created by Kubernetes.
|
||||
-->
|
||||
kubelet 是在每个节点上运行的主要 "节点代理"。kubelet 以 PodSpec 为单位来运行任务，PodSpec 是一个描述 pod 的 YAML 或 JSON 对象。
|
||||
kubelet 运行多种机制（主要通过 apiserver）提供的一组 PodSpec，并确保这些 PodSpecs 中描述的容器健康运行。
|
||||
不是 Kubernetes 创建的容器将不在 kubelet 的管理范围。
|
||||
|
||||
<!--
|
||||
Other than from a PodSpec from the apiserver, there are three ways that a container
|
||||
manifest can be provided to the Kubelet.
|
||||
|
||||
File: Path passed as a flag on the command line. Files under this path will be monitored
|
||||
periodically for updates. The monitoring period is 20s by default and is configurable
|
||||
via a flag.
|
||||
|
||||
HTTP endpoint: HTTP endpoint passed as a parameter on the command line. This endpoint
|
||||
is checked every 20 seconds (also configurable with a flag).
|
||||
|
||||
HTTP server: The kubelet can also listen for HTTP and respond to a simple API
|
||||
(underspec'd currently) to submit a new manifest.
|
||||
-->
|
||||
除了来自 apiserver 的 PodSpec 之外，还有三种方法可以将容器清单提供给 Kubelet。
|
||||
|
||||
文件：通过命令行传入的文件路径。kubelet 将定期监听该路径下的文件以获得更新。监视周期默认为 20 秒，可通过参数进行配置。
|
||||
|
||||
HTTP 端点：HTTP 端点以命令行参数传入。每 20 秒检查一次该端点（该时间间隔也是可以通过命令行配置的）。
|
||||
|
||||
HTTP 服务：kubelet 还可以监听 HTTP 并响应简单的 API（当前未指定）以提交新的清单。
|
||||
|
||||
```
|
||||
kubelet [flags]
|
||||
```
|
||||
|
||||
<!--
|
||||
### Options
|
||||
-->
|
||||
### 选项
|
||||
|
||||
<table style="width: 100%; table-layout: fixed;">
|
||||
<colgroup>
|
||||
<col span="1" style="width: 10px;" />
|
||||
<col span="1" />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--azure-container-registry-config string</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Path to the file containing Azure container registry configuration information.</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">包含 Azure 容器注册配置信息的文件路径</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">-h, --help</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">help for kubelet</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">kubelet 的帮助信息</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<!--
|
||||
<td colspan="2">--log-flush-frequency duration Default: 5s</td>
|
||||
-->
|
||||
<td colspan="2">--log-flush-frequency 间隔 默认: 5s</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Maximum number of seconds between log flushes</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">日志刷新间隔的最大秒数</td>
|
||||
</tr>
|
||||
|
||||
<tr>
|
||||
<td colspan="2">--version version[=true]</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<!--
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">Print version information and quit</td>
|
||||
-->
|
||||
<td></td><td style="line-height: 130%; word-wrap: break-word;">打印版本信息并退出</td>
|
||||
</tr>
|
||||
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,178 @@
|
||||
---
|
||||
title: kubectl
|
||||
notitle: true
|
||||
---
|
||||
|
||||
## kubectl
|
||||
<!--
|
||||
kubectl controls the Kubernetes cluster manager
|
||||
-->
|
||||
kubectl 可以操控 Kubernetes 集群。
|
||||
|
||||
<!--
|
||||
### Synopsis
|
||||
|
||||
kubectl controls the Kubernetes cluster manager.
|
||||
|
||||
Find more information at: https://kubernetes.io/docs/reference/kubectl/overview/
|
||||
-->
|
||||
### 简介
|
||||
|
||||
kubectl 可以操控 Kubernetes 集群。
|
||||
|
||||
获取更多信息，请访问：https://kubernetes.io/docs/reference/kubectl/overview/
|
||||
|
||||
```
|
||||
kubectl [flags]
|
||||
```
|
||||
<!--
|
||||
### Options
|
||||
|
||||
```
|
||||
--alsologtostderr log to standard error as well as files
|
||||
--as string Username to impersonate for the operation
|
||||
--as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
|
||||
--cache-dir string Default HTTP cache directory (default "/home/username/.kube/http-cache")
|
||||
--certificate-authority string Path to a cert file for the certificate authority
|
||||
--client-certificate string Path to a client certificate file for TLS
|
||||
--client-key string Path to a client key file for TLS
|
||||
--cluster string The name of the kubeconfig cluster to use
|
||||
--context string The name of the kubeconfig context to use
|
||||
-h, --help help for kubectl
|
||||
--insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
|
||||
--kubeconfig string Path to the kubeconfig file to use for CLI requests.
|
||||
--log-backtrace-at traceLocation when logging hits line file:N, emit a stack trace (default :0)
|
||||
--log-dir string If non-empty, write log files in this directory
|
||||
--logtostderr log to standard error instead of files
|
||||
--match-server-version Require server version to match client version
|
||||
-n, --namespace string If present, the namespace scope for this CLI request
|
||||
--request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default "0")
|
||||
-s, --server string The address and port of the Kubernetes API server
|
||||
--stderrthreshold severity logs at or above this threshold go to stderr (default 2)
|
||||
--token string Bearer token for authentication to the API server
|
||||
--user string The name of the kubeconfig user to use
|
||||
-v, --v Level log level for V logs
|
||||
--vmodule moduleSpec comma-separated list of pattern=N settings for file-filtered logging
|
||||
```
|
||||
-->
|
||||
### 选项
|
||||
```
|
||||
--alsologtostderr 同时输出日志到标准错误控制台和文件
|
||||
--as string 以指定用户执行操作
|
||||
--as-group stringArray 模拟操作的组，可以使用这个标识来指定多个组。
|
||||
--cache-dir string 默认 HTTP 缓存目录（默认值 "/home/username/.kube/http-cache" ）
|
||||
--certificate-authority string 用于进行认证授权的 .cert 文件路径
|
||||
--client-certificate string TLS 使用的客户端证书路径
|
||||
--client-key string TLS 使用的客户端密钥文件路径
|
||||
--cluster string 指定要使用的 kubeconfig 文件中集群名
|
||||
--context string 指定要使用的 kubeconfig 文件中上下文
|
||||
-h, --help kubectl 帮助
|
||||
--insecure-skip-tls-verify 值为 true，则不会检查服务器的证书的有效性。 这将使您的HTTPS连接不安全
|
||||
--kubeconfig string CLI 请求使用的 kubeconfig 配置文件路径。
|
||||
--log-backtrace-at traceLocation 当日志长度超出规定的行数时，忽略堆栈信息（默认值：0）
|
||||
--log-dir string 如果不为空，则将日志文件写入此目录
|
||||
--logtostderr 日志输出到标准错误控制台而不输出到文件
|
||||
--match-server-version 要求客户端版本和服务端版本相匹配
|
||||
-n, --namespace string 如果存在，CLI 请求将使用此命名空间
|
||||
--request-timeout string 放弃一个简单服务请求前的等待时间，非零值需要包含相应时间单位(例如：1s, 2m, 3h)。零值则认为不做超时请求。 (默认值 "0")
|
||||
-s, --server string Kubernetes API server 的地址和端口
|
||||
--stderrthreshold severity 等于或高于此阈值的日志将输出标准错误控制台（默认值2）
|
||||
--token string 用于 API server 进行身份认证的承载令牌
|
||||
--user string 指定使用的 kubeconfig 配置文件中的用户名
|
||||
-v, --v Level 指定输出日志的日志级别
|
||||
--vmodule moduleSpec 指定输出日志的模块，格式如下：pattern=N，使用逗号分隔
|
||||
```
|
||||
<!--
|
||||
### SEE ALSO
|
||||
|
||||
* [kubectl alpha](kubectl_alpha.md) - Commands for features in alpha
|
||||
* [kubectl annotate](kubectl_annotate.md) - Update the annotations on a resource
|
||||
* [kubectl api-resources](kubectl_api-resources.md) - Print the supported API resources on the server
|
||||
* [kubectl api-versions](kubectl_api-versions.md) - Print the supported API versions on the server, in the form of "group/version"
|
||||
* [kubectl apply](kubectl_apply.md) - Apply a configuration to a resource by filename or stdin
|
||||
* [kubectl attach](kubectl_attach.md) - Attach to a running container
|
||||
* [kubectl auth](kubectl_auth.md) - Inspect authorization
|
||||
* [kubectl autoscale](kubectl_autoscale.md) - Auto-scale a Deployment, ReplicaSet, or ReplicationController
|
||||
* [kubectl certificate](kubectl_certificate.md) - Modify certificate resources.
|
||||
* [kubectl cluster-info](kubectl_cluster-info.md) - Display cluster info
|
||||
* [kubectl completion](kubectl_completion.md) - Output shell completion code for the specified shell (bash or zsh)
|
||||
* [kubectl config](kubectl_config.md) - Modify kubeconfig files
|
||||
* [kubectl convert](kubectl_convert.md) - Convert config files between different API versions
|
||||
* [kubectl cordon](kubectl_cordon.md) - Mark node as unschedulable
|
||||
* [kubectl cp](kubectl_cp.md) - Copy files and directories to and from containers.
|
||||
* [kubectl create](kubectl_create.md) - Create a resource from a file or from stdin.
|
||||
* [kubectl delete](kubectl_delete.md) - Delete resources by filenames, stdin, resources and names, or by resources and label selector
|
||||
* [kubectl describe](kubectl_describe.md) - Show details of a specific resource or group of resources
|
||||
* [kubectl drain](kubectl_drain.md) - Drain node in preparation for maintenance
|
||||
* [kubectl edit](kubectl_edit.md) - Edit a resource on the server
|
||||
* [kubectl exec](kubectl_exec.md) - Execute a command in a container
|
||||
* [kubectl explain](kubectl_explain.md) - Documentation of resources
|
||||
* [kubectl expose](kubectl_expose.md) - Take a replication controller, service, deployment or pod and expose it as a new Kubernetes Service
|
||||
* [kubectl get](kubectl_get.md) - Display one or many resources
|
||||
* [kubectl label](kubectl_label.md) - Update the labels on a resource
|
||||
* [kubectl logs](kubectl_logs.md) - Print the logs for a container in a pod
|
||||
* [kubectl options](kubectl_options.md) - Print the list of flags inherited by all commands
|
||||
* [kubectl patch](kubectl_patch.md) - Update field(s) of a resource using strategic merge patch
|
||||
* [kubectl plugin](kubectl_plugin.md) - Runs a command-line plugin
|
||||
* [kubectl port-forward](kubectl_port-forward.md) - Forward one or more local ports to a pod
|
||||
* [kubectl proxy](kubectl_proxy.md) - Run a proxy to the Kubernetes API server
|
||||
* [kubectl replace](kubectl_replace.md) - Replace a resource by filename or stdin
|
||||
* [kubectl rollout](kubectl_rollout.md) - Manage the rollout of a resource
|
||||
* [kubectl run](kubectl_run.md) - Run a particular image on the cluster
|
||||
* [kubectl scale](kubectl_scale.md) - Set a new size for a Deployment, ReplicaSet, Replication Controller, or Job
|
||||
* [kubectl set](kubectl_set.md) - Set specific features on objects
|
||||
* [kubectl taint](kubectl_taint.md) - Update the taints on one or more nodes
|
||||
* [kubectl top](kubectl_top.md) - Display Resource (CPU/Memory/Storage) usage.
|
||||
* [kubectl uncordon](kubectl_uncordon.md) - Mark node as schedulable
|
||||
* [kubectl version](kubectl_version.md) - Print the client and server version information
|
||||
* [kubectl wait](kubectl_wait.md) - Experimental: Wait for one condition on one or many resources
|
||||
-->
|
||||
### 接下来看
|
||||
|
||||
* [kubectl alpha](kubectl_alpha.md) - alpha环境上命令属性
|
||||
* [kubectl annotate](kubectl_annotate.md) - 更新资源上注释
|
||||
* [kubectl api-resources](kubectl_api-resources.md) - 在服务器上打印支持的 API 资源
|
||||
* [kubectl api-versions](kubectl_api-versions.md) - 以 "group/version" 的形式在服务器上打印支持的 API 版本
|
||||
* [kubectl apply](kubectl_apply.md) - 通过文件名或标准输入将配置添加给资源
|
||||
* [kubectl attach](kubectl_attach.md) - 附加到正在运行的容器
|
||||
* [kubectl auth](kubectl_auth.md) - 检查授权
|
||||
* [kubectl autoscale](kubectl_autoscale.md) - 自动扩展 Deployment, ReplicaSet 或 ReplicationController
|
||||
* [kubectl certificate](kubectl_certificate.md) - 修改证书资源。
|
||||
* [kubectl cluster-info](kubectl_cluster-info.md) - 展示集群信息
|
||||
* [kubectl completion](kubectl_completion.md) - 为给定的 shell 输出完成代码（ bash 或 zsh）
|
||||
* [kubectl config](kubectl_config.md) - 修改 kubeconfig 配置文件
|
||||
* [kubectl convert](kubectl_convert.md) - 在不同的 API 版本之间转换配置文件
|
||||
* [kubectl cordon](kubectl_cordon.md) - 将 node 节点标记为不可调度
|
||||
* [kubectl cp](kubectl_cp.md) - 从容器复制文件和目录，也可将文件和目录复制到容器。
|
||||
* [kubectl create](kubectl_create.md) - 通过文件名或标准输入创建资源。
|
||||
* [kubectl delete](kubectl_delete.md) - 通过文件名，标准输入，资源和名称或资源和标签选择器删除资源
|
||||
* [kubectl describe](kubectl_describe.md) - 显示特定资源或资源组的详细信息
|
||||
* [kubectl drain](kubectl_drain.md) - 为便于维护，需要提前驱逐node节点
|
||||
* [kubectl edit](kubectl_edit.md) - 在服务器编辑资源
|
||||
* [kubectl exec](kubectl_exec.md) - 容器内退出命令
|
||||
* [kubectl explain](kubectl_explain.md) - 资源文档
|
||||
* [kubectl expose](kubectl_expose.md) - 获取 replication controller, service, deployment 或 pod 资源，并作为新的 Kubernetes 服务暴露
|
||||
* [kubectl get](kubectl_get.md) - 展示一个或多个资源
|
||||
* [kubectl label](kubectl_label.md) - 升级资源标签
|
||||
* [kubectl logs](kubectl_logs.md) - 为 pod 中的容器打印日志
|
||||
* [kubectl options](kubectl_options.md) - 打印所有命令继承的标识列表
|
||||
* [kubectl patch](kubectl_patch.md) - 使用战略性合并补丁更新资源字段
|
||||
* [kubectl plugin](kubectl_plugin.md) - 运行命令行插件
|
||||
* [kubectl port-forward](kubectl_port-forward.md) - 给 pod 开放一个或多个本地端口
|
||||
* [kubectl proxy](kubectl_proxy.md) - 为 Kubernetes API server 运行代理
|
||||
* [kubectl replace](kubectl_replace.md) - 通过文件或标准输入替换资源
|
||||
* [kubectl rollout](kubectl_rollout.md) - 管理资源展示
|
||||
* [kubectl run](kubectl_run.md) - 在集群上运行指定镜像
|
||||
* [kubectl scale](kubectl_scale.md) - 给 Deployment, ReplicaSet, Replication Controller 或 Job 设置新副本规模
|
||||
* [kubectl set](kubectl_set.md) - 给对象设置特定功能
|
||||
* [kubectl taint](kubectl_taint.md) - 更新一个或多个 node 节点的污点信息
|
||||
* [kubectl top](kubectl_top.md) - 展示资源 (CPU/Memory/Storage) 使用信息。
|
||||
* [kubectl uncordon](kubectl_uncordon.md) - 标记 node 节点为可调度
|
||||
* [kubectl version](kubectl_version.md) - 打印客户端和服务端版本信息
|
||||
* [kubectl wait](kubectl_wait.md) - 试验: 在一个或多个资源上等待条件完成
|
||||
|
||||
<!--
|
||||
###### Auto generated by spf13/cobra on 16-Jun-2018
|
||||
-->
|
||||
######2018年6月16日，通过spf13/cobra自动生成
|
||||
|
||||
@@ -0,0 +1,104 @@
|
||||
---
|
||||
title: 知名标签（Label）、注解（Annotation）和 Taints
|
||||
---
|
||||
|
||||
Kubernetes 保留了 kubernetes.io 名字空间下的所有标签和注解。 本文描述了知名的
|
||||
kubernetes.io 标签和注解。
|
||||
|
||||
本文既作为这些标签和注解值的参考，也就这些标签和注解的赋值进行了说明。
|
||||
|
||||
**目录：**
|
||||
<!-- BEGIN MUNGE: GENERATED_TOC -->
|
||||
|
||||
- [知名标签、注解和 Taints](#well-known-labels-annotations-and-taints)
|
||||
- [beta.kubernetes.io/arch](#betakubernetesioarch)
|
||||
- [beta.kubernetes.io/os](#betakubernetesioos)
|
||||
- [kubernetes.io/hostname](#kubernetesiohostname)
|
||||
- [beta.kubernetes.io/instance-type](#betakubernetesioinstance-type)
|
||||
- [failure-domain.beta.kubernetes.io/region](#failure-domainbetakubernetesioregion)
|
||||
- [failure-domain.beta.kubernetes.io/zone](#failure-domainbetakubernetesiozone)
|
||||
|
||||
<!-- END MUNGE: GENERATED_TOC -->
|
||||
|
||||
|
||||
## beta.kubernetes.io/arch
|
||||
|
||||
示例：`beta.kubernetes.io/arch=amd64`
|
||||
|
||||
用于：节点
|
||||
|
||||
Kubelet 用 Go 中定义的 `runtime.GOARCH` 值来填充该标签。 这在诸如混用 arm 和 x86 节点的情况下很有用。
|
||||
|
||||
## beta.kubernetes.io/os
|
||||
|
||||
示例：`beta.kubernetes.io/os=linux`
|
||||
|
||||
用于：节点
|
||||
|
||||
Kubelet 用该 Go 中定义的 `runtime.GOOS` 值来填充该标签。 这在集群中存在不同操作系统的节点时很有用（尽管当前 Kubernetes 只支持 Linux 操作系统）。
|
||||
|
||||
## kubernetes.io/hostname
|
||||
|
||||
示例：`kubernetes.io/hostname=ip-172-20-114-199.ec2.internal`
|
||||
|
||||
用于：节点
|
||||
|
||||
Kubelet 用 hostname 值来填充该标签。 注意：可以通过向 kubelet 传入 `--hostname-override`
|
||||
参数对 “真正的” hostname 进行修改。
|
||||
|
||||
## beta.kubernetes.io/instance-type
|
||||
|
||||
示例：`beta.kubernetes.io/instance-type=m3.medium`
|
||||
|
||||
用于：节点
|
||||
|
||||
Kubelet 用 `cloudprovider` 中定义的实例类型来填充该标签。 未使用 `cloudprovider` 时不会设置该标签。
|
||||
该标签在想要将某些负载定向到特定实例类型的节点上时会很有用，但通常用户更希望依赖 Kubernetes 调度器来执行基于资源的调度，所以用户应该致力于基于属性而不是实例类型来进行调度(例如：需要一个 CPU，而不是 `g2.2xlarge`)。
|
||||
|
||||
|
||||
## failure-domain.beta.kubernetes.io/region
|
||||
|
||||
参考 [failure-domain.beta.kubernetes.io/zone](#failure-domainbetakubernetesiozone).
|
||||
|
||||
## failure-domain.beta.kubernetes.io/zone
|
||||
|
||||
示例：
|
||||
|
||||
`failure-domain.beta.kubernetes.io/region=us-east-1`
|
||||
|
||||
`failure-domain.beta.kubernetes.io/zone=us-east-1c`
|
||||
|
||||
用于：节点、PersistentVolume
|
||||
|
||||
用于节点： Kubelet 用 `cloudprovider` 中定义的区域（zone）信息来填充该标签。 未使用 `cloudprovider`
|
||||
时不会设置该标签，但如果该标签在你的拓扑中有意义的话，应该考虑设置。
|
||||
|
||||
用于 PersistentVolume：在 GCE 和 AWS 中，`PersistentVolumeLabel` 准入控制器会自动添加区域标签。
|
||||
|
||||
在单区的集群中，Kubernetes 会自动将同一副本控制器或服务下的 pod 分散到不同的节点上 (以降低故障的影响)。
|
||||
在多区的集群中，这种分散的行为扩展到跨区的层面 (以降低区域故障的影响)。 跨区分散通过 SelectorSpreadPriority
|
||||
来实现。
|
||||
|
||||
这是一种尽力而为（best-effort）的处置方式， 如果集群中的区域是异构的 (例如：不同区域之间的节点数量、
|
||||
节点类型或 pod 资源需求不同），可能使得 pod 在各区域间无法均匀分布。 如有需要，用户可以使用同质的区域
|
||||
(节点数量和类型相同) 来减小 pod 分布不均的可能性。
|
||||
|
||||
由于卷不能跨区域挂载（attach），调度器 (通过 VolumeZonePredicate 断言) 也会保证需要特定卷的 pod
|
||||
被调度到卷所在的区域中。
|
||||
|
||||
|
||||
区域和地域（region）的实际值无关紧要，两者的层次含义也没有严格的定义。 最终期望是，除非整个地域故障，
|
||||
否则某一区域节点的故障不应该影响到其他区域的节点。 例如，通常区域间应该避免共用同一个网络交换机。
|
||||
具体的规划取决于特定的基础设备—— three-rack 设备所选择的设置与多数据中心截然不同。
|
||||
|
||||
如果 `PersistentVolumeLabel` 准入控制器不支持自动为 PersistentVolume 打标签，且用户希望防止 pod
|
||||
跨区域进行卷的挂载，应考虑手动打标签 (或对 `PersistentVolumeLabel` 增加支持）。 如果用户的基础设施没有这种约束，则不需要为卷添加区域标签。
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<!-- BEGIN MUNGE: GENERATED_ANALYTICS -->
|
||||
[]()
|
||||
<!-- END MUNGE: GENERATED_ANALYTICS -->
|
||||
@@ -0,0 +1,112 @@
|
||||
<!--
|
||||
---
|
||||
reviewers:
|
||||
- janetkuo
|
||||
title: Tools
|
||||
content_template: templates/concept
|
||||
---
|
||||
-->
|
||||
---
|
||||
reviewers:
|
||||
- janetkuo
|
||||
title: 工具
|
||||
content_template: templates/concept
|
||||
---
|
||||
|
||||
<!--
|
||||
{{% capture overview %}}
|
||||
Kubernetes contains several built-in tools to help you work with the Kubernetes system.
|
||||
{{% /capture %}}
|
||||
-->
|
||||
{{% capture overview %}}
|
||||
Kubernetes 包含一些内置工具，可以帮助用户更好的使用 Kubernetes 系统。
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture body %}}
|
||||
## Kubectl
|
||||
|
||||
<!--
|
||||
[`kubectl`](/docs/tasks/tools/install-kubectl/) is the command line tool for Kubernetes. It controls the Kubernetes cluster manager.
|
||||
-->
|
||||
[`kubectl`](/docs/tasks/tools/install-kubectl/) 是 Kubernetes 命令行工具，可以用来操控 Kubernetes 集群。
|
||||
|
||||
## Kubeadm
|
||||
|
||||
<!--
|
||||
[`kubeadm`](/docs/tasks/tools/install-kubeadm/) is the command line tool for easily provisioning a secure Kubernetes cluster on top of physical or cloud servers or virtual machines (currently in alpha).
|
||||
-->
|
||||
[`kubeadm`](/docs/tasks/tools/install-kubeadm/) 是一个命令行工具，可以用来在物理机、云服务器或虚拟机（目前处于 alpha 阶段）上轻松部署一个安全可靠的 Kubernetes 集群。
|
||||
|
||||
## Kubefed
|
||||
|
||||
<!--
|
||||
[`kubefed`](/docs/tasks/federation/set-up-cluster-federation-kubefed/) is the command line tool
|
||||
to help you administrate your federated clusters.
|
||||
-->
|
||||
[`kubefed`](/docs/tasks/federation/set-up-cluster-federation-kubefed/) 是一个命令行工具，可以用来帮助用户管理联邦集群。
|
||||
|
||||
|
||||
## Minikube
|
||||
|
||||
<!--
|
||||
[`minikube`](/docs/tasks/tools/install-minikube/) is a tool that makes it
|
||||
easy to run a single-node Kubernetes cluster locally on your workstation for
|
||||
development and testing purposes.
|
||||
-->
|
||||
[`minikube`](/docs/tasks/tools/install-minikube/) 是一个可以方便用户在其工作站点本地部署一个单节点 Kubernetes 集群的工具，用于开发和测试。
|
||||
|
||||
|
||||
## Dashboard
|
||||
|
||||
<!--
|
||||
[`Dashboard`](/docs/tasks/access-application-cluster/web-ui-dashboard/), the web-based user interface of Kubernetes, allows you to deploy containerized applications
|
||||
to a Kubernetes cluster, troubleshoot them, and manage the cluster and its resources itself.
|
||||
-->
|
||||
[`Dashboard`](/docs/tasks/access-application-cluster/web-ui-dashboard/), 是 Kubernetes 基于 Web 的用户管理界面，允许用户部署容器化应用到 Kubernetes 集群，进行故障排查以及管理集群和集群资源。
|
||||
|
||||
## Helm
|
||||
|
||||
<!--
|
||||
[`Kubernetes Helm`](https://github.com/kubernetes/helm) is a tool for managing packages of pre-configured
|
||||
Kubernetes resources, aka Kubernetes charts.
|
||||
-->
|
||||
[`Kubernetes Helm`](https://github.com/kubernetes/helm) 是一个管理预先配置 Kubernetes 资源包的工具，这里的资源在 Helm 中也被称作 Kubernetes charts。
|
||||
|
||||
<!--
|
||||
Use Helm to:
|
||||
|
||||
* Find and use popular software packaged as Kubernetes charts
|
||||
* Share your own applications as Kubernetes charts
|
||||
* Create reproducible builds of your Kubernetes applications
|
||||
* Intelligently manage your Kubernetes manifest files
|
||||
* Manage releases of Helm packages
|
||||
-->
|
||||
使用 Helm：
|
||||
|
||||
*查找并使用已经打包为 Kubernetes charts 的流行软件
|
||||
*分享您自己的应用作为 Kubernetes charts
|
||||
*为 Kubernetes 应用创建可重复执行的构建
|
||||
*为您的 Kubernetes 清单文件提供更智能化的管理
|
||||
*管理 Helm 软件包的发布
|
||||
|
||||
## Kompose
|
||||
|
||||
<!--
|
||||
[`Kompose`](https://github.com/kubernetes-incubator/kompose) is a tool to help Docker Compose users move to Kubernetes.
|
||||
-->
|
||||
[`Kompose`](https://github.com/kubernetes-incubator/kompose) 一个转换工具，用来帮助 Docker Compose 用户迁移至 Kubernetes。
|
||||
|
||||
<!--
|
||||
Use Kompose to:
|
||||
|
||||
* Translate a Docker Compose file into Kubernetes objects
|
||||
* Go from local Docker development to managing your application via Kubernetes
|
||||
* Convert v1 or v2 Docker Compose `yaml` files or [Distributed Application Bundles](https://docs.docker.com/compose/bundles/)
|
||||
{{% /capture %}}
|
||||
-->
|
||||
使用 Kompose:
|
||||
|
||||
* 将一个 Docker Compose 文件解释成 Kubernetes 对象
|
||||
* 将本地 Docker 开发 转变成通过 Kubernetes 来管理
|
||||
* 转换 v1 或 v2 Docker Compose `yaml` 文件 或 [分布式应用程序包](https://docs.docker.com/compose/bundles/)
|
||||
{{% /capture %}}
|
||||
Reference in New Issue
Block a user